feat: add governed candidate withdrawal evidence - #67
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
| IF audit_event_envelope ->> 'source' <> 'urn:orgmetra:talent_acquisition' | ||
| OR audit_event_envelope ->> 'type' <> 'orgmetra.candidate.application_withdrawn' | ||
| OR audit_event_envelope ->> 'subject' | ||
| <> 'candidate_withdrawal_record:' || NEW.candidate_withdrawal_record_id::text | ||
| OR audit_event_envelope ->> 'orgmetraactor' <> NEW.initiating_actor_reference | ||
| OR audit_event_envelope ->> 'orgmetrapurpose' <> 'candidate_withdrawal' | ||
| OR audit_event_envelope ->> 'orgmetrareason' <> 'candidate_requested' | ||
| OR audit_event_envelope ->> 'orgmetraevidence' <> NEW.withdrawal_evidence_reference | ||
| OR audit_event_envelope ? 'orgmetraconfirmation' | ||
| OR (audit_event_envelope #>> '{data,high_impact}')::boolean IS NOT FALSE | ||
| OR audit_event_envelope #>> '{data,result_code}' <> 'application_withdrawn' | ||
| OR audit_event_time <> NEW.withdrawn_at | ||
| OR audit_event_time > NEW.recorded_at THEN | ||
| RAISE EXCEPTION 'candidate withdrawal audit envelope does not bind exact candidate provenance' | ||
| USING ERRCODE = '23514'; | ||
| END IF; |
There was a problem hiding this comment.
📝 Info: Digests and evidence version are not bound to the audit envelope
The insert trigger (0015_candidate_withdrawal_governance.sql) binds withdrawal_evidence_reference to the envelope's orgmetraevidence, but evidence_version, identity_resolution_digest, and withdrawal_evidence_digest are only shape-checked, never cross-checked against the audit event. The audit record therefore does not attest to those digest values. This reads as intentional but is a real gap in provenance coverage.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Buyer-visible gap
PR #66 deliberately removes bare
withdrawnfrom raw candidate-application stage persistence because that shape cannot prove candidate initiation. This stacked lane adds the missing governed candidate-withdrawal boundary without reintroducing a staff-controlled shadow rejection.Implemented withdrawal contract
The branch adds separate tenant-qualified, append-only, FORCE-RLS
candidate_withdrawal_recordevidence rather than a raw pipeline stage. It binds candidate actor/identity-resolution provenance, withdrawal evidence version/digest, chronology, immutable audit/outbox correlation, one-withdrawal cardinality, and rejects staff-actor shadow rejection, evidence mismatch, duplicate withdrawal, destructive rewrite, and foreign-tenant visibility.candidate:syntax is correlation, not authentication; Keyverse remains read-only through the published identity contract.Fresh dependency state
Dependency PR #66 exact head is
f27136f5febea21fb9b3cc7f22d4b564484a52beonfeat/normalized-candidate-application. Every applicable exact-current-head Orgmetra workflow is terminal GREEN: Candidate Application32975075961, Foundation32975075951, Recovery32975076065, Job-Analysis API32975076045, Selection Review32975075811, Requisition Review32975076032, SAST32975076053, and Security32975075769. #66 is open · non-draft · mergeable, but technical GREEN is not merge authorization because no qualifying independent non-author approval exists and the acquisition-grade control gap remains open in #89.Fresh child state / active-writer boundary
During the current freshness pass, this child branch advanced independently to exact head
79d1f6233c3bc5d9c2b796f3eba00f69ba6051e9(docs(adr): index active decision records and reseal foundation manifest). GitHub reports open · non-draft · currently non-mergeable. The recorded stack base is still old parent head15a4bc98f983e0357acb5e373be3cbfb4e0b0072, so this descendant remains stale relative to #66's current head and parent checks/reviews cannot transfer.Fresh exact-head Actions lookup for
79d1f6233c3bc5d9c2b796f3eba00f69ba6051e9returns no workflow runs. Absent exact-current-head evidence is non-passing. Historical Candidate Withdrawal Quality32480099494on predecessor child headcf59b3001fa58e5a978099c2a5692a03f4849fddis predecessor-only evidence and must not be promoted to the new child head.Because another same-repository writer advanced the child branch during this run, this loop will not race that writer by changing branch refs, retargeting, or toggling Draft/Ready. The live non-draft flag is metadata only and is not integration or merge authority.
Stack / merge governance
Process #66 dependency-first. Do not restack merely to manufacture descendant evidence while #66 is still unintegrated. After #66 actually integrates, the owning writer must retarget/revalidate #67 against fresh
develop, reconcile the new child ADR/provenance changes plus migration ordering, refetch exact head/base/rules/reviews/threads, and rerun every applicable global and withdrawal-lane gate without transferring parent/predecessor evidence.Effective organization ruleset 18156473 is active on the default branch but currently requires only one approving review, dismisses stale reviews, does not require last-push approval, requires conversation resolution and central workflows, and permits routine OrganizationAdmin
alwaysbypass. Issue #89 owns the stricter acquisition-grade target of at least two qualifying independent non-author approvals, approval after last push, complete exact-head local/central GREEN evidence, resolved conversations, and no routine administrator bypass.Do not self-approve, weaken a gate, use routine admin bypass, race another writer, transfer predecessor evidence, or mutate a dedicated-writer dependency.