diff --git a/.gitignore b/.gitignore index 1f0b61ba5..8c0face9e 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,6 @@ secrets/ artifacts/ reports/ *.log + +# Local code-intelligence index (colbymchenry/codegraph); never committed +.codegraph/ diff --git a/AGENTS.md b/AGENTS.md index fb8c0470c..19dcf0426 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -8,7 +8,7 @@ Build Orgmetra as a commercial-grade, evidence-centered HRIS and HCM platform th - Never bypass branch protection, required checks, independent review, OpenCode, Noema, Strix, SAST, or Security Scan gates. - Never self-approve or manufacture approval evidence. -- Never use `COPILOT_GITHUB_TOKEN` as a development model credential. Use `NVIDIA_NIM_API_KEY` for model-backed tests and OpenCode development paths. +- Model-backed GitHub Actions request only `orchestrator/free` through the released contextual-orchestrator gateway token. Consumer workflows must not select a provider, provider group, paid fallback, or use `COPILOT_GITHUB_TOKEN` or provider API keys directly. - Never make LLM output an autonomous high-impact employment decision. - Never copy another CWL product into Orgmetra when an adapter/package/API/event boundary is sufficient. - Never directly query another service's application database. diff --git a/CHANGELOG.md b/CHANGELOG.md index 99f4752d7..2bd04d452 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,12 +7,12 @@ All notable changes to Orgmetra will be documented in this file. ### Added - Accepted ADRs 0001–0003 now include buyer-facing Context, Decision, and Consequences grounded in verified ISO 30400:2022, ISO 30414:2025, Uniform Guidelines (29 C.F.R. Part 1607), SIOP (2018), OpenAPI Specification v3.2.0, OpenID Connect Core 1.0 errata set 2, CloudEvents v1.0.2, Jensen and Snodgrass (1999), Snodgrass (1999), and Allen (1983) records already listed in `docs/doctoring/REFERENCES.md`. ADRs 0004 and 0005 gained APA 7th References pointers to that same bibliography without changing their Decision bodies. -- Active-PR governed Job Analysis persistence/API on the canonical `JobAnalysisSnapshot` model: migration `0013_job_analysis_snapshot.sql` stores immutable tenant-scoped snapshot, Task, KSAO, Task–KSAO, FJA and write-command evidence; `POST /v1/tenants/{tenant_record_id}/job-analysis-snapshots` and matching GET enforce purpose-bound Keyverse scope, authenticated-principal actor authority, bounded/strict JSON handling, transactional Idempotency-Key serialization, parent-scope fail-closed integrity, forced RLS, and atomic audit/outbox evidence. ADR 0014 records the persistence decision while ADR 0007 remains the domain/evidence authority; validated evidence still requires accountable human review and non-LLM provenance, and the service does not make a high-impact employment decision. -- Active-PR `orgmetra_selection_review` packet for PII-minimized, evidence-bound human selection review: canonical operational tenant identity, UUID-backed opaque candidate/Job/sealed-evidence/reviewer references, explicit purpose/reason/evidence version, deterministic canonical JSON and SHA-256 correlation, mandatory human decision state, redacted packet repr, and provenance-paired model evidence that remains `untrusted_draft`, with exact 100% owned statement and branch coverage required by its quality gate. +- Protected-main governed Job Analysis persistence/API on the canonical `JobAnalysisSnapshot` model: migration `0013_job_analysis_snapshot.sql` stores immutable tenant-scoped snapshot, Task, KSAO, Task–KSAO, FJA and write-command evidence; `POST /v1/tenants/{tenant_record_id}/job-analysis-snapshots` and matching GET enforce purpose-bound Keyverse scope, authenticated-principal actor authority, bounded/strict JSON handling, transactional Idempotency-Key serialization, parent-scope fail-closed integrity, forced RLS, and atomic audit/outbox evidence. ADR 0014 records the persistence decision while ADR 0007 remains the domain/evidence authority; validated evidence still requires accountable human review and non-LLM provenance, and the service does not make a high-impact employment decision. +- Protected-main `orgmetra_selection_review` packet for PII-minimized, evidence-bound human selection review: canonical operational tenant identity, UUID-backed opaque candidate/Job/sealed-evidence/reviewer references, explicit purpose/reason/evidence version, deterministic canonical JSON and SHA-256 correlation, mandatory human decision state, redacted packet repr, and provenance-paired model evidence that remains `untrusted_draft`, with exact 100% owned statement and branch coverage required by its quality gate. - Active performance-criterion scope hardening: `criterion_observation_scope_guard` rejects criterion outcomes for a Job the worker did not effectively hold at the observation date, observations before the relevant assignment, and observations outside the referenced performance cycle while preserving valid multiple-assignment cases and existing bitemporal correction semantics. The guard evaluates current-recorded facts, derives the date coordinate from `observed_at` in UTC so session `TimeZone` cannot alter the result, uses a trusted function search path, and adds no PII or automated employment decision authority. The Foundation PostgreSQL contract also rejects a closed `recorded_to` on each time-coordinate lookup and proves UTC midnight plus non-UTC session `TimeZone` boundaries. - Bitemporal tenant-scoped organization hierarchy validation that rejects visible indirect parent cycles and reuses single-valued recorded-time reconstruction before graph traversal. - Stacked governed job-analysis evidence contract via `JobAnalysisSnapshot`, `TaskEvidence`, `KSAORequirement`, `TaskKSAOLink`, `FunctionalJobAnalysisProfile`, and `EvidenceSource`: tenant/Job-scoped observable tasks, explicit Task-to-KSAO linkage, importance/difficulty/proficiency ratings, source/version/retrieval/SHA-256 provenance, deterministic canonical snapshot bytes, current O*NET evidence support, and historical DOT Data/People/Things compatibility. Validated snapshots require accountable human review and complete non-LLM evidence; LLM-origin material remains `analysis_draft`, and the snapshot is evidence input rather than a hiring, promotion, termination, compensation, or other high-impact employment decision. -- Stacked governed audit/outbox slice via `AuditOutboxEvent`, `audit_event_record`, `outbox_delivery_record`, and `outbox_delivery_escalation_record`: CloudEvents 1.0-compatible PII-minimized metadata, exact canonical JSON bytes, database-verified SHA-256 digests, mandatory human confirmation for high-impact events, immutable audit evidence, tenant RLS, atomic audit/outbox insertion, guarded pending/leased/delivered/dead-lettered delivery state, tenant-safe `claim_outbox_delivery(...)` with deterministic due-work ordering, `FOR UPDATE ... SKIP LOCKED`, opaque worker identity, bounded future leases, immutable envelope return, and atomic takeover of genuinely expired leases only while retry attempts remain; owner-bound `complete_outbox_delivery(...)` and `retry_outbox_delivery(...)`; database-budget-governed `dead_letter_outbox_delivery(...)`; and a separately privileged `operator_dead_letter_expired_outbox_delivery(...)` recovery path for an exhausted final lease whose recorded worker identity is permanently unavailable. `maximum_attempt_count` is persisted on the delivery row, defaults to 5, is constrained to 1 through 100, and cannot be lowered by a dispatcher during finalization. Migration 0007 prevents retry or expired-lease takeover from creating attempt N+1; migration 0008 adds TRUNCATE guards, trusted function search paths, a concurrently built due-work partial index, session-independent immutable envelope validation, and operator recovery backed by separate NOLOGIN/NOBYPASSRLS owner/capability roles so the externally assignable operator role can invoke recovery without receiving direct transport-table read/write rights. Migration 0008 also rejects pre-existing reserved recovery-role names before project DDL, atomically contains the temporary schema-creation privilege used for function ownership handoff, and forces deferred escalation binding while the narrow SECURITY DEFINER owner is still active. Exponential/backoff policy selection, policy-specific producer configuration, and external delivery receipts remain subsequent work. +- Governed audit/outbox slice on protected `develop` via `AuditOutboxEvent`, `audit_event_record`, `outbox_delivery_record`, and `outbox_delivery_escalation_record`: CloudEvents 1.0-compatible PII-minimized metadata, exact canonical JSON bytes, database-verified SHA-256 digests, mandatory human confirmation for high-impact events, immutable audit evidence, tenant RLS, atomic audit/outbox insertion, guarded pending/leased/delivered/dead-lettered delivery state, tenant-safe `claim_outbox_delivery(...)` with deterministic due-work ordering, `FOR UPDATE ... SKIP LOCKED`, opaque worker identity, bounded future leases, immutable envelope return, and atomic takeover of genuinely expired leases only while retry attempts remain; owner-bound `complete_outbox_delivery(...)` and `retry_outbox_delivery(...)`; database-budget-governed `dead_letter_outbox_delivery(...)`; and a separately privileged `operator_dead_letter_expired_outbox_delivery(...)` recovery path for an exhausted final lease whose recorded worker identity is permanently unavailable. `maximum_attempt_count` is persisted on the delivery row, defaults to 5, is constrained to 1 through 100, and cannot be lowered by a dispatcher during finalization. Migration 0007 prevents retry or expired-lease takeover from creating attempt N+1; migration 0008 adds TRUNCATE guards, trusted function search paths, a concurrently built due-work partial index, session-independent immutable envelope validation, and operator recovery backed by separate NOLOGIN/NOBYPASSRLS owner/capability roles so the externally assignable operator role can invoke recovery without receiving direct transport-table read/write rights. Migration 0008 also rejects pre-existing reserved recovery-role names before project DDL, atomically contains the temporary schema-creation privilege used for function ownership handoff, and forces deferred escalation binding while the narrow SECURITY DEFINER owner is still active. Exponential/backoff policy selection, policy-specific producer configuration, and external delivery receipts remain subsequent work. - `orgmetra_hris_kernel` 0.4.0 with exclusive-versus-concurrent employment, staffable position coverage, exclusive-seat capacity, and `validate_assignment_write` at 100% statement and branch coverage. - `POST /v1/employment-records`, `POST /v1/position-records`, and `POST /v1/assignment-records` with the same Keyverse mutation context, confirmation, and versioned evidence composition as other high-impact commands. - `employment_record_version.employment_concurrency_code` constrained to `exclusive` or `concurrent`. @@ -73,4 +73,4 @@ All notable changes to Orgmetra will be documented in this file. ### Notes -- Protected `develop` at `e7ddb7a78a5e1460410005d10f43ebf18c5e12e4` includes normalized validity-study and criterion integrity, bitemporal workforce composition, governed candidate-to-worker conversion, purpose-bound PII authorization, GET-only People reads, governed People mutation/idempotency API, and the accepted ADR 0001–0003 source expansion integrated by #37. Job Analysis persistence/API and the selection-review packet remain active-PR truth until their unchanged exact heads satisfy fresh gates and merge. +- Protected `develop` at `e7ddb7a78a5e1460410005d10f43ebf18c5e12e4` includes normalized validity-study and criterion integrity, bitemporal workforce composition, governed candidate-to-worker conversion, purpose-bound PII authorization, GET-only People reads, governed People mutation/idempotency API, and the accepted ADR 0001–0003 source expansion integrated by #37. Subsequent protected-develop merges recorded governed Job Analysis persistence/API and the selection-review packet as shipped capabilities; current active hardening and exact protected-head status are tracked in the README, TRACEABILITY, and product gap baseline rather than this historical anchor. diff --git a/CLAUDE.md b/CLAUDE.md index 33818e4c0..6e5d54ddb 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -11,9 +11,10 @@ Do not treat Orgmetra as a resume parser, ATS-only system, psychometric engine, - Psychometrics Commons owns assessment operations