feat(integration): add governed TEPP analysis request boundary

.github/workflows/tepp-adapter-quality.yml

@@ -0,0 +1,67 @@
+name: TEPP Adapter Quality
+
+on:
+  pull_request:
+    branches:
+      - bootstrap
+      - develop
+      - main
+    paths:
+      - "packages/tepp-adapter/**"
+      - "docs/adr/0023-governed-tepp-analysis-request-boundary.md"
+      - "docs/doctoring/tepp-analysis-adapter-references.md"
+      - "docs/traceability/tepp-analysis-adapter.md"
+      - ".github/requirements/foundation-test.txt"
+      - ".github/workflows/tepp-adapter-quality.yml"
+      - ".gitignore"
+      - ".python-version"
+      - "conftest.py"
+      - "packages/conftest.py"
+      - "pyproject.toml"
+      - "pytest.ini"
+      - "setup.cfg"
+      - "tox.ini"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tepp-adapter-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  unit:
+    name: TEPP request boundary and 100% coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout exact candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Prove exact candidate checkout
+        env:
+          ORGMETRA_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: test "$(git rev-parse HEAD)" = "$ORGMETRA_EXPECTED_HEAD_SHA"
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          check-latest: false
+      - name: Install reviewed test toolchain
+        run: |
+          python -m pip install --require-hashes --no-deps --only-binary=:all: -r .github/requirements/foundation-test.txt
+          python -m pip check
+      - name: Compile TEPP adapter boundary
+        run: python -m compileall -q packages/tepp-adapter/src packages/tepp-adapter/tests
+      - name: Test TEPP request contract with exact statement and branch coverage
+        env:
+          PYTHONPATH: packages/tepp-adapter/src
+          COVERAGE_FILE: /tmp/orgmetra-tepp-adapter.coverage
+        run: python -m pytest -c packages/tepp-adapter/pyproject.toml packages/tepp-adapter/tests
+      - name: Require clean checkout
+        run: |
+          git diff --exit-code
+          test -z "$(git status --porcelain)"

CHANGELOG.md

@@ -11,6 +11,7 @@ All notable changes to Orgmetra will be documented in this file.
 - Active-PR `orgmetra_selection_review` packet for PII-minimized, evidence-bound human selection review: canonical operational tenant identity, UUID-backed opaque candidate/Job/sealed-evidence/reviewer references, explicit purpose/reason/evidence version, deterministic canonical JSON and SHA-256 correlation, mandatory human decision state, redacted packet repr, and provenance-paired model evidence that remains `untrusted_draft`, with exact 100% owned statement and branch coverage required by its quality gate.
 - Active performance-criterion scope hardening: `criterion_observation_scope_guard` rejects criterion outcomes for a Job the worker did not effectively hold at the observation date, observations before the relevant assignment, and observations outside the referenced performance cycle while preserving valid multiple-assignment cases and existing bitemporal correction semantics. The guard evaluates current-recorded facts, derives the date coordinate from `observed_at` in UTC so session `TimeZone` cannot alter the result, uses a trusted function search path, and adds no PII or automated employment decision authority. The Foundation PostgreSQL contract also rejects a closed `recorded_to` on each time-coordinate lookup and proves UTC midnight plus non-UTC session `TimeZone` boundaries.
 - Bitemporal tenant-scoped organization hierarchy validation that rejects visible indirect parent cycles and reuses single-valued recorded-time reconstruction before graph traversal.
+- Active-PR TEPP analysis-request evidence now detaches knowledge and generation times to exact UTC instants and normalizes failing or overflowing timezone providers before request or governance digests are emitted.
 - Stacked governed job-analysis evidence contract via `JobAnalysisSnapshot`, `TaskEvidence`, `KSAORequirement`, `TaskKSAOLink`, `FunctionalJobAnalysisProfile`, and `EvidenceSource`: tenant/Job-scoped observable tasks, explicit Task-to-KSAO linkage, importance/difficulty/proficiency ratings, source/version/retrieval/SHA-256 provenance, deterministic canonical snapshot bytes, current O*NET evidence support, and historical DOT Data/People/Things compatibility. Validated snapshots require accountable human review and complete non-LLM evidence; LLM-origin material remains `analysis_draft`, and the snapshot is evidence input rather than a hiring, promotion, termination, compensation, or other high-impact employment decision.
 - Stacked governed audit/outbox slice via `AuditOutboxEvent`, `audit_event_record`, `outbox_delivery_record`, and `outbox_delivery_escalation_record`: CloudEvents 1.0-compatible PII-minimized metadata, exact canonical JSON bytes, database-verified SHA-256 digests, mandatory human confirmation for high-impact events, immutable audit evidence, tenant RLS, atomic audit/outbox insertion, guarded pending/leased/delivered/dead-lettered delivery state, tenant-safe `claim_outbox_delivery(...)` with deterministic due-work ordering, `FOR UPDATE ... SKIP LOCKED`, opaque worker identity, bounded future leases, immutable envelope return, and atomic takeover of genuinely expired leases only while retry attempts remain; owner-bound `complete_outbox_delivery(...)` and `retry_outbox_delivery(...)`; database-budget-governed `dead_letter_outbox_delivery(...)`; and a separately privileged `operator_dead_letter_expired_outbox_delivery(...)` recovery path for an exhausted final lease whose recorded worker identity is permanently unavailable. `maximum_attempt_count` is persisted on the delivery row, defaults to 5, is constrained to 1 through 100, and cannot be lowered by a dispatcher during finalization. Migration 0007 prevents retry or expired-lease takeover from creating attempt N+1; migration 0008 adds TRUNCATE guards, trusted function search paths, a concurrently built due-work partial index, session-independent immutable envelope validation, and operator recovery backed by separate NOLOGIN/NOBYPASSRLS owner/capability roles so the externally assignable operator role can invoke recovery without receiving direct transport-table read/write rights. Migration 0008 also rejects pre-existing reserved recovery-role names before project DDL, atomically contains the temporary schema-creation privilege used for function ownership handoff, and forces deferred escalation binding while the narrow SECURITY DEFINER owner is still active. Exponential/backoff policy selection, policy-specific producer configuration, and external delivery receipts remain subsequent work.
 - `orgmetra_hris_kernel` 0.4.0 with exclusive-versus-concurrent employment, staffable position coverage, exclusive-seat capacity, and `validate_assignment_write` at 100% statement and branch coverage.

