feat(document-records): persist immutable HR document metadata

[seonghobae]

Buyer-visible gap

PR #98 defines a value-minimized DocumentRecordEvidence packet but intentionally leaves durable persistence to the authoritative document_records boundary. This stacked Orgmetra-only lane adds immutable, tenant-isolated PostgreSQL persistence for reviewed HR document metadata and artifact references without storing document content or other HR values.

Ownership and persistence contract

document_records owns the new document_record relation. Person/Employment identities and audit/outbox handoffs are kept as bounded opaque contract references rather than direct foreign keys or queries into people_core, audit_provenance, or integration_hub application tables. The relation stores reviewed category, artifact/source/retention digests, business receipt time, exact value-minimized canonical DocumentRecordEvidence JSON, its SHA-256, application correlation evidence, and fixed restricted_hr / artifact_reference_only / not_authorized_for_employment_decision states. Document bytes/title, free-form HR text, compensation, ratings, credentials, and employment-decision output are absent.

PostgreSQL owns durable recorded_at; caller backdating and future receipt time fail closed. UPDATE/DELETE/TRUNCATE are rejected. ENABLE + FORCE RLS is exercised with a NOSUPERUSER NOBYPASSRLS reader. Missing tenant context returns no visible rows.

Test-first repair sequence

• Initial contract commits fc422cf507053aa6eb010f9f0e623caef06dbdda and e3eb7d80e04ca77a47165210291ba4a911af6b0a added the PostgreSQL regression and dedicated exact-head workflow while deliberately omitting migration 0021; run 32696739767 was later cancelled after the branch advanced and is not claimed as terminal RED evidence.
• f29459aceb5d4fdeb32c01fc5489ef28b0ff4c8f corrected the ownership boundary before implementation: People and audit/outbox application tables remain opaque foreign-owner contracts rather than direct SQL dependencies.
• Root implementation began in fa1cbd02299f6357b038291867ae368297583146 with immutable metadata persistence, PostgreSQL-owned system time, fixed reviewed vocabularies, destructive-write resistance, and forced tenant RLS. ADR 0107, traceability, and primary-source doctoring were then added.
• Self-review found a data-integrity defect: a syntactically valid evidence_digest_sha256 could be supplied independently of the typed metadata, allowing metadata from one document to be correlated with another packet's digest. Regression 59f2d8247c631da0f35fb8bf0a4b806c5ee8925b supplies a different, internally valid canonical evidence payload with the predecessor digest and requires fail-closed canonical evidence digest rejection.
• Root repair 4a5f76f067fc505420f729a35f2b4c8e68fcc116 stores the exact bounded canonical evidence JSON and validates its exact SHA-256, v1 key set/schema, typed-field equality, and evidence receipt/issuance chronology. Extension-resolution repair head 5e521fd829de313a037f45ac28227c2ae5362d37 additionally resolves the pgcrypto digest function through its extension schema.
• ADR 0107 and traceability explicitly distinguish the canonical evidence snapshot from document content and bind the row to the exact reviewed evidence bytes.

Exact-current-head evidence

Current exact head: 78e67a0493c6b25210b0fcc4a8a6efddf5d339c7.
Fresh live base: 59b809bead617d9045357396df684991548bdc30.

GitHub reports the PR open, draft, mergeable MERGEABLE, merge state CLEAN, review decision NONE.

All 1 latest named check run(s) are terminal success or skipped.

Current exact-head review state: 0 unresolved thread(s); APPROVED review records: none.

This evidence section was synchronized on 2026-08-29. Any predecessor-head claims or prior run IDs elsewhere in this PR body are historical and do not transfer to the current head. Keep this PR governed by the current exact-head checks, review threads, effective protection, and independent approval requirements.

Stack and merge governance

This PR is intentionally stacked on #98. #98 remains open, ready-for-review, mergeable, exact-head GREEN, and without a qualifying independent non-author approval. Process #98 dependency-first and keep #107 Draft while #98 is unmerged. After #98 integrates, retarget #107 to the then-current protected develop, reconcile migration/document inventory ordering, refetch exact head/base/rules/reviews/threads, and rerun every applicable Foundation/SAST/Security/Recovery/document-record evidence/persistence gate on the resulting exact head without transferring predecessor evidence.

No dedicated-writer dependency repository or cross-service application table is modified.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 4 potential issues.