feat(job-analysis): add governed semantic ontology evidence

.github/requirements/foundation-test.txt

@@ -1,6 +1,6 @@
-# Reviewed Foundation CI test toolchain for CPython 3.14 on GitHub-hosted Ubuntu x86_64.
+# Reviewed Foundation CI test toolchain for CPython 3.12-3.14 on GitHub-hosted Ubuntu x86_64.
 # Version and artifact hash changes must be reverified against the official PyPI release JSON.
-coverage==7.14.2 --hash=sha256:cda36d8e7bfd63b3e44e75163265429caa5d935b672b00f71bccc8c010518c64
+coverage==7.14.2 --hash=sha256:8b4910cce599cd2438f8da65f5ef199a70a1cdb6ab314926df78271ca5954240 --hash=sha256:1d9a1b5813d00ea6151f6ccf64d1fa16892771dfdda12ba87162d15ec4ea3e1e --hash=sha256:cda36d8e7bfd63b3e44e75163265429caa5d935b672b00f71bccc8c010518c64
 iniconfig==2.3.0 --hash=sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12
 packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
 pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746

.github/workflows/semantic-job-evidence-adapter-quality.yml

@@ -0,0 +1,98 @@
+name: Semantic Job Evidence Adapter Quality
+
+on:
+  pull_request:
+    branches:
+      - bootstrap
+      - develop
+      - main
+    paths:
+      - "packages/semantic-job-evidence-adapter/**"
+      - ".github/requirements/foundation-test.txt"
+      - ".github/workflows/semantic-job-evidence-adapter-quality.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: semantic-job-evidence-adapter-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  unit:
+    name: Semantic source evidence contract and 100% coverage (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13", "3.14"]
+    steps:
+      - name: Checkout exact candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Prove exact candidate checkout
+        env:
+          ORGMETRA_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: test "$(git rev-parse HEAD)" = "$ORGMETRA_EXPECTED_HEAD_SHA"
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          check-latest: false
+      - name: Install reviewed test and build toolchain
+        run: |
+          python -m pip install --require-hashes --no-deps --only-binary=:all: -r .github/requirements/foundation-test.txt
+          printf '%s\n' 'setuptools==84.0.0 --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670' > /tmp/orgmetra-semantic-job-evidence-build.txt
+          python -m pip install --require-hashes --no-deps --only-binary=:all: -r /tmp/orgmetra-semantic-job-evidence-build.txt
+          python -m pip check
+      - name: Compile adapter boundary
+        run: python -m compileall -q packages/semantic-job-evidence-adapter/src packages/semantic-job-evidence-adapter/tests
+      - name: Build and install exact package artifact
+        run: |
+          rm -rf /tmp/orgmetra-semantic-job-evidence-adapter-build /tmp/orgmetra-semantic-job-evidence-adapter-dist /tmp/orgmetra-semantic-job-evidence-adapter-venv
+          cp -a packages/semantic-job-evidence-adapter /tmp/orgmetra-semantic-job-evidence-adapter-build
+          mkdir -p /tmp/orgmetra-semantic-job-evidence-adapter-dist
+          python -m pip wheel --no-deps --no-build-isolation --wheel-dir /tmp/orgmetra-semantic-job-evidence-adapter-dist /tmp/orgmetra-semantic-job-evidence-adapter-build
+          test "$(find /tmp/orgmetra-semantic-job-evidence-adapter-dist -maxdepth 1 -type f -name '*.whl' | wc -l)" -eq 1
+          python -m venv /tmp/orgmetra-semantic-job-evidence-adapter-venv
+          /tmp/orgmetra-semantic-job-evidence-adapter-venv/bin/python -m pip install --require-hashes --no-deps --only-binary=:all: -r "$GITHUB_WORKSPACE/.github/requirements/foundation-test.txt"
+          wheel_path="$(find /tmp/orgmetra-semantic-job-evidence-adapter-dist -maxdepth 1 -type f -name '*.whl' -print -quit)"
+          wheel_sha="$(sha256sum "$wheel_path" | awk '{print $1}')"
+          printf 'orgmetra-semantic-job-evidence-adapter[test] @ file://%s --hash=sha256:%s\n' "$wheel_path" "$wheel_sha" > /tmp/orgmetra-semantic-job-evidence-install.txt
+          /tmp/orgmetra-semantic-job-evidence-adapter-venv/bin/python -m pip install --require-hashes --no-deps -r /tmp/orgmetra-semantic-job-evidence-install.txt
+          /tmp/orgmetra-semantic-job-evidence-adapter-venv/bin/python -m pip check
+          /tmp/orgmetra-semantic-job-evidence-adapter-venv/bin/python - <<'PY'
+          from importlib.metadata import metadata
+          from pathlib import Path
+          import coverage
+          import pytest
+          import pytest_cov
+          import orgmetra_semantic_job_evidence_adapter
+
+          venv_root = Path("/tmp/orgmetra-semantic-job-evidence-adapter-venv").resolve()
+          module_path = Path(orgmetra_semantic_job_evidence_adapter.__file__).resolve()
+          if not module_path.is_relative_to(venv_root):
+              raise SystemExit(f"package imported outside isolated environment: {module_path}")
+          for module in (coverage, pytest, pytest_cov):
+              dependency_path = Path(module.__file__).resolve()
+              if not dependency_path.is_relative_to(venv_root):
+                  raise SystemExit(
+                      f"test dependency imported outside isolated environment: {dependency_path}"
+                  )
+          if "test" not in (metadata("orgmetra-semantic-job-evidence-adapter").get_all("Provides-Extra") or []):
+              raise SystemExit("built distribution does not expose the reviewed test extra")
+          PY
+      - name: Test installed semantic source evidence with exact statement and branch coverage
+        env:
+          COVERAGE_FILE: /tmp/orgmetra-semantic-job-evidence-adapter.coverage
+        run: |
+          cd /tmp
+          /tmp/orgmetra-semantic-job-evidence-adapter-venv/bin/python -m pytest -c "$GITHUB_WORKSPACE/packages/semantic-job-evidence-adapter/pyproject.toml" "$GITHUB_WORKSPACE/packages/semantic-job-evidence-adapter/tests"
+      - name: Require clean checkout
+        run: |
+          git diff --exit-code
+          test -z "$(git status --porcelain)"

