feat: add governed employment separation review packet - #46
Conversation
📝 WalkthroughWalkthrough고용 분리 사전 검토를 위한 불변 Changes고용 분리 검토
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟡 Moderate · up to The packet still needs to ensure requester and reviewer references resolve to distinct identities before any consequential employment change, otherwise separation-of-duties controls could be bypassed. The README also describes tenant_record_id as UUIDv4 even though valid tenant identifiers may use UUIDv7, which could cause integration rejection. Keep unmerged until the identity check is enforced or explicitly accepted. Sequence Diagram(s)sequenceDiagram
participant Caller
participant ReviewBuilder
participant ReviewPacket
participant QualityWorkflow
Caller->>ReviewBuilder: 고용 분리 검토 입력 전달
ReviewBuilder->>ReviewPacket: 검증된 패킷 생성
ReviewPacket-->>Caller: canonical JSON 및 SHA-256 digest 제공
QualityWorkflow->>ReviewPacket: pytest 및 커버리지 실행
ReviewPacket-->>QualityWorkflow: 검증 결과 반환
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent Please independently review exact current head |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
_validate_digest now enforces the exact built-in str contract the rest of the packet boundary uses, closing the last isinstance-based gap; a regression rejects a hostile digest subclass whose forged equality would otherwise pass pattern matching. Suite stays at 100% statement+branch coverage (107 tests). Addresses Devin review observation on PR #46.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
1 participant
Current governed contract
This Orgmetra-only lane provides a value-minimized, human-reviewed Employment separation packet. It binds tenant/Person/Employment/separation-process scope, reviewed evidence, controlled governance metadata, distinct requester/reviewer evidence, explicit evidence versioning, and system-recorded time without carrying HR payload values or granting mutation authority. Before consequential mutation, the authoritative Orgmetra host must re-resolve every packet reference within
tenant_record_id, prove requester/reviewer resolve to distinct actor identities, re-establish Person→Employment and active Assignment/Job/Position scope, verify reviewed evidence and human authority, and persist immutable audit/outbox evidence atomically.Current integrity boundary
The branch includes the completed test-first runtime/evidence repairs: exact built-in validation, bounded governance vocabulary, fail-closed timezone normalization, fixed UTC recorded evidence, actor-separation semantics, repr/privacy hardening, complete canonical field coverage, and a creation-bound process-local HMAC seal outside packet-writable slots. Low-level post-construction mutation or missing issuance evidence causes canonical export to fail closed.
The process-local seal is defense-in-depth only. It is not durable uniqueness/audit evidence, a portable signature, a rehydration credential, or cross-process issuance authority; authoritative persistence owns those contracts.
Current exact state
96fe0b69e8e1bc3caa0fa206146a87c6e5027746develop@9e3e4847510e1e612b48474ba42b177b8ed824df32984491785: terminal CANCELLED on this exact head. The original attempt did not acquire a runner/checkout. A fresh supported retry attempt was made again and GitHub rejected it with HTTP 403This workflow run cannot be retried; no product/test result exists.32984493884: terminal CANCELLED on this exact head.32984413441: terminal CANCELLED on this exact head.0check-runs), so Required OpenCode/Noema/Strix/SAST/Security/coverage evidence is absent. Absence/cancellation/pre-checkout infrastructure state is non-passing and is not evidence of either product failure or success.CHANGES_REQUESTED. All current inline review threads are resolved.No no-op/source commit is permitted merely to manufacture a fresh workflow attempt. This Draft lane therefore remains locally waiting until an authorized execution path can produce exact-current-head evidence or a genuine source/review defect independently requires a branch change.
Stack impact
Child #129 has now been adapted onto this exact parent: its live base is
feat/governed-employment-separation-review@96fe0b69e8e1bc3caa0fa206146a87c6e5027746, and its current child head is4c377a35055e126a5e2435ec36bd9ac1e593456e. The child remains Draft and dependency-blocked. Do not transfer #46 checks/reviews or any predecessor child evidence. Process #46 dependency-first; only after #46 integrates may #129 be retargeted/revalidated against the then-current protecteddevelop.Merge governance
This PR is not merge-ready and remains intentionally Draft. Do not mark it Ready or merge it without terminal exact-current-head local/central evidence and qualifying independent non-author approval under Orgmetra's stricter commercial acceptance policy.
Do not self-approve, use routine administrator bypass, weaken/simulate protection, create a no-op evidence commit, race another lifecycle writer, or reuse predecessor/cancelled/absent evidence.