feat(workforce-validation): establish governed validity-study registry boundary - #235
feat(workforce-validation): establish governed validity-study registry boundary#235seonghobae wants to merge 60 commits into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="b59f9cadfab1d4571efd62d805b9d319f9cb9741"
echo "== Exact commits =="
git show -s --format='%H%n%P%n%s' "$base"
git show -s --format='%H%n%P%n%s' "$head"
echo "== Merge base =="
git merge-base "$base" "$head"
echo "== Changed files =="
git diff --name-status "$base" "$head"
echo "== Diff summary =="
git diff --stat "$base" "$head"
echo "== Candidate outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Relevant documentation/CI references =="
rg -n -i -C 3 \
'workforce_validation|validity.study|validity_study|foundation-ci|pytest|coverage|public\.' \
.github ARCHITECTURE.md README.md 2>/dev/null || trueLength of output: 22416 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Changed package contents =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/pyproject.toml \
services/workforce-validation-api/README.md
do
echo "--- $file"
cat -n "$file"
done
echo "== Keyverse authorization API candidates =="
fd -t f . packages/keyverse-adapter | sort
ast-grep outline packages/keyverse-adapter/src --items all 2>/dev/null || true
rg -n -C 5 \
'class PurposeBoundAccess|def require_purpose_bound_access|AuthorizationDeniedError|PurposeBoundAccessRequest|runtime_checkable' \
packages/keyverse-adapter/src packages/keyverse-adapter/tests
echo "== Foundation CI unit-test and install steps =="
sed -n '35,75p' .github/workflows/foundation-ci.yml
echo "== Existing service port patterns =="
rg -n -C 4 \
'`@runtime_checkable`|class .*ReadPort\(Protocol\)|isinstance\(.*Port|def read_.*\(' \
services/job-analysis-api/src services/people-api/src 2>/dev/null || trueLength of output: 65327 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Validity-study schema and migration references =="
rg -n -i -C 8 \
'create table.*validity|validity_study|criterion_blueprint|recorded_from|recorded_to|study_status_code' \
-g '*.sql' -g '*.md' -g '*.py' . \
| head -n 800
echo "== Keyverse authorization implementation =="
sed -n '1,330p' packages/keyverse-adapter/src/orgmetra_keyverse_adapter/authorization.py
echo "== Comparable port validation helpers and read functions =="
sed -n '70,160p' services/people-api/src/orgmetra_people_api/people.py
sed -n '330,510p' services/job-analysis-api/src/orgmetra_job_analysis_api/snapshot.py
echo "== Complete changed-diff scan for persistence/schema dependencies =="
git diff --unified=40 eb9757f8649aaad026a9865508d9aad50c1a7a4f b59f9cadfab1d4571efd62d805b9d319f9cb9741 \
-- services/workforce-validation-api \
| rg -n -i -C 3 'public|postgres|sql|schema|select|insert|validity_study|read_port|callable|timezone|zoneinfo'Length of output: 143503 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Base validity_study table definition =="
rg -n -i -A 80 -B 5 'CREATE TABLE validity_study\s*\(' database/migrations -g '*.sql'
echo "== Repository inventory validation mechanism =="
sed -n '1,130p' tests/validate_repository.py
rg -n -C 3 \
'manifest\.json|REQUIRED|EXPECTED|inventory|services/job-analysis-api|services/people-api|workforce-validation' \
tests scripts package.json .github/workflows/foundation-ci.yml \
-g '*.py' -g '*.mjs' -g '*.json' -g '*.yml'
echo "== New package references outside its own directory =="
rg -n -C 2 \
'workforce-validation-api|orgmetra_workforce_validation_api' \
. \
-g '!services/workforce-validation-api/**'
echo "== Current CI workflow context around unit commands =="
nl -ba .github/workflows/foundation-ci.yml | sed -n '52,74p'Length of output: 36146
I found two blocking issues:
The remaining requested boundary checks are sound in the reviewed slice:
|
|
@coderabbitai review Current exact head moved to |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="b59f9cadfab1d4571efd62d805b9d319f9cb9741"
test_first="b22383c27ec3da6c8111e78fc862363e84399822"
head="3fe809250c86b328dedf3cb46c3d5953966cfc72"
echo "== Exact commit identity and ancestry =="
for commit in "$base" "$prior" "$test_first" "$head"; do
git show -s --format='%H%n%P%n%s%n' "$commit"
done
echo "merge-base:"
git merge-base "$base" "$head"
echo "base ancestor of head:"
git merge-base --is-ancestor "$base" "$head" && echo yes
echo "test-first ancestor of head:"
git merge-base --is-ancestor "$test_first" "$head" && echo yes
echo "== Changed files from protected base to exact head =="
git diff --name-status "$base" "$head"
echo "== Repair diff =="
git diff --stat "$test_first" "$head"
git diff --unified=80 "$test_first" "$head" -- \
services/workforce-validation-api \
packages/keyverse-adapter
echo "== Changed Python outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all || true
;;
esac
done
echo "== Registry, tests, package definition, and CI =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/pyproject.toml \
services/workforce-validation-api/README.md \
.github/workflows/foundation-ci.yml
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
done
echo "== Keyverse authorization contract =="
fd -t f . packages/keyverse-adapter/src | sort
rg -n -C 8 \
'class PurposeBoundAccess|def require_purpose_bound_access|PurposeBoundAccessRequest|AuthorizationDeniedError' \
packages/keyverse-adapter/srcLength of output: 71392 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Executable-policy regression test =="
cat -n services/workforce-validation-api/tests/test_policy_runtime_integrity.py
echo "== Complete Keyverse evaluator =="
sed -n '1,340p' packages/keyverse-adapter/src/orgmetra_keyverse_adapter/authorization.py
echo "== Owner package exports and all direct dependency imports =="
cat -n services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py
rg -n -C 3 \
'^(from|import) |public\.|SELECT |INSERT |UPDATE |DELETE |psycopg|sqlalchemy|database|postgres|people|talent|performance|job_analysis|psychometric|fast_mlsirm|tepp' \
services/workforce-validation-api
echo "== Architecture and protected table evidence =="
rg -n -i -C 6 \
'workforce_validation|validity_study|CREATE TABLE validity_study|CREATE TABLE.*validity_study' \
ARCHITECTURE.md database/migrations -g '*.md' -g '*.sql'
echo "== Read-port runtime protocol behavior test shape =="
python - <<'PY'
from typing import Protocol, runtime_checkable
`@runtime_checkable`
class Port(Protocol):
def read_validity_study(self) -> object: ...
class NonCallable:
read_validity_study = None
print(isinstance(NonCallable(), Port))
PYLength of output: 61765
I found one blocking issue.
