fix(data): bind candidate conversion recorded time to PostgreSQL transaction time

[seonghobae]

Current authority — 2026-09-06

Current exact head remains 0c4fe88ed0e0b1a117e1adeebe6e5aa1975e87a7 on recorded old base develop@9e3e4847510e1e612b48474ba42b177b8ed824df. Live protected truth is develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. GitHub currently reports this PR open · Draft · non-mergeable. The candidate-conversion system-time repair remains valid and is not a Close candidate.

Retained persistence repair

The branch makes candidate-to-worker conversion knowledge time database-authored. Forward migration 0017_candidate_conversion_system_recorded_time.sql requires fresh candidate_worker_conversion_record.recorded_from to equal PostgreSQL transaction_timestamp() and rejects caller-authored backdating while keeping effective_from as business-effective time. The PostgreSQL regression covers rejected backdating, server-authored transaction time, UTC event serialization, successful insertion and correction history. The branch does not rewrite already-published migration 0009.

Historical exact-head repository/local evidence against the old parent remains causal only and does not transfer to a protected-parent successor. No qualifying independent approval is established for a future reconciled head.

Protected-parent semantic reconciliation finding

This branch predates protected #161 repository-quality consolidation and still adds .github/workflows/candidate-conversion-system-time-quality.yml. That retired-style leaf runs on ubuntu-latest and independently owns the candidate-conversion PostgreSQL contract. Current protected .github/workflows/foundation-ci.yml instead pins ubuntu-24.04 and owns the canonical isolated PostgreSQL contract fleet. Mechanical conflict resolution must therefore not resurrect this leaf or its old runner selector.

The protected Foundation currently runs the existing candidate-worker conversion contract but does not yet execute tests/test_candidate_conversion_system_recorded_time_postgres.sh. The valid feature obligation must be admitted to the canonical owner rather than discarded: add that exact contract to Foundation's isolated PostgreSQL list, add migration 0017 and the new executable contract to both canonical required-file inventories (scripts/foundation-contract-core.mjs::REQUIRED_FILES and tests/validate_repository.py::REQUIRED), merge the candidate-conversion CHANGELOG entry with protected #161's consolidation entry, and regenerate manifest.json from the final resolved bytes. Keep the package-local workflow deleted.

docs/traceability/candidate-conversion-system-recorded-time.md must also stop calling develop@9e3e484... current protected truth. It should distinguish the vulnerable historical snapshot, the active repair, and the eventual reconciled successor without prematurely describing unmerged migration 0017 as protected capability.

Required repair order

Build one ordinary non-force successor from the complete valid 0c4fe88... delta plus fresh protected develop; resolve CHANGELOG/Foundation/inventory/manifest conflicts semantically; keep the retired leaf absent; preserve migration 0017, the PostgreSQL regression and its transaction-time semantics; reseal deterministic provenance from final bytes; then reacquire exact-head Foundation/PostgreSQL/SAST/Security/CodeQL/review evidence.

Do not choose either stale manifest wholesale, restore package-local CI, remove the PostgreSQL regression to make the tree easier to merge, transfer old-base GREEN, self-approve, use routine administrator bypass, force-push/destructively rebase, weaken a gate, or simply Close the valid persistence delta.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a4b66a5-4f9c-4727-a1d3-91b00824644f

📥 Commits

Reviewing files that changed from the base of the PR and between 32926f7 and bcb98f3.

📒 Files selected for processing (1)

• manifest.json

🚧 Files skipped from review as they are similar to previous changes (1)

• manifest.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

후보 전환 레코드의 recorded_from을 PostgreSQL 트랜잭션 시간으로 제한하는 마이그레이션과 회귀 테스트를 추가했습니다. 필수 파일 목록, 매니페스트, CI 워크플로, 설계 및 추적 문서를 갱신했습니다.

Changes

후보 전환 기록 시간

Layer / File(s)	Summary
기록 시간 데이터베이스 계약 database/migrations/0017_candidate_conversion_system_recorded_time.sql	BEFORE INSERT 트리거가 recorded_from과 transaction_timestamp()의 불일치를 23514로 거부합니다.
기록 시간 회귀 검증 tests/test_candidate_conversion_system_recorded_time_postgres.sh	마이그레이션 적용, 테스트 데이터 생성, 과거 recorded_from을 지정한 INSERT의 실패, 값을 생략한 INSERT와 수정 전환의 트랜잭션 시간 저장을 검증합니다.
저장소 및 CI 통합 .github/workflows/candidate-conversion-system-time-quality.yml, scripts/foundation-contract-core.mjs, tests/validate_repository.py, manifest.json, docs/doctoring/..., docs/traceability/...	새 마이그레이션과 테스트를 저장소 검증, 매니페스트, PostgreSQL CI 및 관련 문서에 등록합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to bcb98

The database change prevents candidate conversions from backdating system-recorded time while preserving PostgreSQL transaction time as the normal path, so the functional impact is localized. Merge readiness remains moderate because the required independent non-author review is absent on the exact current head, and the test evidence still labels an event as UTC without supplied proof of the PostgreSQL session timezone.

Sequence Diagram(s)

sequenceDiagram
  participant CI as GitHub Actions
  participant Test as PostgreSQL 회귀 테스트
  participant DB as PostgreSQL
  participant Guard as 기록 시간 트리거
  CI->>DB: PostgreSQL 16.14 서비스 시작
  CI->>Test: 회귀 테스트 실행
  Test->>DB: 마이그레이션 적용 및 테스트 데이터 생성
  Test->>DB: 후보 전환 INSERT 실행
  DB->>Guard: BEFORE INSERT 기록 시간 검사
  Guard-->>Test: 불일치 시 23514 반환
  Test-->>CI: 검증 결과 반환

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 후보자 전환의 recorded_from을 PostgreSQL 트랜잭션 시간에 연결하는 핵심 변경을 정확하고 구체적으로 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/candidate-conversion-system-recorded-time

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.