fix(people): protect governed mutation runtime types - #64
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughPeople 변이와 채용 수락 경계가 서브클래스를 거부하도록 변경되었습니다. UUID, 문자열, Decimal, 명령, 결과, 권한 결정, 시간값, PostgreSQL 행 형태에 정확한 타입 검사를 적용했습니다. 런타임 무결성 회귀 테스트와 변경 기록을 갱신했습니다. ChangesPeople 런타임 무결성
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This change hardens People mutation and hire-acceptance inputs against executable subtype values while preserving supported built-in values and persistence behavior. No concrete current-head merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
changed the title
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact-head repair/evidence update for the current branch state:
Fresh exact-current-head hosted evidence is terminal GREEN: People API Quality Live protected base remains |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Current exact-head follow-up after fresh review: A new review correctly identified that the three direct
Fresh exact-current-head hosted evidence is terminal GREEN:
Live protected base remains |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="8f986853a6f234c317e29080c4982bab34f3dc51"
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="8d3877650865f71c4d9708b06eb55f43a7cb7661"
echo '== Exact revision and PR state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git cat-file -e "${prior}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git merge-base --is-ancestor "$prior" "$head" && echo 'prior_is_ancestor=true'
gh pr view 64 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Issue `#233` =='
gh issue view 233 --repo "$repo" --json number,title,state,body,url
echo '== Successor commits and paths =='
git log --reverse --format='commit %H%nparents %P%nsubject %s%n' "${prior}..${head}"
for commit in $(git rev-list --reverse "${prior}..${head}"); do
printf '\n-- %s --\n' "$commit"
git show --check --format='subject %s' --no-patch "$commit"
git diff-tree --no-commit-id --name-status -r "$commit"
done
echo '== Total and successor diff checks =='
git diff --check "$base" "$head"
git diff --check "$prior" "$head"
git diff --name-status "$prior" "$head"
git diff --stat "$prior" "$head"
echo '== Production paths changed after prior head =='
git diff --name-status "$prior" "$head" -- services/people-api/src
echo '== Locate allocation parser, OpenAPI contract, manifests, and tests =='
fd -t f . | rg -i '(mutation.*http|mutation.*openapi|openapi|swagger|assignment|allocation|manifest|contract)'
rg -n -C 12 --glob '*.{py,json,yaml,yml}' \
'(parse_allocation_ratio|allocation_ratio|exclusiveMinimum|minimum|0\.0000|0\.0001|Assignment)' \
services/people-api CHANGELOG.md manifest.json 2>/dev/null || true
echo '== Source outlines =='
ast-grep outline services/people-api/src/orgmetra_people_api/mutations.py --items all
for file in $(fd -t f -e py -e json -e yaml -e yml . services/people-api | rg -i '(openapi|mutation_http|contract)'); do
echo "== ${file} =="
ast-grep outline "$file" --items all || true
done
echo '== Focused diff after prior head =='
git diff --unified=160 "$prior" "$head" -- \
services/people-api/src \
services/people-api/tests \
CHANGELOG.md \
manifest.json \
'*.yaml' '*.yml' '*.json'
echo '== Manifest evidence at exact head =='
if [ -f manifest.json ]; then
cat manifest.json
echo '== Referenced manifest entries =='
jq -r '.. | objects | select(has("path") and (.path == "CHANGELOG.md" or (.path | test("openapi|people"; "i"))) )' manifest.json || true
fi
echo '== Recomputed CHANGELOG evidence =='
sha256sum CHANGELOG.md
wc -c -l CHANGELOG.md
echo '== Find and inspect da4b628 lineage =='
git rev-parse 'da4b628^{commit}' 2>/dev/null || true
git merge-base --is-ancestor da4b628 "$head" 2>/dev/null && echo 'da4b628_is_ancestor=true' || true
git log --reverse --format='commit %H%nparents %P%nsubject %s%n' "${prior}..${head}"
git log --all --oneline --decorate --max-count=80 --grep='manifest\|`#233`\|allocation' -i
git show --check --format='commit %H%nparents %P%nsubject %s%n' da4b628 2>/dev/null || true
git diff --unified=120 da4b628^ da4b628 -- manifest.json CHANGELOG.md 2>/dev/null || true
echo '== Exact-head check runs and reviews =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"'
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"'Length of output: 119892 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="8f986853a6f234c317e29080c4982bab34f3dc51"
prior="8d3877650865f71c4d9708b06eb55f43a7cb7661"
