feat: add governed compensation change review packet

[seonghobae]

Buyer-visible scope

Adds a portable, value-minimized compensation-change review envelope before authoritative HRIS mutation or payroll execution. It binds tenant, Person, Employment, active Assignment/Job/Position snapshot, current/proposed compensation evidence, exact policy, pay-equity review, budget authorization, payroll-handoff provenance, requester/reviewer, effective date, and evidence version while excluding compensation values, protected-attribute values, credentials, and free-form case/model content. It remains human-review-only and grants no mutation or execution authority.

Integrity boundary retained

The branch preserves the recorded-time repair: caller-owned mutable tzinfo state is resolved once and detached into an exact built-in UTC datetime, with indeterminate/hostile timestamp providers failing closed. It also preserves strict exact-type evidence validation, controlled governance constants, tenant/reference privacy boundaries, complete canonical field coverage, and process-local creation-bound evidence integrity. The process-local seal remains defense-in-depth only, not durable authorization or portable signing.

Protected-parent adoption and causal repair

Current exact head is 13327760f71dbfacd0d02411a79c875ade0d7417 on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; the PR remains open · Draft.

Predecessor adoption aba3c1ca28a697259f7b5a6c9235a1d0641bd86d was conflict-free but semantically incomplete. Foundation 34005848591 failed at the explicit runner-image contract because .github/workflows/compensation-change-review-quality.yml survived protected #161's consolidation. Current 13327760... retires that leaf, invokes the package through canonical Foundation, preserves the exact 100% statement/branch coverage contract, adds executable regression against leaf resurrection, updates traceability/changelog, and reseals Foundation provenance (sha256=972ef8929abe93342eb11d000c490e397b44e6e34ddb41d317383ff67067ffe8, 6889 bytes, 126 lines). Production compensation-review source, database contracts, HR truth and coverage thresholds are unchanged.

Current acceptance and central-owner boundary

Foundation 34008716404 and SAST Semgrep 34008716427 are terminal SUCCESS on exact 13327760.... Security Scan 34008716459 is terminal FAILURE only at the dependency-review availability boundary: exact-head path classification, OSV, Trivy and Scorecard succeed, while the dependency-review lane cannot produce the authoritative Dependency Review verdict. Those successful scanners are retained as evidence but are not treated as substitutes for the required verdict.

CodeQL 34008716428 is terminal FAILURE, but the exact job graph shows both Actions and Python compatibility lanes successfully requested the current-head scan dispatch and failed only at Release runner or enforce current-head CodeQL verdict; this is the established central verdict-production/authorization handoff, not a demonstrated leaf SARIF/source finding. Orgmetra does not synthesize the missing verdict, add a fallback shim, weaken the gate, or no-op retrigger.

Historical b9e487cc... evidence—78 tests, 190/190 statements and 54/54 branches = 100.00%—remains predecessor-only. Keep Draft until authoritative Dependency Review/CodeQL and qualifying independent review are satisfied.

This packet does not calculate or authorize compensation, payroll, taxes, pay-equity findings, or employment decisions; it does not claim certification, deployed production integrations, durable signing infrastructure, or commercial release. No self-approval, routine administrator bypass, force-push/destructive rebase, or predecessor-evidence transfer.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c63ae1e-b52b-4711-b0ee-984c620fbdb1

📥 Commits

Reviewing files that changed from the base of the PR and between dc3fa7e and b1f1aa5.

📒 Files selected for processing (1)

• packages/compensation-change-review/tests/test_packet.py

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/compensation-change-review/tests/test_packet.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

보상 변경 검토 패킷의 최소화된 데이터 계약과 fail-closed 검증을 추가했습니다. 패킷은 결정적 canonical JSON과 SHA-256 digest를 사용합니다. 회귀 테스트, 추적성 문서와 GitHub Actions 품질 게이트도 추가했습니다.