The requested boundary checks are correct in this head:
The prior read-port finding does not apply to this runtime. The You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="b609b0a46b835e4ba4c7f46f51088c5673dcbdb7"
echo "== Commit identity and ancestry =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$base"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
echo "merge_base=$(git merge-base "$base" "$head")"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
echo "== Changed files =="
git diff --name-status "$base" "$head"
echo "== Diff summary =="
git diff --stat "$base" "$head"
echo "== Changed Python outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Exact full diff for service, workflow, and inventory-related files =="
git diff --unified=80 "$base" "$head" -- \
services/workforce-validation-api \
.github/workflows/foundation-ci.yml \
tests/validate_repository.py \
package.json \
manifest.json \
| sed -n '1,5000p'
echo "== Locate repository inventory and Foundation test contracts =="
rg -n -i -C 6 \
'workforce-validation|workforce_validation|foundation-ci|pytest|PYTHONPATH|manifest|inventory|required|expected' \
.github tests scripts package.json \
-g '*.py' -g '*.json' -g '*.yml' -g '*.yaml' -g '*.mjs' \
| sed -n '1,5000p'
echo "== Current relevant files =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/tests/test_policy_runtime_integrity.py \
services/workforce-validation-api/pyproject.toml \
.github/workflows/foundation-ci.yml \
tests/validate_repository.py
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
doneLength of output: 194155 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="b609b0a46b835e4ba4c7f46f51088c5673dcbdb7"
echo "== Head commit and immediate `#236` patch =="
git show --format=fuller --stat "$head"
git show --format=fuller --unified=120 "$head" -- \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests/test_registry.py \
tests/test_foundation_ci_dependency_hygiene.sh \
.github/workflows/foundation-ci.yml
echo "== Complete Foundation CI dependency-hygiene contract =="
cat -n tests/test_foundation_ci_dependency_hygiene.sh
echo "== Base-to-head diff for the hygiene contract =="
git diff --unified=100 "$base" "$head" -- tests/test_foundation_ci_dependency_hygiene.sh
echo "== All Foundation CI test commands and hygiene assertions =="
rg -n -C 4 \
'PYTHONPATH=|python -m pytest|workforce-validation|candidate-evidence|keyverse-adapter|foundation-test' \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
.github/requirements/foundation-test.txt
echo "== Keyverse policy construction and evaluation =="
ast-grep outline packages/keyverse-adapter/src --items all 2>/dev/null || true
rg -n -C 12 \
'class PurposeBoundAccessPolicy|class PurposeBoundAccessRequest|def require_purpose_bound_access|AuthorizationDeniedError|permitted_fields|policy_version_code' \
packages/keyverse-adapter/src \
-g '*.py'
echo "== Service persistence, schema, and dependency references =="
rg -n -i -C 3 \
'public\.|postgres|psycopg|sqlalchemy|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|database|schema|read_validity_study' \
services/workforce-validation-api \
-g '*.py' -g '*.md' -g '*.toml'
echo "== Changed non-service files and gate removals =="
git diff --unified=20 "$base" "$head" -- .github/workflows/foundation-ci.yml tests/test_foundation_ci_dependency_hygiene.sh
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
.github/*|tests/*|scripts/*|package.json|manifest.json)
echo "--- $file"
git diff --numstat "$base" "$head" -- "$file"
;;
esac
doneLength of output: 77396 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="b609b0a46b835e4ba4c7f46f51088c5673dcbdb7"
workflow=".github/workflows/foundation-ci.yml"
echo "== Manifest changed in exact range? =="
git diff --name-status "$base" "$head" -- manifest.json
echo "== Checked-in manifest entry =="
jq -c --arg path "$workflow" '.files[] | select(.path == $path)' manifest.json
echo "== Current workflow metadata =="
printf 'sha256='
sha256sum "$workflow" | awk '{print $1}'
printf 'bytes='
wc -c < "$workflow" | tr -d ' '
printf '\nlines='
awk 'END { print NR }' "$workflow"
echo "== Base workflow manifest metadata =="
git show "$base:$workflow" | sha256sum | awk '{print "base_sha256=" $1}'
git show "$base:$workflow" | wc -c | tr -d ' ' | sed 's/^/base_bytes=/'
git show "$base:$workflow" | awk 'END { print "base_lines=" NR }'
echo "== Required-list and manifest validation logic around the workflow =="
rg -n -C 3 --fixed-strings "$workflow" tests/validate_repository.py scripts/foundation-contract-core.mjs
sed -n '179,202p' tests/validate_repository.pyLength of output: 3837
I found one blocking issue.
The requested current-head checks are otherwise sound:
You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="cf498b96c0308e5037ebe11441e77c3677b0bdac"
echo "== Commit identity and ancestry =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$base"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
echo "== Changed files and diff summary =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Full exact-range diff for review scope =="
git diff --unified=100 "$base" "$head" -- \
services/workforce-validation-api \
.github/workflows/foundation-ci.yml \
manifest.json \
tests/validate_repository.py \
tests/test_foundation_ci_dependency_hygiene.sh \
.github/requirements/foundation-test.txt \
package.json \
| sed -n '1,9000p'
echo "== Changed Python outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Current application, tests, documentation, CI, and manifest =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/tests/test_policy_runtime_integrity.py \
services/workforce-validation-api/README.md \
services/workforce-validation-api/pyproject.toml \
.github/workflows/foundation-ci.yml \
manifest.json \
tests/validate_repository.py \
tests/test_foundation_ci_dependency_hygiene.sh
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
done
echo "== Manifest seal for Foundation workflow =="
workflow=".github/workflows/foundation-ci.yml"
echo "manifest_entry:"
jq -c --arg path "$workflow" '.files[] | select(.path == $path)' manifest.json
echo "current_sha256=$(sha256sum "$workflow" | awk '{print $1}')"
echo "current_bytes=$(wc -c < "$workflow" | tr -d ' ')"
echo "current_lines=$(awk 'END {print NR}' "$workflow")"
echo "base_manifest_entry:"
git show "$base:manifest.json" | jq -c --arg path "$workflow" '.files[] | select(.path == $path)'
echo "== Authorization, persistence, and forbidden dependency scan =="
rg -n -i -C 5 \
'require_purpose_bound_access|read_validity_study|_detach_policy|ValidityStudyRecord|object\.__setattr__|public\.|postgres|psycopg|sqlalchemy|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|people-api|job-analysis-api' \
services/workforce-validation-api \
packages/keyverse-adapter/src/orgmetra_keyverse_adapter \
-g '*.py' -g '*.md' -g '*.toml'
echo "== Gate and contract removals in exact range =="
git diff --diff-filter=D --name-status "$base" "$head"
git diff --unified=40 "$base" "$head" -- \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
.github/requirements/foundation-test.txt \
manifest.json \
package.jsonLength of output: 200831
I found no blocking issue in the requested scope.