mistake="da4b628fe344372ec22421cfa010e15105ad2c50"
outbox_path="database/migrations/0005_outbox_delivery_finalization.sql"
echo '== Exact PR metadata =='
git rev-parse HEAD
gh pr view 64 --repo "$repo" --json headRefOid,baseRefOid,state,isDraft,mergeable
echo '== Focused final `#233` files =='
cat -n services/people-api/src/orgmetra_people_api/mutations.py | sed -n '455,480p'
rg -n -A22 -B6 '^ allocation_ratio:' schemas/openapi.yaml
cat -n services/people-api/tests/test_people_mutation_allocation_text_runtime_integrity.py
rg -n -C 8 --glob '*.{py,mjs}' \
'(allocation_ratio|0\\\.0000|0\\\.0001|CreateAssignmentRecordCommand)' \
services/people-api/tests tests
echo '== All OpenAPI allocation-ratio declarations =='
rg -n -A5 -B3 'allocation_ratio:' schemas/openapi.yaml
echo '== All application allocation parser call sites =='
rg -n -C 5 'parse_allocation_ratio\s*\(' services/people-api/src services/people-api/tests
echo '== `#233` and manifest successor diffs =='
git diff --unified=100 "$prior" "$head" -- \
services/people-api/src/orgmetra_people_api/mutations.py \
services/people-api/tests/test_people_mutation_allocation_text_runtime_integrity.py \
schemas/openapi.yaml \
manifest.json
echo '== Mistake then correction only =='
git diff --unified=60 "${mistake}^" "$mistake" -- manifest.json
git diff --unified=60 "${head}^" "$head" -- manifest.json
echo '== Corrected outbox manifest evidence =='
actual_sha="$(sha256sum "$outbox_path" | awk '{print $1}')"
actual_bytes="$(wc -c < "$outbox_path" | tr -d ' ')"
actual_lines="$(wc -l < "$outbox_path" | tr -d ' ')"
manifest_entry="$(jq -c --arg path "$outbox_path" '.files[] | select(.path == $path)' manifest.json)"
printf 'actual_sha=%s\nactual_bytes=%s\nactual_lines=%s\nmanifest_entry=%s\n' \
"$actual_sha" "$actual_bytes" "$actual_lines" "$manifest_entry"
jq -e --arg path "$outbox_path" --arg sha "$actual_sha" \
--argjson bytes "$actual_bytes" --argjson lines "$actual_lines" \
'.files[] | select(.path == $path) | .sha256 == $sha and .bytes == $bytes and .lines == $lines' \
manifest.json >/dev/null && echo 'outbox_manifest_matches=true'
echo '== OpenAPI manifest evidence =='
actual_openapi_sha="$(sha256sum schemas/openapi.yaml | awk '{print $1}')"
actual_openapi_bytes="$(wc -c < schemas/openapi.yaml | tr -d ' ')"
actual_openapi_lines="$(wc -l < schemas/openapi.yaml | tr -d ' ')"
openapi_entry="$(jq -c '.files[] | select(.path == "schemas/openapi.yaml")' manifest.json)"
printf 'actual_sha=%s\nactual_bytes=%s\nactual_lines=%s\nmanifest_entry=%s\n' \
"$actual_openapi_sha" "$actual_openapi_bytes" "$actual_openapi_lines" "$openapi_entry"
jq -e --arg sha "$actual_openapi_sha" --argjson bytes "$actual_openapi_bytes" --argjson lines "$actual_openapi_lines" \
'.files[] | select(.path == "schemas/openapi.yaml") | .sha256 == $sha and .bytes == $bytes and .lines == $lines' \
manifest.json >/dev/null && echo 'openapi_manifest_matches=true'
echo '== Repository manifest validator references =='
rg -n -C 6 '(manifest\.json|sha256|wc -c|line.*count|validate_repository)' \
tests/validate_repository.py scripts tests/foundation-contract.test.mjsLength of output: 101649
I found no defect in the reviewed
The OpenAPI The published-contract regression rejects The
The ordinary successor Its byte count (
The PR is open, draft, and mergeable. The exact-head hosted checks are queued or skipped. I did not use predecessor reviews or checks as evidence for this head. You are interacting with an AI system. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="a61617f0cdd6f1a2e29b512b2a3c66872af5ccc4"
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="8f986853a6f234c317e29080c4982bab34f3dc51"
echo '== Exact revision, PR state, and ancestry =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git merge-base --is-ancestor "$prior" "$head" && echo 'prior_is_ancestor=true'
gh pr view 64 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Issue `#246` =='
gh issue view 246 --repo "$repo" --json number,title,state,body,url
echo '== Successor commits and changed paths =='
git log --reverse --format='commit %H%nparents %P%nsubject %s%n' "${prior}..${head}"
for commit in $(git rev-list --reverse "${prior}..${head}"); do
printf '\n-- %s --\n' "$commit"
git show --check --format='subject %s' --no-patch "$commit"
git diff-tree --no-commit-id --name-status -r "$commit"
done
echo '== Delta and source scope =='
git diff --check "$base" "$head"
git diff --name-status "$prior" "$head"