Changes

보상 변경 검토

Layer / File(s)	Summary
거버넌스 계약과 추적성 docs/adr/..., docs/doctoring/..., docs/traceability/..., packages/compensation-change-review/README.md, packages/compensation-change-review/CHANGELOG.md	패킷의 데이터 경계, 식별자 규칙, 인간 검토, HRIS·급여 실행 소유권과 검증 근거를 문서화했습니다.
패킷 계약과 생성 구현 packages/compensation-change-review/src/..., packages/compensation-change-review/pyproject.toml	불변 CompensationChangeReviewPacket과 빌더를 추가했습니다. 입력을 검증하고 canonical JSON, SHA-256 digest, 민감정보 비노출과 발행 시점 무결성 검사를 제공합니다.
무결성 및 개인정보 회귀 검증 packages/compensation-change-review/tests/*	패킷 생성, 상태 제한, 참조 검증, UUID·문자열·시간 위조 방어, 발행 후 변조 탐지와 시간 정규화를 검증합니다.
자동 품질 게이트 .github/workflows/compensation-change-review-quality.yml	검증된 SHA 체크아웃, 고정된 테스트 도구 설치, 컴파일, pytest, 100% 문장·분기 커버리지와 깨끗한 작업 트리 검사를 실행합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to b1f1a

The packet behavior is unchanged by the latest fix, but the current head is not merge-ready because a required review gate has failed and other required checks are still incomplete. Merge should wait until all required checks are terminally green and the required approval is obtained.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 79.31% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 58 functions across 8 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 보상 변경 검토 패킷 추가라는 주요 변경을 정확하고 간결하게 설명합니다. 품질 게이트와 무결성 강화 세부 사항을 모두 포함하지 않아도 제목 기준을 충족합니다.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/governed-compensation-change-review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Review current exact head 2b78f0d3cfca5216b7c13794d296fd7550e9a8d5 against live develop@93f86ad6ab5083f4d82422d517d9352d7384d3be. Treat local-only and predecessor evidence as non-passing. Verify value-minimized—not anonymous—compensation-change review; opaque worker/current+proposed compensation/policy/pay-equity/budget/payroll-handoff references and independent digests; tenant-scoped reference re-resolution plus requester/reviewer authoritative identity separation; Person↔Employment↔active Assignment/Job/Position scope; no compensation/protected-attribute/free-form values; fully redacted repr; bounded positive evidence_version; human-only review with HRIS mutation and payroll execution unauthorized; exact 100% owned production statement/branch coverage and owned docstring contract; and that every repository workflow checked out this SHA. Submit formal APPROVE only if the unchanged head is merge-ready; otherwise REQUEST_CHANGES with the narrowest source-backed RED→GREEN finding.

[seonghobae]

@opencode-agent Please independently review exact current head ac439f35d8bd0b0ddfe0d7a739c5c97c5779d3b0 against live protected develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca. Treat predecessor evidence as stale. Verify CompensationChangeReviewPacket is value-minimized but correctly marks opaque worker/evidence correlation as personal data; binds tenant/Person/Employment/active Assignment-Job-Position scope, current/proposed compensation artifacts, exact policy, pay-equity review, budget authorization, payroll handoff, effective date, precision-preserving evidence time and bounded true-integer evidence_version with independent digests; excludes salary/wage/bonus/benefit/equity values, protected-attribute values, free-form case narrative and free-form model output; fully redacts representation; requires authoritative actor/scope/provenance re-resolution; and keeps payroll execution behind its published owner contract. Verify exact 100% owned production statement/branch coverage and actual checkout SHA for repository workflows. Submit formal APPROVE only if the unchanged exact head satisfies the live standard; otherwise REQUEST_CHANGES with the smallest source-backed RED→GREEN finding. Do not modify the branch or use author approval.

[seonghobae]

@opencode-agent review exact head ac439f35d8bd0b0ddfe0d7a739c5c97c5779d3b0 against live protected develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca. The earlier OpenCode request in this PR targeted predecessor 2b78... and is stale. Current Foundation CI, SAST Semgrep, Security Scan, Recovery Rehearsal Quality, and Compensation Change Review Quality are terminal GREEN; fresh formal review and thread queries show no reviews and no unresolved threads. Independently verify exact-tenant re-resolution, resolved requester/reviewer identity separation, Person→Employment/active Assignment/Job/Position scope, current/proposed compensation evidence and exact policy, pay-equity review, budget authorization, effective date and payroll-handoff provenance, value/protected-attribute minimization, redacted representation, bounded evidence version, and People-boundary/payroll-owner execution separation. Post a formal current-head APPROVE only if the unchanged exact head is technically mergeable; otherwise leave source-backed actionable findings. Do not use seonghobae approval.