and immutable assessment result snapshots. - fast-mlsirm owns psychometric numerical kernels. - TEPP owns temporal/event/multilevel analysis artifacts. -- Semantic Data Portal owns occupation/skill/ability ontology and semantic catalog. +- ConceptWeave owns ontology and semantic-layer observe/discover/propose/align/validate/review/publish workflows and immutable semantic releases. +- semantic-data-portal owns catalog, governance, search, serving, and consumption of released semantic resources; it does not author Orgmetra domain truth. - Naruon owns mail/calendar/file control-plane integrations. -- Contextual Orchestrator owns bounded LLM orchestration traces. +- contextual-orchestrator owns bounded LLM orchestration traces, provider discovery, capability-aware routing, and gateway contracts; Orgmetra consumes only released APIs and schemas. ## Writing guidance diff --git a/README.md b/README.md index 47bb087a3..872b922a5 100644 --- a/README.md +++ b/README.md @@ -78,4 +78,4 @@ Job evidence ## Status -Protected `develop` includes the employment-truth kernel, governed candidate-to-worker conversion, purpose-bound PII authorization, normalized worker-bound validity studies, criterion-observation scope, bitemporal workforce-composition evidence, the governed Naruon intent adapter, and requisition review packets. This active PR adds durable purpose-bound People mutation and confirmed-hire materialization paths for Employment, Position, and Assignment with atomic audit/outbox evidence and tenant-scoped idempotency; treat those write paths as active-PR truth until this exact head passes all fresh protected-base gates and merges. +Protected `develop` includes the employment-truth kernel, durable purpose-bound People mutation and confirmed-hire materialization paths for Employment, Position, and Assignment with atomic audit/outbox evidence and tenant-scoped idempotency, governed Job Analysis snapshot persistence/read, candidate evidence intake, offer approval packets, governed candidate-to-worker conversion, purpose-bound PII authorization, normalized worker-bound validity studies, criterion-observation scope, bitemporal workforce-composition evidence, the governed Naruon intent adapter, and requisition review packets. Active PRs remain separate from this protected-branch shipped truth until their exact heads pass all fresh protected-base gates and merge. diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index 22a4178fe..5266c25fa 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -4,34 +4,36 @@ | Requirement | Architecture | Data object | Test family | ADR | Maturity | |---|---|---|---|---|---| -| Separate person/employment/organization/job/position/assignment | Core bounded contexts | `person_record`, `employment_record`, `employment_record_version`, `organization_unit`, `job_profile`, `position_record`, `position_record_version`, `assignment_record` | schema/domain and `orgmetra_hris_kernel` tests | ADR-0001, ADR-0004, ADR-0005 | implemented_on_active_pr | -| Exclusive employment and staffable seats | Core bounded contexts | `employment_concurrency_code`, staffable `position_status_code`, assignment allocation totals | Memorial Hospital exclusivity, freeze, and seat-capacity kernel tests plus OpenAPI employment/position/assignment commands | ADR-0005 | implemented_on_active_pr | -| Tenant-qualified HRIS integrity and fail-closed isolation | Core bounded contexts / Security architecture | `tenant_record`, tenant-qualified foreign keys, forced row-level security policies, tenant-scoped kernel query parameters | PostgreSQL cross-tenant FK/application-role RLS contracts plus kernel cross-tenant reconstruction, employment coverage, position coverage, seat-capacity, portfolio, exclusivity, and organization-hierarchy regressions | ADR-0001, ADR-0003 | implemented_on_active_pr | -| Reserved UUID sentinel exclusion | Persistence integrity boundary | every foundation UUID `*_id` column plus audit/outbox identifiers | PostgreSQL inventory proof plus Nil/Max foundation and audit/outbox persistence regressions | ADR-0001, RFC 9562 | implemented_on_active_pr | -| Normalized bitemporal organization/job/employment/position history | Core bounded contexts | `organization_unit_version`, `job_profile_version`, `employment_record_version`, `position_record_version` | PostgreSQL non-overlap, concurrent conflict, correction, rewrite-rejection, assignment-employment binding, and single-valued historical reconstruction | ADR-0001, ADR-0003, ADR-0004 | implemented_on_active_pr | +| Separate person/employment/organization/job/position/assignment | Core bounded contexts | `person_record`, `employment_record`, `employment_record_version`, `organization_unit`, `job_profile`, `position_record`, `position_record_version`, `assignment_record` | schema/domain and `orgmetra_hris_kernel` tests | ADR-0001, ADR-0004, ADR-0005 | implemented_on_protected_main | +| Exclusive employment and staffable seats | Core bounded contexts | `employment_concurrency_code`, staffable `position_status_code`, assignment allocation totals | Memorial Hospital exclusivity, freeze, and seat-capacity kernel tests plus OpenAPI employment/position/assignment commands | ADR-0005 | implemented_on_protected_main | +| Tenant-qualified HRIS integrity and fail-closed isolation | Core bounded contexts / Security architecture | `tenant_record`, tenant-qualified foreign keys, forced row-level security policies, tenant-scoped kernel query parameters | PostgreSQL cross-tenant FK/application-role RLS contracts plus kernel cross-tenant reconstruction, employment coverage, position coverage, seat-capacity, portfolio, exclusivity, and organization-hierarchy regressions | ADR-0001, ADR-0003 | implemented_on_protected_main | +| Reserved UUID sentinel exclusion | Persistence integrity boundary | every foundation UUID `*_id` column plus audit/outbox identifiers | PostgreSQL inventory proof plus Nil/Max foundation and audit/outbox persistence regressions | ADR-0001, RFC 9562 | implemented_on_protected_main | +| Normalized bitemporal organization/job/employment/position history | Core bounded contexts | `organization_unit_version`, `job_profile_version`, `employment_record_version`, `position_record_version` | PostgreSQL non-overlap, concurrent conflict, correction, rewrite-rejection, assignment-employment binding, and single-valued historical reconstruction | ADR-0001, ADR-0003, ADR-0004 | implemented_on_protected_main | | Acyclic organization hierarchy at historical coordinates | Organization core | `organization_unit_version.parent_organization_unit_id` | indirect A→B→C→A rejection plus future-recorded and foreign-tenant isolation in `orgmetra_hris_kernel` | ADR-0001, ADR-0003 | implemented_on_protected_main | -| Effective/system time | Bitemporal HRIS | `effective_from`, `recorded_from` | strict half-open interval and historical-coordinate tests | ADR-0003 | implemented_on_active_pr | -| Evidence-backed human selection decisions | Talent Acquisition | `decision_evidence_set`, `selection_decision_evidence`, `selection_decision` | database-owned SHA-256 sealing, non-empty evidence, drift/reuse rejection, OpenAPI human-confirmation tests | ADR-0001 | implemented_on_active_pr | +| Effective/system time | Bitemporal HRIS | `effective_from`, `recorded_from` | strict half-open interval and historical-coordinate tests | ADR-0003 | implemented_on_protected_main | +| Evidence-backed human selection decisions | Talent Acquisition | `decision_evidence_set`, `selection_decision_evidence`, `selection_decision` | database-owned SHA-256 sealing, non-empty evidence, drift/reuse rejection, OpenAPI human-confirmation tests | ADR-0001 | implemented_on_protected_main | | Governed candidate-to-worker conversion | Talent Acquisition / People core | `candidate_worker_conversion_record` with candidate, person, employment, selection decision, audit event and outbox evidence | PostgreSQL exact hire/evidence/audit-envelope binding, correction provenance, tenant RLS, legacy-write rejection and bitemporal history contract | ADR-0001, ADR-0003, ADR-0006 | implemented_on_protected_main | | GET-only People API | People API / purpose-bound read boundary | `GET /v1/tenants/{tenant_record_id}/people/{person_record_id}`, `read_worker_people_record()`, `PostgresPeopleReadPort` | People API HTTP and PostgreSQL read contracts with exact 100% owned statement/branch coverage; current conversion lineage; no mutation writes | ADR-0002, ADR-0008 | implemented_on_protected_main | | Governed People writes and confirmed-hire materialization | People API / purpose-bound mutation boundary | `POST /v1/employment-records`, `POST /v1/position-records`, `POST /v1/assignment-records`, `POST /v1/tenants/{tenant_record_id}/candidate-worker-conversions`, `people_mutation_idempotency_record` | People command/HTTP/PostgreSQL contracts with exact owned statement/branch coverage plus PostgreSQL tenant-RLS, atomic audit/outbox/idempotency, identical-retry replay, changed-command rejection, rollback, and concurrent-key regression | ADR-0002, ADR-0006, ADR-0008 | implemented_on_protected_main | -| Evidence-grounded Job analysis with governed Task/FJA/KSAO persistence | Job Analysis / Workforce Validation | `JobAnalysisSnapshot`, `TaskEvidence`, `KSAORequirement`, `FunctionalJobAnalysisProfile`, `TaskKSAOLink`, `EvidenceSource`, `job_analysis_snapshot`, `job_analysis_task_item`, `job_analysis_ksao_item`, `job_analysis_task_ksao_link`, `job_analysis_write_command`, `POST /v1/tenants/{tenant_record_id}/job-analysis-snapshots`, `GET /v1/tenants/{tenant_record_id}/job-analysis-snapshots/{analysis_record_id}` | domain tenant/Job isolation, source/version/digest provenance, task-KSAO completeness, deterministic canonicalization, accountable human-review and LLM-draft-only regressions; migration 0013 PostgreSQL parent-scope/RLS/append-only/idempotency/audit-outbox persistence; exact route/OpenAPI/error contracts and 100% owned service statement/branch coverage | ADR-0007, ADR-0014 | implemented_on_active_pr | +| Evidence-grounded Job analysis with governed Task/FJA/KSAO persistence | Job Analysis / Workforce Validation | `JobAnalysisSnapshot`, `TaskEvidence`, `KSAORequirement`, `FunctionalJobAnalysisProfile`, `TaskKSAOLink`, `EvidenceSource`, `job_analysis_snapshot`, `job_analysis_task_item`, `job_analysis_ksao_item`, `job_analysis_task_ksao_link`, `job_analysis_write_command`, `POST /v1/tenants/{tenant_record_id}/job-analysis-snapshots`, `GET /v1/tenants/{tenant_record_id}/job-analysis-snapshots/{analysis_record_id}` | domain tenant/Job isolation, source/version/digest provenance, task-KSAO completeness, deterministic canonicalization, accountable human-review and LLM-draft-only regressions; migration 0013 PostgreSQL parent-scope/RLS/append-only/idempotency/audit-outbox persistence; exact route/OpenAPI/error contracts and 100% owned service statement/branch coverage | ADR-0007, ADR-0014 | implemented_on_protected_main | +| Governed candidate evidence intake | Talent Acquisition | `CandidateEvidenceIntakePacket` and `docs/traceability/candidate-evidence-intake.md` | Candidate Evidence Quality contract tests for tenant scope, opaque references, evidence versioning, redacted representation, human review, and exact 100% coverage | ADR-0025 | implemented_on_protected_main | +| Governed offer approval evidence | Talent Acquisition | `OfferApprovalPacket` and `docs/traceability/offer-approval.md` | Offer Approval Quality contract tests for tenant identity, opaque references, actor separation, evidence versioning, human approval, and delivery denial | ADR-0017 | implemented_on_protected_main | | Job-, cycle-, and staffing-scoped performance criterion observations | Performance / Workforce Validation | `criterion_observation`, `criterion_blueprint`, `performance_cycle`, `assignment_record`, `employment_record_version`, `position_record`, `position_record_version` | PostgreSQL wrong-Job, pre-assignment, out-of-cycle, frozen-Position, terminated-employment, closed-recorded-time, and session-TimeZone/UTC-midnight rejection plus valid worker-Job/staffing acceptance | ADR-0009 | implemented_on_protected_main | -| Governed immutable audit and transactional outbox persistence | Audit Provenance / Integration Hub | `AuditOutboxEvent.canonical_json()`, `audit_event_record`, `outbox_delivery_record`, SHA-256 envelope digest | canonical-byte/digest regression plus PostgreSQL digest, allowlist/PII, high-impact confirmation, append-only, atomicity, lease-transition, terminal-state, and reserved-UUID tests | ADR-0006 | implemented_on_active_pr | -| Tenant-safe atomic outbox claiming and crash recovery | Integration Hub dispatcher boundary | `outbox_delivery_record` pending/expired-lease claim indexes plus `claim_outbox_delivery(...)