git diff --stat "$prior" "$head"
git diff --name-status "$prior" "$head" -- services/people-api/src
echo '== Source maps =='
ast-grep outline services/people-api/src/orgmetra_people_api/mutations.py --items all
ast-grep outline services/people-api/src/orgmetra_people_api/postgres_mutations.py --items all --match 'PostgresPeopleMutationPort'
ast-grep outline services/people-api/src/orgmetra_people_api/hire.py --items all
ast-grep outline services/people-api/src/orgmetra_people_api/postgres_hire.py --items all
echo '== Replay evidence producers, consumers, digest checks, and identity binding =='
rg -n -C 18 --glob '*.py' \
'(replay_command_digest|replay.*digest|_replayed_record_id|stored_digest|idempotency.*digest|mutation_command_digest|def\s+(create_employment_record|create_position_record|create_assignment_record|accept_confirmed_hire|create_employment|create_position|create_assignment)\b|expected_(employment|position|assignment|person|candidate_worker_conversion)_record_id|MutationResult\.__post_init__|HireAcceptanceResult\.__post_init__)' \
services/people-api/src/orgmetra_people_api \
services/people-api/tests
echo '== Focused source and test delta =='
git diff --unified=140 "$prior" "$head" -- \
services/people-api/src/orgmetra_people_api/mutations.py \
services/people-api/src/orgmetra_people_api/postgres_mutations.py \
services/people-api/src/orgmetra_people_api/hire.py \
services/people-api/src/orgmetra_people_api/postgres_hire.py \
services/people-api/tests
echo '== Candidate Issue `#246` regression files =='
fd -t f -e py . services/people-api/tests | rg -i \
'(replay|idempotency|result.*identity|mutation.*(integrity|digest|snapshot)|hire.*integrity)' \
| while IFS= read -r file; do
echo "== ${file} =="
ast-grep outline "$file" --items all
done
echo '== Exact-head check runs and reviews =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"'
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"'Length of output: 164780 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="a61617f0cdd6f1a2e29b512b2a3c66872af5ccc4"
prior="8f986853a6f234c317e29080c4982bab34f3dc51"
generic="services/people-api/src/orgmetra_people_api/mutations.py"
postgres="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
hire="services/people-api/src/orgmetra_people_api/hire.py"
postgres_hire="services/people-api/src/orgmetra_people_api/postgres_hire.py"
focused_test="services/people-api/tests/test_people_mutation_idempotent_replay_result.py"
postgres_test="services/people-api/tests/test_postgres_people_mutations.py"
echo '== Issue `#246` full metadata =='
gh issue view 246 --repo "$repo" --json number,title,state,body,comments,url
echo '== Exact successor parents and complete scopes =='
for commit in $(git rev-list --reverse "${prior}..${head}"); do
echo "-- $commit --"
git show --no-patch --format='parents %P%nsubject %s' "$commit"
git diff-tree --no-commit-id --name-status -r "$commit"
done
echo '== Generic result evidence contracts and all consumers =='
rg -n -A45 -B10 \
'def _validate_replay_command_digest\b|class (EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult)\b|def _require_result_identity_or_replay\b|^def create_(employment|position|assignment)_record\b' \
"$generic"
rg -n -C 8 'replay_command_digest|_require_result_identity_or_replay\s*\(' \
services/people-api/src services/people-api/tests
echo '== Direct PostgreSQL idempotency producer and all generic result returns =='
rg -n -A65 -B12 '^def _replayed_record_id\b|^def _record_idempotency\b' "$postgres"
rg -n -C 8 \
'replayed\s*=|if replayed is not None|return (EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult)' \
"$postgres"
echo '== Focused Issue `#246` regression module =='
cat -n "$focused_test"
echo '== Direct PostgreSQL generic replay regression and normal-create assertions =='
rg -n -A90 -B15 \
'def test_same_key_replays_without_second_hris_or_audit_facts\b|def test_same_key_different_command_fails_closed\b|def test_different_key_is_a_new_command\b' \
"$postgres_test"
echo '== Confirmed-hire code and tests, plus successor delta =='
rg -n -A150 -B10 '^def accept_confirmed_hire\b' "$hire"
rg -n -C 10 'return HireAcceptanceResult|HireAcceptanceResult\(' "$postgres_hire"
git diff --quiet "$prior" "$head" -- "$hire" "$postgres_hire" \
&& echo 'hire_source_delta_after_prior=none'
echo '== Focused test type-checking and test discovery configuration =='
fd -t f -a 'pyproject.toml' 'pytest.ini' 'tox.ini' 'mypy.ini' .