Hosted CI must still provide terminal results for this exact head. The README states that condition correctly. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="0ac2255321eaf1d0068978b931990f4d9c9f1c85"
test_first="9a83ff0b373799297c0c1daede645da11296c388"
parent="$(git show -s --format=%P "$head")"
echo "== Commit identity and ancestry =="
for commit in "$base" "$test_first" "$parent" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$commit"
done
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
git merge-base --is-ancestor "$test_first" "$head" && echo "test_first_is_ancestor=yes"
echo "== Exact-range and `#249` incremental changes =="
git diff --name-status "$base" "$head"
echo "-- test-first to production head --"
git diff --name-status "$test_first" "$head"
git diff --stat "$test_first" "$head"
git diff --check "$test_first" "$head"
git diff --unified=220 "$test_first" "$head" -- \
services/workforce-validation-api \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json \
packages/keyverse-adapter \
database/migrations
echo "== Candidate source outline =="
ast-grep outline \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
--items all
echo "== Current boundary source and `#249` regression =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests/test_read_port_capability_integrity.py \
services/workforce-validation-api/tests/test_read_port_dependency_integrity.py \
services/workforce-validation-api/tests/test_principal_storage_integrity.py \
services/workforce-validation-api/tests/test_uuid_payload_integrity.py \
services/workforce-validation-api/tests/test_view_issuance_integrity.py \
services/workforce-validation-api/tests/test_uuid_storage_integrity.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/README.md \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json
do
if git cat-file -e "${head}:${file}" 2>/dev/null; then
echo "--- $file"
git show "${head}:${file}" | cat -n
fi
done
echo "== Exact function capture, authorization ordering, and invocation evidence =="
git grep -n -I -E \
'getattr_static|read_capability|read_validity_study|__getattribute__|__get__|callable\(|ValidationPrincipal\(|_detach_policy|PurposeBoundAccessRequest|require_purpose_bound_access|type\(persisted\)|_require_operational_uuid|_issue_validity_study_view' \
"$head" -- services/workforce-validation-api \
|| true
echo "== All repository read capability definitions and dynamic lookup sites =="
git grep -n -I -E \
'def read_validity_study|\.read_validity_study[[:space:]]*\(|getattr\(.*read_validity_study|__getattribute__' \
"$head" -- services/workforce-validation-api \
|| true
echo "== Scope expansion, Keyverse, SQL, schema, and route checks =="
echo "-- Keyverse changes --"
git diff --name-status "$base" "$head" -- packages/keyverse-adapter
echo "-- Global migration changes --"
git diff --name-status "$base" "$head" -- database/migrations
echo "-- Removed paths --"
git diff --diff-filter=D --name-status "$base" "$head"
echo "-- SQL/schema/route references --"
git grep -n -I -E \
'public\.|psycopg|sqlalchemy|asyncpg|\bSELECT\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b|CREATE TABLE|ALTER TABLE|DROP TABLE|CREATE ROLE|ALTER ROLE|SET ROLE|search_path|FastAPI|openapi' \
"$head" -- services/workforce-validation-api \
|| true
echo "== Foundation admission and manifest integrity =="
git show "${head}:.github/workflows/foundation-ci.yml" | \
grep -n -E -C 5 'workforce.validation|workforce_validation|pytest|PYTHONPATH|postgres|manifest|validate' || true
git show "${head}:tests/test_foundation_ci_dependency_hygiene.sh" | \
grep -n -E -C 5 'workforce.validation|workforce_validation|PYTHONPATH|pytest|lock|require' || true
python - "$base" "$head" <<'PY'
import hashlib
import json
import subprocess
import sys
base, head = sys.argv[1:]
manifest = json.loads(subprocess.check_output(
["git", "show", f"{head}:manifest.json"], text=True
))
entries = {entry["path"]: entry for entry in manifest.get("files", [])}
for path in subprocess.check_output(
["git", "diff", "--name-only", base, head], text=True
).splitlines():
if path in entries:
data = subprocess.check_output(["git", "show", f"{head}:{path}"])
actual = {
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": data.count(b"\n"),
}
print(path)
print(" manifest=" + json.dumps(entries[path], sort_keys=True))
print(" actual=" + json.dumps(actual, sort_keys=True))
PYLength of output: 146016
I found no blocking defect in the requested static scope. Issue
The
The retained
The canonical Foundation controls remain intact.
This is independent static evidence only. Hosted Foundation, PostgreSQL, coverage, and security results remain required for exact-head acceptance. You are interacting with an AI system. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="0ac2255321eaf1d0068978b931990f4d9c9f1c85"
head="db7ce6b117052ea4fba59e61f15fd22389abe194"
echo "== Commit identity and ancestry =="
for commit in "$base" "$prior" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$commit"
done
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git merge-base --is-ancestor "$prior" "$head" && echo 'prior_is_ancestor=yes'
echo "== Repair delta =="
git diff --name-status "$prior" "$head"
git diff --check "$prior" "$head"
git diff --unified=180 "$prior" "$head" -- \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests \
services/workforce-validation-api/README.md
echo "== Registry outline and exact source =="
ast-grep outline \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
--items all
git show "${head}:services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py" \
| cat -n
echo "== Exact-head tests for the repair and capability boundary =="
git ls-tree -r --name-only "$head" services/workforce-validation-api/tests \
| rg 'uuid|read_port|capability|registry|integrity' \
| while IFS= read -r file; do
echo "--- $file"
git show "${head}:${file}" | cat -n
done
echo "== Static protocol and invocation surfaces =="
git grep -n -I -E \
'class ValidityStudyReadPort|def read_validity_study|[[:space:]]\.\.\.[[:space:]]*$|getattr_static|FunctionType|read_capability|read_port\.read_validity_study|__getattribute__|__get__|__eq__|__ne__|AttributeError|UUID|\.int' \
"$head" -- services/workforce-validation-api \
|| true
echo "== Imports in registry and package public exports =="
git show "${head}:services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py" \
| sed -n '1,100p'
git show "${head}:services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py" \
| cat -n
echo "== Retained scope and gate checks =="
git diff --name-status "$base" "$head" -- packages/keyverse-adapter database/migrations
git diff --diff-filter=D --name-status "$base" "$head"
git grep -n -I -E \
'public\.|psycopg|sqlalchemy|asyncpg|\bSELECT\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b|FastAPI|openapi' \
"$head" -- services/workforce-validation-api \
|| true
git show "${head}:.github/workflows/foundation-ci.yml" \
| grep -n -E -C 3 'workforce.validation|workforce_validation|pytest|PYTHONPATH|postgres' || trueLength of output: 110687
I found one blocking issue.