` | PostgreSQL already-expired-new-lease rejection, due-order claim, live-lease exclusion, pre-exhaustion takeover with `lease_expired` evidence, retry-budget claim bound, tenant-context binding, opaque-worker validation, and bounded-lease contract | ADR-0006 | implemented_on_active_pr | -| Owner-bound outbox completion, retry, and terminal dead-letter escalation | Integration Hub dispatcher boundary | immutable `outbox_delivery_record.maximum_attempt_count`, `complete_outbox_delivery(...)`, `retry_outbox_delivery(...)`, `dead_letter_outbox_delivery(...)`, `outbox_delivery_escalation_record` | PostgreSQL foreign/stale-owner denial, dispatcher-budget-signature rejection, direct-terminal-DML rejection, stored-budget exhaustion, retry-attempt-N+1 denial, exhausted expired-lease non-reclaimability, recorded-owner terminalization, nonterminal-escalation rejection, terminal non-reclaimability, and append-only escalation evidence | ADR-0006 | implemented_on_active_pr | +| Governed immutable audit and transactional outbox persistence | Audit Provenance / Integration Hub | `AuditOutboxEvent.canonical_json()`, `audit_event_record`, `outbox_delivery_record`, SHA-256 envelope digest | canonical-byte/digest regression plus PostgreSQL digest, allowlist/PII, high-impact confirmation, append-only, atomicity, lease-transition, terminal-state, and reserved-UUID tests | ADR-0006 | implemented_on_protected_main | +| Tenant-safe atomic outbox claiming and crash recovery | Integration Hub dispatcher boundary | `outbox_delivery_record` pending/expired-lease claim indexes plus `claim_outbox_delivery(...)` | PostgreSQL already-expired-new-lease rejection, due-order claim, live-lease exclusion, pre-exhaustion takeover with `lease_expired` evidence, retry-budget claim bound, tenant-context binding, opaque-worker validation, and bounded-lease contract | ADR-0006 | implemented_on_protected_main | +| Owner-bound outbox completion, retry, and terminal dead-letter escalation | Integration Hub dispatcher boundary | immutable `outbox_delivery_record.maximum_attempt_count`, `complete_outbox_delivery(...)`, `retry_outbox_delivery(...)`, `dead_letter_outbox_delivery(...)`, `outbox_delivery_escalation_record` | PostgreSQL foreign/stale-owner denial, dispatcher-budget-signature rejection, direct-terminal-DML rejection, stored-budget exhaustion, retry-attempt-N+1 denial, exhausted expired-lease non-reclaimability, recorded-owner terminalization, nonterminal-escalation rejection, terminal non-reclaimability, and append-only escalation evidence | ADR-0006 | implemented_on_protected_main | | Predictive-validity case integrity | Workforce Validation | `validity_study`, normalized `validity_study_case_record`, exact `selection_decision`, sealed `decision_evidence_set`, governed `candidate_worker_conversion_record`, `criterion_observation` | `test_validity_study_case_postgres.sh`: legacy loose-link write rejection; exact evidence-set ID, Job, criterion and worker mismatch rejection; study/observation system-recorded visibility boundaries; governed upstream decision/evidence/conversion lineage from the evidence-sealing and candidate-worker conversion contracts; UPDATE/DELETE/TRUNCATE protection; missing/foreign-tenant RLS denial. Statistical estimation remains subsequent work. | ADR-0001, SIOP Principles 5th ed., 29 C.F.R. Part 1607 | implemented_on_protected_main | | Purpose-bound PII access | Security architecture / Keyverse adapter boundary | `PurposeBoundAccessPolicy`, `PurposeBoundAccessRequest.resource_reference`, `AuthorizationDecision.resource_reference` | exact tenant/actor/resource binding, exact opaque target correlation for allow/deny audit evidence, resource/purpose/operation matching, operation-specific scope, field-subset minimization, malformed-attribute rejection, reserved-UUID rejection, PII-minimized denial evidence, and exact 100% owned statement/branch coverage | ADR-0008 | implemented_on_protected_main | -| Least-privilege API capability | Keyverse gateway boundary | operation scope conceptual | structural per-operation scope and confused-deputy contract tests | ADR-0002 | implemented_on_active_pr | -| Client-safe failure correlation | API error boundary | `support_reference` conceptual | error disclosure and support-lookup tests | ADR-0002 | implemented_on_active_pr | -| Foundation artifact integrity | Repository governance | deterministic `manifest.json` file inventory | SHA-256/byte/line validation plus Python/Node inventory-equivalence regression and explicit dispatcher/validity/criterion/job-analysis migration and execution-contract provenance regression | ADR-0001 | implemented_on_active_pr | +| Least-privilege API capability | Keyverse gateway boundary | operation scope conceptual | structural per-operation scope and confused-deputy contract tests | ADR-0002 | implemented_on_protected_main | +| Client-safe failure correlation | API error boundary | `support_reference` conceptual | error disclosure and support-lookup tests | ADR-0002 | implemented_on_protected_main | +| Foundation artifact integrity | Repository governance | deterministic `manifest.json` file inventory | SHA-256/byte/line validation plus Python/Node inventory-equivalence regression and explicit dispatcher/validity/criterion/job-analysis migration and execution-contract provenance regression | ADR-0001 | implemented_on_protected_main | ## 4. CWL integration traceability | External contract | Orgmetra owner boundary | Integration style | Required evidence | ADR | Maturity | |---|---|---|---|---|---| | Keyverse identity and authorization | API Gateway / purpose-bound authorization | Published OIDC/API identity and scope contract plus Orgmetra-owned `orgmetra_keyverse_adapter` policy evaluation | tenant/actor/resource agreement, exact opaque target-resource reference, purpose, operation-specific scope, requested-field minimization, opaque subject, no stored credentials or protected values in authorization evidence | ADR-0002, ADR-0008 | implemented_on_protected_main | -| naruon communication and calendar | Integration Hub | Published API/event adapter | idempotency, delivery audit, no direct table access | ADR-0002 | planned | +| Naruon calendar intent | Integration Hub | Published `/api/calendar/writeback-intent` intent adapter; provider execution remains Naruon-owned and out of this slice | purpose-bound human confirmation, exact contract/provenance validation, intent-only audit correlation, no provider execution or direct table access | ADR-0002, ADR-0010 | implemented_on_protected_main | | Psychometrics Commons @ `cc5850a0d1eacbbf16d03075534fce460a8286e6` | Workforce Validation | Immutable response/result snapshot contract | pinned revision, model/version/provenance snapshot, immutable result linkage, no direct application-table access | ADR-0002 | accepted_architecture | | fast-mlsirm @ `fb67ced09d8ee00542c05d56374537a9a7239751` | Workforce Validation | Published `orgmetra.fast_mlsirm.v1` result contract; direct calls only from approved offline validation worker | pinned revision, contract identifier, backend/result provenance, CPU/GPU parity evidence where material, no duplicated kernel | ADR-0002 | accepted_architecture | | TEPP temporal evidence | Workforce Validation | Published package/API contract | temporal provenance and version binding | ADR-0002 | planned | diff --git a/docs/adr/0006-governed-audit-outbox-envelope.md b/docs/adr/0006-governed-audit-outbox-envelope.md index bd86f2684..c9c88c6a9 100644 --- a/docs/adr/0006-governed-audit-outbox-envelope.md +++ b/docs/adr/0006-governed-audit-outbox-envelope.md @@ -1,6 +1,6 @@ # ADR-0006: Governed audit/outbox envelope and durable persistence -- **Status:** Accepted for the stacked implementation branch; not protected-main truth until merged. +- **Status:** Accepted on protected `develop`. - **Decision date:** 2026-08-17 - **Scope:** Orgmetra-owned audit envelope, immutable audit persistence, guarded outbox delivery state, tenant-safe atomic dispatcher claiming, expired-lease takeover, owner-bound completion/retry, database-budget-governed terminal dead-letter escalation, review hardening, and privileged recovery of an expired exhausted lease when its recorded final worker identity is permanently unavailable. Exponential retry policy, retention/export workflows, and external delivery receipts remain subsequent work. diff --git a/docs/adr/0007-governed-job-analysis-evidence.md b/docs/adr/0007-governed-job-analysis-evidence.md index f9aeea835..2a161d356 100644 --- a/docs/adr/0007-governed-job-analysis-evidence.md +++ b/docs/adr/0007-governed-job-analysis-evidence.md @@ -1,6 +1,6 @@ # ADR 0007: Governed job-analysis evidence snapshots -- Status: Accepted on stacked implementation branch +- Status: Accepted on protected `develop` - Date: 2026-08-17 - Owners: Orgmetra Job Analysis / Workforce Validation diff --git a/docs/adr/0009-performance-criterion-observation-scope.md b/docs/adr/0009-performance-criterion-observation-scope.md index 69baa87c9..f2a679005 100644 --- a/docs/adr/0009-performance-criterion-observation-scope.md +++ b/docs/adr/0009-performance-criterion-observation-scope.md @@ -1,6 +1,6 @@ # ADR 0009: Performance criterion observations require worker-job scope -Status: Accepted +Status: Accepted on protected `develop` ## Context diff --git a/docs/adr/0010-naruon-calendar-intent-boundary.md b/docs/adr/0010-naruon-calendar-intent-boundary.md index 6bed4dd49..155c623ce 100644 --- a/docs/adr/0010-naruon-calendar-intent-boundary.md +++ b/docs/adr/0010-naruon-calendar-intent-boundary.md @@ -2,7 +2,7 @@ ## Status -Accepted on active PR only. This document is not protected-`develop` product truth until its owning PR integrates. +Accepted on protected `develop`. ## Context diff --git a/docs/adr/0011-bitemporal-workforce-composition.md b/docs/adr/0011-bitemporal-workforce-composition.md index 7e9302870..a6a26bab6 100644 --- a/docs/adr/0011-bitemporal-workforce-composition.md +++ b/docs/adr/0011-bitemporal-workforce-composition.md @@ -2,7 +2,7 @@ ## Status -Accepted on active PR #33 only. This document is not protected-`develop` product truth until the owning PR integrates. +Accepted on protected `develop`. ## Context diff --git a/docs/adr/0012-governed-migration-handoff.md b/docs/adr/0012-governed-migration-handoff.md index ec9ab40f0..c1b99dc14 100644 --- a/docs/adr/0012-governed-migration-handoff.md +++ b/docs/adr/0012-governed-migration-handoff.md @@ -2,7 +2,7 @@ ## Status -Accepted on this active PR only. This is not protected-`develop` product truth until the owning PR integrates. +Accepted on protected `develop`. ## Context diff --git a/docs/adr/0013-governed-requisition-review-packet.md b/docs/adr/0013-governed-requisition-review-packet.md index 4f1e0b239..ba53dcc28 100644 --- a/docs/adr/0013-governed-requisition-review-packet.md +++ b/docs/adr/0013-governed-requisition-review-packet.md @@ -1,6 +1,6 @@ # ADR 0013: Governed requisition review packet -- Status: Accepted on active implementation branch +- Status: Accepted on protected `develop` - Date: 2026-08-18 - Owners: Talent Acquisition / Job Architecture / People Governance @@ -39,7 +39,7 @@ The packet cannot claim approval, open a requisition, create a candidate, or per - Routine `repr()` output does not disclose trust-bearing references or digests. - Requisition approval requires authoritative resolved-actor separation; two different opaque references alone cannot satisfy the hiring-manager/approver separation requirement. - Downstream persistence must still enforce purpose-bound authorization, idempotency, human approval, and immutable audit/outbox evidence at the authoritative mutation boundary. -- This ADR describes active-PR truth only until the corresponding exact head integrates into protected `develop`. +- This ADR records the protected `develop` requisition-review boundary; downstream approval and creation remain separate authorities. ## References diff --git a/docs/adr/0014-job-analysis-snapshot-persistence.md b/docs/adr/0014-job-analysis-snapshot-persistence.md index cef05e28f..e0a6b3c92 100644 --- a/docs/adr/0014-job-analysis-snapshot-persistence.md +++ b/docs/adr/0014-job-analysis-snapshot-persistence.md @@ -1,6 +1,6 @@ # ADR 0014: Persist governed job-analysis snapshots -- Status: Accepted on active implementation branch +- Status: