feat(core): govern Position lifecycle-change review

[seonghobae]

Current authority — 2026-09-07

Current exact head: 25aaef404fc60cdeb1be5a5575cd80491c61ebb2.
Protected base: develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f.

GitHub reports open · Draft · mechanically mergeable. This lane adds governed, value-minimized human review evidence for an existing Position lifecycle change; it still does not mutate authoritative Position truth.

Protected-parent reconciliation

The predecessor 03f3f6de674ee07cf33b9d2a75f58a8d210d7ed8 carried valid Position lifecycle review/domain/test evidence, but GitHub's conflict-free synthetic protected-parent merge 1090a853bd07a94b64d0b2eca391156e0fd9726f resurrected .github/workflows/position-lifecycle-review-quality.yml. Protected #161 retired that leaf while consolidating repository-owned quality under canonical Foundation CI. The resurrected leaf also reintroduced ubuntu-latest.

Current 25aaef40... is an ordinary two-parent successor of the complete predecessor feature delta and develop@eb9757f...; the branch ref advanced non-force. The corrected tree keeps the retired leaf absent and preserves protected Foundation/Recovery workflow bytes. Its useful quality obligations are not discarded: canonical Foundation's dependency-hygiene step delegates to tests/test_position_lifecycle_review_artifact.sh, which requires exact CPython 3.14.7, hash-pinned build tooling, an exact-checkout wheel installed by computed SHA-256 into an isolated venv, import provenance checks, and the package's existing exact 100% statement/branch coverage gate without package-local PYTHONPATH execution. packages/position-lifecycle-review/tests/test_artifact_execution.py prevents leaf-workflow resurrection and proves the canonical path independently of process cwd.

The same repair removes stale governance text from ADR/README/traceability. Current effective ruleset 18156473 remains the merge authority; Issue #89 remains the canonical Orgmetra evidence lane for central governance/control-plane convergence. Product capability and repository policy remain separate.

No Position lifecycle transition rule, PII/data-minimization boundary, human authority, mutation prohibition, test threshold, protected runner contract, central required workflow, or foreign-owner boundary was weakened.

Exact-current-head acceptance

Fresh terminal evidence on unchanged 25aaef40... is now:

• Foundation CI 34028263073 — SUCCESS.
• SAST Semgrep 34028263075 — SUCCESS.
• Security Scan 34028263097 — FAILURE only at the central Dependency Review support boundary. Exact-head checkout succeeds. OSV, Scorecard and Trivy complete successfully; dependency-review job 101478922604 fails at Check dependency review support and the authoritative Dependency Review action is skipped. This does not establish a Position Lifecycle Review source vulnerability.
• CodeQL PR 34028263063 — FAILURE only at the central verdict handoff. Language detection succeeds; Python job 101478634205 and Actions job 101478634218 both successfully request current-head CodeQL scan dispatch, then fail only at Release runner or enforce current-head CodeQL verdict. No Position source/SARIF defect is established by that wrapper failure.

All predecessor GREEN on 03f3f6de... is historical only and does not transfer to 25aaef40.... Fresh formal review enumeration remains COMMENTED-only with no qualifying APPROVED review. Every currently returned inline review thread is resolved. No leaf fallback, synthetic verdict, or no-op retrigger is introduced for central-owner failures.

Stack discipline

Child #112 remains open · Draft at exact 1889851f9f8c7e0528e047ec53f33f947be6dd88 and is based on stale parent snapshot b9e85a1b8eb92f168fd261aa150a6204490c8023. Do not copy this mutable #111 head into the child now. Required order is: #111 central exact-head gate recovery and qualifying independent review → normal protected integration → #112 non-force adoption/retarget preserving the full application delta → fresh PostgreSQL/package/security/review evidence on the resulting child head.

Do not self-approve, use routine administrator bypass, force-push/destructively rebase, restore the retired leaf workflow, manufacture no-op evidence, transfer predecessor checks/reviews, weaken gates, or Close the valid delta.

[coderabbitai]

📝 Walkthrough

Walkthrough

Position 생명주기 변경 검토 패킷을 추가했습니다. 패킷은 상태 전이, 행위자, 스냅샷 digest, 시간 및 검토 결과를 검증하고 canonical 증거로 직렬화합니다. 테스트와 wheel 기반 GitHub Actions 품질 게이트도 추가했습니다.

Changes

Position 생명주기 검토

Layer / File(s)	Summary
검토 계약과 패키지 공개면 docs/adr/0111-governed-position-lifecycle-review.md, docs/traceability/position-lifecycle-review.md, docs/doctoring/position-lifecycle-review-references.md, packages/position-lifecycle-review/README.md, packages/position-lifecycle-review/CHANGELOG.md, packages/position-lifecycle-review/pyproject.toml, packages/position-lifecycle-review/src/orgmetra_position_lifecycle_review/__init__.py	Position 생명주기 검토의 증거 필드, 권한 경계, 상태 규칙, 참고문헌, 패키지 설정 및 공개 API를 정의했습니다.
패킷 규칙과 입력 검증 packages/position-lifecycle-review/src/orgmetra_position_lifecycle_review/review.py	PositionLifecycleChangeReviewPacket과 허용 전이, 사유 어휘, UUID, actor, UTC 시간 및 snapshot digest 검증을 구현했습니다.
권한 경계와 무결성 출력 packages/position-lifecycle-review/src/orgmetra_position_lifecycle_review/review.py	검토 결과에 따른 다음 조치를 기록하고, 권위 있는 재검증 필요성을 유지합니다. canonical JSON, 콘텐츠 digest, 발행 후 변조 감지 및 redacted 표현을 제공합니다.
계약 테스트와 설치 artifact 품질 게이트 packages/position-lifecycle-review/tests/test_review.py, packages/position-lifecycle-review/tests/test_validation_edges.py, .github/workflows/position-lifecycle-review-quality.yml	정상·거부·경계·변조·중복 참조·민감 필드 제외 동작을 검증합니다. wheel 설치 후 pytest, 100% 문장·분기 커버리지, 의존성 및 checkout 상태를 검사합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to b9e85

The PR’s documentation currently presents develop as protected even though enforceable protection is still unresolved, which could lead maintainers to overestimate merge safeguards. Correct the affected documentation or clearly state the protection prerequisite before merging.

Sequence Diagram(s)

sequenceDiagram
  participant Reviewer
  participant ReviewPacket
  participant AuthoritativeHost
  participant AuditOutbox

  Reviewer->>ReviewPacket: 검토 결과와 snapshot digest 제출
  ReviewPacket->>ReviewPacket: 상태 전이와 입력 검증
  ReviewPacket-->>Reviewer: canonical 증거와 다음 조치 반환
  AuthoritativeHost->>ReviewPacket: 최신 Position·Assignment 정보 재검증
  AuthoritativeHost->>AuditOutbox: 권위 있는 변경과 감사·아웃박스 기록

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 Position lifecycle-change review를 도입하고 관리한다는 주요 변경을 간결하고 명확하게 설명합니다.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/position-lifecycle-review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 3 potential issues.

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

[devin-ai-integration]

Devin Review found 3 new potential issues.