feat(core): persist bitemporal position reporting relationships

.github/workflows/position-reporting-persistence-quality.yml

@@ -0,0 +1,96 @@
+name: Position Reporting Persistence Quality
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - feat/position-reporting-hierarchy
+    paths:
+      - "database/migrations/0020_position_reporting_relationship.sql"
+      - "tests/test_position_reporting_persistence_postgres.sh"
+      - "tests/test_position_reporting_review_binding_postgres.sh"
+      - "tests/test_position_reporting_concurrency_postgres.sh"
+      - "docs/adr/0106-position-reporting-persistence.md"
+      - "docs/traceability/position-reporting-persistence.md"
+      - "docs/doctoring/position-reporting-persistence-references.md"
+      - ".github/workflows/position-reporting-persistence-quality.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: position-reporting-persistence-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  postgres_contract:
+    name: Governed position-reporting persistence contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    services:
+      postgres:
+        image: postgres:16.14@sha256:33f923b05f64ca54ac4401c01126a6b92afe839a0aa0a52bc5aeb5cc958e5f20
+        env:
+          POSTGRES_USER: orgmetra
+          POSTGRES_PASSWORD: orgmetra
+          POSTGRES_DB: orgmetra
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U orgmetra -d orgmetra"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgresql://orgmetra:orgmetra@localhost:5432/orgmetra
+    steps:
+      - name: Checkout exact candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Prove exact candidate checkout
+        env:
+          ORGMETRA_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: test "$(git rev-parse HEAD)" = "$ORGMETRA_EXPECTED_HEAD_SHA"
+      - name: Print deterministic persistence provenance
+        run: |
+          python - <<'PY'
+          import hashlib
+          import json
+          from pathlib import Path
+
+          required = [
+              "tests/test_position_reporting_persistence_postgres.sh",
+              "tests/test_position_reporting_review_binding_postgres.sh",
+              "tests/test_position_reporting_concurrency_postgres.sh",
+              ".github/workflows/position-reporting-persistence-quality.yml",
+          ]
+          optional = [
+              "database/migrations/0020_position_reporting_relationship.sql",
+              "docs/adr/0106-position-reporting-persistence.md",
+              "docs/traceability/position-reporting-persistence.md",
+              "docs/doctoring/position-reporting-persistence-references.md",
+          ]
+          rows = []
+          for path_text in required + [path for path in optional if Path(path).is_file()]:
+              data = Path(path_text).read_bytes()
+              rows.append({
+                  "path": path_text,
+                  "sha256": hashlib.sha256(data).hexdigest(),
+                  "bytes": len(data),
+                  "lines": len(data.decode("utf-8").splitlines()),
+              })
+          print(json.dumps(rows, separators=(",", ":")))
+          PY
+      - name: Run position-reporting persistence regressions
+        run: bash tests/test_position_reporting_persistence_postgres.sh
+      - name: Verify immutable human-review binding
+        run: bash tests/test_position_reporting_review_binding_postgres.sh
+      - name: Verify concurrent cycle prevention
+        run: bash tests/test_position_reporting_concurrency_postgres.sh
+      - name: Require clean checkout
+        run: |
+          git diff --exit-code
+          test -z "$(git status --porcelain)"

ARCHITECTURE.md

@@ -75,7 +75,7 @@ The initial deployment may share one physical PostgreSQL cluster. Logical isolat
 | Service identifier | Owned schema and representative tables | Database role |
 |---|---|---|
 | `people_core` | `people_core`: person, name, employment, assignment, compensation, and candidate-worker linkage records | `people_core_role` |
-| `organization_core` | `organization_core`: organization units and position records | `organization_core_role` |
+| `organization_core` | `organization_core`: organization units, position records, and Position reporting relations | `organization_core_role` |
 | `job_architecture` | `job_architecture`: job profiles, publication evidence, and persisted `job_analysis_snapshot` / task / KSAO rows | `job_architecture_role` |
 | `talent_acquisition` | `talent_acquisition`: candidate profiles, selection decisions, and decision evidence | `talent_acquisition_role` |
 | `performance_management` | `performance_management`: criterion blueprints and observations | `performance_management_role` |

CHANGELOG.md

@@ -8,6 +8,7 @@ All notable changes to Orgmetra will be documented in this file.
 
 - Accepted ADRs 0001–0003 now include buyer-facing Context, Decision, and Consequences grounded in verified ISO 30400:2022, ISO 30414:2025, Uniform Guidelines (29 C.F.R. Part 1607), SIOP (2018), OpenAPI Specification v3.2.0, OpenID Connect Core 1.0 errata set 2, CloudEvents v1.0.2, Jensen and Snodgrass (1999), Snodgrass (1999), and Allen (1983) records already listed in `docs/doctoring/REFERENCES.md`. ADRs 0004 and 0005 gained APA 7th References pointers to that same bibliography without changing their Decision bodies.
 - Active-PR governed Job Analysis persistence/API on the canonical `JobAnalysisSnapshot` model: migration `0013_job_analysis_snapshot.sql` stores immutable tenant-scoped snapshot, Task, KSAO, Task–KSAO, FJA and write-command evidence; `POST /v1/tenants/{tenant_record_id}/job-analysis-snapshots` and matching GET enforce purpose-bound Keyverse scope, authenticated-principal actor authority, bounded/strict JSON handling, transactional Idempotency-Key serialization, parent-scope fail-closed integrity, forced RLS, and atomic audit/outbox evidence. ADR 0014 records the persistence decision while ADR 0007 remains the domain/evidence authority; validated evidence still requires accountable human review and non-LLM provenance, and the service does not make a high-impact employment decision.
+- Active-PR #106 Position-to-Position reporting persistence: normalized bitemporal solid-line relationship anchor/version tables with staffable endpoint coverage, tenant isolation, cycle prevention under concurrent writes, immutable human-review/application audit binding, history/TRUNCATE guards, trusted trigger search paths, and reserved UUID sentinel checks. It remains Draft stacked on PR #94 and is not protected-branch truth.
 - Active-PR `orgmetra_selection_review` packet for PII-minimized, evidence-bound human selection review: canonical operational tenant identity, UUID-backed opaque candidate/Job/sealed-evidence/reviewer references, explicit purpose/reason/evidence version, deterministic canonical JSON and SHA-256 correlation, mandatory human decision state, redacted packet repr, and provenance-paired model evidence that remains `untrusted_draft`, with exact 100% owned statement and branch coverage required by its quality gate.
 - Active performance-criterion scope hardening: `criterion_observation_scope_guard` rejects criterion outcomes for a Job the worker did not effectively hold at the observation date, observations before the relevant assignment, and observations outside the referenced performance cycle while preserving valid multiple-assignment cases and existing bitemporal correction semantics. The guard evaluates current-recorded facts, derives the date coordinate from `observed_at` in UTC so session `TimeZone` cannot alter the result, uses a trusted function search path, and adds no PII or automated employment decision authority. The Foundation PostgreSQL contract also rejects a closed `recorded_to` on each time-coordinate lookup and proves UTC midnight plus non-UTC session `TimeZone` boundaries.
 - Bitemporal tenant-scoped organization hierarchy validation that rejects visible indirect parent cycles and reuses single-valued recorded-time reconstruction before graph traversal.