people: reconcile result-identity hardening with idempotent replay identity

[seonghobae]

Finding

Exact #64 predecessor 8f986853a6f234c317e29080c4982bab34f3dc51 produced a real hosted Foundation RED in run 33947715482, job 101256719960. People API reached 232 passed / 1 failed because create_employment_record(...) rejected the first committed replay identity as different from the retry command's fresh generated record ID.

This is a production-contract conflict, not a stale fixture. docs/API_CONTRACT.md and docs/TEST_STRATEGY.md require Employment/Position/Assignment retries with the same tenant/route/idempotency key and same semantic command to return the first committed record identity. Generated record identifiers are deliberately excluded from mutation_command_digest(...); confirmed-hire remains intentionally different because exact materialization identities are part of that contract.

Repair lineage

• d7440d40e46f59a2596167bbca54af2a79e901a4 adds test-first contracts: a foreign first-committed identity is accepted only with matching semantic replay evidence; mismatched evidence fails closed and the replay digest must be an exact string.
• cc1cc53f34908178495ff657930c3950ce5931f9 adds optional replay_command_digest plus application verification.
• a61617f0cdd6f1a2e29b512b2a3c66872af5ccc4 returns the first committed UUID plus stored digest only after stored/current semantic digest equality and propagates that receipt for Employment/Position/Assignment replay. Normal creates carry no replay receipt; SQL/schema/migration/key derivation/audit/outbox and confirmed-hire semantics stay unchanged.

Foundation 33964015934, job 101300767068, then ran exact a61617f0.... People API executed 236/236 passing tests but the 100% gate failed at 99.69% because _employment_version_from_row, _position_version_from_row, and _assignment_from_row retained three unexecuted fail-closed wrong-width projection guards. Test-only 3f3b23a35a71f4fdaded3cb0cd1ee57412a7df05 covers those guards without changing production, SQL, migration, manifest, workflow, replay semantics, audit/outbox, or the threshold.

Six later test-quality successors only make hostile Python special-method tripwires protocol-conformant. Current exact #64 head is 4be7f1681959e43d32c8e85a8f2660da36ff6d9c; its last change converts hostile Decimal __add__/__radd__ failures to TypeError while retaining the call-count/fail-fast contract. Production replay behavior is unchanged.

Current exact-head acceptance — 2026-09-06

Foundation 33981039419, Repository quality 101346183995, checked out exact 4be7f1681959e43d32c8e85a8f2660da36ff6d9c and completed SUCCESS. Compile, Foundation validation, dependency hygiene, all owned unit/service suites, isolated PostgreSQL contracts, and read-only validation passed. People API executed 239/239 passing tests and services/people-api reached 100.00% statement/branch coverage (1472 statements / 482 branches). The working tree remained clean after validation.

Security Scan 33981039429 and SAST Semgrep 33981039445 are now terminal SUCCESS on the same exact head. CodeQL PR 33981039424 is terminal FAILURE, but the current evidence does not establish an Orgmetra source/SARIF finding: language detection succeeds, both Actions job 101358598317 and Python job 101358598361 successfully complete Request current-head CodeQL scan dispatch, and each fails only at Release runner or enforce current-head CodeQL verdict. Treat this as the shared current-head CodeQL handoff/control-plane boundary; do not add a leaf no-op commit, synthesize a verdict, or weaken the required workflow to manufacture GREEN.

This is current-head hosted evidence that the #246 replay repair and the later 99.69% coverage gap are fixed without weakening the gate. CodeRabbit's exact-head static review also found no defect in the final test-only successor, and all visible #64 review threads are resolved. Formal submitted reviews remain COMMENTED-only; no qualifying independent non-author APPROVED review is recorded.

#246 therefore remains open through ordinary protected integration. Remaining acceptance is the required CodeQL current-head verdict/control-plane convergence plus a qualifying approval and normal ruleset path; Security/SAST/Foundation are no longer pending. Do not include generated IDs in the semantic digest, delete the replay contract, accept unexplained foreign results, remove the three fail-closed projection guards, weaken same-key/different-command rejection or coverage, create a no-op retrigger commit, self-approve, or use routine administrator bypass.