The requested repair checks are otherwise correct.
This is static review evidence only. It does not establish hosted GREEN or approval. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
test_first_prefix="14c10e8"
head="72ec2296cbc6b2df94e9c4e7394a8990061d0c88"
parent="$(git show -s --format=%P "$head")"
echo "== Exact commits and ancestry =="
for commit in "$base" "$parent" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$commit"
done
test_first="$(git rev-parse "${test_first_prefix}^{commit}")"
git show -s --format='test_first=%H%nparents=%P%nsubject=%s%n' "$test_first"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
git merge-base --is-ancestor "$test_first" "$head" && echo "test_first_is_ancestor=yes"
echo "== Issue `#253` test-first and production deltas =="
git diff --name-status "$(git show -s --format=%P "$test_first")" "$test_first"
git diff --unified=160 "$(git show -s --format=%P "$test_first")" "$test_first" -- services/workforce-validation-api
git diff --name-status "$parent" "$head"
git diff --check "$parent" "$head"
git diff --unified=200 "$parent" "$head" -- \
services/workforce-validation-api \
packages/keyverse-adapter \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json \
database/migrations
echo "== Registry map and narrow source region =="
registry="services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py"
ast-grep outline "$registry" --items all
rg -n -A180 -B35 \
'class ValidityStudyReadPort|def read_validity_study\(|getattr_static|read_capability|FunctionType|ValidationPrincipal\(|_detach_policy|PurposeBoundAccessRequest|require_purpose_bound_access|type\(persisted\)' \
"$registry"
echo "== Issue `#253` tests and all port-method accesses =="
fd -t f -e py . services/workforce-validation-api/tests | sort | while IFS= read -r file; do
if rg -q 'ValidityStudyReadPort|inherited|placeholder|read_capability|read_validity_study' "$file"; then
echo "--- $file"
cat -n "$file"
fi
done
rg -n -C 5 \
'\.read_validity_study\s*\(|getattr\([^)]*read_validity_study|__getattribute__|getattr_static|read_capability\s*\(' \
services/workforce-validation-api -g '*.py'
echo "== Exact-head Protocol declaration and class-method override inventory =="
rg -n -C 4 \
'class .*ValidityStudyReadPort|class .*ReadPort|def read_validity_study\s*\(' \
services/workforce-validation-api -g '*.py'
echo "== Scope, gates, and seals =="
git diff --name-status "$base" "$head" -- packages/keyverse-adapter database/migrations
git diff --diff-filter=D --name-status "$base" "$head"
git grep -n -I -E \
'public\.|psycopg|sqlalchemy|asyncpg|\bSELECT\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b|FastAPI|openapi' \
"$head" -- services/workforce-validation-api || true
git show "${head}:.github/workflows/foundation-ci.yml" | rg -n -C 3 \
'workforce.validation|workforce_validation|pytest|PYTHONPATH|postgres|manifest|validate' || true
git show "${head}:tests/test_foundation_ci_dependency_hygiene.sh" | rg -n -C 3 \
'workforce.validation|workforce_validation|PYTHONPATH|pytest|lock|require' || true
python - "$base" "$head" <<'PY'
import hashlib, json, subprocess, sys
base, head = sys.argv[1:]
manifest = json.loads(subprocess.check_output(["git", "show", f"{head}:manifest.json"], text=True))
entries = {entry["path"]: entry for entry in manifest.get("files", [])}
paths = subprocess.check_output(["git", "diff", "--name-only", base, head], text=True).splitlines()
for path in paths:
if path in entries:
data = subprocess.check_output(["git", "show", f"{head}:{path}"])
actual = {"sha256": hashlib.sha256(data).hexdigest(), "bytes": len(data), "lines": data.count(b"\n")}
print(f"{path}: sealed={json.dumps(entries[path], sort_keys=True)} actual={json.dumps(actual, sort_keys=True)}")
PYLength of output: 113524
I found no blocking defect in the requested static scope. Issue
The production repair rejects the executable Protocol placeholder.
The
The retained authorization and ownership controls remain intact.
This is static review evidence only. It does not establish hosted GREEN, coverage completion, security completion, or approval. You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="72ec2296cbc6b2df94e9c4e7394a8990061d0c88"
head="c91df2374eaf65bb36a337854cd231c601e93cb7"
echo "== Exact commit identity and ancestry =="
for commit in "$base" "$prior" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$commit"
done
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git merge-base --is-ancestor "$prior" "$head" && echo 'prior_is_ancestor=yes'
echo "== Successor chain after prior head =="
git rev-list --reverse --ancestry-path "${prior}..${head}" | while IFS= read -r commit; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$commit"
done
echo "== Exact-range and successor changes =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --name-status "$prior" "$head"
git diff --check "$prior" "$head"
git diff --unified=160 "$prior" "$head" -- \
tests/test_workforce_validation_owner_schema_postgres.sh \
.github/workflows/foundation-ci.yml \
tests/validate_repository.py \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json \
package.json \
.github/requirements/foundation-test.txt
echo "== Locate all candidate inventory and workflow files =="
fd -t f . .github tests | sort | rg 'foundation|validate|inventory|manifest|workforce_validation|workforce-validation|postgres'
echo "== Current candidate file contents =="
for file in \
tests/test_workforce_validation_owner_schema_postgres.sh \
.github/workflows/foundation-ci.yml \
tests/validate_repository.py \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json \