Accepted on protected `develop` - Date: 2026-08-20 - Owners: Orgmetra Job Analysis / Workforce Validation diff --git a/docs/adr/0017-governed-offer-approval.md b/docs/adr/0017-governed-offer-approval.md index c662a0429..f2bf102f3 100644 --- a/docs/adr/0017-governed-offer-approval.md +++ b/docs/adr/0017-governed-offer-approval.md @@ -1,12 +1,12 @@ # ADR 0017: Governed offer approval evidence -- Status: Proposed — active PR only +- Status: Accepted on protected `develop` - Date: 2026-08-19 - Scope: Talent Acquisition offer review ## Context -Protected `develop` can govern candidate, requisition, selection, and employment evidence, but it does not yet expose a bounded pre-send contract proving that a proposed offer is tied to the selected candidate, authoritative Job/optional Position, reviewed selection decision, compensation-package provenance, offer-terms provenance, and accountable human approval. +Protected `develop` now exposes a bounded pre-send contract proving that a proposed offer is tied to the selected candidate, authoritative Job/optional Position, reviewed selection decision, compensation-package provenance, offer-terms provenance, and accountable human approval. Offer review is high-impact employment workflow. A governance envelope must not become an alternate decision authority, a salary-value cache, or a channel that lets generated/model material masquerade as an approved offer. Different opaque requester/approver references also do not prove that the authoritative actor boundary resolves them to different people, and UUID syntax does not prove that the referenced candidate, requisition, Job/Position, selection decision, compensation package, or offer terms belong to the packet tenant. Packet-owned UUIDv1 references also carry timestamp/node-derived correlation metadata. The authoritative tenant identifier is different: it is issued by Orgmetra core, so this leaf package must accept the canonical non-sentinel operational UUID contract owned by that boundary rather than silently imposing a second version policy. @@ -30,7 +30,7 @@ Canonical JSON and SHA-256 are audit-correlation evidence only. The packet does A buyer can review one deterministic, PII-minimized envelope before an offer moves to the authoritative offer workflow. Compensation values stay in their purpose-bound owner boundary, while Orgmetra keeps exact provenance references, evidence version, and human accountability. Packet-owned UUIDv1/non-v4 references fail closed before serialization without making this leaf package incompatible with authoritative Orgmetra tenant UUIDs. Cross-tenant evidence mixing is fail-closed at the host approval boundary because every packet reference must resolve in the exact tenant. Requester/approver separation is proven only after tenant-scoped authoritative actor resolution. New offer-review reason categories require an explicit contract change and regression evidence rather than accepting arbitrary caller text. -Downstream offer persistence/execution must independently enforce authorization, tenant-scoped source-evidence resolution, idempotency where applicable, and immutable audit/outbox evidence. This ADR remains proposed active-PR truth until integrated into protected `develop`. +Downstream offer persistence/execution must independently enforce authorization, tenant-scoped source-evidence resolution, idempotency where applicable, and immutable audit/outbox evidence. This ADR records the accepted protected-`develop` offer-review boundary; downstream execution remains a separate authority. ## References diff --git a/docs/adr/0025-governed-candidate-evidence-intake.md b/docs/adr/0025-governed-candidate-evidence-intake.md index ab66b3088..3c274884e 100644 --- a/docs/adr/0025-governed-candidate-evidence-intake.md +++ b/docs/adr/0025-governed-candidate-evidence-intake.md @@ -1,6 +1,6 @@ # ADR 0025: Govern candidate evidence intake as reference-only evidence -- **Status:** Proposed — active PR only +- **Status:** Accepted on protected `develop` - **Date:** 2026-08-19 ## Context @@ -40,7 +40,7 @@ Canonical JSON plus SHA-256 provide immutable audit correlation but do not estab - The packet does not store raw candidate evidence, decide whether an item is lawfully usable, or prove the referenced policy was followed. - UUID-backed tenant and candidate references are still sensitive correlating metadata and require least-privilege handling. - Evidence sealing, authoritative selection decisions, immutable audit/outbox, deletion/retention execution, export controls, accommodations, adverse-impact monitoring, and jurisdiction-specific legal review remain separate obligations. -- This ADR remains proposed until its exact PR head merges into protected `develop`. +- This ADR records the accepted protected-`develop` candidate-evidence intake boundary; later sealing, selection, retention, and legal-use obligations remain separate authorities. ## References diff --git a/docs/adr/README.md b/docs/adr/README.md index 099a21139..dcf692c4d 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -7,12 +7,14 @@ | [0003](0003-bitemporal-hris-data-contract.md) | Bitemporal HRIS data contract | Accepted | | [0004](0004-employment-position-version-and-assignment-binding.md) | Employment and position versions bind assignments | Accepted | | [0005](0005-exclusive-employment-and-staffable-seats.md) | Exclusive employment and staffable seats | Accepted | -| [0006](0006-governed-audit-outbox-envelope.md) | Governed audit/outbox envelope and durable persistence | Accepted on stacked implementation branch | -| [0007](0007-governed-job-analysis-evidence.md) | Governed job-analysis evidence snapshots | Accepted on stacked implementation branch | +| [0006](0006-governed-audit-outbox-envelope.md) | Governed audit/outbox envelope and durable persistence | Accepted on protected `develop` | +| [0007](0007-governed-job-analysis-evidence.md) | Governed job-analysis evidence snapshots | Accepted on protected `develop` | | [0008](0008-purpose-bound-pii-authorization.md) | Purpose-bound PII authorization | Accepted on protected `develop` | -| [0009](0009-performance-criterion-observation-scope.md) | Performance criterion observations require worker-job scope | Accepted on active implementation branch | -| [0010](0010-naruon-calendar-intent-boundary.md) | Naruon calendar intent boundary | Accepted on active implementation branch | -| [0011](0011-bitemporal-workforce-composition.md) | Bitemporal workforce composition | Accepted on active implementation branch | -| [0012](0012-governed-migration-handoff.md) | Governed migration handoff | Accepted on active implementation branch | -| [0013](0013-governed-requisition-review-packet.md) | Governed requisition review packet | Accepted on active implementation branch | -| [0014](0014-job-analysis-snapshot-persistence.md) | Persist governed job-analysis snapshots | Accepted on active implementation branch | +| [0009](0009-performance-criterion-observation-scope.md) | Performance criterion observations require worker-job scope | Accepted on protected `develop` | +| [0010](0010-naruon-calendar-intent-boundary.md) | Naruon calendar intent boundary | Accepted on protected `develop` | +| [0011](0011-bitemporal-workforce-composition.md) | Bitemporal workforce composition | Accepted on protected `develop` | +| [0012](0012-governed-migration-handoff.md) | Governed migration handoff | Accepted on protected `develop` | +| [0013](0013-governed-requisition-review-packet.md) | Governed requisition review packet | Accepted on protected `develop` | +| [0014](0014-job-analysis-snapshot-persistence.md) | Persist governed job-analysis snapshots | Accepted on protected `develop` | +| [0017](0017-governed-offer-approval.md) | Governed offer approval evidence | Accepted on protected `develop` | +| [0025](0025-governed-candidate-evidence-intake.md) | Govern candidate evidence intake as reference-only evidence | Accepted on protected `develop` | diff --git a/docs/doctoring/product-gap-baseline-references.md b/docs/doctoring/product-gap-baseline-references.md new file mode 100644 index 000000000..3e2c3fe51 --- /dev/null +++ b/docs/doctoring/product-gap-baseline-references.md @@ -0,0 +1,51 @@ +# Product-gap baseline references and applied boundaries + +Retrieved September 1, 2026. + +This doctoring note records the external sources re-checked while replacing `docs/product-technical-gap-baseline.md` and repairing its upstream governance assumptions. A citation is evidence for a design constraint, not certification, legal advice, merge authorization, or proof that an implementation satisfies the source. + +## Human-resource and selection governance + +International Organization for Standardization. (2023). *ISO 30405:2023 Human resource management—Guidelines on recruitment* (2nd ed.). https://www.iso.org/standard/79488.html + +American Educational Research Association, American Psychological Association, & National Council on Measurement in Education. (2014). *Standards for educational and psychological testing*. American Educational Research Association. + +### Applied boundary + +Orgmetra keeps recruitment/selection evidence reviewable and attributable, preserves job/evidence provenance, and keeps model output outside autonomous employment-decision authority. Criterion-related or fairness claims require exact predictor/criterion/version linkage and scientific evidence rather than a correlation-only product claim. These sources do not establish that a particular employment decision is lawful or valid. + +## Accessibility and customer interaction + +World Wide Web Consortium. (2023, October 5). *Web Content Accessibility Guidelines (WCAG) 2.2 is a W3C Recommendation*. https://www.w3.org/WAI/news/2023-10-05/wcag22rec/ + +### Applied boundary + +The P1 role-workspace release gate requires WCAG 2.2 AA-oriented evidence, including keyboard/focus behavior, touch-target and dragging alternatives, accessible authentication where applicable, consistent help/error semantics, exact-value alternatives for charts, responsive screenshots, and Storybook edge states. A design-token or wireframe document alone is not accessibility evidence. + +## Security, privacy and AI risk + +Joint Task Force. (2020). *Security and privacy controls for information systems and organizations* (NIST Special Publication 800-53 Rev. 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-53r5 + +Autio, C., Schwartz, R., Dunietz, J., Jain, S., Stanley, M., Tabassi, E., Hall, P., & Roberts, K. (2024). *Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile* (NIST AI 600-1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.600-1 + +### Applied boundary + +Orgmetra treats tenant/actor/purpose/resource authorization, immutable audit evidence, least privilege, retention/export/delete, recovery, provenance, and separately governed emergency access as executable control boundaries. Generative-AI output is supporting/draft evidence routed through the contextual-orchestrator boundary; it does not obtain authoritative HRIS write or employment-decision authority merely because a model response is structured. These NIST publications inform evidence readiness and risk management; they are not SOC 2, CSAP, or product certification claims. + +## GitHub protected-branch and dependency-review semantics + +GitHub. (n.d.). *Available rules for rulesets*. GitHub Docs. https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets + +GitHub. (n.d.). *REST API endpoints for dependency review*. GitHub Docs. https://docs.github.com/en/rest/dependency-graph/dependency-review + +GitHub. (n.d.). *Dependency graph*. GitHub Docs. https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-graph + +### Applied boundary + +The current one-human-maintainer governance decision uses the documented ability to set the generic required approving-review count to zero; it also disables latest-push approval because that rule requires approval from someone other than the latest pusher. The repair does **not** manufacture independence through bot/service-account approvals and does not weaken required review-thread resolution or deterministic required workflows. + +For Dependency Review, an HTTP failure from the exact dependency comparison is treated as missing authoritative evidence and fails closed. Independent OSV/Trivy/SAST/Scorecard evidence is retained but is not promoted to a semantic substitute for GitHub Dependency Review. + +## Traceability rule + +When any cited source changes an executable invariant, the owning PR must carry a regression/contract test and the relevant ADR/TRD/API/schema/UI evidence must be updated on the same exact head. If only the prose changes, the result remains documentation evidence rather than implemented product behavior. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md new file mode 100644 index 000000000..d8077a935 --- /dev/null +++ b/docs/product-technical-gap-baseline.md @@ -0,0 +1,161 @@ +# Product and technical gap baseline + +Verified: 2026-09-04 (Asia/Seoul) for Orgmetra protected/product refs. External owner-repository evidence is treated as dependency context and must be re-fetched in its canonical owner lane before mutation or release claims. + +This is Orgmetra’s durable commercialization baseline, not merge authorization and not a frozen PR inventory. Volatile PR heads, workflow-run IDs, queue states, reviews, mergeability and base tips are live GitHub truth and must be fetched again before every material action. + +## 1. Product thesis and buyer outcome + +Orgmetra is the ContextualWisdomLab HRIS/HCM system of record for authoritative People, Organization, Position, Assignment, Job Architecture, FJA/KSAO, Talent, Assessment and Workforce truth. Its buyer value is evidence-preserving decision infrastructure: what employment fact was true, when it was true, what evidence justified a high-impact decision, who acted, what purpose authorized access, and how later outcomes validate the original job/selection model. + +Primary users are HR operations owners, HRIS administrators, recruiters, hiring managers, job-analysis specialists, psychometricians/people-analytics scientists, compliance/audit reviewers, workers and enterprise integration engineers. + +The buyer lifecycle is Job requirements/evidence → Candidate evidence → accountable human selection/offer → authoritative worker/employment/assignment truth → job-relevant performance evidence → validation/fairness evidence → purpose-bound operational workflows. + +## 2. Truth-state contract + +| State | Meaning | +| --- | --- | +| **Shipped truth** | Present on protected `develop` with executable evidence. | +| **Active PR** | Implemented only on an open exact PR head; predecessor/sibling evidence does not transfer. | +| **Accepted architecture** | Accepted ADR/PRD/TRD boundary whose implementation is incomplete. | +| **Planned** | Prioritized buyer capability without executable production evidence. | +| **Research-only** | Experiment/evidence that must not be represented as product behavior. | +| **Superseded** | Replaced decision/evidence retained for provenance only. | +| **Out of scope** | Owned by another bounded context/repository or explicitly rejected. | + +A documentation-only design is never promoted to shipped truth. Merge, release, deployment and compliance claims require fresh exact-head evidence independently of this file. + +## 3. Domain ownership and context map + +Orgmetra owns authoritative HR domain truth. Specialist CWL systems are consumed through released/versioned contracts and ACLs; source copying, mutable-branch dependency and cross-service SQL are prohibited. + +| Bounded context | Orgmetra responsibility | Integration boundary | +| --- | --- | --- | +| `people_core` | person anchors, employment, assignments, compensation references, candidate-worker linkage | Keyverse provides identity, not HRIS truth | +| `organization_core` | legal/organization units, reporting relations, locations, positions | external organization identities are referenced, not copied wholesale | +| `job_architecture` | Jobs, tasks, FJA/KSAO evidence, qualification rules, SME approval, governed snapshots | ontology/contextual-orchestrator outputs are evidence/draft adapters | +| `talent_acquisition` | requisitions, candidates, interviews, decision-evidence sets, selection/offer governance | specialist assessment systems remain evidence owners | +| `performance_management` | cycles, criterion blueprints, observations, calibration | observations bind authoritative worker/job/time scope | +| `workforce_validation` | validity-study registry, exact predictor/criterion links, subgroup/drift evidence | fast-mlsirm/TEPP/Psychometrics Commons own specialist numerical/psychometric computation | +| `document_records` | canonical document/image metadata and immutable artifact references | document services remain adapters | +| `integration_hub` | idempotency, inbox/outbox, adapter state, migration/CDC boundary | peer systems remain behind versioned ACLs | +| `audit_provenance` | append-only audit/provenance evidence | no peer service silently becomes authoritative HRIS state | + +One physical PostgreSQL cluster may host multiple bounded contexts initially, but each context keeps an owned schema/role/migrations/access layer/contract. A shared physical database is not a Shared Kernel license. + +## 4. Current protected truth and owner stack + +Protected `develop` is `eb9757f8649aaad026a9865508d9aad50c1a7a4f`, produced by normal integration of PR #161. #161 is therefore no longer a mutable prerequisite. Its protected delta consolidates repository-owned quality workflows and pins repository runner selection to explicit `ubuntu-24.04` without weakening domain, PostgreSQL or repository validation gates. + +The selector repair did not resolve the wider Actions admission incident: exact-current-head #63/#64/#65 jobs still materialize with the intended `ubuntu-24.04` label but remain queued before checkout with no runner assigned. Treat this as runner admission evidence, not as evidence that the selector repair failed and not as justification for no-op retriggers or copying workflow bytes into feature branches. + +Current canonical owner order is: + +1. **#63 shared HRIS-kernel audit/runtime evidence** — Draft and mechanically mergeable over current protected `develop`. A current CodeRabbit suggestion to add Job Analysis source/test files to `manifest.json` was verified against `tests/validate_repository.py` and rejected: the canonical manifest requires exact equality to its `REQUIRED` path set, which intentionally excludes those two files. Adding them would create `extra_entries` and make validation fail. The review thread was resolved without source change. +2. **#64 generic People mutation runtime integrity** — Draft and mechanically mergeable over current protected `develop`; current product/security checks remain non-terminal. +3. **#65 purpose-bound authorization plus Job Analysis durable/runtime integrity** — Draft and mechanically mergeable over current protected `develop`. Its #210 request-edge invariant is retained after #161 adoption: exact built-in Authorization text → header length at most 8,199 → Bearer parsing → token length at most 8,192. #65 must consume #63 only after #63 reaches protected truth, then reacquire exact-head evidence. +4. **#163 explicit Assignment category** — valid buyer/domain delta retained, but still based on predecessor protected truth and currently non-mergeable against current `develop`. This is a repair/restack finding, not a close condition. After #63 and applicable #64/#65 integrations, #163 must non-force adopt resulting protected truth and reacquire every exact-head gate. +5. **#165 Assignment category correction/supersession** — Draft child of #163. Preserve its close → replacement → predecessor/replacement provenance delta until #163 integrates, then non-force restack/adopt protected truth and rerun all exact-head gates. + +Protected `develop` still does not make explicit primary-vs-concurrent-secondary Assignment classification shipped truth. Allocation, row order, Position identity and graph topology are not classification authority. + +There are no published Orgmetra GitHub releases as of this verification. Do not manufacture a release merely to clear the count. + +## 5. Effective GitHub governance + +Orgmetra’s effective default-branch control plane is inherited organization ruleset **18156473 — `CWL Central required workflows`**, active as of 2026-09-04. Current live parameters are: + +- one approving review required; +- stale reviews dismissed after push; +- review-thread resolution required; +- extra approval required for unattributed changes; +- merge and squash are the allowed merge methods; +- deletion and non-fast-forward protection are enabled; +- required workflows are `opencode-review`, `pr-review-merge-scheduler`, `security-scan`, `strix`, `sast-semgrep`, `noema-review`, and `codeql-pr`; +- `OrganizationAdmin/always` bypass is exposed. + +Routine bypass, self-approval, synthetic reviewer identity, gate weakening or treating model/bot review as the required human approval are not acceptable repair strategies. Central ruleset mutation remains owned by `ContextualWisdomLab/.github`; Orgmetra records the dependency and canary evidence but does not create a leaf workflow shim or copy central policy source. + +## 6. Commercialization gap register + +| Gap | Current evidence | Buyer consequence | Owner / next acceptance evidence | Priority | +| --- | --- | --- | --- | --- | +| **GOV-01 satisfiable protected admission** | inherited ruleset still requires one approval and exposes routine admin bypass | otherwise-GREEN work may be unable to progress normally, while bypass weakens auditability | canonical `.github` owner repair → live ruleset convergence → unchanged Orgmetra canary through ordinary path | **P0** | +| **RUN-01 Actions runner admission** | #161 selector/workflow consolidation is protected truth; current #63/#64/#65 jobs carry `ubuntu-24.04` yet remain pre-checkout with no runner | exact-head product/security evidence remains unavailable | central/repository Actions admission RCA; unchanged candidate must materially execute rather than no-op retrigger | **P0 evidence** | +| **SEC-01 authoritative Dependency Review** | required central workflow remains owner-controlled; substitutes cannot prove dependency diff | merge evidence can be incomplete or misleading | immutable released central workflow + authenticated exact comparison + material pinned action execution | **P0** | +| **REL-01 integrated release evidence** | no published release and no single integrated protected head proves the full buyer/security/operability gate set | buyers cannot install/deploy a supported release | causal owner integration → protected-head release checklist → version/CHANGELOG/tag/package/SBOM/provenance/reproducibility/rollback | **P0** | +| **AUTH-01 purpose-bound authorization/durable trust boundary** | #65 retains exact tenant/resource/purpose/operation/scope/field narrowing, exact runtime validation, decision revalidation, durable Job Analysis integrity and #210 request budget; still Active PR | remote/request/plugin-controlled data must not become HR policy authority or executable evidence before validation | #63 protected integration → #65 non-force protected adoption → exact-head product/PostgreSQL/security/review evidence → normal integration | **P1 security foundation** | +| **ASG-01 explicit Assignment authority** | #162/#163 retain explicit `primary | concurrent_secondary`; `legacy_unspecified` is historical/restoration provenance; #163 is currently behind/conflicting with current protected truth | employee profile/reporting/authorization/graph consumers otherwise have to guess authoritative membership | integrate #63/#64/#65 as applicable → non-force adopt protected truth into #163 → PostgreSQL/API/OpenAPI/idempotency/bitemporal evidence → ordinary integration | **P1 buyer truth** | +| **ASG-02 auditable Assignment correction** | #164/#165 retain immutable predecessor closure, replacement and normalized supersession provenance | HR operations cannot safely correct misclassification without rewriting history or losing provenance | #163 protected integration → #165 non-force restack/adoption → exact-head People/PostgreSQL/idempotency/security/review evidence → ordinary integration | **P1 buyer truth** | +| **UX-01 role workspaces** | PRD/wireframe/design foundations exist; buyer-facing executable workspace evidence is not yet sufficient for a release claim | buyer lifecycle is not yet proven end-to-end through a coherent UI | Job Architecture → Candidate Evidence → Hiring Decision → Employee Profile → Validation vertical slice; Storybook/current-head E2E/a11y/i18n/edge-state evidence | **P1** | +| **API-01 deployable gateway/composition** | service/package contracts exist but no released integrated application boundary is available | integrations lack one supported deployment contract | async gateway, generated OpenAPI