feat(talent): connect accepted offer evidence to confirmed-hire authority

[seonghobae]

Buyer-visible gap

PR #80 adds candidate-originated offer acceptance/decline evidence but deliberately leaves it non-authorizing. Protected develop already has the authoritative accept_confirmed_hire(...) mutation path. This stacked Orgmetra-only lane closes the application-layer gap between those boundaries without turning a candidate response into hire authority.

Test-first repair sequence

Initial contract head d9775c3d233e8496e66581f890c918df7f919b38 added only the offer-to-hire regression while orgmetra_people_api.offer_close was absent. No terminal hosted RED is claimed because that head was superseded before an exact run materialized.

The implementation validates an exact canonical CandidateOfferResponsePacket; rejects offer_declined before protected resolution or persistence; requires purpose-bound materialize_worker authorization before protected candidate/offer authority resolution; re-resolves the opaque candidate profile, external candidate actor, identity-resolution provenance, exact offer approval/terms provenance and immutable selection decision through CandidateOfferHireAuthority; binds those facts in a redacted CandidateOfferHireVerification; revalidates candidate-response evidence after authority work; and only then delegates to existing accept_confirmed_hire(...), which independently reauthorizes immediately before mutation.

Regression e8a2726bafc34051c9d568b9d1e92ba66f96d774 exposed a privacy/authorization-order defect in the first implementation. Repairs 21e992df613770c5b269f50c8fc606ec57260e73 and d15d20e3533ab486656bde92baafa7138f96165b moved purpose-bound authorization ahead of the protected resolver while preserving envelope validation.

Fresh dependency / ancestry state

Current parent #80 exact head: c62dd2c536b8b2e10a4912e34637e8dcf0d8fdf8.
Current child #108 exact head: d465d1cd34ec3eeaee863535a7a4142cd018e06b.
Recorded child base: feat/candidate-offer-response-evidence@5070f34cd13814f09d74162347f837cb34d76a57.

Parent #80 first non-force adopted protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f at b9d09ba2.... Fresh Foundation run 34005884590 then exposed a real runner/inventory RED because the adopted feature tree resurrected a package-local workflow that protected #161 had consolidated. Parent successor c62dd2c... retires that leaf workflow and preserves the candidate-response SHA-256-bound installed-wheel/isolated-toolchain 100% coverage contract inside canonical Foundation CI; its fresh current-head gates are still non-terminal. The child intentionally remains on its recorded older parent snapshot.

Historical Offer To Hire Close Quality run 33180159995 is GREEN on exact child d465d1cd...; the lane-local suite passes 12 tests with 100% statement/branch coverage (106/30), plus compileall, Ruff, actionlint and diff checks. This is child/predecessor evidence only and does not prove compatibility with current parent c62dd2c..., protected develop, or current central controls.

Stack / ownership / merge governance

Normal order is: #80 c62dd2c... fresh exact-head acceptance and independent review → #80 normal protected integration → #108 non-force adoption/retarget preserving its complete valid delta and all parent-owned candidate-response evidence → fresh child People/Foundation/SAST/Security/Recovery and central reviewer acceptance on one resulting exact head.

people-api remains the owner of authoritative confirmed-hire authorization/mutation. Keyverse and every other dedicated-writer CWL repository remain read-only; no cross-service application-table SQL is introduced.

Ruleset 18156473 requires one approving review, dismisses stale approvals on push, requires review-thread resolution, can require an extra approval for unattributed changes, and requires the central workflow set. Do not restack onto mutable #80 merely to manufacture descendant evidence; do not self-approve, use routine administrator bypass, transfer parent/predecessor evidence, force-push/destructively rebase, or mutate a dedicated-writer dependency.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.