package.json \
.github/requirements/foundation-test.txt
do
if git cat-file -e "${head}:${file}" 2>/dev/null; then
echo "--- $file"
git show "${head}:${file}" | cat -n
fi
done
echo "== All exact-head references to PostgreSQL owner-schema contract and required inventories =="
git grep -n -I -E \
'test_workforce_validation_owner_schema_postgres\.sh|workforce.validation|workforce_validation|REQUIRED|required.files|inventory|validate_repository|foundation-ci|postgres:16\.14|postgres' \
"$head" -- \
.github tests manifest.json package.json README.md services/workforce-validation-api \
|| true
echo "== Workflow execution commands and acceptance-path duplication scan =="
git show "${head}:.github/workflows/foundation-ci.yml" | \
rg -n -C 5 \
'test_workforce_validation_owner_schema_postgres\.sh|workforce.validation|workforce_validation|pytest|postgres|services:' \
|| true
git grep -n -I -E \
'(^|[[:space:]/])test_workforce_validation_owner_schema_postgres\.sh([[:space:]]|$)|docker run.*postgres|postgres:16\.14' \
"$head" -- . \
|| true
echo "== Inventory definitions and current membership =="
git grep -n -I -E \
'REQUIRED|required.*file|test_workforce_validation_owner_schema_postgres\.sh|test_foundation_ci_dependency_hygiene\.sh|foundation-ci\.yml' \
"$head" -- tests .github manifest.json package.json \
|| true
echo "== Gate removals and scope changes =="
git diff --diff-filter=D --name-status "$base" "$head"
git diff --name-status "$base" "$head" -- \
packages/keyverse-adapter database/migrations services/workforce-validation-api/src
echo "== Manifest checks for changed manifest-tracked files =="
python - "$base" "$head" <<'PY'
import hashlib
import json
import subprocess
import sys
base, head = sys.argv[1:]
manifest = json.loads(subprocess.check_output(["git", "show", f"{head}:manifest.json"], text=True))
entries = {entry["path"]: entry for entry in manifest.get("files", [])}
paths = subprocess.check_output(
["git", "diff", "--name-only", base, head], text=True
).splitlines()
for path in paths:
if path in entries:
data = subprocess.check_output(["git", "show", f"{head}:{path}"])
actual = {
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": data.count(b"\n"),
}
print(f"{path}: sealed={json.dumps(entries[path], sort_keys=True)} actual={json.dumps(actual, sort_keys=True)}")
PYLength of output: 140403 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="72ec2296cbc6b2df94e9c4e7394a8990061d0c88"
first="195ffef5026625d5e1d36b0dbd0175acb4f65108"
head="c91df2374eaf65bb36a337854cd231c601e93cb7"
echo "== Immediate successor diffs for provenance controls =="
for pair in "$prior $first" "$first $head"; do
set -- $pair
echo "--- $1..$2"
git diff --name-status "$1" "$2"
git diff --unified=100 "$1" "$2" -- \
scripts/foundation-contract-core.mjs \
tests/validate_repository.py \
manifest.json \
tests/dispatcher-inventory.test.mjs \
tests/foundation-contract.test.mjs \
.github/workflows/foundation-ci.yml
done
echo "== JavaScript canonical inventory definition and parity tests =="
ast-grep outline scripts/foundation-contract-core.mjs --items all
git show "${head}:scripts/foundation-contract-core.mjs" | \
rg -n -C 8 'REQUIRED_FILES|test_workforce_validation_owner_schema_postgres\.sh|Object\.freeze'
git show "${head}:tests/dispatcher-inventory.test.mjs" | cat -n
git show "${head}:tests/foundation-contract.test.mjs" | sed -n '1,145p' | cat -n
echo "== Exact-head blob digest comparison against manifest =="
python - "$head" <<'PY'
import hashlib
import json
import subprocess
import sys
head = sys.argv[1]
manifest = json.loads(subprocess.check_output(["git", "show", f"{head}:manifest.json"], text=True))
entries = {entry["path"]: entry for entry in manifest["files"]}
for path in (
"scripts/foundation-contract-core.mjs",
"tests/validate_repository.py",
"tests/test_workforce_validation_owner_schema_postgres.sh",
".github/workflows/foundation-ci.yml",
):
data = subprocess.check_output(["git", "show", f"{head}:{path}"])
actual = {"sha256": hashlib.sha256(data).hexdigest(), "bytes": len(data), "lines": len(data.decode("utf-8").splitlines())}
print(f"{path}\n sealed={entries.get(path)}\n actual={actual}")
PY
echo "== All manifest entry history for the affected files =="
for commit in "$base" "$prior" "$first" "$head"; do
echo "--- $commit"
git show "${commit}:manifest.json" | jq -c \
'.files[] | select(.path == "scripts/foundation-contract-core.mjs" or .path == "tests/validate_repository.py" or .path == "tests/test_workforce_validation_owner_schema_postgres.sh")'
done
echo "== Exact-head acceptance-path references and duplicate count =="
git grep -n -I -E 'test_workforce_validation_owner_schema_postgres\.sh' "$head" -- . || true
echo -n "workflow-list occurrences: "
git show "${head}:.github/workflows/foundation-ci.yml" | grep -c '^[[:space:]]*test_workforce_validation_owner_schema_postgres\.sh$' || true
echo -n "python REQUIRED occurrences: "
git show "${head}:tests/validate_repository.py" | grep -c '"tests/test_workforce_validation_owner_schema_postgres.sh"' || true
echo -n "javascript REQUIRED occurrences: "
git show "${head}:scripts/foundation-contract-core.mjs" | grep -c '"tests/test_workforce_validation_owner_schema_postgres.sh"' || true
echo "== Check stale standalone execution paths in workflows and package scripts =="
git grep -n -I -E 'test_workforce_validation_owner_schema_postgres\.sh|Run PostgreSQL contracts|contracts=\(' \
"$head" -- .github package.json scripts tests || trueLength of output: 48944
I found one blocking issue.
The requested provenance admission is otherwise correct.