docs/adr/semantic-job-source-evidence.md

@@ -0,0 +1,46 @@
+# ADR — Govern Semantic Data Portal source evidence at the Orgmetra Job Analysis boundary
+
+## Status
+
+Active PR. This document does not describe protected-main truth until the owning PR merges.
+
+## Context
+
+Orgmetra's protected Job Analysis model already distinguishes authoritative human-reviewed evidence from draft/model-derived material, while protected traceability still lists Semantic Data Portal integration as planned. Semantic Data Portal is a separately owned CWL product and publishes ontology-resolution APIs. Direct table access or copying its implementation into Orgmetra would violate the dedicated-writer and modular-service boundary.
+
+Ontology resolution can improve Task/FJA/KSAO evidence discovery, but a semantic match is not itself an authoritative Job-analysis conclusion and must not become an autonomous employment decision. Orgmetra therefore needs a local governance artifact that records exactly what external contract and evidence version were reviewed without storing the raw ontology query/response in the audit correlation object.
+
+## Decision
+
+Orgmetra owns a final, immutable `SemanticJobEvidenceEnvelope` that binds:
+
+1. tenant and Job Analysis scope;
+2. an opaque Orgmetra ontology-request reference;
+3. distinct requesting and human-reviewing opaque `actor:` UUIDv4 references;
+4. the closed use `job_analysis_source_evidence`;
+5. SHA-256 digests for query-term evidence, response evidence, and source-catalog state;
+6. the reviewed Semantic Data Portal revision `e48aa13c4af7a4875d4b53e6a60b50405c265a2f` and `POST /ontology/resolve` operation;
+7. evidence version and exact UTC system-recorded time.
+
+The canonical evidence always records `external_source_evidence`, `requires_human_review`, and `not_authorized_for_job_or_employment_decision`.
+
+Semantic Data Portal remains read-only to this Orgmetra lane. No foreign application table is queried. Provider revision/API drift fails closed until explicitly reviewed. Raw ontology content, PII, credentials, scores, and decisions stay outside this value-minimized envelope.
+
+Trust-bearing runtime primitives are accepted only as exact built-in types before caller-overridable equality, hashing, comparison, parsing, or serialization can run. Creation-time evidence is sealed in process and its authoritative seal is held in a lock-protected issuance registry outside envelope-writable slots. Canonical export verifies one canonical payload snapshot and returns that same snapshot/JSON rather than rereading live fields after the integrity decision, so checked and emitted evidence cannot diverge through an intervening same-process mutation.
+
+The issuance registry and process MAC key are intentionally process-local. Copy/deepcopy, pickle/unpickle, worker transfer, and process restart do not recreate an envelope's issuance authority; restored envelope objects fail closed. Durable systems must persist the already-emitted canonical JSON and its evidence digest through Orgmetra's immutable audit/outbox boundary, not serialize a live envelope and expect it to regain process-local validation state. If long-term independent revalidation becomes a requirement, a separately governed managed and rotatable key/signing boundary must be designed; it is not claimed by this slice.
+
+The package's supported runtime is deliberately bounded to Python `>=3.12,<3.15` and the dedicated quality workflow executes the installed artifact on 3.12, 3.13, and 3.14 before support is claimed. New Python minors require explicit compatibility evidence before widening that range.
+
+## Consequences
+
+- Buyers can trace a Job Analysis source claim to an exact external contract revision and evidence digests without treating that source as authoritative by syntax alone.
+- Human review remains explicit and separable from source retrieval.
+- A future Semantic Data Portal contract change requires an Orgmetra review/update rather than silently changing evidence semantics.
+- Process-local tamper evidence is safe to use only in the issuing process; durable evidence uses canonical bytes/digest plus the repository's immutable audit/outbox controls.
+- This slice does not implement network transport, foreign retries, foreign authorization, raw ontology storage, Job Analysis approval, employment decisions, or durable signing-key management.
+- The approach is compatible with W3C provenance principles: source entities and activities remain externally owned while Orgmetra records bounded provenance needed for its own evidence chain.
+
+## Verification
+
+The package quality lane requires exact-current-head tests, exact 100% owned production statement and branch coverage, installed-wheel execution across the declared Python minor range, adversarial runtime-integrity regressions, and a clean checkout. Repository-level Foundation/SAST/Security/Recovery evidence remains separately required by live merge governance.

