feat: add governed compensation change review packet

[seonghobae]

Buyer-visible scope

Adds a portable, value-minimized compensation-change review envelope before authoritative HRIS mutation or payroll execution. It binds tenant, Person, Employment, active Assignment/Job/Position snapshot, current/proposed compensation evidence, exact policy, pay-equity review, budget authorization, payroll-handoff provenance, requester/reviewer, effective date, and evidence version while excluding compensation values, protected-attribute values, credentials, and free-form case/model content. It remains human-review-only and grants no mutation or execution authority.

Current integrity boundary

The branch preserves the recorded-time repair: caller-owned mutable tzinfo state is resolved once and detached into an exact built-in UTC datetime, with indeterminate/hostile timestamp providers failing closed. It also preserves strict exact-type evidence validation, controlled governance constants, tenant/reference privacy boundaries, complete canonical field coverage, and process-local creation-bound evidence integrity. The process-local seal is defense-in-depth only and is not durable authorization, portable signing, persisted uniqueness, rehydration authority, or a substitute for immutable audit/outbox evidence.

This successor head also repairs package-quality evidence freshness. The package workflow previously omitted root/shared Python test/runtime and clean-checkout configuration from its PR path filter. A structural regression was added first at 118a3a385a76b2a791a107465ad51e213e4477de, then the workflow was repaired to retrigger on .gitignore, .python-version, root/shared conftest.py, root pyproject.toml, pytest.ini, setup.cfg, and tox.ini; CHANGELOG and traceability were synchronized. The latest Devin observation on this trigger contract is resolved: all eight shared paths are now present.

Exact-current-head evidence

• exact head: b9e487cc1e07267ff69d222b0917ec108804b799
• independently resolved live base: develop@9e3e4847510e1e612b48474ba42b177b8ed824df
• state: open · non-draft · mergeable
• Compensation Change Review Quality run 33279024704, job 99170874250: terminal SUCCESS on this exact head; 78 tests passed, owned production 190/190 statements and 54/54 branches (100.00%), compile and clean-checkout proof GREEN.
• Foundation CI run 33279024705: terminal SUCCESS.
• Recovery Rehearsal Quality run 33279024698: terminal SUCCESS.
• SAST Semgrep run 33279024690: terminal SUCCESS.
• Security Scan run 33279024680: OSV 99170874427, Trivy 99170874445, and Scorecard 99170874455 are terminal GREEN; dependency-review job 99170874472 is terminal FAILURE at the central dependency-review support/control-plane boundary, before the pinned Dependency Review action executes. Exact consumer evidence is routed through existing owner handoff ContextualWisdomLab/.github#810.
• Required OpenCode run 33279023383, job 99171902498: terminal FAILURE because no authenticated opencode-agent / opencode-agent[bot] formal APPROVED or CHANGES_REQUESTED review exists on this exact head. Existing owner handoff ContextualWisdomLab/.github#624 has the exact-current canary; deterministic/model-unavailable/unsupported fallback and predecessor verdicts are non-transferable.
• Required Noema run 33279023408, job 99170871640: trusted-source materialization, repository-scoped reviewer token, target visibility, and all five provider credential checks succeed; the endpoint feed returns 413 request_too_large, the live OpenRouter ZDR feed is selected, and the pinned contextual-orchestrator sidecar exits status 1 before /healthz. The actual Noema review/verdict never executes. Existing owner handoff ContextualWisdomLab/.github#1399 has the exact-current canary.
• Required Strix: the exact-head check query returns total_count=0. No authoritative Strix run/check materialized for this head; absence is non-passing. Existing owner handoff ContextualWisdomLab/.github#1327 has the exact-current materialization canary.
• All current inline review threads are resolved. Submitted reviews are COMMENTED only; there is no qualifying independent current-head non-author approval and no current CHANGES_REQUESTED verdict.

Merge discipline

This PR is not merge-ready. Before integration require the unchanged exact head, or a fresh successor head revalidated from zero, to satisfy every applicable local and central gate, including terminal Dependency Review/Security, authoritative exact-head OpenCode/Noema/Strix evidence, resolved required conversations, and qualifying independent non-author approval after the last push. Queued, pending, skipped-required, cancelled, absent, neutral, failed, stale, predecessor, status-only, fallback-only, and model-only evidence is non-passing.

The remaining central failures/absence are foreign-owner boundaries. Do not self-approve, use routine administrator bypass, weaken a gate, transfer predecessor evidence, manufacture review/security evidence, add an Orgmetra shim for a foreign owner, or mutate another dedicated-writer repository.

