feat: add evidence-centered HR workspace slice

[seonghobae]

Scope

Adds the dependency-free HR Home / Employee Profile fixture, shared design-token consumption, local Storybook, purpose-bound evidence review interactions, bitemporal presentation, high-impact confirmation, accessibility assertions, and English/Korean labels. This remains fixture/component-state evidence only: it does not claim deployed customer UI, People API write integration, production psychometric compute, or ownership of a dedicated-writer dependency.

This branch also owns the page-level keyboard bypass interaction for the existing HR Workspace UI. The Figma baseline was re-read without mutating the design file: nodes 1:10 (HR Home) and 1:28 (Employee Profile) remain the visual geometry baseline. The bypass control is intentionally focus-only until keyboard focus, so its visible state is captured in Storybook and Chromium rather than by creating a conflicting Figma geometry change.

Current branch truth — 2026-09-01

Fresh base at the latest read: develop@9e3e4847510e1e612b48474ba42b177b8ed824df
Exact head: 016f27e13f7a47cb78a1c936aa533cc8daa2c66c
GitHub reports open · Draft · mechanically mergeable. Re-fetch all three values before acting.

The Draft flag is authoritative: event history shows repeated Ready/Draft lifecycle mutations under a separate same-repository writer, so this lane does not race that lifecycle owner. Older evidence at predecessor heads is stale and is not reused.

Latest owner-side RED → root-cause repair

A separate writer advanced the canonical branch to predecessor d955faf5d1e7e10ea3dda3b9deaa74db940bf634 to reseal the new HR Workspace index.html provenance. The new index evidence itself was correct, but that commit also changed the unrelated database/migrations/0005_outbox_delivery_finalization.sql manifest digest to a value that did not match the file on disk.

Foundation run 33042232951, job 98418198435, proved exact checkout of d955faf... and failed at Validate foundation pack with a deterministic provenance mismatch for migration 0005. The same job's --print-manifest repair output proved the authoritative artifact evidence remained SHA-256 b7e8790595b288f752d6ef5cc6cbfe4e1b6712248f5b7a3a25fa60016b6a4961, 6,125 bytes, 170 lines. All PostgreSQL integrity matrix jobs in that run were already GREEN, so changing migration source or weakening the validator would have been the wrong remedy.

Root repair 016f27e13f7a47cb78a1c936aa533cc8daa2c66c restores only that unrelated migration digest while preserving the valid new HR Workspace index provenance. No product behavior, database migration, validation rule, security gate, or dependency contract was weakened.

The earlier keyboard-bypass repair remains intact: the locale E2E binds to the stable skip-link DOM identity and verifies the active English/Korean accessible name instead of re-resolving a stale English role locator after the locale switch.

Latest thread inspection found all inline review threads resolved; submitted reviews were COMMENTED only. Re-fetch after any push.

Exact-current-head evidence and superseded security result

The Orgmetra-hosted product/repository workflows recorded on exact head 016f27e... were terminal-success on 2026-08-27, including Foundation, Recovery, HR Workspace Browser E2E, People/Job-Analysis APIs, migration, candidate/requisition/offer/selection quality, SAST and the then-current central Security Scan.

However, the 2026-08-27 Security Scan is not valid evidence for the current Dependency Review contract. Its dependency-review job queried the exact develop@9e3e484... → 016f27e... dependency comparison, received HTTP 403, emitted supported=false, skipped the pinned actions/dependency-review-action step, and still returned SUCCESS. That was the predecessor fail-open behavior subsequently repaired centrally by .github#810/#897.

The current central Security Scan correctly fails closed on any non-200/malformed/transport-failed exact dependency comparison. Public Orgmetra canaries continue to expose the upstream availability/configuration incident as HTTP 403, so this PR must not reuse its old Security GREEN or claim current required-workflow completeness. No OSV/Trivy/Scorecard/SAST result substitutes for authoritative Dependency Review.

Do not make a no-op product commit merely to manufacture a newer check. Once .github#810 restores authoritative dependency comparison availability, run/retrigger the then-current central required workflow on this unchanged or meaningfully advanced exact head and require the pinned Dependency Review action itself to execute to a terminal result.

Current merge governance

.github#772 supersedes the former 2 independent approvals + last-push approval target. The ContextualWisdomLab fleet currently has one human maintainer and no genuinely independent human reviewer capacity; a positive generic human approval count is therefore structurally unsatisfiable.

The compliant target is:

• required_approving_review_count = 0 while independent human capacity does not exist;
• require_last_push_approval = false;
• no synthetic named reviewer, bot approval, service-account approval or self-approval merely to manufacture independence;
• review-thread resolution and deterministic OpenCode/Noema/Strix/Security/SAST/Dependency Review/coverage/provenance/product gates remain fail-closed;
• deletion and non-fast-forward protection remain enabled; and
• no routine OrganizationAdmin/always bypass. Emergency repair belongs to a separately governed, time-bounded, auditable break-glass path.