rg -n -C 8 '(mypy|pyright|pytest|coverage|strict)' \
pyproject.toml pytest.ini tox.ini mypy.ini 2>/dev/null || true
echo '== Whitespace and final exact-head state =='
git diff --check "$prior" "$head"
printf 'checked_out='; git rev-parse HEAD
gh pr view 64 --repo "$repo" --json headRefOid,baseRefOid,state,isDraft,mergeableLength of output: 73769
I found no defect in the reviewed The repair preserves both required result paths:
The replay evidence has an exact built-in
Each generic The focused regression covers all three generic mutation services with a foreign first-committed identity and matching evidence. It also covers mismatched evidence and invalid replay-evidence type. The existing PostgreSQL replay test verifies that same-key retries return the first committed Employment, Position, and Assignment IDs without new business, audit, or idempotency writes. It also retains the same-key/different-command failure case. Confirmed-hire code has no delta from the predecessor head. It still requires the returned Person, Employment, and conversion IDs to match the exact detached command IDs. The
The exact-head workflows are queued or skipped. I did not treat predecessor workflow evidence as current-head GREEN. You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="3f3b23a35a71f4fdaded3cb0cd1ee57412a7df05"
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="a61617f0cdd6f1a2e29b512b2a3c66872af5ccc4"
source="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
test_file="services/people-api/tests/test_postgres_mutation_projection_shape_coverage.py"
generic="services/people-api/src/orgmetra_people_api/mutations.py"
echo '== Exact revisions and pull request metadata =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git cat-file -e "${prior}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git merge-base --is-ancestor "$prior" "$head" && echo 'prior_is_ancestor=true'
gh pr view 64 --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeable,url
echo '== Successors after `#246` reviewed head =='
git log --reverse --format='commit %H%nparents %P%nsubject %s%n' "${prior}..${head}"
for commit in $(git rev-list --reverse "${prior}..${head}"); do
printf '\n-- %s --\n' "$commit"
git show --check --format='subject %s' --no-patch "$commit"
git diff-tree --no-commit-id --name-status -r "$commit"
done
echo '== Scope, production, manifest, and whitespace deltas =='
git diff --check "$prior" "$head"
git diff --name-status "$prior" "$head"
git diff --stat "$prior" "$head"
echo '-- source delta after prior --'
git diff --name-status "$prior" "$head" -- services/people-api/src
echo '-- manifest delta after prior --'
git diff --name-status "$prior" "$head" -- manifest.json
echo '-- schema delta after prior --'
git diff --name-status "$prior" "$head" -- schemas
echo '== Focused successor diff =='
git diff --unified=140 "$prior" "$head" -- "$test_file" "$source" "$generic" manifest.json
echo '== Target production functions and the indicated guard lines =='
ast-grep outline "$source" --items all \
--match '_employment_version_from_row|_position_version_from_row|_assignment_from_row'
sed -n '360,490p' "$source"
echo '== Exact focused coverage test =='
cat -n "$test_file"
echo '== Test-to-guard relationships and all call sites =='
rg -n -C 12 --glob '*.py' \
'(_employment_version_from_row|_position_version_from_row|_assignment_from_row|projection.*invalid|wrong.*width|fetchmany|fetchall)' \
"$source" "$test_file" services/people-api/tests
echo '== `#246` replay evidence remains unchanged after prior head =='
git diff --quiet "$prior" "$head" -- "$generic" "$source" \
&& echo 'replay_source_delta_after_prior=none' \
|| git diff --unified=100 "$prior" "$head" -- "$generic" "$source"
rg -n -C 12 \
'(replay_command_digest|_replayed_record_id|_require_result_identity_or_replay|stored_digest)' \
"$generic" "$source"
echo '== Exact-head checks and reviews, for separate status reporting =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"'
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"'Length of output: 144119
I found no defect in the reviewed change. The successor has one commit. It adds only The parameterized test invokes each helper with an exact built-in empty tuple. Each invocation reaches the intended width guard before row unpacking or value validation:
Each case requires the helper-specific The