[seonghobae]

@opencode-agent Please independently review exact current head a83a8b00d878ab810ffc614d5349e15b5fd2f90a against live protected develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca. Do not reuse predecessor-head evidence. Verify UUIDv4 opacity across all trust-reference and replacement paths, exact-tenant authoritative Person↔Employment↔active Assignment/Job/Position resolution, distinct resolved requester/reviewer identities, exact current/proposed compensation/policy/pay-equity/budget/effective-date/payroll-handoff provenance, bounded evidence-version identity, strict exclusion of compensation/protected-attribute/free-form/model-output values, explicit personal-data handling, and the People-mutation/payroll-owner boundary. Exact-head workflows remain queued/pending and are non-passing. Submit a formal independent APPROVE only if the unchanged head satisfies the live contract; otherwise leave the narrowest source-backed actionable finding tied to this SHA. Do not modify or merge the branch.

[seonghobae]

@opencode-agent Please independently review exact current head a83a8b00d878ab810ffc614d5349e15b5fd2f90a against protected develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca. Fresh exact-head Compensation Change Review Quality, Foundation CI, Recovery Rehearsal, SAST, and Security runs are terminal success. Re-read the current diff and verify canonical UUIDv4 trust references, evidence-version/digest determinism, requester/reviewer authoritative separation, Person↔Employment↔active Assignment/Job/Position re-resolution, current/proposed compensation/policy/pay-equity/budget/effective-date/payroll-handoff provenance, explicit personal-data sensitivity with compensation/protected-attribute/free-form value exclusion, and that HRIS mutation and payroll execution remain behind their authoritative owner boundaries. If this unchanged head satisfies the independent review standard, submit a formal APPROVE; otherwise leave only exact-head source-backed actionable findings. Do not modify, merge, weaken gates, or reuse predecessor evidence.

[seonghobae]

@opencode-agent Please independently review exact current head a83a8b00d878ab810ffc614d5349e15b5fd2f90a against live develop@ebad8c1c97337819754572c0b615ab78b4a9f3ca; prior requests target predecessor heads and are stale. Exact-head Compensation Change Review, Foundation, Security, SAST, and Recovery workflows are terminal GREEN; there are no formal reviews or review threads. Re-read current source and verify canonical UUIDv4 opaque references; value-minimized-but-personal-data handling; exact-tenant requester/reviewer authoritative identity separation and Person→Employment→active Assignment/Job/Position scope; current/proposed compensation artifact, exact policy, pay-equity, budget, effective-date, and payroll-handoff provenance with independent digests; no salary/wage/bonus/benefit/equity/protected-attribute/free-form values; fully redacted representation; bounded evidence-version/deterministic evidence; and the boundary that HRIS mutation and payroll execution remain unauthorized and behind published owner contracts. Submit formal independent current-head APPROVE only if clean; otherwise leave exact actionable findings.

[seonghobae]

Verified the remaining CodeRabbit maintainability finding against exact head b1f1aa54637e0508b7785edc833430a7b58b4d77: the same 24-field valid compensation-review input seed was duplicated across the six cited tests, so the finding was valid. I added a structural regression that requires one canonical definition, consolidated the seed into tests/conftest.py, and changed each cited test to consume a fresh shared fixture while preserving hostile-subclass and per-test override behavior. Current exact head is d767befe864218c5592dbb71c3e075eb3d2082ad. Compensation Change Review Quality rerun 33216123092 / job 99000140603 is terminal GREEN on that exact SHA: compile succeeded, 74 tests passed, owned production remains 181 statements / 50 branches at exactly 100.00%, and checkout is clean. No production packet behavior changed.