This is static review evidence only. It does not establish hosted GREEN or approval. You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="c91df2374eaf65bb36a337854cd231c601e93cb7"
head="e87d28a32683c6e6f115b3d13645b7d263451795"
echo "== Exact commit identity and ancestry =="
for commit in "$base" "$prior" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$commit"
done
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git merge-base --is-ancestor "$prior" "$head" && echo 'prior_is_ancestor=yes'
echo "== Successor chain and changed paths =="
git rev-list --reverse --ancestry-path "${prior}..${head}" |
xargs -r -n1 git show -s --format='commit=%H%nparents=%P%nsubject=%s'
git diff --name-status "$prior" "$head"
git diff --stat "$prior" "$head"
git diff --check "$prior" "$head"
git diff --unified=140 "$prior" "$head" -- \
scripts/foundation-contract-core.mjs \
tests/validate_repository.py \
manifest.json \
tests/test_workforce_validation_owner_schema_postgres.sh \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
services/workforce-validation-api \
database/migrations \
packages/keyverse-adapter
echo "== Canonical inventory membership and workflow execution =="
for file in \
scripts/foundation-contract-core.mjs \
tests/validate_repository.py \
.github/workflows/foundation-ci.yml \
tests/test_workforce_validation_owner_schema_postgres.sh \
manifest.json
do
echo "--- $file"
git show "${head}:${file}" | rg -n -C 5 \
'test_workforce_validation_owner_schema_postgres\.sh|REQUIRED_FILES|REQUIRED|postgres:16\.14|contracts=\(|validate_repository|manifest' \
|| true
done
echo "== Exact manifest metadata comparison =="
python - "$head" <<'PY'
import hashlib
import json
import subprocess
import sys
head = sys.argv[1]
paths = (
"scripts/foundation-contract-core.mjs",
"tests/validate_repository.py",
"tests/test_workforce_validation_owner_schema_postgres.sh",
".github/workflows/foundation-ci.yml",
)
manifest = json.loads(subprocess.check_output(
["git", "show", f"{head}:manifest.json"], text=True
))
entries = {item["path"]: item for item in manifest["files"]}
for path in paths:
data = subprocess.check_output(["git", "show", f"{head}:{path}"])
actual = {
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": data.count(b"\n"),
}
print(f"{path}\n sealed={json.dumps(entries.get(path), sort_keys=True)}\n actual={json.dumps(actual, sort_keys=True)}")
PY
echo "== Acceptance-path reference counts =="
echo -n "workflow standalone commands: "
git show "${head}:.github/workflows/foundation-ci.yml" |
grep -c '^[[:space:]]*test_workforce_validation_owner_schema_postgres\.sh$' || true
echo -n "node required entries: "
git show "${head}:scripts/foundation-contract-core.mjs" |
grep -c '"tests/test_workforce_validation_owner_schema_postgres.sh"' || true
echo -n "python required entries: "
git show "${head}:tests/validate_repository.py" |
grep -c '"tests/test_workforce_validation_owner_schema_postgres.sh"' || true
echo "all exact-head contract references:"
git grep -n -I 'test_workforce_validation_owner_schema_postgres\.sh' "$head" -- . || true
echo "== Repair-range gate, runtime, and schema scope =="
echo "-- removed paths --"
git diff --diff-filter=D --name-status "$prior" "$head"
echo "-- gate changes --"
git diff --name-status "$prior" "$head" -- \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
scripts/foundation-contract-core.mjs \
tests/validate_repository.py \
manifest.json
echo "-- application/schema/Keyverse changes --"
git diff --name-status "$prior" "$head" -- \
services/workforce-validation-api \
database/migrations \
packages/keyverse-adapterLength of output: 29250 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="e87d28a32683c6e6f115b3d13645b7d263451795"
echo "== Static canonical inventory and manifest set parity =="
python - "$head" <<'PY'
import ast
import hashlib
import json
import re
import subprocess
import sys
head = sys.argv[1]
def show(path):
return subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
node = show("scripts/foundation-contract-core.mjs")
python_source = show("tests/validate_repository.py")
manifest = json.loads(show("manifest.json"))
node_match = re.search(
r"export const REQUIRED_FILES = Object\.freeze\(\[(.*?)\]\);",
node,
flags=re.DOTALL,
)
if not node_match:
raise SystemExit("Could not parse Node REQUIRED_FILES")
node_required = re.findall(r"['\"]([^'\"]+)['\"]", node_match.group(1))
tree = ast.parse(python_source, filename="tests/validate_repository.py")
python_required = None
for statement in tree.body:
if isinstance(statement, ast.Assign) and any(
isinstance(target, ast.Name) and target.id == "REQUIRED"
for target in statement.targets
):
python_required = ast.literal_eval(statement.value)
break
if python_required is None:
raise SystemExit("Could not parse Python REQUIRED")
manifest_paths = [entry["path"] for entry in manifest["files"]]
expected = set(python_required) - {"manifest.json"}
for label, paths in (
("node_required", node_required),
("python_required", python_required),
("manifest_paths", manifest_paths),
):
duplicates = sorted({item for item in paths if paths.count(item) > 1})
print(f"{label}_count={len(paths)} duplicates={duplicates}")
print(f"node_python_symmetric_difference={sorted(set(node_required) ^ set(python_required))}")
print(f"python_manifest_missing={sorted(expected - set(manifest_paths))}")
print(f"python_manifest_extra={sorted(set(manifest_paths) - expected)}")
for path in (
"scripts/foundation-contract-core.mjs",
"tests/validate_repository.py",
"tests/test_workforce_validation_owner_schema_postgres.sh",
):
data = subprocess.check_output(["git", "show", f"{head}:{path}"])
entry = next(item for item in manifest["files"] if item["path"] == path)
actual = {
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": len(data.decode("utf-8").splitlines()),
}
print(f"{path}: exact_match={all(entry[key] == value for key, value in actual.items())} sealed={entry} actual={actual}")
PY
echo "== Single executable PostgreSQL acceptance path =="
git show "${head}:.github/workflows/foundation-ci.yml" |
sed -n '70,122p' | cat -n
echo "contract list member count:"
git show "${head}:.github/workflows/foundation-ci.yml" |
grep -c '^[[:space:]]*test_workforce_validation_owner_schema_postgres\.sh$' || true
echo "all executable shell references outside the Foundation workflow:"
git grep -n -I -E '(^|[[:space:]/])test_workforce_validation_owner_schema_postgres\.sh([[:space:]]|$)' \
"$head" -- . ':!.github/workflows/foundation-ci.yml' \
|| trueLength of output: 7778
I found no blocking defect in the requested scope. The
The three repaired seals are exact.
The acceptance path remains singular.
The repair introduces no gate weakening or unrelated behavior change.