validation, purpose/idempotency, service-owned persistence, contract/load/recovery tests | **P1** | +| **VAL-01 governed validation workflow** | normalized validity/evidence architecture exists and scientific compute ownership remains external | people-analytics buyer cannot yet run the complete predictor→criterion→fairness workflow | exact immutable snapshots through released fast-mlsirm/TEPP/Psychometrics Commons contracts; reproducibility/error evidence | **P1** | +| **OPS-01 commercial operability/SLO** | operability/test contracts exist; no released integrated web service proves buyer traffic/recovery characteristics | enterprise buyer lacks capacity/recovery evidence | Podman/Colima → compose/k8s path, async handling, clean connection lifecycle, recovery rehearsal, k6 buyer-path p95 ≤20 ms | **P1** | +| **SEC-02 certification-ready control evidence** | purpose-bound PII/RLS/audit architecture exists; certification is not claimed | security review still requires operational control evidence | NIST/SOC 2/CSAP mapping, key/retention/export/delete/break-glass/incident/recovery evidence | **P1** | +| **DATA-01 schema/persistence audit** | strong bitemporal/tenant foundations exist; every new migration can still introduce naming, lock, hot-partition or idempotency drift | latent data debt becomes expensive after adoption | automated naming/3NF/ownership/UPSERT/idempotency/partition-lock audit | **P1 continuous** | +| **SCI-01 Rust scientific compute boundary** | HRIS domain code is not itself a reason to move into Rust; material math/psychometrics/EDA kernels remain Rust-first by architecture | future analytics could regress into slow or unauditable numerics | Rust API for material kernels, bounded CPU parallelism, justified GPU parity and true-parameter recovery evidence | **P1 continuous** | + +## 7. Next buyer-visible product loop + +After P0 governance/execution prerequisites are materially runnable, the next commercial slice should be **Job Architecture → Candidate Evidence → Hiring Decision → Employee Profile → Validation**, not another isolated evidence packet. + +Minimum acceptance: + +1. authenticated tenant/actor/purpose context, idempotency and exact OpenAPI validation at the gateway; +2. governed Job snapshot provenance, SME review and qualification rules; +3. immutable Candidate Evidence references with insufficiency/escalation states and no autonomous hiring decision; +4. human-confirmed Hiring Decision bound to an exact sealed evidence set and candidate-worker conversion; +5. bitemporal Employee Profile with explicit Assignment category and correction provenance; +6. Validation with exact predictor/criterion versions, Job scope, time and subgroup/multilevel context; +7. material UI evidence for normal/loading/empty/error/permission/responsive/keyboard/touch/focus/i18n states in KO/EN/JA/ZH/VI/ES/DE/FR, including CJK/text expansion/font fallback; +8. operability/recovery/load evidence against production-equivalent PostgreSQL and real buyer paths rather than reduced samples or unrealistic warm-cache exclusions. + +UI work must use reusable objects/page composition and product design evidence rather than template filler. Keyverse remains identity backend; authentication journey remains product form. Translation resources are versioned DB resources with screen-key cache and remain separate from ontology-label truth. + +## 8. Data, scientific and AI invariants + +- DDD subdomains, bounded contexts, UL, aggregates, entities, value objects, domain services, repositories, events and invariants must agree across code/API/DB/tests. +- Relational authoritative truth remains normalized; read models are separated explicitly when measured need justifies them. +- Tenant, bitemporal, lock/partition and item-level UPSERT/idempotency contracts are tested at database boundaries. +- Multiple assignments/memberships and time-varying context remain representable; person-level inference must not silently commit atomistic fallacy. +- Material mathematical/psychometric/EDA/vector/linear/matrix/token-size computation is Rust-first with bounded CPU parallelism and justified GPU parity. +- Psychometric acceptance uses true-parameter recovery, RMSE, bias, coverage and reproducibility. Synthetic data is unit-test evidence, not real-world acceptance. +- LLM output is draft/supporting evidence only. LLM work consumes released contextual-orchestrator API/client/schema contracts; GitHub Actions request only `orchestrator/free` through the gateway token and do not hard-code provider/model/group/paid fallback policy. Capability absence fails closed and is repaired in the canonical orchestrator owner. + +## 9. Security, privacy and compliance posture + +Orgmetra targets evidence readiness for CSAP/SOC 2-style enterprise review without claiming certification. PII controls are purpose-bound and operationally usable: tenant/actor/purpose/resource/lifetime authorization, least privilege, forced RLS where applicable, encryption, immutable audit evidence, retention/export/delete lifecycle, incident/recovery evidence and separately governed break-glass operation. + +Customer-facing language describes the user’s next action and evidence state, not internal repository/schema/model/agent boundaries. + +## 10. Research and standards basis + +These sources define design/audit constraints; they do not certify Orgmetra or establish legal compliance by citation alone. Implementation-specific citations and invariants belong in `docs/doctoring/`, ADRs and traceability records beside the code/test they constrain. + +- International Organization for Standardization. (2023). *ISO 30405:2023 Human resource management—Guidelines on recruitment* (2nd ed.). https://www.iso.org/standard/79488.html +- International Organization for Standardization, & International Electrotechnical Commission. (2025). *ISO/IEC 40500:2025 Information technology—W3C Web Content Accessibility Guidelines (WCAG) 2.2* (2nd ed.). https://www.iso.org/standard/91029.html +- World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ +- Joint Task Force. (2020). *Security and privacy controls for information systems and organizations* (NIST Special Publication 800-53 Rev. 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-53r5 +- National Institute of Standards and Technology. (2025, August 27). *NIST releases revision to SP 800-53 security and privacy controls (Release 5.2.0)*. https://csrc.nist.gov/news/2025/nist-releases-revision-to-sp-800-53-controls +- Autio, C., Schwartz, R., Dunietz, J., Jain, S., Stanley, M., Tabassi, E., Hall, P., & Roberts, K. (2024). *Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile* (NIST AI 600-1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.600-1 +- American Educational Research Association, American Psychological Association, & National Council on Measurement in Education. (2014). *Standards for educational and psychological testing*. American Educational Research Association. + +A source citation without an executable invariant/test is documentation evidence only. + +## 11. Release gate + +A commercial release is allowed only from one freshly fetched protected `develop` head that simultaneously proves: + +- release-scope dependencies integrated in causal order; +- no unresolved valid review finding; +- every required exact-head deterministic gate terminal-success, including authoritative Dependency Review rather than substitutes; +- satisfiable protected-branch admission without synthetic approval or routine admin bypass; +- buyer vertical-slice E2E, accessibility, security, recovery and load evidence terminal-success; +- migrations/rollback/backup-restore and tenant/purpose/audit invariants against production-equivalent PostgreSQL; +- documentation/ADR/TRD/API/events/schema/UI copy matching released implementation; +- release version and CHANGELOG bound to the exact protected commit and migration/API compatibility; +- immutable package/release plus SBOM/provenance/reproducibility/rollback evidence; and +- no temporary purpose-complete self-modifying/source-fix workflow. + +Until this evidence exists, version `0.1.0` and zero published releases are correctly treated as pre-commercial integration state rather than a release-management defect to paper over. \ No newline at end of file diff --git a/docs/traceability/candidate-evidence-intake.md b/docs/traceability/candidate-evidence-intake.md index 62955813c..c3dfa8b04 100644 --- a/docs/traceability/candidate-evidence-intake.md +++ b/docs/traceability/candidate-evidence-intake.md @@ -1,6 +1,6 @@ # Candidate evidence intake traceability -- **Maturity:** `implemented_on_active_pr` +- **Maturity:** `implemented_on_protected_main` - **Buyer capability:** Candidate Evidence workspace governance boundary - **Owned contract:** `CandidateEvidenceIntakePacket` diff --git a/docs/traceability/migration-handoff.md b/docs/traceability/migration-handoff.md index 27ec3f113..d09f2f87a 100644 --- a/docs/traceability/migration-handoff.md +++ b/docs/traceability/migration-handoff.md @@ -2,7 +2,7 @@ ## Status -Active-PR only. This evidence does not describe protected-`develop` product truth until the owning PR integrates. +Implemented on protected `develop`; this remains a pre-write handoff boundary rather than a migration executor. | Requirement | Decision / owner contract | Production implementation | Executable evidence | |---|---|---|---| diff --git a/docs/traceability/naruon-calendar-intent.md b/docs/traceability/naruon-calendar-intent.md index 790447641..f1e15676a 100644 --- a/docs/traceability/naruon-calendar-intent.md +++ b/docs/traceability/naruon-calendar-intent.md @@ -2,7 +2,7 @@ ## Status -Active-PR only. This evidence does not describe protected-`develop` product truth until the owning PR integrates. +Implemented on protected `develop`; Naruon remains the owner of provider execution. | Requirement | Decision / contract | Production implementation | Executable evidence | |---|---|---|---| diff --git a/docs/traceability/offer-approval.md b/docs/traceability/offer-approval.md index 5104cfb8d..8da33aabe 100644 --- a/docs/traceability/offer-approval.md +++ b/docs/traceability/offer-approval.md @@ -1,6 +1,6 @@ # Governed offer approval traceability -Status: **active PR / proposed capability**, not protected-main truth. +Status: **implemented on protected `develop`**; downstream offer persistence/execution remains a separate authority. | Buyer requirement | Executable evidence | Contract outcome | | --- | --- | --- | diff --git a/docs/traceability/requisition-review.md b/docs/traceability/requisition-review.md index ca9bfe0ec..6d0ff6391 100644 --- a/docs/traceability/requisition-review.md +++ b/docs/traceability/requisition-review.md @@ -2,7 +2,7 @@ ## Maturity -**Active PR only.** Protected `develop` does not contain this capability until the candidate branch is integrated with fresh protected-head evidence. +**Implemented on protected `develop`.