feat(job-analysis): add governed semantic ontology evidence

[seonghobae]

Buyer-visible gap

Orgmetra needs a governed boundary that can bind one ontology-resolution result to exact tenant/Job Analysis scope, source revision, evidence digests, accountable actors, and mandatory human review without copying raw ontology query/response content into HR governance evidence. This lane writes Orgmetra only; ContextualWisdomLab/semantic-data-portal remains a read-only dedicated-writer dependency and no cross-service application-table SQL is introduced.

Governed source-evidence boundary

SemanticJobEvidenceEnvelope binds tenant and Orgmetra-owned Job Analysis/request references, distinct opaque actor: UUIDv4 requester/reviewer correlations, the closed non-decision use job_analysis_source_evidence, query/response/catalog SHA-256 evidence digests, foreign contract identity, evidence version and exact UTC system-recorded time.

Canonical evidence remains external_source_evidence, requires_human_review, and not_authorized_for_job_or_employment_decision. It carries no raw query term, ontology response, Person/candidate PII, credential, score, employment decision, or autonomous Job-analysis approval. The current source repair c340e7599f147b25fab4c94cd2042a96d6128235 also rejects human-readable actor handles by reusing the canonical opaque UUIDv4 reference validator.

Fresh release-contract prerequisite

The current branch records a reviewed Semantic Data Portal revision, but Orgmetra's integration rule is stricter: production/dependency acceptance consumes an immutable released contract, not a mutable branch or bare source revision. A fresh owner-repository release query on 2026-09-06 returns zero published releases for ContextualWisdomLab/semantic-data-portal.

Therefore this PR remains dependency-first and Draft. The pinned source revision is review evidence only; it is not an admissible production dependency. Do not integrate or relabel it as released until the canonical owner publishes an immutable versioned contract/API/schema and Orgmetra updates its ACL/adapter binding to that release with exact compatibility evidence.

Protected-parent semantic adoption finding

Current protected authority is develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; current feature head remains c340e7599f147b25fab4c94cd2042a96d6128235. GitHub reports the PR mechanically mergeable, but the current synthetic merge 1811ed75a8cb9d560ad59337d7520389296764ef is not semantically acceptable as-is: its exact workflow inventory resurrects .github/workflows/semantic-job-evidence-adapter-quality.yml alongside canonical Foundation/Recovery. The resurrected leaf still uses ubuntu-latest, while protected #161 consolidated repository-owned quality workflows and pins the canonical runner contract.

This is the same class of semantic adoption defect already proven on other old-feature lanes. A future Orgmetra reconciliation must retire the leaf and preserve its useful contracts—Python 3.12/3.13/3.14 compatibility, SHA-256-bound installed-wheel execution, isolated toolchain/import provenance, compile and exact 100% statement/branch coverage—inside the canonical Foundation path, add executable non-resurrection coverage, and reseal provenance from final bytes before a non-force protected-parent adoption is pushed.

Current acceptance discipline

Historical local/hosted GREEN on c340e759... remains predecessor/old-base evidence only. No protected-parent successor has been pushed in this repair because doing so with the currently computed tree would knowingly restore retired CI and because the required foreign released contract does not yet exist.

The PR remains open · Draft. Do not self-approve, use routine administrator bypass, weaken gates, treat a bare foreign commit as a released dependency, copy Semantic Data Portal source, push the known-bad synthetic merge tree, no-op retrigger, force-push/destructively rebase, or Close this valid Job Analysis evidence delta.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8097e0ee-f5ed-4d0f-8df8-51fdda2d4a88

📥 Commits

Reviewing files that changed from the base of the PR and between 505054a and c340e75.

📒 Files selected for processing (16)

• .github/requirements/foundation-test.txt
• .github/workflows/semantic-job-evidence-adapter-quality.yml
• docs/adr/semantic-job-source-evidence.md
• docs/doctoring/semantic-job-evidence-references.md
• docs/traceability/semantic-job-evidence.md
• packages/semantic-job-evidence-adapter/CHANGELOG.md
• packages/semantic-job-evidence-adapter/README.md
• packages/semantic-job-evidence-adapter/pyproject.toml
• packages/semantic-job-evidence-adapter/src/orgmetra_semantic_job_evidence_adapter/envelope.py
• packages/semantic-job-evidence-adapter/tests/conftest.py
• packages/semantic-job-evidence-adapter/tests/test_artifact_execution.py
• packages/semantic-job-evidence-adapter/tests/test_creation_seal_integrity.py
• packages/semantic-job-evidence-adapter/tests/test_docstrings.py
• packages/semantic-job-evidence-adapter/tests/test_envelope.py
• packages/semantic-job-evidence-adapter/tests/test_python_support_contract.py
• tests/test_foundation_ci_dependency_hygiene.sh

🚧 Files skipped from review as they are similar to previous changes (5)

• docs/doctoring/semantic-job-evidence-references.md
• docs/adr/semantic-job-source-evidence.md
• packages/semantic-job-evidence-adapter/README.md
• docs/traceability/semantic-job-evidence.md
• packages/semantic-job-evidence-adapter/CHANGELOG.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Semantic Job Evidence Adapter의 공개 API와 봉투 무결성 검증을 정비했습니다. 검증된 스냅샷을 canonical 출력에 재사용합니다. Python 3.12–3.14 wheel 품질 검증, 테스트 fixture, 추적성 문서를 추가했습니다.

Changes

Semantic Job Evidence 구현

Layer / File(s)	Summary
증거 봉투 계약과 스냅샷 출력 packages/semantic-job-evidence-adapter/pyproject.toml, packages/semantic-job-evidence-adapter/src/..., packages/semantic-job-evidence-adapter/tests/test_envelope.py	SemanticJobEvidenceEnvelope를 공개 API로 등록했습니다. actor reference 검증을 공통 reference 검증으로 통합했습니다. 무결성 검사를 통과한 payload와 JSON을 canonical 출력과 digest 계산에 재사용합니다.
무결성 회귀 검증과 문서화 packages/semantic-job-evidence-adapter/tests/*, docs/doctoring/..., docs/traceability/..., packages/semantic-job-evidence-adapter/README.md, packages/semantic-job-evidence-adapter/CHANGELOG.md	입력 거부, 행위자 분리, 런타임 타입 방어, 생성 후 변조 거부와 checked-snapshot export를 검증합니다. 문서는 증거 범위, fail-closed 동작, Python 지원 범위와 품질 요구사항을 설명합니다.
배포 산출물과 호환성 품질 검증 .github/workflows/semantic-job-evidence-adapter-quality.yml, .github/requirements/foundation-test.txt, tests/test_foundation_ci_dependency_hygiene.sh, packages/semantic-job-evidence-adapter/tests/test_artifact_execution.py, packages/semantic-job-evidence-adapter/tests/test_python_support_contract.py	워크플로는 Python 3.12–3.14에서 wheel을 빌드하고 해시 고정 의존성을 격리된 가상환경에 설치합니다. 설치된 package를 대상으로 pytest와 100% 문장·분기 커버리지를 실행합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to c340e

This PR adds a metadata-only, human-review-required evidence envelope that records tenant scope, actor references, provenance, and integrity digests without carrying raw ontology or employment-decision content. Production consumers must still bind actor references to authenticated tenant principals and persist the canonical payload and digest together; otherwise evidence accountability could be weakened. The exact head is not merge-ready because dependency review has failed, required checks are incomplete, and qualifying approval is still missing.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 45 functions across 9 files. (8 skipped: 8…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 Orgmetra의 관리형 semantic ontology evidence envelope 추가라는 주요 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/semantic-job-evidence-adapter

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.