feat(job-analysis): add governed qualification-rule review

[seonghobae]

Buyer-visible gap

Orgmetra needs governed evidence showing which Job Analysis evidence supports a proposed qualification rule before that rule can influence recruiting or selection. This lane remains a human-reviewed, PII-minimized qualification-rule review boundary; it does not evaluate candidates, reject applicants, mutate Job/Job Analysis, or write foreign CWL repositories.

Retained domain contract

The original RED/implementation chain remains intact: d92ac4cb... hardened malformed Job references, 79adb799... sealed JobQualificationRuleReviewPacket against subclass override, and 14eab4eb... repaired the deterministic test-quality defects. Canonical evidence stays fixed to job_qualification_rule_review, mandatory human review, reviewed_for_authoritative_resolution, and not_authorized_for_candidate_or_employment_decision.

Candidate/person PII, candidate qualification outcomes, assessment/cut scores, compensation, raw rule text, prompts and model output remain excluded. Before authoritative persistence/use, the host must re-resolve tenant/Job/Job Analysis, rule artifact, Task/KSAO/source provenance and reviewer authority at the business-effective coordinate and preserve immutable audit/outbox evidence.

Protected-parent reconciliation completed

Protected adoption authority remains develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. The branch first adopted it through ordinary non-force two-parent successor 5bc1663afbd363dc75524afb0cebcf856595d421.

The previously verified synthetic merge tree would have resurrected .github/workflows/job-qualification-rule-review-quality.yml with runs-on: ubuntu-latest, undoing protected #161's repository-quality consolidation. That semantic adoption defect remains repaired:

• the resurrected package-local workflow is retired;
• canonical .github/workflows/foundation-ci.yml preserves exact CPython 3.14.7, SHA-256-bound installed-wheel, isolated test-toolchain, package-import provenance, and 100% statement/branch coverage contracts;
• packages/job-qualification-rule-review/tests/test_artifact_execution.py rejects leaf-workflow reintroduction and requires the canonical installed-artifact path;
• manifest.json remains sealed to the final Foundation bytes from that repair: SHA-256 2e7e89e7c1158b23e4cf5947ab2a6440c3a3dc47f4a6b23182ff5a15e53b5eaf, 10324 bytes, 169 lines.

A follow-up docs-to-code sweep found docs/traceability/job-qualification-rule-review.md still describing old develop@9e3e484... as protected truth and a retired dedicated quality workflow as the artifact gate. Ordinary successor fde420ae11680a8b54eada785683db1afecca6bd repairs only that traceability authority: it records eb9757f... as the protected-parent adoption snapshot, requires a fresh protected read before merge, and names canonical Foundation CI plus the leaf-reintroduction regression as the current artifact gate. The Foundation manifest does not inventory this traceability file, so no manifest reseal is implied by this docs-only successor.

No Job Analysis production behavior, human-review authority, coverage threshold, protected history, central gate or dependency boundary was weakened.

Current acceptance state

GitHub reports this PR open · Draft at exact fde420ae11680a8b54eada785683db1afecca6bd with current protected base eb9757f.... Foundation 34017994517 is now terminal SUCCESS on this exact head. Security 34017994490, SAST 34017994471, and CodeQL 34017994488 remain queued/non-terminal, so the lane is not review-ready and no predecessor result is being transferred.

For predecessor 5bc1663a..., Foundation 34013148564 and SAST 34013148551 were terminal SUCCESS. Security 34013148557 failed only after exact checkout at Check dependency review support, while sibling OSV/Scorecard paths succeeded; central .github#810 remains the owner of that fail-closed Dependency Review availability incident. CodeQL 34013148598 failed only after both Actions/Python shards successfully requested current-head dispatch and then failed Release runner or enforce current-head CodeQL verdict; .github#1927/#1929 remain open around the dispatcher-identity authorization boundary. Those predecessor results are causal evidence, not GREEN for fde420ae....

Submitted formal reviews remain COMMENTED-only; no qualifying independent APPROVED review exists. All currently visible review threads are resolved.

Stack order

#105 remains Draft at child exact e9e4731b... on predecessor parent snapshot d92ac4cb...; it does not yet contain the current #104 trust-boundary/protected-parent/traceability repairs. Required order is: exact-head #104 acceptance → normal protected integration → #105 non-force adoption/retarget preserving its full persistence/search-path/PostgreSQL/provenance delta → retire/reconcile #105's own historical package-local workflow without resurrecting leaf CI → reseal final tracked bytes → fresh descendant acceptance.

The active organization ruleset still requires one approval, stale-review dismissal on push, resolved threads, extra approval for unattributed changes, seven central required workflows, and deletion/non-fast-forward protection. Do not self-approve, use routine administrator bypass, weaken gates, transfer predecessor evidence, force-push/destructively rebase, or simply Close the valid delta.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head correction: production implementation is now present at 4c42b422fbca9d4bc79c04b67f778632d0be2aca. The earlier body section describing f0649807… as the current RED head is stale; that RED contract was superseded before terminal execution and is not passing evidence. Exact-current-head Job Qualification Rule Review, Foundation, Recovery, SAST, and Security workflows are materialized but queued, so this PR remains Draft and no predecessor result is promoted. The current source binds reviewed Job/Job-Analysis/rule-artifact Task/KSAO/source provenance, generates system-recorded UTC time inside the owner boundary, keeps canonical evidence value-minimized, and remains non-authoritative for downstream personnel actions.

[seonghobae]

Current-head evidence update: d92ac4cb798b3bd32b632c0ab677c03f944070e4 adds a realistic malformed-but-correctly-namespaced UUID regression (job_record:not-a-uuid) so the shared reference parser's fail-closed exception path is exercised rather than relying on only wrong-namespace/sentinel/version cases. Production behavior is unchanged. The prior head's queued results do not transfer, and no hosted run has materialized yet for d92ac4c…; under the repository evidence policy this remains non-passing and #104 remains Draft. Protected base remains develop@9e3e4847510e1e612b48474ba42b177b8ed824df.

[devin-ai-integration]

Devin Review found 2 potential issues.

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Lifecycle correction: live protected develop is now eb9757f8649aaad026a9865508d9aad50c1a7a4f, not the 9e3e484... snapshot recorded in the body. This PR has been returned to Draft. Its qualification-rule review delta and prior exact-source evidence remain valid historical evidence, but current integration must first non-force adopt protected truth, preserve the current #104 trust-boundary/test repairs, reconcile any repository-quality/provenance changes introduced since the old base, reseal exact artifacts if bytes change, then rerun all applicable current-head local/central gates. Descendant #105 remains dependency-first and must not inherit #104 checks/reviews. The body’s older non-draft/live-base statements are superseded by this live correction.