This is independent static evidence for You are interacting with an AI system. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="c91df2374eaf65bb36a337854cd231c601e93cb7"
head="e87d28a32683c6e6f115b3d13645b7d263451795"
contract="tests/test_workforce_validation_owner_schema_postgres.sh"
echo "== Commit identity and ancestry =="
for commit in "$base" "$prior" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$commit"
done
printf 'merge-base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git merge-base --is-ancestor "$prior" "$head" && echo 'prior_is_ancestor=yes'
echo "== Causal successors and immediate diffs =="
git rev-list --reverse --ancestry-path "${prior}..${head}" |
xargs -r -n1 git show -s --format='commit=%H%nparents=%P%nsubject=%s'
git diff --name-status "$prior" "$head"
git diff --check "$prior" "$head"
git diff --unified=140 "$prior" "$head" -- \
scripts/foundation-contract-core.mjs \
tests/validate_repository.py \
"$contract" \
manifest.json \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/dispatcher-inventory.test.mjs \
tests/foundation-contract.test.mjs
echo "== Current inventory, workflow, validator, and manifest sources =="
for file in \
scripts/foundation-contract-core.mjs \
tests/validate_repository.py \
"$contract" \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/dispatcher-inventory.test.mjs \
tests/foundation-contract.test.mjs \
manifest.json
do
echo "--- $file"
git show "${head}:${file}" | cat -n
done
echo "== Exact-head contract references and counts =="
git grep -n -I -E 'test_workforce_validation_owner_schema_postgres\.sh' "$head" -- . || true
printf 'workflow executable command count='
git show "${head}:.github/workflows/foundation-ci.yml" |
grep -c '^[[:space:]]*tests/test_workforce_validation_owner_schema_postgres\.sh[[:space:]]*$' || true
printf 'Node REQUIRED_FILES membership count='
git show "${head}:scripts/foundation-contract-core.mjs" |
grep -c '"tests/test_workforce_validation_owner_schema_postgres.sh"' || true
printf 'Python REQUIRED membership count='
git show "${head}:tests/validate_repository.py" |
grep -c '"tests/test_workforce_validation_owner_schema_postgres.sh"' || true
echo "== Exact manifest verification for required contract and changed tracked files =="
python - "$base" "$head" <<'PY'
import hashlib
import json
import subprocess
import sys
base, head = sys.argv[1:]
manifest = json.loads(subprocess.check_output(["git", "show", f"{head}:manifest.json"], text=True))
entries = {entry["path"]: entry for entry in manifest["files"]}
changed = set(subprocess.check_output(
["git", "diff", "--name-only", base, head], text=True
).splitlines())
required = {
"scripts/foundation-contract-core.mjs",
"tests/validate_repository.py",
"tests/test_workforce_validation_owner_schema_postgres.sh",
}
for path in sorted(changed | required):
if path not in entries:
if path in required:
print(f"{path}: MISSING_MANIFEST_ENTRY")
continue
data = subprocess.check_output(["git", "show", f"{head}:{path}"])
actual = {
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": data.count(b"\n"),
}
print(f"{path}: sealed={json.dumps(entries[path], sort_keys=True)} actual={json.dumps(actual, sort_keys=True)}")
PY
echo "== Exact-set and coverage gate changes =="
git diff --unified=120 "$base" "$head" -- \
scripts/foundation-contract-core.mjs \
tests/validate_repository.py \
tests/dispatcher-inventory.test.mjs \
tests/foundation-contract.test.mjs \
tests/test_foundation_ci_dependency_hygiene.sh \
.github/workflows/foundation-ci.yml \
services/workforce-validation-api/pyproject.toml \
manifest.json
echo "-- deleted paths --"
git diff --diff-filter=D --name-status "$base" "$head"
echo "== Scope checks outside provenance repair =="
git diff --name-status "$prior" "$head" -- \
':!scripts/foundation-contract-core.mjs' \
':!tests/validate_repository.py' \
':!manifest.json'
git diff --name-status "$base" "$head" -- \
packages/keyverse-adapter \
database/migrations \
services/workforce-validation-api/src \
services/workforce-validation-api/databaseLength of output: 190605 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="e87d28a32683c6e6f115b3d13645b7d263451795"
python - "$head" <<'PY'
import hashlib
import json
import re
import subprocess
import sys
head = sys.argv[1]
def show(path):
return subprocess.check_output(["git", "show", f"{head}:{path}"])
node = show("scripts/foundation-contract-core.mjs").decode("utf-8")
python_source = show("tests/validate_repository.py").decode("utf-8")
workflow = show(".github/workflows/foundation-ci.yml").decode("utf-8")
manifest = json.loads(show("manifest.json"))
node_block = re.search(r"REQUIRED_FILES = Object\.freeze\(\[(.*?)\]\);", node, re.S)
python_block = re.search(r"REQUIRED = \[(.*?)\]\n\]", python_source, re.S)
assert node_block and python_block, "required inventory block not found"
node_required = re.findall(r"^\s*'([^']+)',\s*$", node_block.group(1), re.M)
python_required = re.findall(r'^\s*"([^"]+)",\s*$', python_block.group(1), re.M)
manifest_entries = {entry["path"]: entry for entry in manifest["files"]}
print(f"node_count={len(node_required)} node_unique={len(set(node_required))}")
print(f"python_count={len(python_required)} python_unique={len(set(python_required))}")
print(f"node_minus_python={sorted(set(node_required) - set(python_required))}")
print(f"python_minus_node={sorted(set(python_required) - set(node_required))}")
print(f"node_duplicates={sorted({x for x in node_required if node_required.count(x) > 1})}")
print(f"python_duplicates={sorted({x for x in python_required if python_required.count(x) > 1})}")
expected_manifest_paths = set(python_required) - {"manifest.json"}
actual_manifest_paths = set(manifest_entries)
print(f"manifest_missing={sorted(expected_manifest_paths - actual_manifest_paths)}")
print(f"manifest_extra={sorted(actual_manifest_paths - expected_manifest_paths)}")
metadata_errors = []
for path in sorted(expected_manifest_paths):
data = show(path)
expected = {
"path": path,
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": len(data.decode("utf-8").splitlines()),
}
observed = manifest_entries[path]
if any(observed.get(key) != value for key, value in expected.items()):
metadata_errors.append((path, observed, expected))
print(f"manifest_metadata_error_count={len(metadata_errors)}")
for error in metadata_errors:
print(f"manifest_metadata_error={error}")
contracts_block = re.search(
r"contracts=\(\n(.*?)\n\s*\)\n\s*for contract in", workflow, re.S
)
assert contracts_block, "workflow PostgreSQL contracts array not found"
workflow_contracts = re.findall(r"^\s*([a-z0-9_]+\.sh)\s*$", contracts_block.group(1), re.M)
target = "test_workforce_validation_owner_schema_postgres.sh"
print(f"workflow_target_array_count={workflow_contracts.count(target)}")
print(f"workflow_target_all_occurrences={workflow.count(target)}")
print(f"workflow_contract_duplicates={sorted({x for x in workflow_contracts if workflow_contracts.count(x) > 1})}")
PY
echo "== Exact repair scope and whitespace validation =="
git diff --check c91df2374eaf65bb36a337854cd231c601e93cb7 e87d28a32683c6e6f115b3d13645b7d263451795
git diff --name-status c91df2374eaf65bb36a337854cd231c601e93cb7 e87d28a32683c6e6f115b3d13645b7d263451795Length of output: 3664 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="e87d28a32683c6e6f115b3d13645b7d263451795"
python - "$head" <<'PY'
import hashlib
import json
import re
import subprocess
import sys
head = sys.argv[1]
def text(path):
return subprocess.check_output(["git", "show", f"{head}:{path}"]).decode("utf-8")
def between_lines(source, start_line, end_line):
lines = source.splitlines()
start = next(i for i, line in enumerate(lines) if line.strip() == start_line)
