fix(hris): harden workforce evidence boundaries

[seonghobae]

Summary

• Reject malformed employment status-count rows with the governed SingleValuedFactError instead of unpacking TypeError/ValueError.
• Canonicalize zero FTE without expanding hostile Decimal exponents and reject nonzero FTE above the staffed-assignment bound before fixed-scale expansion.
• Revalidate exact endpoint types and cross-endpoint tenant, effective-date, and knowledge-cutoff invariants before change evidence export.
• Refresh the stale manifest entry for docs/adr/0011-bitemporal-workforce-composition.md, which was causing Foundation validation to fail.

Stack

This is a stacked child of #54 and must merge only after #54. Parent exact HEAD at creation: 6dc0f3da8f716d1b67d48336e0cdfb8f35a2770e. Child exact HEAD: 065ef30b10f0fce9bd74ac442f307b41433aa58d.

Evidence

• PYTHONPATH=src pytest -q tests in packages/hris-kernel: 230 passed; 100% statement and branch coverage.
• npm run validate: Foundation validation passed; 55 Node tests passed.
• python -m compileall, Ruff, actionlint, git diff --check, and CodeGraph sync/status passed.
• No database migration or runtime schema change.

Protected OpenCode, Noema, Strix, SAST, Security Scan, required checks, and independent review remain required.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing as technically superseded by the current parent branch rather than carrying a stale three-commit child forward.

Fresh comparison establishes the dependency history precisely:

• fix(hris): harden workforce evidence boundaries #158 head: 065ef30b10f0fce9bd74ac442f307b41433aa58d
• recorded parent/base: 6dc0f3da8f716d1b67d48336e0cdfb8f35a2770e
• current feat(workforce): add same-cutoff composition change evidence #54 head: 90e2cffdafb2ca385359068b53f5ca1dc437a5af
• fix(hris): harden workforce evidence boundaries #158 is 3 commits ahead of its recorded base but 13 commits behind and diverged from current feat(workforce): add same-cutoff composition change evidence #54.

Every material #158 repair is already present on current #54, with equal or stronger contracts:

1. malformed status rows: current parent uses _status_values / _freeze_employment_status_counts to detach rows, catch malformed iterables as governed SingleValuedFactError, enforce exact two-value row shape/types/non-negative counts, and canonicalize semantic zero rows;
2. hostile Decimal exponents: current parent canonicalizes mathematical zero immediately and rejects nonzero FTE above the exact staffed-assignment capacity before any exponent-proportional padding;
3. change-evidence mutation: current parent has _validate_comparable_endpoints() at construction and again at canonical export, revalidating exact endpoint types, each endpoint's canonical invariants, tenant identity, effective-date order, and knowledge cutoff;
4. regression coverage: current parent adds test_workforce_canonical_evidence_hardening.py, covering malformed rows, invalid assignment-count types, canonical zero/negative-zero and zero-row evidence, huge zero/nonzero exponents, and post-construction endpoint tenant/date/cutoff/type mutation. Existing boundary tests additionally retain the FTE capacity invariants.

The current parent exact head has stronger hosted proof: Workforce Intelligence Quality 33329979690 / 99306693732 reports 232/232 tests and exact 876/876 statements plus 360/360 branches = 100%, while current Foundation and Recovery evidence are also GREEN. Its active central review/security blockers remain on #54 and are not bypassed or transferred from this child.

#158 has no submitted reviews or inline review threads, so closing it drops no unique unresolved review finding. No child check/review evidence is transferred to #54; #54 continues to require its own exact-current-head gates and independent approval.