This is static current-head evidence only. The exact-head workflows are queued or skipped. No qualifying independent approval is present. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="998e06f49e5f91d84b335992761f2c210ea0ec39"
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="3f3b23a35a71f4fdaded3cb0cd1ee57412a7df05"
source="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
generic="services/people-api/src/orgmetra_people_api/mutations.py"
projection_test="services/people-api/tests/test_postgres_mutation_projection_shape_coverage.py"
echo '== Exact revision, ancestry, and pull request metadata =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git cat-file -e "${prior}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git merge-base --is-ancestor "$prior" "$head" && echo 'prior_is_ancestor=true'
gh pr view 64 --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeable,url
echo '== Exact successor sequence, parents, paths, and whitespace =='
mapfile -t commits < <(git rev-list --reverse "${prior}..${head}")
printf 'successor_count=%s\n' "${`#commits`[@]}"
for commit in "${commits[@]}"; do
printf '\n-- %s --\n' "$commit"
git show --no-patch --format='parents %P%nsubject %s' "$commit"
git diff-tree --no-commit-id --name-status -r "$commit"
git diff --check "${commit}^" "$commit"
done
echo '== Aggregate successor scope =='
git diff --name-status "$prior" "$head"
git diff --stat "$prior" "$head"
echo '-- non-test deltas --'
git diff --name-status "$prior" "$head" -- \
':(exclude)services/people-api/tests/**'
echo '-- protected categories --'
git diff --name-status "$prior" "$head" -- \
services/people-api/src \
database \
manifest.json \
.github \
scripts \
schemas \
CHANGELOG.md
echo '== Complete successor diff =='
git diff --unified=120 "$prior" "$head" -- services/people-api/tests
echo '== Changed test-module structure and exception behavior =='
git diff --name-only "$prior" "$head" -- services/people-api/tests \
| while IFS= read -r file; do
echo "== ${file} =="
ast-grep outline "$file" --items all
rg -n -C 12 \
'(except\s+(AttributeError|TypeError|IndexError|Exception|BaseException)|pytest\.raises|raises\s*=|AssertionError|__getattribute__|__getitem__|__iter__|__len__|__bool__|__eq__|__ne__|fetchmany|fetchall|projection)' \
"$file"
done
echo '== All exception handlers in successor diff and final changed tests =='
git diff -U0 "$prior" "$head" -- services/people-api/tests \
| rg -n -C 4 '^[+-].*except\b|^[+-].*(AttributeError|TypeError|IndexError)' || true
git diff --name-only "$prior" "$head" -- services/people-api/tests \
| xargs -r rg -n -C 5 \
'except\s+(AttributeError|TypeError|IndexError|Exception|BaseException)|contextlib\.suppress'
echo '== Code Quality finding references and causal coverage =='
rg -n -C 10 --glob '*.py' --glob '*.md' --glob '*.json' \
'(Code Quality|code quality|finding|projection shape|special.method|special-method|AttributeError|TypeError|IndexError)' \
services/people-api/tests services/people-api/src .github 2>/dev/null || true
echo '== Projection-shape coverage regression remains unchanged =='
git diff --quiet "$prior" "$head" -- "$projection_test" \
&& echo 'projection_shape_test_delta_after_prior=none' \
|| git diff --unified=100 "$prior" "$head" -- "$projection_test"
sed -n '360,490p' "$source"
cat -n "$projection_test"
echo '== `#246` replay production repair remains unchanged =='
git diff --quiet "$prior" "$head" -- "$generic" "$source" \
&& echo 'replay_production_delta_after_prior=none' \
|| git diff --unified=120 "$prior" "$head" -- "$generic" "$source"
rg -n -C 12 \
'(replay_command_digest|_replayed_record_id|_require_result_identity_or_replay|stored_digest)' \
"$generic" "$source"
echo '== Exact-head checks and reviews (status only) =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"'
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"'Length of output: 4944 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="998e06f49e5f91d84b335992761f2c210ea0ec39"
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="3f3b23a35a71f4fdaded3cb0cd1ee57412a7df05"
source="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
generic="services/people-api/src/orgmetra_people_api/mutations.py"
projection_test="services/people-api/tests/test_postgres_mutation_projection_shape_coverage.py"
echo '== Exact successor sequence, parents, paths, and whitespace =='
commits="$(git rev-list --reverse "${prior}..${head}")"