** This packet remains review evidence rather than an authoritative requisition or approval. ## Requirement-to-evidence map diff --git a/docs/traceability/workforce-composition.md b/docs/traceability/workforce-composition.md index c33c5ca0d..014e29a49 100644 --- a/docs/traceability/workforce-composition.md +++ b/docs/traceability/workforce-composition.md @@ -2,7 +2,7 @@ ## Status -Active-PR only. This evidence does not describe protected-`develop` product truth until PR #33 integrates. +Implemented on protected `develop`; the aggregate boundary remains descriptive and does not make employment decisions. | Requirement | Decision / contract | Production implementation | Executable evidence | |---|---|---|---| diff --git a/manifest.json b/manifest.json index 97f2bab14..40bdab29f 100644 --- a/manifest.json +++ b/manifest.json @@ -1 +1 @@ -{"package":"orgmetra-foundation-pack","version":"0.1.0","generated_for_branch":"feat/audit-outbox-envelope","files":[{"path":".github/workflows/foundation-ci.yml","sha256":"12686a3bbd6445e6fdb202b4137dae118ddeeab1efb0c7f18ea6c8fa19d62537","bytes":4379,"lines":123},{"path":".github/workflows/job-analysis-api-quality.yml","sha256":"352dc78931dd94afea3e88912d38dcc4b562a004112f199f3d7a12d22b6d637a","bytes":4159,"lines":105},{"path":".gitignore","sha256":"145fda644f5209fa1fb3e3b40c9af9258bfac6d1a634bba2520fd08fe6d77a21","bytes":375,"lines":37},{"path":"AGENTS.md","sha256":"28f7b7bc010a7739cfdc3e793fb5d39a0e74b842ea9c190e9a251e2d0cbc3a16","bytes":2246,"lines":34},{"path":"ARCHITECTURE.md","sha256":"52d68786f7359c1a50d804996021e4c70e90accd2fff6f1a27c91de1dd8df850","bytes":7864,"lines":107},{"path":"CHANGELOG.md","sha256":"32cc4ef78d1eca557fa01731026840be01211a043eb0ada552e4e6cb9eace353","bytes":17295,"lines":76},{"path":"CLAUDE.md","sha256":"add33884f466d324e20875388d103de41c6e062938a6e98727dc83a87ffe976f","bytes":1229,"lines":20},{"path":"LICENSE","sha256":"cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30","bytes":11358,"lines":202},{"path":"NOTICE","sha256":"34b4618e946bdd8d33407d6ac5279f0a0388f5e7c8f79d2e7d8c3c47d0266042","bytes":305,"lines":4},{"path":"README.md","sha256":"1a9fc400d26d8137ae5911488794a6d3fa915957c95f27b36a48cef0fdf823c6","bytes":3785,"lines":81},{"path":"database/migrations/0001_foundation_schema.sql","sha256":"ce2ae52fc66b2f99597ea5285df82c66f90caa46174fef4930d68a8b6177d0dd","bytes":38747,"lines":916},{"path":"database/migrations/0002_sealed_evidence_digest.sql","sha256":"93d659ca8e0e9293a83d5422d043be7b1022c5470a5b22670aa3416fa334a04c","bytes":6649,"lines":202},{"path":"database/migrations/0003_audit_outbox_persistence.sql","sha256":"2aa7bbb8220923ec584537c0cd46f0cba2b692d69d431f097b7df6db75235bfc","bytes":15417,"lines":423},{"path":"database/migrations/0004_outbox_delivery_claim.sql","sha256":"d4504acf7d58528a2a8f4f03d1584b868c8d3ba9046a007b9c2e7cfef993b2ef","bytes":9451,"lines":234},{"path":"database/migrations/0005_outbox_delivery_finalization.sql","sha256":"b7e8790595b288f752d6ef5cc6cbfe4e1b6712248f5b7a3a25fa60016b6a4961","bytes":6125,"lines":170},{"path":"database/migrations/0006_outbox_delivery_dead_letter.sql","sha256":"c1fb91cdf98169fd6684984e86cb0a14fa19c8f1226028d2346a2a069df2b3c7","bytes":24919,"lines":628},{"path":"database/migrations/0007_outbox_retry_exhaustion.sql","sha256":"812f50d70ca5929c7eba964d34a208aedee660d11cc7ffc09d67688c4737e0d5","bytes":19081,"lines":476},{"path":"database/migrations/0008_audit_outbox_review_hardening.sql","sha256":"c3713a12db9d00fdc10005df1f86c07965e9555eefad78ca67e994537a739d9b","bytes":17562,"lines":448},{"path":"database/migrations/0009_candidate_worker_conversion_governance.sql","sha256":"4030666629a6b8deb383b8337ead4f09d6a945969313def2577a38f31f06cda9","bytes":11537,"lines":281},{"path":"database/migrations/0010_validity_study_case_integrity.sql","sha256":"3f594810ac9e1a6747a2bb4838e5ce65b921cb6e3d36fcdc3ff08b4a7579ebd1","bytes":11979,"lines":313},{"path":"database/migrations/0011_criterion_observation_scope.sql","sha256":"f9fe7c35f1ee7b167e1c2ba75a50a84febda9a6ccf8123b4f5726f51968694f9","bytes":7444,"lines":165},{"path":"database/migrations/0012_people_mutation_idempotency.sql","sha256":"52dbbb9ec7f9be5291593ba88f228d7fffd736dcb99547a08c1d6cad076afb69","bytes":3162,"lines":76},{"path":"database/migrations/0013_job_analysis_snapshot.sql","sha256":"b6553a5a4c94c4aa9f341a474e13bbe34db63044eda2446b3ebee178995977ee","bytes":12713,"lines":260},{"path":"docs/API_CONTRACT.md","sha256":"63533dff785da62b89e585d742a158e2aeb05913644f2bf9fb6486f281c2e589","bytes":4555,"lines":76},{"path":"docs/DATA_MODEL.md","sha256":"6ad29731ae7ee7aa5bf3a2d0bfef88894a35a2550edb2be3244d6f143d76444a","bytes":13366,"lines":85},{"path":"docs/ERD.md","sha256":"546001aa85c4fe020e0c39d881dc860daf7f69090596666fdf9092487b0725fe","bytes":6964,"lines":70},{"path":"docs/OPERABILITY.md","sha256":"82b2d3e70cec371ef35e9e0f982ac40fef84351976bc04b863b81d27023d5a62","bytes":11189,"lines":71},{"path":"docs/PRD.md","sha256":"3ad85ae633cce0fc7a93af39b21d7a7c70bb2efa786da6b12f3c5327906e34f1","bytes":5490,"lines":111},{"path":"docs/SECURITY.md","sha256":"01918512d8882060e9cff0c4aa8206e0eccbdfb61cfd7f829331123c7a9fe6ac","bytes":11185,"lines":64},{"path":"docs/STORYBOARD.md","sha256":"6e4ffb0eb03a80343f50d363ffc43b34da9348a44232dd947a9ff416ea92a3d2","bytes":1342,"lines":28},{"path":"docs/STORYBOOK.md","sha256":"82f79029b3c2b7a45393bad5ba8fabe61014d4b6149c7d4e73f70ba447f885e9","bytes":1389,"lines":50},{"path":"docs/TEST_STRATEGY.md","sha256":"d0a0bc3b54ed0fc7973747987f1afb117d6144c390b51ed9370eb571972a33f8","bytes":16534,"lines":135},{"path":"docs/THREAT_MODEL.md","sha256":"f314f375c2e41252536de224c7bc7e4a10ab8f340cb86642724e7399e32f4252","bytes":6736,"lines":23},{"path":"docs/TRACEABILITY.md","sha256":"dbf6fd91375ea28e05456d2a0c9ba629506cbac6f52f5dfda61ae68db2395f7e","bytes":11462,"lines":40},{"path":"docs/TRD.md","sha256":"23697d88a4882698e1a2782b7da3f2ccd0d3cd2d6d1bffe89b6597dc16851077","bytes":9064,"lines":101},{"path":"docs/UML.md","sha256":"fe67c37aa88e5814ceb2db7e8f7d8d85ca27a994802efbb7c75164b387adf0a9","bytes":5528,"lines":122},{"path":"docs/USER_STORIES.md","sha256":"5535b39d8c71a36c81f78e2d6dbd90a2d32e6541790f0d28f6dd4baf3ea7b45f","bytes":2670,"lines":37},{"path":"docs/WIREFRAMES.md","sha256":"b03aa6419aeaf5d42a5698c4d43a434c1633b7ac6fd0b0bd0cda979077adc56e","bytes":2005,"lines":77},{"path":"docs/adr/0001-orgmetra-authoritative-hris-record.md","sha256":"0f8055b73c63d3130321415ad53233588ff952aabd1a88952b39c71747253572","bytes":6108,"lines":53},{"path":"docs/adr/0002-federated-cwl-integration-boundaries.md","sha256":"b77165f2aacfa6f4fde994baf77d5879c6da3e8dae4fd2db0ed912d60ae9b3b2","bytes":4072,"lines":44},{"path":"docs/adr/0003-bitemporal-hris-data-contract.md","sha256":"d7f2660616622c1a7994b28aa66d99d13836bcf755735595f9609a41282ab799","bytes":4453,"lines":47},{"path":"docs/adr/0004-employment-position-version-and-assignment-binding.md","sha256":"fee89e700414abe0b1cffec2acc687e5e014634db8f5ef9e8a92abba5c3cf182","bytes":1872,"lines":30},{"path":"docs/adr/0005-exclusive-employment-and-staffable-seats.md","sha256":"10f0eb409f4fa32d2c5bed2d583d8b43be8e61b5cbef0e927e5bebb5f5c8f85b","bytes":2091,"lines":34},{"path":"docs/adr/0006-governed-audit-outbox-envelope.md","sha256":"827298ddd997b47f78a89e89911ad8ea72e517b7714303637f0329b8cb52cabd","bytes":14100,"lines":66},{"path":"docs/adr/0007-governed-job-analysis-evidence.md","sha256":"953c6d2b9864a78b461b576092ec3f198f0b76709eaaaf7d0ed0182f95182c52","bytes":5653,"lines":57},{"path":"docs/adr/0008-purpose-bound-pii-authorization.md","sha256":"c5157d3bc58f3d8d29e03104dd15eb2911cc1bb66e2c92a935b26d7164648dc7","bytes":5988,"lines":55},{"path":"docs/adr/0009-performance-criterion-observation-scope.md","sha256":"1ac10bb2747b0a5b4d62f627825cfd7f978f3fa88d7575bffc23d56371240a64","bytes":7057,"lines":57},{"path":"docs/adr/0010-naruon-calendar-intent-boundary.md","sha256":"3e1050a964cc4ed76a1a0cf1e699ae5080acf8c9336f0decdd6d5229359db3c9","bytes":3917,"lines":35},{"path":"docs/adr/0011-bitemporal-workforce-composition.md","sha256":"1656ef8b57c836ef7936a8e9cb6a824681eb7563157a1ab0a29deb25849a457b","bytes":5568,"lines":53},{"path":"docs/adr/0012-governed-migration-handoff.md","sha256":"713855d670001d3964ecb36cc653830502fb1d82a58b9e39f564b6992dd2bd80","bytes":5965,"lines":59},{"path":"docs/adr/0013-governed-requisition-review-packet.md","sha256":"70bf2cbdf903a8793d6d8bc116a08331931090118341f42010236e09c6cc1802","bytes":4693,"lines":46},{"path":"docs/adr/0014-job-analysis-snapshot-persistence.md","sha256":"a7ab6fee50aaa63f7f407516a4cb39885faeb0fc6e5035ee8fc352ed73430105","bytes":5365,"lines":49},{"path":"docs/adr/README.md","sha256":"f3b3b5ed3b3b31a40a0a3696abf0065e3c25879b6be50077f38ffae742b9d002","bytes":1838,"lines":18},{"path":"docs/doctoring/REFERENCES.md","sha256":"929f7ee36df16279f028f726fcf039982180deb377746fe3804f3c0d090778d5","bytes":6352,"lines":69},{"path":"docs/superpowers/plans/2026-08-15-orgmetra-foundation-implementation-plan.md","sha256":"b64f21abb19373e780db8b9e64deb8ba9a6219ccf9625a651f25407b8691fcbd","bytes":8227,"lines":226},{"path":"docs/superpowers/specs/2026-08-15-orgmetra-foundation-design.md","sha256":"4a0e1a7943e40d12bd3082db3757045b4085e5a089fea7bc0d8a1565ffcbcf1d","bytes":6237,"lines":187},{"path":"package.json","sha256":"59ae9e3e67c3fba9320cb18439692395cdfd16ae5c24e3c4cf30d77d63ebabb5","bytes":388,"lines":9},{"path":"packages/hris-kernel/src/orgmetra_hris_kernel/audit.py","sha256":"3e5b7190cf857dc8c1fc7e898cef303060f34aabee6c27a9034d4d9650e33190","bytes":7707,"lines":160},{"path":"packages/hris-kernel/tests/test_audit_outbox.py","sha256":"5928dd7b97fe38d6b7472ce62966437e339058a59c3b301a93a7b5c05432b40c","bytes":7556,"lines":200},{"path":"schemas/openapi.yaml","sha256":"09c1e43486779198574fe31b8bcabbd1c1f74beec7bf86245ae578061619838f","bytes":29503,"lines":1020},{"path":"scripts/foundation-contract-core.mjs","sha256":"595e8381dbd62e97093b11eef818af5f04d6473ac592d57e3985ffbc2210d445","bytes":28173,"lines":689},{"path":"scripts/foundation-contract.mjs","sha256":"5242dcdbe0935775edf074462c82600e9bc4927d9fdc50c47727af915fd4b23a","bytes":218,"lines":6},{"path":"tests/dispatcher-inventory.test.mjs","sha256":"09f5e64410e6b7a26bf8d6ce61c50b737da2ea85d955f91eba63aa21f1537261","bytes":1597,"lines":34},{"path":"tests/foundation-contract.test.mjs","sha256":"960306fd7cda7b982a52c4428a432d10a4f570430a5d39fb23aeca0b2ede0615","bytes":14860,"lines":386},{"path":"tests/openapi-contract.test.mjs","sha256":"80c1610ef1c189fa325e55389501e0e51531ddf61ee335bb94d9cb3aa55a9fdc","bytes":6438,"lines":195},{"path":"tests/test_audit_outbox_hardening_postgres.sh","sha256":"518ba2f37ba6292943e5abe22c2599452b2f031a42e453b2493aedf8714421a0","bytes":13396,"lines":333},{"path":"tests/test_audit_outbox_postgres.sh","sha256":"e57a04920a0ba97fa6a06752d15ea150016ab8d44099e998c5c4f4067592b4d2","bytes":13443,"lines":357},{"path":"tests/test_bitemporal_postgres.sh","sha256":"7684b8c2ff52c044c081135515bd5aabbfd00e2daad0d471b0868701af2df6cc","bytes":8209,"lines":230},{"path":"tests/test_candidate_worker_conversion_postgres.sh","sha256":"681cb74d6cfa859ed92c6c2439881ea20c430ef8df94ec662e2807761a377f90","bytes":14673,"lines":344},{"path":"tests/test_criterion_observation_scope_postgres.sh","sha256":"0ee9539ee57f840c27d08009f7868cdc8662669df78a01dbc8be39216b8f1a3d","bytes":17811,"lines":469},{"path":"tests/test_evidence_sealing_postgres.sh","sha256":"57d16b632a0c60ffdcb4842ceb1cfe25d19c54cefeeefb622ff4fa6e83441ad7","bytes":11349,"lines":370},{"path":"tests/test_job_analysis_snapshot_postgres.sh","sha256":"ca9c323a1dd68cfc520277efbbb7495e37fb3ca027890928c8624e5b4f57403f","bytes":13542,"lines":296},{"path":"tests/test_operational_uuid_postgres.sh","sha256":"7378f98f0d4b3000e8ea641d8701f1540dbad71410b3637d81d799969e0f6ff7","bytes":3346,"lines":101},{"path":"tests/test_outbox_claim_postgres.sh","sha256":"1027806d436ebfe34e108c25b6a4001f43b9550f1d70057c6c0d7974323b0c9b","bytes":14817,"lines":429},{"path":"tests/test_outbox_dead_letter_postgres.sh","sha256":"0d728d578e64252e6079f2d141ddaa7fa9cfbf9784e625832273596d69a6e13d","bytes":14008,"lines":377},{"path":"tests/test_people_mutation_idempotency_postgres.sh","sha256":"3f57e12f80bd1b034c9aac54b669d8530106e3e26b3795689671fb53807b3cd5","bytes":16191,"lines":381},{"path":"tests/test_tenant_isolation_postgres.sh","sha256":"dd649435ef8ab9e57f0609c101917e36656a6d40d63de9bcdbdac23d764f6c3a","bytes":15134,"lines":388},{"path":"tests/test_validity_study_case_postgres.sh","sha256":"0070ad58300323c7f9900c5645e0df3106b36ccd245ae686e982c2fd6fa4dc02","bytes":14708,"lines":301},{"path":"tests/validate_repository.py","sha256":"918cf92fd18d81572e9bd5f5daa7f033c32731e2e13f0d00661d1c1de30b12a9","bytes":27291,"lines":638}]} +{"package":"orgmetra-foundation-pack","version":"0.1.0","generated_for_branch":"feat/audit-outbox-envelope","files":[{"path":".github/workflows/foundation-ci.yml","sha256":"12686a3bbd6445e6fdb202b4137dae118ddeeab1efb0c7f18ea6c8fa19d62537","bytes":4379,"lines":123},{"path":".github/workflows/job-analysis-api-quality.yml","sha256":"352dc78931dd94afea3e88912d38dcc4b562a004112f199f3d7a12d22b6d637a","bytes":4159,"lines":105},{"path":".gitignore","sha256":"46fbdd18f514f680ec88cd5c77d765094beff78b2919d5089f30c985015e05be","bytes":462,"lines":40},{"path":"AGENTS.md","sha256":"d968907ee765f78c55683f19d478d8f05cd068de463d07fc5cf4cfde0099eb51","bytes":2358,"lines":34},{"path":"ARCHITECTURE.md","sha256":"52d68786f7359c1a50d804996021e4c70e90accd2fff6f1a27c91de1dd8df850","bytes":7864,"lines":107},{"path":"CHANGELOG.md","sha256":"416cdb7898d24dd265790b2ba62c47e8e20dafc737371b754ef1a53f900f63e9","bytes":17470,"lines":76},{"path":"CLAUDE.md","sha256":"a121e79f799361b4b2b01328f42df29da9f7746484e3dc7b01e6495d7fc6f33c","bytes":1566,"lines":21},{"path":"LICENSE","sha256":"cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30","bytes":11358,"lines":202},{"path":"NOTICE","sha256":"34b4618e946bdd8d33407d6ac5279f0a0388f5e7c8f79d2e7d8c3c47d0266042","bytes":305,"lines":4},{"path":"README.md","sha256":"c5d656b223df3059d0e31fff8c44322000debf925295281d0b1ea17421f0814e","bytes":3889,"lines":81},{"path":"database/migrations/0001_foundation_schema.sql