docs/doctoring/semantic-job-evidence-references.md

@@ -0,0 +1,23 @@
+# Semantic Job Evidence — primary references
+
+## Scope
+
+These references support the active-PR decision to keep foreign ontology output as provenance-bearing source evidence that requires human review, rather than copying a dedicated-writer service or treating semantic resolution as authoritative Job/employment decision evidence. They also record the primary package metadata used to bind the adapter's declared Python support to its hosted compatibility evidence.
+
+## References (APA 7)
+
+ContextualWisdomLab. (2026). *Semantic Data Portal* (Revision e48aa13c4af7a4875d4b53e6a60b50405c265a2f) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/semantic-data-portal/tree/e48aa13c4af7a4875d4b53e6a60b50405c265a2f
+
+Lebo, T., Sahoo, S., & McGuinness, D. (Eds.). (2013). *PROV-O: The PROV ontology* (W3C Recommendation). World Wide Web Consortium. https://www.w3.org/TR/prov-o/
+
+Python Software Foundation. (2026). *coverage 7.14.2 release metadata* [JSON metadata]. Python Package Index. https://pypi.org/pypi/coverage/7.14.2/json
+
+Tabassi, E. (2023). *Artificial intelligence risk management framework (AI RMF 1.0)* (NIST AI 100-1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
+
+## Evidence notes
+
+- The pinned Semantic Data Portal README publishes `POST /ontology/resolve` as an ontology/terminology API. That is the exact foreign operation recorded by this Orgmetra adapter; the dependency remains read-only.
+- W3C PROV-O is a W3C Recommendation for interoperable provenance representation across heterogeneous systems. The Orgmetra envelope uses a small application-specific provenance record rather than claiming PROV-O serialization compliance.
+- NIST AI RMF 1.0 remains the published final framework while NIST develops revisions/profiles. Its risk-management framing supports keeping model/semantic outputs governed and reviewable. This package does not claim AI RMF conformity or certification.
+- The official PyPI JSON for coverage 7.14.2 advertises Python 3.12, 3.13, and 3.14 support and publishes distinct SHA-256 digests for their CPython Linux wheels. The Orgmetra hash lock admits only the exact reviewed 3.12/3.13/3.14 coverage wheel hashes used by the hosted matrix; it does not disable `--require-hashes` or broaden dependency versions.
+- No psychometric/statistical estimator is implemented in this slice, so no research-only statistical claim is introduced and no foreign psychometric kernel is duplicated.