printf 'successor_count='
printf '%s\n' "$commits" | sed '/^$/d' | wc -l
for commit in $commits; do
printf '\n-- %s --\n' "$commit"
git show --no-patch --format='parents %P%nsubject %s' "$commit"
git diff-tree --no-commit-id --name-status -r "$commit"
git diff --check "${commit}^" "$commit"
done
echo '== Aggregate successor scope =='
git diff --name-status "$prior" "$head"
git diff --stat "$prior" "$head"
echo '-- non-test deltas --'
git diff --name-status "$prior" "$head" -- ':(exclude)services/people-api/tests/**'
echo '-- protected categories --'
git diff --name-status "$prior" "$head" -- \
services/people-api/src database manifest.json .github scripts schemas CHANGELOG.md
echo '== Complete successor test diff =='
git diff --unified=100 "$prior" "$head" -- services/people-api/tests
echo '== Changed test-module exception behavior =='
changed_tests="$(git diff --name-only "$prior" "$head" -- services/people-api/tests)"
for file in $changed_tests; do
echo "== ${file} =="
ast-grep outline "$file" --items all
rg -n -C 10 \
'(except\s+(AttributeError|TypeError|IndexError|Exception|BaseException)|pytest\.raises|raises\s*=|AssertionError|__getattribute__|__getitem__|__iter__|__len__|__bool__|__eq__|__ne__|fetchmany|fetchall|projection)' \
"$file" || true
done
echo '== Exception handlers added or removed by this successor =='
git diff -U0 "$prior" "$head" -- services/people-api/tests \
| rg -n -C 4 '^[+-].*except\b|^[+-].*(AttributeError|TypeError|IndexError|Exception|BaseException)' || true
echo '== Exception handlers in changed final test modules =='
for file in $changed_tests; do
rg -n -C 5 \
'except\s+(AttributeError|TypeError|IndexError|Exception|BaseException)|contextlib\.suppress' \
"$file" || true
done
echo '== Code Quality finding references and causal coverage =='
rg -n -C 8 --glob '*.py' --glob '*.md' --glob '*.json' \
'(Code Quality|code quality|finding|projection shape|special.method|special-method|AttributeError|TypeError|IndexError)' \
services/people-api/tests services/people-api/src .github 2>/dev/null || true
echo '== Projection-shape coverage regression unchanged =='
git diff --quiet "$prior" "$head" -- "$projection_test" \
&& echo 'projection_shape_test_delta_after_prior=none' \
|| git diff --unified=100 "$prior" "$head" -- "$projection_test"
sed -n '360,490p' "$source"
cat -n "$projection_test"
echo '== `#246` replay production repair unchanged =='
git diff --quiet "$prior" "$head" -- "$generic" "$source" \
&& echo 'replay_production_delta_after_prior=none' \
|| git diff --unified=100 "$prior" "$head" -- "$generic" "$source"
rg -n -C 10 \
'(replay_command_digest|_replayed_record_id|_require_result_identity_or_replay|stored_digest)' \
"$generic" "$source"
echo '== Exact-head check and review status =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")"'
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"'Length of output: 242319 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="998e06f49e5f91d84b335992761f2c210ea0ec39"
prior="3f3b23a35a71f4fdaded3cb0cd1ee57412a7df05"
echo '== GitHub Code Quality review metadata and inline comments =='
gh api "repos/${repo}/pulls/64/reviews?per_page=100" \
--jq '.[] | select(.user.login == "github-code-quality") | [.id, .commit_id, .state, .submitted_at, .body] | `@tsv`'
gh api "repos/${repo}/pulls/64/comments?per_page=100" \
--jq '.[] | select(.user.login == "github-code-quality") | {
id,
commit_id,
path,
line,
original_line,
side,
body
}'
echo '== Review-repair lines after the prior head =='
git diff -U0 "$prior" "$head" -- services/people-api/tests \
| rg -n -C 3 '^[+-].*(raise (AttributeError|TypeError|IndexError)|__hash__)' || true
echo '== Exact changed-test exception constructs =='
for file in $(git diff --name-only "$prior" "$head" -- services/people-api/tests); do
echo "-- ${file} --"
rg -n -C 3 \
'raise (AttributeError|TypeError|IndexError)|__hash__\s*=\s*None|except\b|contextlib\.suppress' \
"$file" || true
doneLength of output: 11906
I found no defect in the reviewed changes. The successor chain contains exactly five linear test-only commits. The commits modify only these files:
There is no production, SQL, migration, manifest, workflow, schema, script, or changelog delta after The revised tripwires use standard special-method exceptions:
These changes do not weaken the tests. The changed modules do not catch or suppress The container tests retain zero-call assertions. If The changed special-method cases causally cover the requested Code Quality concern categories. The GitHub API did not return inline The three projection-shape coverage regressions are unchanged. The
This is static current-head evidence only. The exact-head workflows are queued or skipped. No qualifying independent approval is present. You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="4be7f1681959e43d32c8e85a8f2660da36ff6d9c"
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="998e06f49e5f91d84b335992761f2c210ea0ec39"
scalar_test="services/people-api/tests/test_postgres_mutation_scalar_runtime_integrity.py"
generic="services/people-api/src/orgmetra_people_api/mutations.py"
postgres="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
projection_test="services/people-api/tests/test_postgres_mutation_projection_shape_coverage.py"
echo '== Exact revision and pull request state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git cat-file -e "${prior}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git merge-base --is-ancestor "$prior" "$head" && echo 'prior_is_ancestor=true'
gh pr view 64 --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeable,url
echo '== Successor commits, parents, paths, and whitespace =='
for commit in $(git rev-list --reverse "${prior}..${head}"); do
printf '\n-- %s --\n' "$commit"
git show --no-patch --format='parents %P%nsubject %s' "$commit"
git diff-tree --no-commit-id --name-status -r "$commit"
git diff --check "${commit}^" "$commit"
done
echo '== Aggregate successor scope =='
git diff --name-status "$prior" "$head"
git diff --stat "$prior" "$head"
echo '-- protected non-test paths --'
git diff --name-status "$prior" "$head" -- \
services/people-api/src database manifest.json .github scripts schemas CHANGELOG.md
echo '== Focused repair diff and final scalar test =='
git diff --unified=160 "$prior" "$head" -- "$scalar_test"
ast-grep outline "$scalar_test" --items all --match '_ExecutableDecimal'
rg -n -C 20 \
'(class _ExecutableDecimal|def __add__|def __radd__|add_calls|radd_calls|TypeError|pytest\.raises|AssertionError|Decimal)' \
"$scalar_test"
echo '== Exception swallowing in the changed test =='
rg -n -C 8 \
'(except\s+(AttributeError|TypeError|IndexError|Exception|BaseException)|contextlib\.suppress|pytest\.raises)' \
"$scalar_test" || true
echo '== Production and retained regression deltas =='
git diff --quiet "$prior" "$head" -- services/people-api/src \
&& echo 'production_source_delta_after_prior=none' \
|| git diff --unified=120 "$prior" "$head" -- services/people-api/src
git diff --quiet "$prior" "$head" -- "$generic" "$postgres" \
&& echo 'replay_source_delta_after_prior=none' \
|| git diff --unified=120 "$prior" "$head" -- "$generic" "$postgres"
git diff --quiet "$prior" "$head" -- "$projection_test" \
&& echo 'projection_shape_test_delta_after_prior=none' \
|| git diff --unified=120 "$prior" "$head" -- "$projection_test"
echo '== Retained Issue `#246` replay contexts =='
rg -n -C 10 \
'(replay_command_digest|_require_result_identity_or_replay|_replayed_record_id|stored_digest)' \
"$generic" "$postgres"
echo '== Retained projection-shape coverage test =='
cat -n "$projection_test"
echo '== Exact-head checks and reviews =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"'
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"'Length of output: 64668
I found no defect in the reviewed change. The successor has one commit. It changes only
The changed test contains no handler or suppression for The Issue
This is static current-head evidence only. The exact-head workflows are queued or skipped. No qualifying independent approval is present. You are interacting with an AI system. |
|
Central-owner clarification for current exact Do not push an Orgmetra no-op or alter People source to chase that central verdict. #64 stays Draft until unchanged-head required evidence and a qualifying independent approval exist. Its 239/239 People tests, 1472 statements / 482 branches at 100%, isolated PostgreSQL acceptance, Security and SAST successes remain exact-head evidence; they do not substitute for CodeQL or review. |
1 participant
Scope
Canonical Orgmetra People mutation runtime/contract-integrity lane. HR mutation truth stays in Orgmetra; this PR does not copy mutable shared-kernel, authorization, feature-lane, workflow-owner, or Assignment source.