","sha256":"ce2ae52fc66b2f99597ea5285df82c66f90caa46174fef4930d68a8b6177d0dd","bytes":38747,"lines":916},{"path":"database/migrations/0002_sealed_evidence_digest.sql","sha256":"93d659ca8e0e9293a83d5422d043be7b1022c5470a5b22670aa3416fa334a04c","bytes":6649,"lines":202},{"path":"database/migrations/0003_audit_outbox_persistence.sql","sha256":"2aa7bbb8220923ec584537c0cd46f0cba2b692d69d431f097b7df6db75235bfc","bytes":15417,"lines":423},{"path":"database/migrations/0004_outbox_delivery_claim.sql","sha256":"d4504acf7d58528a2a8f4f03d1584b868c8d3ba9046a007b9c2e7cfef993b2ef","bytes":9451,"lines":234},{"path":"database/migrations/0005_outbox_delivery_finalization.sql","sha256":"b7e8790595b288f752d6ef5cc6cbfe4e1b6712248f5b7a3a25fa60016b6a4961","bytes":6125,"lines":170},{"path":"database/migrations/0006_outbox_delivery_dead_letter.sql","sha256":"c1fb91cdf98169fd6684984e86cb0a14fa19c8f1226028d2346a2a069df2b3c7","bytes":24919,"lines":628},{"path":"database/migrations/0007_outbox_retry_exhaustion.sql","sha256":"812f50d70ca5929c7eba964d34a208aedee660d11cc7ffc09d67688c4737e0d5","bytes":19081,"lines":476},{"path":"database/migrations/0008_audit_outbox_review_hardening.sql","sha256":"c3713a12db9d00fdc10005df1f86c07965e9555eefad78ca67e994537a739d9b","bytes":17562,"lines":448},{"path":"database/migrations/0009_candidate_worker_conversion_governance.sql","sha256":"4030666629a6b8deb383b8337ead4f09d6a945969313def2577a38f31f06cda9","bytes":11537,"lines":281},{"path":"database/migrations/0010_validity_study_case_integrity.sql","sha256":"3f594810ac9e1a6747a2bb4838e5ce65b921cb6e3d36fcdc3ff08b4a7579ebd1","bytes":11979,"lines":313},{"path":"database/migrations/0011_criterion_observation_scope.sql","sha256":"f9fe7c35f1ee7b167e1c2ba75a50a84febda9a6ccf8123b4f5726f51968694f9","bytes":7444,"lines":165},{"path":"database/migrations/0012_people_mutation_idempotency.sql","sha256":"52dbbb9ec7f9be5291593ba88f228d7fffd736dcb99547a08c1d6cad076afb69","bytes":3162,"lines":76},{"path":"database/migrations/0013_job_analysis_snapshot.sql","sha256":"b6553a5a4c94c4aa9f341a474e13bbe34db63044eda2446b3ebee178995977ee","bytes":12713,"lines":260},{"path":"docs/API_CONTRACT.md","sha256":"63533dff785da62b89e585d742a158e2aeb05913644f2bf9fb6486f281c2e589","bytes":4555,"lines":76},{"path":"docs/DATA_MODEL.md","sha256":"6ad29731ae7ee7aa5bf3a2d0bfef88894a35a2550edb2be3244d6f143d76444a","bytes":13366,"lines":85},{"path":"docs/ERD.md","sha256":"546001aa85c4fe020e0c39d881dc860daf7f69090596666fdf9092487b0725fe","bytes":6964,"lines":70},{"path":"docs/OPERABILITY.md","sha256":"82b2d3e70cec371ef35e9e0f982ac40fef84351976bc04b863b81d27023d5a62","bytes":11189,"lines":71},{"path":"docs/PRD.md","sha256":"3ad85ae633cce0fc7a93af39b21d7a7c70bb2efa786da6b12f3c5327906e34f1","bytes":5490,"lines":111},{"path":"docs/SECURITY.md","sha256":"01918512d8882060e9cff0c4aa8206e0eccbdfb61cfd7f829331123c7a9fe6ac","bytes":11185,"lines":64},{"path":"docs/STORYBOARD.md","sha256":"6e4ffb0eb03a80343f50d363ffc43b34da9348a44232dd947a9ff416ea92a3d2","bytes":1342,"lines":28},{"path":"docs/STORYBOOK.md","sha256":"82f79029b3c2b7a45393bad5ba8fabe61014d4b6149c7d4e73f70ba447f885e9","bytes":1389,"lines":50},{"path":"docs/TEST_STRATEGY.md","sha256":"d0a0bc3b54ed0fc7973747987f1afb117d6144c390b51ed9370eb571972a33f8","bytes":16534,"lines":135},{"path":"docs/THREAT_MODEL.md","sha256":"f314f375c2e41252536de224c7bc7e4a10ab8f340cb86642724e7399e32f4252","bytes":6736,"lines":23},{"path":"docs/TRACEABILITY.md","sha256":"27af9b5fcc359a5131d146a258d55bfad5aa45c3310860821912e2446c75e0f2","bytes":12419,"lines":42},{"path":"docs/TRD.md","sha256":"23697d88a4882698e1a2782b7da3f2ccd0d3cd2d6d1bffe89b6597dc16851077","bytes":9064,"lines":101},{"path":"docs/UML.md","sha256":"fe67c37aa88e5814ceb2db7e8f7d8d85ca27a994802efbb7c75164b387adf0a9","bytes":5528,"lines":122},{"path":"docs/USER_STORIES.md","sha256":"5535b39d8c71a36c81f78e2d6dbd90a2d32e6541790f0d28f6dd4baf3ea7b45f","bytes":2670,"lines":37},{"path":"docs/WIREFRAMES.md","sha256":"b03aa6419aeaf5d42a5698c4d43a434c1633b7ac6fd0b0bd0cda979077adc56e","bytes":2005,"lines":77},{"path":"docs/adr/0001-orgmetra-authoritative-hris-record.md","sha256":"0f8055b73c63d3130321415ad53233588ff952aabd1a88952b39c71747253572","bytes":6108,"lines":53},{"path":"docs/adr/0002-federated-cwl-integration-boundaries.md","sha256":"b77165f2aacfa6f4fde994baf77d5879c6da3e8dae4fd2db0ed912d60ae9b3b2","bytes":4072,"lines":44},{"path":"docs/adr/0003-bitemporal-hris-data-contract.md","sha256":"d7f2660616622c1a7994b28aa66d99d13836bcf755735595f9609a41282ab799","bytes":4453,"lines":47},{"path":"docs/adr/0004-employment-position-version-and-assignment-binding.md","sha256":"fee89e700414abe0b1cffec2acc687e5e014634db8f5ef9e8a92abba5c3cf182","bytes":1872,"lines":30},{"path":"docs/adr/0005-exclusive-employment-and-staffable-seats.md","sha256":"10f0eb409f4fa32d2c5bed2d583d8b43be8e61b5cbef0e927e5bebb5f5c8f85b","bytes":2091,"lines":34},{"path":"docs/adr/0006-governed-audit-outbox-envelope.md","sha256":"987a6f613501d0825fff8682c80d20468cbedf797559bf950a7ea0ca18f6dcf9","bytes":14046,"lines":66},{"path":"docs/adr/0007-governed-job-analysis-evidence.md","sha256":"0996bb1162d6a5e544d6efa8c66f17f03060a5ed38d5145bd8ed23c719dd77e5","bytes":5643,"lines":57},{"path":"docs/adr/0008-purpose-bound-pii-authorization.md","sha256":"c5157d3bc58f3d8d29e03104dd15eb2911cc1bb66e2c92a935b26d7164648dc7","bytes":5988,"lines":55},{"path":"docs/adr/0009-performance-criterion-observation-scope.md","sha256":"5ff47b4e579126e2d32ccd6d4c0e04f806686a4143a749bb14b60aa0ab43cb8e","bytes":7080,"lines":57},{"path":"docs/adr/0010-naruon-calendar-intent-boundary.md","sha256":"ca3cd67b226dbbc89a29598531b272cc208d9408beff012994f5dc3e23812d0e","bytes":3835,"lines":35},{"path":"docs/adr/0011-bitemporal-workforce-composition.md","sha256":"1bb7fa543d4a8ec03f076d3c88ad50181a145e554c9ec2fd5bd86e58e9c50103","bytes":5482,"lines":53},{"path":"docs/adr/0012-governed-migration-handoff.md","sha256":"cfe3e8f556e64a57a68ce676201929a5c2a48b9d13840056817dfe7729af1dbc","bytes":5887,"lines":59},{"path":"docs/adr/0013-governed-requisition-review-packet.md","sha256":"2ff83ca71f53993cf423b0336161f6cfba794181333a765165656517b128cd48","bytes":4704,"lines":46},{"path":"docs/adr/0014-job-analysis-snapshot-persistence.md","sha256":"d6d71187c4bae68b4b5555e3d74f3a243bef8f75192425b3a303baf6b371e26d","bytes":5356,"lines":49},{"path":"docs/adr/README.md","sha256":"f390154b397d57ba2b92deff74092968269a951249494c662d83e8add0cd68af","bytes":2028,"lines":20},{"path":"docs/doctoring/REFERENCES.md","sha256":"929f7ee36df16279f028f726fcf039982180deb377746fe3804f3c0d090778d5","bytes":6352,"lines":69},{"path":"docs/superpowers/plans/2026-08-15-orgmetra-foundation-implementation-plan.md","sha256":"b64f21abb19373e780db8b9e64deb8ba9a6219ccf9625a651f25407b8691fcbd","bytes":8227,"lines":226},{"path":"docs/superpowers/specs/2026-08-15-orgmetra-foundation-design.md","sha256":"4a0e1a7943e40d12bd3082db3757045b4085e5a089fea7bc0d8a1565ffcbcf1d","bytes":6237,"lines":187},{"path":"package.json","sha256":"e7a2b82f99f76bf795d3f88dd8ab3bfebc2372f4cc41e4c0b3b6b2ab0eb81cac","bytes":422,"lines":9},{"path":"packages/hris-kernel/src/orgmetra_hris_kernel/audit.py","sha256":"3e5b7190cf857dc8c1fc7e898cef303060f34aabee6c27a9034d4d9650e33190","bytes":7707,"lines":160},{"path":"packages/hris-kernel/tests/test_audit_outbox.py","sha256":"5928dd7b97fe38d6b7472ce62966437e339058a59c3b301a93a7b5c05432b40c","bytes":7556,"lines":200},{"path":"schemas/openapi.yaml","sha256":"09c1e43486779198574fe31b8bcabbd1c1f74beec7bf86245ae578061619838f","bytes":29503,"lines":1020},{"path":"scripts/foundation-contract-core.mjs","sha256":"595e8381dbd62e97093b11eef818af5f04d6473ac592d57e3985ffbc2210d445","bytes":28173,"lines":689},{"path":"scripts/foundation-contract.mjs","sha256":"5242dcdbe0935775edf074462c82600e9bc4927d9fdc50c47727af915fd4b23a","bytes":218,"lines":6},{"path":"tests/dispatcher-inventory.test.mjs","sha256":"09f5e64410e6b7a26bf8d6ce61c50b737da2ea85d955f91eba63aa21f1537261","bytes":1597,"lines":34},{"path":"tests/foundation-contract.test.mjs","sha256":"960306fd7cda7b982a52c4428a432d10a4f570430a5d39fb23aeca0b2ede0615","bytes":14860,"lines":386},{"path":"tests/openapi-contract.test.mjs","sha256":"80c1610ef1c189fa325e55389501e0e51531ddf61ee335bb94d9cb3aa55a9fdc","bytes":6438,"lines":195},{"path":"tests/test_audit_outbox_hardening_postgres.sh","sha256":"518ba2f37ba6292943e5abe22c2599452b2f031a42e453b2493aedf8714421a0","bytes":13396,"lines":333},{"path":"tests/test_audit_outbox_postgres.sh","sha256":"e57a04920a0ba97fa6a06752d15ea150016ab8d44099e998c5c4f4067592b4d2","bytes":13443,"lines":357},{"path":"tests/test_bitemporal_postgres.sh","sha256":"7684b8c2ff52c044c081135515bd5aabbfd00e2daad0d471b0868701af2df6cc","bytes":8209,"lines":230},{"path":"tests/test_candidate_worker_conversion_postgres.sh","sha256":"681cb74d6cfa859ed92c6c2439881ea20c430ef8df94ec662e2807761a377f90","bytes":14673,"lines":344},{"path":"tests/test_criterion_observation_scope_postgres.sh","sha256":"0ee9539ee57f840c27d08009f7868cdc8662669df78a01dbc8be39216b8f1a3d","bytes":17811,"lines":469},{"path":"tests/test_evidence_sealing_postgres.sh","sha256":"57d16b632a0c60ffdcb4842ceb1cfe25d19c54cefeeefb622ff4fa6e83441ad7","bytes":11349,"lines":370},{"path":"tests/test_job_analysis_snapshot_postgres.sh","sha256":"ca9c323a1dd68cfc520277efbbb7495e37fb3ca027890928c8624e5b4f57403f","bytes":13542,"lines":296},{"path":"tests/test_operational_uuid_postgres.sh","sha256":"7378f98f0d4b3000e8ea641d8701f1540dbad71410b3637d81d799969e0f6ff7","bytes":3346,"lines":101},{"path":"tests/test_outbox_claim_postgres.sh","sha256":"1027806d436ebfe34e108c25b6a4001f43b9550f1d70057c6c0d7974323b0c9b","bytes":14817,"lines":429},{"path":"tests/test_outbox_dead_letter_postgres.sh","sha256":"0d728d578e64252e6079f2d141ddaa7fa9cfbf9784e625832273596d69a6e13d","bytes":14008,"lines":377},{"path":"tests/test_people_mutation_idempotency_postgres.sh","sha256":"3f57e12f80bd1b034c9aac54b669d8530106e3e26b3795689671fb53807b3cd5","bytes":16191,"lines":381},{"path":"tests/test_tenant_isolation_postgres.sh","sha256":"dd649435ef8ab9e57f0609c101917e36656a6d40d63de9bcdbdac23d764f6c3a","bytes":15134,"lines":388},{"path":"tests/test_validity_study_case_postgres.sh","sha256":"0070ad58300323c7f9900c5645e0df3106b36ccd245ae686e982c2fd6fa4dc02","bytes":14708,"lines":301},{"path":"tests/validate_repository.py","sha256":"918cf92fd18d81572e9bd5f5daa7f033c32731e2e13f0d00661d1c1de30b12a9","bytes":27291,"lines":638}]} \ No newline at end of file diff --git a/package.json b/package.json index ceb2fb8fc..b681b5a2a 100644 --- a/package.json +++ b/package.json @@ -4,6 +4,6 @@ "private": true, "description": "Orgmetra evidence-centered HRIS foundation baseline.", "scripts": { - "validate": "python3 tests/validate_repository.py && node scripts/foundation-contract.mjs && node --test tests/foundation-contract.test.mjs tests/openapi-contract.test.mjs tests/dispatcher-inventory.test.mjs" + "validate": "python3 tests/validate_repository.py && node scripts/foundation-contract.mjs && node --test tests/foundation-contract.test.mjs tests/openapi-contract.test.mjs tests/dispatcher-inventory.test.mjs tests/llm-routing-policy.test.mjs" } } diff --git a/tests/llm-routing-policy.test.mjs b/tests/llm-routing-policy.test.mjs new file mode 100644 index 000000000..44c78cb18 --- /dev/null +++ b/tests/llm-routing-policy.test.mjs @@ -0,0 +1,28 @@ +import assert from 'node:assert/strict'; +import { readFileSync } from 'node:fs'; +import test from 'node:test'; + +function repositoryText(relativePath) { + return readFileSync(new URL(`../${relativePath}`, import.meta.url), 'utf8'); +} + +test('consumer guidance routes model-backed Actions only through contextual-orchestrator free', () => { + const agents = repositoryText('AGENTS.md'); + + assert.match(agents, /`orchestrator\/free`/); + assert.match(agents, /contextual-orchestrator/); + assert.match(agents, /gateway token/i); + assert.doesNotMatch(agents, /NVIDIA_NIM_API_KEY/); + assert.doesNotMatch(agents, /OPENAI_API_KEY/); + assert.doesNotMatch(agents, /OPENROUTER_API_KEY/); + assert.doesNotMatch(agents, /BYTEZ_API_KEY/); +}); + +test('core-boundary guidance separates ontology release from catalog governance', () => { + const claude = repositoryText('CLAUDE.md'); + + assert.match(claude, /ConceptWeave owns ontology/); + assert.match(claude, /semantic-data-portal owns catalog/); + assert.match(claude, /contextual-orchestrator owns bounded LLM orchestration traces/); + assert.doesNotMatch(claude, /Semantic Data Portal owns occupation\/skill\/ability ontology/); +});