docs/traceability/semantic-job-evidence.md

@@ -0,0 +1,32 @@
+# Semantic Job Evidence Traceability
+
+## Maturity
+
+`active_pr`. Protected `develop` still lists Semantic Data Portal / ontology integration as planned. This document records only the executable scope of the owning PR and must not be read as protected-main truth until merge.
+
+| Requirement | Executable evidence | Boundary |
+|---|---|---|
+| Consume only a published foreign contract | reviewed Semantic Data Portal revision `e48aa13c4af7a4875d4b53e6a60b50405c265a2f`; exact `POST /ontology/resolve` operation | read-only dependency; no foreign table access |
+| Bind source evidence to Orgmetra scope | canonical tenant, `job_analysis:` and `ontology_request:` references | Orgmetra-owned evidence envelope |
+| Require accountable human review | distinct `actor:` UUIDv4 requester and reviewer; canonical state `requires_human_review` | syntax is correlation only; host identity/scope resolution remains authoritative |
+| Prevent semantic evidence from becoming a decision | canonical state `not_authorized_for_job_or_employment_decision` | source evidence cannot authorize Job/employment action |
+| Minimize HR/audit exposure | query term, response and source catalog represented only by SHA-256 digests | no raw query/response, PII, credential, score, or decision in canonical evidence |
+| Preserve exact source provenance | foreign revision, API operation, source-system/trust-state, evidence version, UTC recorded time | provider drift fails closed |
+| Prevent runtime evidence forgery | exact built-in primitives, UUID/reference/digest validation, final runtime type | adversarial subclass regressions |
+| Prevent post-issuance rewrite | packet consistency seal plus lock-protected process-local authoritative issuance seal | payload-only, seal-only, payload+recomputed-seal, replace, and marker-tamper regressions |
+| Prevent checked/emitted evidence divergence | canonical export returns the exact payload/JSON snapshot used for live seal verification | deterministic mutation-between-check-and-return regression |
+| Keep process-local issuance semantics explicit | restored/copied envelope objects do not regain issuance registry state; durable systems persist emitted canonical JSON + digest | README/ADR boundary; managed rotatable long-term seal is future work only |
+| Bound declared Python compatibility to evidence | `requires-python = ">=3.12,<3.15"`; hosted matrix executes 3.12, 3.13, 3.14 | support range cannot widen without new current-head CI evidence |
+| Maintain exact owned production coverage | dedicated `Semantic Job Evidence Adapter Quality` workflow | 100% statement and branch coverage required on every matrix runtime |
+
+## Test mapping
+
+`packages/semantic-job-evidence-adapter/tests/test_envelope.py` verifies canonical value minimization, reviewed trust states, tenant/reference validity, requester/reviewer separation, source revision/API binding, bounded evidence versions, exact UTC recorded time, hostile runtime subclasses, post-construction mutation, dataclass replacement/seal reset, marker/seal tampering, checked-snapshot export, redacted repr, and final runtime type.
+
+`packages/semantic-job-evidence-adapter/tests/test_creation_seal_integrity.py` proves that rewriting a valid trust-bearing field together with a freshly recomputed packet-owned HMAC cannot authorize changed evidence because the authoritative creation seal is stored outside envelope-writable slots.
+
+`packages/semantic-job-evidence-adapter/tests/test_python_support_contract.py` binds public Python support metadata to the hosted 3.12/3.13/3.14 compatibility matrix.
+
+## Non-claims
+
+This active PR does not prove the truth of Semantic Data Portal content, does not authenticate actor syntax, does not implement the network client, does not directly approve a Job Analysis, and does not authorize a hiring or other employment decision. The process-local issuance seal is tamper evidence, not durable cryptographic attestation or a managed signing service. Those authorities remain with their owning Orgmetra and dedicated-writer boundaries.

packages/semantic-job-evidence-adapter/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## Unreleased
+
+- Add a value-minimized, human-review-required Semantic Data Portal ontology evidence envelope for Job Analysis.
+- Pin the reviewed read-only dependency revision and `POST /ontology/resolve` API operation.
+- Bind tenant, Job Analysis scope, accountable actors, source/query/response digests, evidence version, and UTC system-recorded time without copying raw ontology or HR content.
+- Require opaque canonical `actor:` UUIDv4 correlations so human-readable actor handles cannot enter durable evidence.
+- Fail closed on malformed governance evidence, self-review, caller-defined primitive subclasses, dependency-contract drift, post-construction mutation, seal reset, and runtime type extension.
+- Repair the post-issuance integrity path so rewriting a payload together with a recomputed packet-owned seal still fails: the authoritative creation seal is held in a process-local, lock-protected issuance registry outside envelope-writable slots.
+- Return the exact canonical payload/JSON snapshot that passed seal verification so an intervening same-process mutation cannot make checked bytes and emitted bytes diverge.
+- Document the process-local issuance boundary: copied/restored envelope objects fail closed, while durable audit/outbox persistence stores emitted canonical JSON and evidence digest rather than the live envelope object.
+- Bound declared runtime support to Python `>=3.12,<3.15` and execute the installed wheel on Python 3.12, 3.13, and 3.14 before claiming compatibility.
+- Add an exact-head quality workflow with exact 100% owned production statement and branch coverage plus clean-checkout enforcement.
+- Build a wheel and execute the quality suite against the SHA-256-bound installed artifact in a fully isolated virtual environment; install the reviewed hash-pinned pytest/coverage toolchain inside that environment and fail closed if package or test-tool imports resolve outside it.