docs/adr/0023-governed-tepp-analysis-request-boundary.md

@@ -0,0 +1,32 @@
+# ADR-0023: Governed TEPP analysis-request boundary
+
+**Status:** Proposed on active PR
+**Decision owner:** Orgmetra
+**Foreign owner:** TEPP (read-only dependency)
+
+## Context
+
+Orgmetra needs temporal/event analytical evidence for workforce validation without duplicating TEPP kernels or violating dedicated-writer ownership. TEPP protected revision `7c29e7c971d7940e1fb3def1ed3aae2d1bc8ad4a` exposes `AnalysisRunRequest` contract v1 in `tepp_api`, with immutable snapshot identity, knowledge cutoff, model contract, output profile, and idempotency key. The same TEPP revision documents that protected main is not yet a production HTTP service.
+
+A direct HTTP client in Orgmetra would therefore overstate foreign runtime maturity. Conversely, copying TEPP's analytical implementation would create split scientific authority and an acquisition-grade integration liability.
+
+## Decision
+
+Orgmetra owns a small pre-transport adapter that:
+
+1. emits exactly the seven fields accepted by TEPP `AnalysisRunRequest` v1;
+2. pins the reviewed TEPP protected revision and contract version as evidence, not as permission to mutate TEPP;
+3. binds the request to an Orgmetra tenant, validation study, accountable actor, immutable snapshot digest, evidence version, and deterministic request digest;
+4. detaches the knowledge cutoff and generation instant to exact UTC datetimes, canonicalizes them to RFC 3339 UTC, and rejects naive or unusable instants;
+5. distinguishes exact same-key retries from same-key semantic conflicts;
+6. treats opaque correlations as linkable personal/governance data while refusing direct identity values, source text, and credentials at this boundary;
+7. performs no network transport until the host proves a compatible executable TEPP service contract is published and authorized; and
+8. treats returned TEPP/LLM output as untrusted analytical evidence requiring accountable human scientific review before any high-impact employment use.
+
+Orgmetra does not read TEPP application tables, mutate TEPP source/configuration, or reimplement TEPP's temporal/event/statistical kernels.
+
+## Consequences
+
+The integration can be unit-tested and audited now without manufacturing runtime evidence. Future transport can be added behind the same adapter only after TEPP publishes an executable service contract; that future change must add consumer/provider compatibility, timeout/deadline, authentication, retry, observability, privacy, and failure-mode tests against the then-current foreign contract.
+
+The adapter deliberately requires host re-resolution of tenant/workspace/snapshot/model/output authority. Syntax validation alone never proves tenant membership, artifact existence, policy applicability, or scientific suitability.