Scope / non-claims

This packet does not calculate or authorize compensation, payroll, taxes, pay-equity findings, or employment decisions; it does not prove policy/legal sufficiency or successful downstream execution; and it does not claim certification, deployed production integrations, durable signing infrastructure, or commercial release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c63ae1e-b52b-4711-b0ee-984c620fbdb1

📥 Commits

Reviewing files that changed from the base of the PR and between dc3fa7e and b1f1aa5.

📒 Files selected for processing (1)

• packages/compensation-change-review/tests/test_packet.py

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/compensation-change-review/tests/test_packet.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

보상 변경 검토 패킷의 최소화된 데이터 계약과 fail-closed 검증을 추가했습니다. 패킷은 결정적 canonical JSON과 SHA-256 digest를 사용합니다. 회귀 테스트, 추적성 문서와 GitHub Actions 품질 게이트도 추가했습니다.

Changes

보상 변경 검토

Layer / File(s)	Summary
거버넌스 계약과 추적성 docs/adr/..., docs/doctoring/..., docs/traceability/..., packages/compensation-change-review/README.md, packages/compensation-change-review/CHANGELOG.md	패킷의 데이터 경계, 식별자 규칙, 인간 검토, HRIS·급여 실행 소유권과 검증 근거를 문서화했습니다.
패킷 계약과 생성 구현 packages/compensation-change-review/src/..., packages/compensation-change-review/pyproject.toml	불변 CompensationChangeReviewPacket과 빌더를 추가했습니다. 입력을 검증하고 canonical JSON, SHA-256 digest, 민감정보 비노출과 발행 시점 무결성 검사를 제공합니다.
무결성 및 개인정보 회귀 검증 packages/compensation-change-review/tests/*	패킷 생성, 상태 제한, 참조 검증, UUID·문자열·시간 위조 방어, 발행 후 변조 탐지와 시간 정규화를 검증합니다.
자동 품질 게이트 .github/workflows/compensation-change-review-quality.yml	검증된 SHA 체크아웃, 고정된 테스트 도구 설치, 컴파일, pytest, 100% 문장·분기 커버리지와 깨끗한 작업 트리 검사를 실행합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to b1f1a

The packet behavior is unchanged by the latest fix, but the current head is not merge-ready because a required review gate has failed and other required checks are still incomplete. Merge should wait until all required checks are terminally green and the required approval is obtained.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 79.31% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 58 functions across 8 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 보상 변경 검토 패킷 추가라는 PR의 주요 변경을 정확하고 간결하게 설명합니다. 품질 게이트 세부사항을 포함하지 않지만 제목에 필수는 아닙니다.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/governed-compensation-change-review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Review current exact head 2b78f0d3cfca5216b7c13794d296fd7550e9a8d5 against live develop@93f86ad6ab5083f4d82422d517d9352d7384d3be. Treat local-only and predecessor evidence as non-passing. Verify value-minimized—not anonymous—compensation-change review; opaque worker/current+proposed compensation/policy/pay-equity/budget/payroll-handoff references and independent digests; tenant-scoped reference re-resolution plus requester/reviewer authoritative identity separation; Person↔Employment↔active Assignment/Job/Position scope; no compensation/protected-attribute/free-form values; fully redacted repr; bounded positive evidence_version; human-only review with HRIS mutation and payroll execution unauthorized; exact 100% owned production statement/branch coverage and owned docstring contract; and that every repository workflow checked out this SHA. Submit formal APPROVE only if the unchanged head is merge-ready; otherwise REQUEST_CHANGES with the narrowest source-backed RED→GREEN finding.

[seonghobae]

@opencode-agent Please independently review exact current head ac439f35d8bd0b0ddfe0d7a739c5c97c5779d3b0 against live protected develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca. Treat predecessor evidence as stale. Verify CompensationChangeReviewPacket is value-minimized but correctly marks opaque worker/evidence correlation as personal data; binds tenant/Person/Employment/active Assignment-Job-Position scope, current/proposed compensation artifacts, exact policy, pay-equity review, budget authorization, payroll handoff, effective date, precision-preserving evidence time and bounded true-integer evidence_version with independent digests; excludes salary/wage/bonus/benefit/equity values, protected-attribute values, free-form case narrative and free-form model output; fully redacts representation; requires authoritative actor/scope/provenance re-resolution; and keeps payroll execution behind its published owner contract. Verify exact 100% owned production statement/branch coverage and actual checkout SHA for repository workflows. Submit formal APPROVE only if the unchanged exact head satisfies the live standard; otherwise REQUEST_CHANGES with the smallest source-backed RED→GREEN finding. Do not modify the branch or use author approval.