end = next(i for i in range(start + 1, len(lines)) if lines[i].strip() == end_line)
return "\n".join(lines[start + 1:end])
node = text("scripts/foundation-contract-core.mjs")
py = text("tests/validate_repository.py")
workflow = text(".github/workflows/foundation-ci.yml")
manifest = json.loads(text("manifest.json"))
node_list = between_lines(node, "export const REQUIRED_FILES = Object.freeze([", "]);")
py_list = between_lines(py, "REQUIRED = [", "]")
node_required = re.findall(r"^\s*'([^']+)',\s*$", node_list, re.M)
py_required = re.findall(r'^\s*"([^"]+)",\s*$', py_list, re.M)
entries = {entry["path"]: entry for entry in manifest["files"]}
print(f"node_count={len(node_required)} node_unique={len(set(node_required))}")
print(f"python_count={len(py_required)} python_unique={len(set(py_required))}")
print(f"node_minus_python={sorted(set(node_required) - set(py_required))}")
print(f"python_minus_node={sorted(set(py_required) - set(node_required))}")
print(f"node_duplicates={sorted({p for p in node_required if node_required.count(p) > 1})}")
print(f"python_duplicates={sorted({p for p in py_required if py_required.count(p) > 1})}")
expected_paths = set(py_required) - {"manifest.json"}
print(f"manifest_missing={sorted(expected_paths - set(entries))}")
print(f"manifest_extra={sorted(set(entries) - expected_paths)}")
errors = []
for path in sorted(expected_paths):
data = subprocess.check_output(["git", "show", f"{head}:{path}"])
expected = {
"path": path,
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": len(data.decode("utf-8").splitlines()),
}
if entries[path] != expected:
errors.append((path, entries[path], expected))
print(f"manifest_metadata_error_count={len(errors)}")
for item in errors:
print(f"manifest_metadata_error={item}")
contract_block = between_lines(workflow, "contracts=(", ")")
contracts = re.findall(r"^\s*([a-z0-9_]+\.sh)\s*$", contract_block, re.M)
target = "test_workforce_validation_owner_schema_postgres.sh"
print(f"workflow_target_array_count={contracts.count(target)}")
print(f"workflow_target_all_occurrences={workflow.count(target)}")
print(f"workflow_contract_duplicates={sorted({p for p in contracts if contracts.count(p) > 1})}")
PY
echo "== Exact successor scope and whitespace =="
git diff --check c91df2374eaf65bb36a337854cd231c601e93cb7 e87d28a32683c6e6f115b3d13645b7d263451795
git diff --name-status c91df2374eaf65bb36a337854cd231c601e93cb7 e87d28a32683c6e6f115b3d13645b7d263451795Length of output: 3530
I found no blocking defect in the requested
The manifest repair is exact.
The workflow has one execution path.
The repair does not weaken gates.
This is independent static review evidence. Hosted Foundation, PostgreSQL, coverage, and security results remain separate evidence for this exact head. You are interacting with an AI system. |
|
Current exact-head gate reconciliation — The previously non-terminal owner evidence has now settled. Foundation CodeQL PR All visible #235 review threads are resolved, but submitted reviews remain COMMENTED-only and no qualifying |
1 participant
Current exact-head authority — 2026-09-06
Protected base remains
develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; current exact head remainsdd95dd7256f37aab2c4f26aa1fb43e8c867f4e4d. The PR is open · Draft · mechanically mergeable. Predecessor checks/reviews remain causal evidence only.Boundary and retained repair lineage
Issue #234 identifies the P0/FR-007 Workforce Validation owner gap: governed validity-study headers/cases exist and
workforce_validationis the canonical bounded context, but protected truth still lacks the complete executable owner service/API. This lane retains purpose-before-persistence, field-minimized reads throughValidityStudyReadPort, executable-policy-scalar hardening, canonical 100% service coverage admission, and the service-localworkforce_validationbootstrap with deny-default NOLOGIN schema-owner authority.#236/#237 make persisted study and principal evidence structurally immutable. #238 verifies actual
SET ROLErather than relying on a NOLOGIN-role default-search_pathassumption. #239 reconstructs/revalidates principal storage before Keyverse authorization. #240 inertly validates repository capability before authorization. #241/#242 keep the minimizedValidityStudyViewstructurally immutable while treating it as data rather than reusable authority. #243/#244 reduce UUID authority to validated immutable scalar evidence and reject forged internal payloads. #245 removes the ordinary module-level projection issuer. #249 binds static capability validation to the same captured ordinary class function that is later invoked; #253 rejects the canonical Protocol declaration itself when inherited without a concrete override. #254 closes the canonical PostgreSQL provenance-inventory/manifest omission.#255 preserves the real hosted coverage RED from predecessor
e87d28a32683c6e6f115b3d13645b7d263451795: Workforce Validation ran 25/25 passing tests but stopped at 99.04% because one fail-closed exact-string branch in_detach_policy(...)was unexecuted. Test-only successordd95dd7256f37aab2c4f26aa1fb43e8c867f4e4dadds the hostilestr-subtype regression without changing production code, authorization semantics, SQL, migrations, workflows, manifests, PostgreSQL contracts or the 100% threshold.Exact-head acceptance
Foundation
33986151272is terminal SUCCESS on exactdd95dd725...: exact checkout, compile, runner-image contract, Foundation validation, dependency hygiene, owned unit/service contracts, isolated PostgreSQL contracts and read-only repository validation all passed. This is the current-head GREEN for #255.SAST Semgrep
33986151255is also terminal SUCCESS. Security Scan33986151270is terminal FAILURE only at dependency-review job101370642407: exact checkout/head verification succeed, thenCheck dependency review supportfails and the pinned Dependency Review action is skipped. Scorecard, Trivy and OSV succeed independently but are not substitutes. The causal owner remainsContextualWisdomLab/.github#810, which keeps the central workflow fail-closed while the public non-fork dependency-graph comparison continues returning HTTP 403.CodeQL PR
33986151302is terminal FAILURE at the central compatibility handoff, not at an Orgmetra SARIF/source finding. Language detection succeeds; both Python job101370698097and Actions job101370698098successfully request current-head CodeQL scan dispatch, then fail only atRelease runner or enforce current-head CodeQL verdict. The current central dispatcher-identity/allowlist incident is owned by.github#1927/#1929; do not add an Orgmetra no-op commit or synthesize a CodeQL verdict.All currently returned #235 review threads are resolved. Submitted reviews remain COMMENTED-only; no qualifying
APPROVEDreview is established. Therefore #235 remains Draft. #255 remains open through normal protected integration.Owner dependencies and next causal work
#235 is independent of mutable #63/#64/#65 source and starts from protected
develop. Child #248 preserves its migration/adapter/test/#250/#251/#252 delta but must not absorb mutable #235 source. After #235 completes authoritative central/security/review acceptance and integrates normally, #248 must non-force adopt the resulting protected truth, preserve parent #249/#253/#254/#255 plus its own valid delta, and reacquire exact-head coverage, PostgreSQL, security and review evidence.docs/product-technical-gap-baseline.mdremains single-writer-owned by #100. No self-approval, administrator bypass, gate weakening, no-op retrigger, predecessor-evidence transfer, mutable-owner dependency, force-push or premature release is authorized.