docs/doctoring/tepp-analysis-adapter-references.md

@@ -0,0 +1,9 @@
+# TEPP analysis adapter references
+
+Primary technical evidence reviewed for ADR-0023 and the active adapter slice:
+
+- ContextualWisdomLab. (2026). *TEPP API and modular integration contract* (protected revision `7c29e7c971d7940e1fb3def1ed3aae2d1bc8ad4a`, `docs/API_CONTRACT.md`). GitHub repository source. Reviewed August 20, 2026.
+- ContextualWisdomLab. (2026). *TEPP analysis-run request and accepted-run response contracts* (protected revision `7c29e7c971d7940e1fb3def1ed3aae2d1bc8ad4a`, `crates/tepp_api/src/analysis_run.rs`). GitHub repository source. Reviewed August 20, 2026.
+- Klyne, G., & Newman, C. (2002). *Date and time on the Internet: Timestamps* (RFC 3339). Internet Engineering Task Force. https://doi.org/10.17487/RFC3339
+
+The TEPP revision is evidence of the reviewed foreign contract, not a claim that Orgmetra owns or may modify TEPP. Before executable transport, re-resolve TEPP's then-current protected contract and service maturity rather than treating this snapshot as perpetual compatibility evidence.

docs/traceability/tepp-analysis-adapter.md

@@ -0,0 +1,19 @@
+# TEPP analysis adapter traceability
+
+| Requirement | Orgmetra evidence | Verification | Maturity |
+|---|---|---|---|
+| No foreign table access or duplicated TEPP kernels | `orgmetra_tepp_adapter.analysis` contains only request/governance binding logic | package source review; no TEPP runtime dependency | implemented_on_active_pr |
+| Exact TEPP analysis-run v1 request shape | `TeppAnalysisRequestPacket.tepp_request()` | exact seven-field regression against reviewed TEPP DTO | implemented_on_active_pr |
+| Temporal cutoff provenance | timezone-aware `knowledge_cutoff` and `generated_at` → detached exact UTC instants and canonical RFC 3339 UTC | mutable-timezone stability, provider-failure, malformed-offset, arithmetic-overflow, naive/null-offset, and datetime-subclass rejection tests | implemented_on_active_pr |
+| Tenant/study/actor governance | authoritative canonical non-sentinel operational tenant UUID plus namespaced UUIDv4 Orgmetra references | protected-core UUIDv7 interoperability plus nil/max/noncanonical tenant rejection; wrong-namespace/reference-version regressions | implemented_on_active_pr |
+| Immutable analytical snapshot evidence | opaque TEPP snapshot ID plus independent SHA-256 `snapshot_digest` | digest format and governance-evidence regressions | implemented_on_active_pr |
+| Durable idempotency handoff | `idempotency_key` + deterministic `request_digest()` + `governance_scope_digest()` | exact-retry and same-key request/scope conflict regressions | implemented_on_active_pr |
+| Privacy minimization without anonymity claims | `contains_personal_data=true`; direct identity/source text/credentials false; redacted repr | direct-construction/replace/privacy regressions | implemented_on_active_pr |
+| High-impact human review | fixed `human_scientific_review_only`, `untrusted_draft_evidence`, governed `next_action` | authority-expansion regressions | implemented_on_active_pr |
+| Foreign runtime maturity is not overstated | `transport_state=requires_published_tepp_service_contract` | fixed-state regression and package/ADR documentation | implemented_on_active_pr |
+| Exact owned production coverage | package pytest-cov gate | 100% statement + branch coverage | implemented_on_active_pr |
+| Keep adapter-quality evidence current when shared repository test/runtime configuration changes | package quality workflow explicitly retriggers on shared Python/test/clean-checkout configuration inputs | `tests/test_quality_workflow_trigger.py`; supplemental to central required workflows | implemented_on_active_pr |
+
+## Foreign evidence snapshot
+
+Reviewed TEPP protected `main`: `7c29e7c971d7940e1fb3def1ed3aae2d1bc8ad4a`. The reviewed `crates/tepp_api/src/analysis_run.rs` defines contract version `1` and the seven request fields above; `docs/API_CONTRACT.md` states that protected main exposes library/domain contracts rather than a production HTTP service. Orgmetra must re-resolve this evidence before enabling transport.