feat(ui): add governed Job Architecture workspace states

[seonghobae]

Buyer-visible gap

Protected PRD and Figma Orgmetra Baseline node 1:16 require a Job Architecture workspace that presents versioned Job evidence, Task → FJA → KSAO lineage, an evidence drawer, and publish-only-after-SME-review behavior. #101/#109 own Job-grade review/persistence and #117 owns model-assisted Job Analysis drafting, while #25/#38 own governed Job Analysis evidence/snapshot boundaries. This child remains presentation/interaction-only and does not create a shadow domain authority.

The branch is stacked on #130 and does not create or mutate Job Analysis truth, Job-grade truth, Position, Assignment, compensation, candidate status, or an employment decision.

Contract-first RED → root repair

Contract head 15c6328d2491009ffca40faaa28d38bb01ca0238 contained the exact-coverage workflow and focused interaction/privacy/fail-closed regressions before the production state module existed. Hosted run 33169736884, job 98843660150, checked out that exact SHA and failed with ERR_MODULE_NOT_FOUND for intentionally absent apps/hr-workspace/job-architecture-state.js: genuine RED evidence.

Root implementation commit d24e1069c549f9be33b164d0ab0237b4b080b513 adds the smallest presentation-state boundary. It uses exact built-in strings plus own-key state membership, rejects prototype-inherited constructor / toString / __proto__, and exposes bounded idle / loading / draft / review / publishing / published / denied / stale / evidenceBlocked / error states.

• draft is read-only Task → FJA → KSAO/source-provenance evidence and explicitly not published Job truth; model-assisted output remains untrusted draft evidence.
• review requires accountable SME confirmation of Job scope, evidence/provenance, limitations, actor, purpose, reason, and evidence version, without candidate, compensation, or employment-decision authority.
• publishing disables duplicate action and does not claim success.
• published is asserted only after authoritative Job Analysis publication plus immutable audit evidence and remains read-only; it does not itself mutate Position, Assignment, compensation, or candidate status.
• denied/stale/incomplete/indeterminate states fail closed with concrete next actions.
• generic interaction evidence excludes Job identifiers/titles, Job Analysis identifiers/version, Task/FJA/KSAO values, source content/URLs, SME identity, candidate/person/position/assignment values, compensation, credentials/tokens, prompts, and model output.

Figma / Storybook / accessibility evidence

Figma Orgmetra Baseline node 1:16 defines Task → FJA → KSAO, evidence drawer and SME-gated publish behavior; Storybook Inventory node 1:64 defines governed interaction states. The branch adds tokenized CSS and Storybook states using existing Orgmetra interaction/focus tokens, a 44px minimum action target, aria-busy, read-only/high-risk-confirmation/permission-denied/validation-error semantics, and APA 7 doctoring for WCAG 2.2, WAI-ARIA 1.2 and O*NET occupational-information context.

Parent synchronization — 2026-09-01

The previous child exact head 26e81931ec031bd9ac72f0053839cae58c21f6bb was based on parent #130 predecessor 68896baa692ecf6fec8f21cfe5d981440be6071c, while #130 had advanced to c92749cf5889a39de1ba8036742f96fd3451f459 with a bounded Storybook compatibility fix in apps/hr-workspace/protected-read-state.stories.js.

Fresh ancestry comparison proved the child was ahead 9 / behind 1 and the parent-only change did not overlap any of this PR's seven owned Job Architecture files. The existing child branch was therefore synchronized non-destructively with a two-parent merge commit rather than rebasing or force-pushing.

Current exact head: 283da6050d487d597351aafcd248c3a92387f970
Current base/parent: #130 feat/hr-workspace-protected-read-state@c92749cf5889a39de1ba8036742f96fd3451f459

Post-merge ancestry proof: parent merge-base is exactly c92749cf…; child is ahead 10 / behind 0. GitHub reports open · Draft · mechanically mergeable. Re-fetch these values before acting.

Exact-current-head evidence

The predecessor Job Architecture focused run on 26e81931… is historical only and does not transfer to 283da605…. The parent sync creates a new exact head and therefore requires fresh focused tests, review threads and any applicable central/stacked required-workflow evidence.

No claim of current-head GREEN or merge readiness is made until those fresh checks conclude. The parent #53 chain also remains blocked from release-readiness by the current central Dependency Review availability incident: its old Security GREEN was produced by predecessor fail-open logic after HTTP 403 and a skipped Dependency Review action.

Current governance and stack discipline

Keep Draft and process causal order #53 → #130 → #147. .github#772 supersedes the old impossible 2 independent approvals + last-push expectation: the current one-human-maintainer fleet must not fabricate approvals. The target removes only the unsatisfiable generic human approval/named-reviewer/last-push dependency while preserving fail-closed review threads and deterministic OpenCode/Noema/Strix/Security/SAST/Dependency Review/coverage/provenance/product gates, deletion/non-fast-forward protection, and no routine administrator bypass.

After #53 and #130 integrate, retarget/revalidate this child against fresh develop, reconcile any intervening Figma/Storybook/domain changes, and rerun applicable browser/accessibility/Foundation/Recovery/SAST/Security and central required workflows on one exact head.

Do not self-approve, manufacture reviewer identity, use routine administrator bypass, weaken/substitute a gate, create a Job Analysis/Job-grade shadow authority, race another lifecycle writer, or transfer predecessor evidence.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}