Protected base is
develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Current exact head is4be7f1681959e43d32c8e85a8f2660da36ff6d9c; the PR remains open · Draft · mechanically mergeable. Predecessor checks/reviews are retained as causal evidence only and do not authorize this head.Retained repair chain
#215–#225 retain hire/generic PostgreSQL trust-boundary hardening. #226–#228 retain application/direct-Port post-construction command/result revalidation. #229 binds unexplained exact revalidated Employment/Position/Assignment results to pre-port target UUID snapshots and keeps confirmed-hire exact materialization identities command-bound. #230 detaches generic commands at direct PostgreSQL adapter entry. #231 detaches generic and confirmed-hire application commands before purpose-bound authorization/port callbacks. #232 requires exact built-in allocation-ratio HTTP text. #233 aligns parser/OpenAPI Assignment allocation with the authoritative strictly-positive
(0, 1.0000]domain.#246 retains the idempotent replay repair. Hosted Foundation
33947715482on predecessor8f986853a6f234c317e29080c4982bab34f3dc51produced the real replay RED: People API reached 232 passed / 1 failed because a same-key/same-semantic-command retry correctly needed the first committed Employment identity rather than the retry command's newly generated UUID.d7440d40...established focused test-first replay-evidence contracts;cc1cc53f...introduced optionalreplay_command_digest;a61617f0...made generic replay return the first committed UUID only after stored/current semantic-digest equality. Confirmed-hire retains exact materialization-identity binding.Foundation
33964015934on exacta61617f0...then produced the second real RED: People API executed 236/236 passing tests but owned coverage was 99.69% because_employment_version_from_row,_position_version_from_row, and_assignment_from_rowretained three unexecuted fail-closed wrong-width projection guards. Test-only3f3b23a35a71f4fdaded3cb0cd1ee57412a7df05covers those guards without changing production, SQL, migration, workflow, replay semantics, audit/outbox behavior, or the 100% threshold.Six ordinary GitHub Code Quality successors then made hostile test doubles protocol-conformant without production semantic changes:
f933fbc2...,4e9e04fb...,7485cb28...,59f6eae3...,998e06f4..., and current4be7f168.... The last commit changes hostile Decimal__add__/__radd__tripwires fromAssertionErrortoTypeErrorwhile retaining call counters and fail-fast meaning. All visible review threads are resolved.Current exact-head acceptance
Foundation run
33981039419, Repository quality job101346183995, checked out exact4be7f1681959e43d32c8e85a8f2660da36ff6d9cand completed success on GitHub-hosted Ubuntu 24.04. Compile, Foundation validation, dependency hygiene, all owned unit/service suites, isolated PostgreSQL contracts, and read-only repository validation passed. The final working tree was clean.Owned coverage evidence on this exact head is GREEN: candidate-evidence 75 passed at 100%; HRIS-kernel 171 passed at 100%; Keyverse adapter 41 passed at 100%; migration adapter 65 passed at 100%; Naruon adapter 41 passed at 100%; offer approval 84 passed at 100%; requisition review 61 passed at 100%; selection review 68 passed at 100%; job-analysis API 68 passed at 100%; and People API 239/239 passed with
services/people-apiat 100.00% statement/branch coverage (1472 statements / 482 branches). Isolated PostgreSQL contracts for tenant isolation, bitemporal concurrency, governed decision evidence, operational UUIDs, immutable audit/outbox, claim/recovery/completion/retry/dead-letter paths, and Job Analysis schema/snapshot integrity also passed.Security Scan
33981039429and SAST Semgrep33981039445are now terminal SUCCESS on the same exact head. CodeQL PR33981039424is terminal FAILURE, but the job graph identifies the same central compatibility-handoff state already seen on #63 rather than a product SARIF verdict: language detection succeeded;CodeQL compatibility analysis (actions)job101358598317and(python)job101358598361both successfully requested current-head dispatch, then failed only atRelease runner or enforce current-head CodeQL verdict. No terminalcodeql-dispatch/<language>status is exposed in the commit-status snapshot. Treat this as non-passing central handoff evidence, not as GREEN and not as a reason for an Orgmetra no-op push.Formal submitted reviews remain COMMENTED-only; no qualifying
APPROVEDreview exists. CodeRabbit's draft status entry is a skipped-review status and is not independent approval. Therefore the PR stays Draft and no merge, self-approval, administrator bypass, gate weakening, no-op retrigger, or predecessor-evidence transfer is allowed.Owner dependencies
72070cb4b8d636825ce5b1a326df4c296596ed7e. Foundation33936088421, Security33936088403, and SAST33936088456are terminal success; CodeQL33936088409remains non-passing in the same central exact-head handoff state, and qualifying approval remains absent. fix(people): protect governed mutation runtime types #64 does not copy fix(core): protect canonical evidence runtime types #63 source.1caf8f760e81f1cb6954fdf1d0d13a46dbb6c0b1and overlaps fix(people): protect governed mutation runtime types #64 on People production files. After fix(people): protect governed mutation runtime types #64 becomes protected truth, fix(authz): protect purpose-bound runtime integrity #65 must non-force adopt it while preserving fix(people): bind mutation results to the exact commanded HR identity #229–fix(people): reject zero assignment allocation at the published HTTP contract #233, people: reconcile result-identity hardening with idempotent replay identity #246, the hosted coverage regressions, current test-quality contracts, and its own authorization-decision validation.docs/product-technical-gap-baseline.mdremains single-writer-owned by docs: maintain durable product-technical gap baseline #100; volatile leaf SHAs/run IDs remain PR/Issue evidence rather than baseline-body truth.Causal order remains #63 normal protected integration as gates allow → #64 normal integration after terminal required workflows and qualifying review → #65 non-force protected adoption/reconciliation and integration → #141 non-force protected adoption/reconciliation → Assignment descendants. The independent #235 Workforce Validation lane may continue from protected
developwhile these People owner gates run.