[seonghobae]

@opencode-agent review exact head ac439f35d8bd0b0ddfe0d7a739c5c97c5779d3b0 against live protected develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca. The earlier OpenCode request in this PR targeted predecessor 2b78... and is stale. Current Foundation CI, SAST Semgrep, Security Scan, Recovery Rehearsal Quality, and Compensation Change Review Quality are terminal GREEN; fresh formal review and thread queries show no reviews and no unresolved threads. Independently verify exact-tenant re-resolution, resolved requester/reviewer identity separation, Person→Employment/active Assignment/Job/Position scope, current/proposed compensation evidence and exact policy, pay-equity review, budget authorization, effective date and payroll-handoff provenance, value/protected-attribute minimization, redacted representation, bounded evidence version, and People-boundary/payroll-owner execution separation. Post a formal current-head APPROVE only if the unchanged exact head is technically mergeable; otherwise leave source-backed actionable findings. Do not use seonghobae approval.

[seonghobae]

@opencode-agent Please independently review exact current head a83a8b00d878ab810ffc614d5349e15b5fd2f90a against live protected develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca. Do not reuse predecessor-head evidence. Verify UUIDv4 opacity across all trust-reference and replacement paths, exact-tenant authoritative Person↔Employment↔active Assignment/Job/Position resolution, distinct resolved requester/reviewer identities, exact current/proposed compensation/policy/pay-equity/budget/effective-date/payroll-handoff provenance, bounded evidence-version identity, strict exclusion of compensation/protected-attribute/free-form/model-output values, explicit personal-data handling, and the People-mutation/payroll-owner boundary. Exact-head workflows remain queued/pending and are non-passing. Submit a formal independent APPROVE only if the unchanged head satisfies the live contract; otherwise leave the narrowest source-backed actionable finding tied to this SHA. Do not modify or merge the branch.

[seonghobae]

@opencode-agent Please independently review exact current head a83a8b00d878ab810ffc614d5349e15b5fd2f90a against protected develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca. Fresh exact-head Compensation Change Review Quality, Foundation CI, Recovery Rehearsal, SAST, and Security runs are terminal success. Re-read the current diff and verify canonical UUIDv4 trust references, evidence-version/digest determinism, requester/reviewer authoritative separation, Person↔Employment↔active Assignment/Job/Position re-resolution, current/proposed compensation/policy/pay-equity/budget/effective-date/payroll-handoff provenance, explicit personal-data sensitivity with compensation/protected-attribute/free-form value exclusion, and that HRIS mutation and payroll execution remain behind their authoritative owner boundaries. If this unchanged head satisfies the independent review standard, submit a formal APPROVE; otherwise leave only exact-head source-backed actionable findings. Do not modify, merge, weaken gates, or reuse predecessor evidence.

[seonghobae]

@opencode-agent Please independently review exact current head a83a8b00d878ab810ffc614d5349e15b5fd2f90a against live develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca; prior requests target predecessor heads and are stale. Exact-head Compensation Change Review, Foundation, Security, SAST, and Recovery workflows are terminal GREEN; there are no formal reviews or review threads. Re-read current source and verify canonical UUIDv4 opaque references; value-minimized-but-personal-data handling; exact-tenant requester/reviewer authoritative identity separation and Person→Employment→active Assignment/Job/Position scope; current/proposed compensation artifact, exact policy, pay-equity, budget, effective-date, and payroll-handoff provenance with independent digests; no salary/wage/bonus/benefit/equity/protected-attribute/free-form values; fully redacted representation; bounded evidence-version/deterministic evidence; and the boundary that HRIS mutation and payroll execution remain unauthorized and behind published owner contracts. Submit formal independent current-head APPROVE only if clean; otherwise leave exact actionable findings.

[seonghobae]

Verified the remaining CodeRabbit maintainability finding against exact head b1f1aa54637e0508b7785edc833430a7b58b4d77: the same 24-field valid compensation-review input seed was duplicated across the six cited tests, so the finding was valid. I added a structural regression that requires one canonical definition, consolidated the seed into tests/conftest.py, and changed each cited test to consume a fresh shared fixture while preserving hostile-subclass and per-test override behavior. Current exact head is d767befe864218c5592dbb71c3e075eb3d2082ad. Compensation Change Review Quality rerun 33216123092 / job 99000140603 is terminal GREEN on that exact SHA: compile succeeded, 74 tests passed, owned production remains 181 statements / 50 branches at exactly 100.00%, and checkout is clean. No production packet behavior changed.