fix(core): protect canonical evidence runtime types

[seonghobae]

Verified protected-main integrity defects

Protected develop@9e3e4847510e1e612b48474ba42b177b8ed824df allowed caller-controlled runtime subclasses to reach canonical immutable evidence serialization in high-value HRIS-kernel boundaries: Job Analysis identity/temporal/governance evidence and AuditOutboxEvent identity/chronology evidence. The branch repairs those Orgmetra-owned boundaries only; no dedicated-writer dependency repository is modified.

RED → root-cause repairs

• Job Analysis temporal RED e10bd567e8cef1bc70e8e1f019c88c03170d1a41 → GREEN 42973968c1e72edf93c6623d8199c17087b17961: exact built-in datetime/date required before canonical temporal rendering.
• Audit/outbox RED e6fe8997e8ac73261f767cc5da70573e57602e3b → GREEN 3058ff9cd67354209cee820547aa37a278e73cdf: exact built-in UUID/datetime required before CloudEvent serialization/digest.
• Job Analysis identity RED 36fe98150b3a71beb6e6b33c56f6c43376e6c973 → GREEN 4a541a5093528116c0b25382a552c7f9138dd1d3: shared UUID validator now fails closed on subclasses across snapshot, Task, KSAO, FJA and Task–KSAO identity evidence.
• Job Analysis governance-primitive RED 943c2dce2601edfa8b360e9de746bb73659a00af → repair 05d04db7b8420f6efe4a2d488044bea31200ceed: hostile str subclasses could forge allow-list membership while canonical JSON retained a different status_code/origin_code, and hostile int subclasses could forge ordinal/FJA bound comparisons while serializing an out-of-range number. Governance codes now require exact built-in str; ordinal and FJA numeric evidence requires exact built-in int before membership/comparison/serialization.
• GitHub Code Quality then correctly found incomplete ordering on the adversarial _ForgedLevel test helper. 7ae6331b68eb9af3faa6bace8b9ef11d037badc4 adds the matching __lt__/__gt__ behavior; only that addressed thread was resolved.

Exact-current-head evidence

Current exact head: 9a1bbd3a12ba3e70a4e19eba8962263ce3146d52.
Fresh live base: develop@9e3e4847510e1e612b48474ba42b177b8ed824df.

GitHub reports the PR open, non-draft and mergeable. Mergeability is not merge authorization.

Fresh exact-head evidence remains non-passing because required central opencode-review and strix checks are terminal FAILURE. Other successful local/security/coverage checks do not override those required central failures, and predecessor/status/model-only evidence does not transfer.

Current exact-head review state has 0 unresolved threads and no qualifying independent APPROVED review.

This section supersedes older wording that said current-head required evidence was terminal GREEN. That statement was stale and directly contradicted the live current-head check set.

Merge governance

This PR is not merge-ready. Keep it unmerged until the unchanged exact head has terminal GREEN evidence for every applicable local and required central gate plus qualifying independent non-author approval under the stricter Orgmetra commercial acceptance policy. Immediately before any merge, refetch exact head/base, formal reviews, unresolved threads, effective rules and the complete exact-head check set, then use expected-head protection.

Do not self-approve, bypass protection, weaken or relabel a failing central gate, or reuse predecessor evidence.

[coderabbitai]

Warning

Review limit reached

Next included review available in 30 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 00036a1e-0ec9-4088-9d1a-32e398749df8

📥 Commits

Reviewing files that changed from the base of the PR and between 9e3e484 and 5c52509.

📒 Files selected for processing (6)

• CHANGELOG.md
• manifest.json
• packages/hris-kernel/src/orgmetra_hris_kernel/audit.py
• packages/hris-kernel/src/orgmetra_hris_kernel/job_analysis.py
• packages/hris-kernel/tests/test_audit_runtime_type_integrity.py
• packages/hris-kernel/tests/test_job_analysis_temporal_type_integrity.py

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/job-analysis-temporal-evidence-types

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.