Live inherited organization ruleset 18156473 still drifts from that target by requiring one generic approving review and retaining routine OrganizationAdmin bypass. Orgmetra#89 mirrors the consumer impact; .github#772/#1351/#1340/#1200 own the policy/control-plane repair and .github PR #1176 is the canonical audit writer.

Stack / readiness

This PR remains the dependency root for the current job-analysis/Job Architecture stack, including #130 and #147. Do not advance descendants as if this root were merge-authorized. Before changing Draft state or merging, freshly resolve:

1. exact head/base and active writer ownership;
2. all current review threads/findings;
3. current central required workflows under their current implementation, including authoritative Dependency Review;
4. the satisfiable live protected-branch policy after central reconciliation; and
5. any repository-local workflows affected by a meaningful new push.

There is currently no qualifying independent APPROVED review, but under the current solo-maintainer decision that fact must not be converted into a fabricated approval requirement. Exact-head technical evidence is still required and does not transfer across pushes.

Do not self-approve, use routine administrator bypass, weaken or substitute a gate, race the lifecycle writer, or transfer predecessor/foreign evidence.

[coderabbitai]

📝 Walkthrough

Walkthrough

HR 워크스페이스 UI와 보호된 People·Job Analysis 조회를 추가했습니다. Storybook과 Playwright 검증을 구성하고, CI·저장소 계약·문서·매니페스트를 develop 기준으로 갱신했습니다.

Changes

HR 워크스페이스 통합

Layer / File(s)	Summary
워크스페이스 UI와 Storybook 기반 packages/design-tokens/*, .storybook/*, apps/hr-workspace/index.html, apps/hr-workspace/styles.css, apps/hr-workspace/workspace.stories.js, package.json, docs/PRD.md, docs/STORYBOOK.md	HR Home, Employee Profile, Job Analysis 화면과 반응형 스타일을 추가했습니다. 디자인 토큰과 접근성·권한·확인·할당 상태의 Storybook 스토리를 추가했습니다.
보호된 API 조회와 화면 상태 apps/hr-workspace/app.js, tests/hr-workspace.test.mjs	영어·한국어 전환, hr_operations 목적 판정, 호스트 인증 기반 People·Job Analysis 읽기, 401·403·기타 오류 처리를 추가했습니다. URL 인코딩, credentials: 'omit', 저장소 미사용을 테스트합니다.
Chromium E2E와 CI 실행 playwright.config.mjs, tests/e2e/hr-workspace.spec.mjs, .github/workflows/*, .gitignore, docs/TEST_STRATEGY.md, services/*/pyproject.toml	Chromium E2E 설정과 HR 워크스페이스 브라우저 테스트를 추가했습니다. PR·수동 실행, Node 의존성 설치, Storybook 빌드, Playwright 실행과 작업 트리 검사를 구성했습니다. Python 테스트 extra와 로컬 uv 소스 매핑도 추가했습니다.
저장소 기준선과 필수 산출물 scripts/foundation-contract-core.mjs, tests/validate_repository.py, manifest.json, docs/product-technical-gap-baseline.md, docs/TRACEABILITY.md, docs/adr/*, ARCHITECTURE.md, CHANGELOG.md, README.md, docs/doctoring/REFERENCES.md	HR 워크스페이스·Storybook·Playwright·기준선 문서를 필수 산출물로 등록했습니다. 매니페스트 검증 기준을 develop으로 변경하고 maturity 및 ADR·추적성 상태를 갱신했습니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to 48ce4

The HR workspace can continue showing previously approved People fields after access is denied and may display an older response after a newer request, creating a bounded privacy and correctness risk; inconsistent service dependency versions may also break reproducible installation or integration. These issues should be fixed or explicitly accepted before merge.

Sequence Diagram(s)

sequenceDiagram
  participant Browser
  participant HRWorkspaceApp
  participant PeopleAPI
  participant JobAnalysisAPI
  Browser->>HRWorkspaceApp: 조회 폼 제출
  HRWorkspaceApp->>PeopleAPI: 목적 코드와 인증 헤더로 People 조회
  PeopleAPI-->>HRWorkspaceApp: fields 응답 또는 401/403 오류
  HRWorkspaceApp->>JobAnalysisAPI: 목적 코드와 인증 헤더로 snapshot 조회
  JobAnalysisAPI-->>HRWorkspaceApp: snapshot 응답 또는 오류
  HRWorkspaceApp-->>Browser: 결과 또는 오류 상태 렌더링

Loading

Suggested reviewers: cursoragent

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 15.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 20 functions across 9 files. (23 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 evidence-centered HR workspace slice 추가라는 변경의 주요 내용을 정확하고 간결하게 요약합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 15.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 20 functions across 9 files. (23 skipped: 23 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/product-gap-baseline-workspace

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}