fix(core): harden recorded correction trust boundary

[seonghobae]

Verified protected-main defect

Protected develop@9e3e4847510e1e612b48474ba42b177b8ed824df exposed close_recorded_interval(...) as a public HRIS-kernel correction boundary but trusted any caller-owned dataclass carrying a RecordedInterval. It also compared chronology against caller-controlled datetime subclasses before establishing exact trusted temporal primitives. A foreign dataclass could be returned as a corrected kernel fact, and hostile datetime behavior could forge chronology.

RED → root-cause repair

• RED d24f940a5f81a829419253dbbe9f768293643c2b adds regressions for a caller-owned fact shape and a hostile datetime subtype.
• Root-cause repair 739e26581095fedd0a18335f2311f972f6b13507 narrows the boundary to the four authoritative kernel fact types, exact RecordedInterval, and exact built-in timezone-aware datetime values before attribute-driven trust or comparison.
• efd87f45417031662382b0c901110f19206488d5 covers malformed recorded history; 01f18286f2a1ec8052ec88c2a3ec69f83d50394d completes adversarial datetime ordering; cbc6dfb374e8ae43df0cadce39aab44dc78fec94 validates both recorded endpoints before comparison and narrows UUID parsing failure handling to ValueError.
• Exact-current-head documentation repair b4cad54cf6067b672c71eb41c87fd62d75097bb3 scopes the defect statement to the authoritative protected snapshot, records the earlier protected snapshot as lineage only, and makes predecessor-head evidence non-transfer explicit.
• The source contains _ForgedDateTime.__lt__, __le__, and __gt__; the older GitHub Code Quality note claiming incomplete ordering is stale and does not identify a current defect.

Scope boundary

Orgmetra-only HRIS-kernel correction hardening. No dedicated-writer dependency repository is modified, no cross-service application-table SQL is introduced, and this branch does not modify the interval implementation owned by PR #69. This PR has no buyer-facing UI delta; Orgmetra's existing Figma/Storybook token and component authority is therefore preserved rather than forked.

Exact-current-head evidence

Current exact head: b4cad54cf6067b672c71eb41c87fd62d75097bb3.
Fresh protected base: develop@9e3e4847510e1e612b48474ba42b177b8ed824df.
GitHub reports the PR open, ready-for-review, and mergeable.

Fresh exact-head verification:

• Repository-owned Foundation, People, Job-analysis, Workforce, PostgreSQL, Recovery, coverage, SAST, and Security evidence inspected for this head is terminal GREEN.
• Noema exact-current-head evidence is terminal GREEN.
• OpenCode exact-current-head required workflow is terminal FAILURE because no authenticated current-head OpenCode verdict exists. A fresh @opencode-agent request is posted for this exact SHA and explicitly requires the authorized NVIDIA_NIM_API_KEY path; predecessor/status-only evidence must not be reused.
• No exact-current-head Strix run is materialized. Absent required evidence is non-passing.
• All current inline review threads are resolved. No qualifying independent non-author APPROVE exists for the current head.

Merge governance

Do not merge while OpenCode is fail-closed, Strix is absent, or independent human approval is missing. Orgmetra commercial governance requires at least two qualifying independent non-author approvals and approval after the latest push even though the inherited live organization ruleset is currently weaker. Re-run/review only through the authorized central workflow/provider path; do not create an empty retrigger commit, self-approve, weaken a gate, manufacture synthetic evidence, broaden agent credentials, or use routine OrganizationAdmin bypass. Immediately before any merge decision, refetch exact head/base/reviews/threads/rules/checks and use expected-head protection.

[coderabbitai]

📝 Walkthrough

Walkthrough

close_recorded_interval이 허용된 커널 사실, 정확한 RecordedInterval, 내장 timezone-aware datetime만 처리하도록 변경되었습니다. 잘못된 입력과 chronology 경계를 검증하는 회귀 테스트와 관련 추적성 및 릴리스 기록이 추가되었습니다.

Changes

기록 구간 수정 무결성

Layer / File(s)	Summary
수정 경계 검증 구현 packages/hris-kernel/src/orgmetra_hris_kernel/correction.py	허용된 네 가지 HRIS 사실 타입과 정확한 RecordedInterval을 확인합니다. recorded_to가 내장 datetime이며 timezone-aware인지 chronology 평가 전에 확인합니다.
런타임 무결성 회귀 테스트 packages/hris-kernel/tests/test_correction.py	외부 dataclass, 잘못된 recorded 값, 비교 연산을 재정의한 datetime 하위 클래스, naive datetime의 거부 동작을 검증합니다.
추적성 및 릴리스 기록 docs/traceability/recorded-correction-runtime-integrity.md, docs/doctoring/recorded-correction-runtime-integrity-references.md, CHANGELOG.md, manifest.json	수정 근거와 Python 참조를 기록합니다. 변경 로그와 CHANGELOG.md의 manifest 해시 및 파일 정보를 갱신합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to b734e

This PR hardens the correction boundary but still allows a caller-defined timestamp subtype in an existing recorded interval to influence chronology, which could create an invalid correction interval. Merge should wait for exact start-time validation and regression coverage.

Suggested reviewers: cursoragent

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 2 files. (4 skipped: 4…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 기록된 교정 경계의 신뢰성 강화라는 주요 변경 사항을 정확하게 요약합니다. 간결하고 구체적입니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 2 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/governed-recorded-correction-boundary

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

[seonghobae]

@opencode-agent Please review exact current head b4cad54cf6067b672c71eb41c87fd62d75097bb3 only. The protected OpenCode gate is currently fail-closed because no authenticated verdict exists for this head; predecessor-head or status-only evidence must not be reused. Execute through the authorized OpenCode path with NVIDIA_NIM_API_KEY only (do not use COPILOT_GITHUB_TOKEN), preserve independent reviewer credentials, and post a verdict explicitly bound to this exact SHA. Focus on the recorded-correction runtime trust boundary and the traceability-only documentation repair in the latest commit.