feat(core): add bitemporal position reporting hierarchy

[seonghobae]

Buyer-visible gap

Orgmetra separates Job, Position and Assignment and models organization-unit hierarchy, but protected truth still has no authoritative Position-to-Position solid-line reporting fact. A commercial HRIS therefore cannot reconstruct which seat reports to which managerial seat at one business date and system-knowledge cutoff without incorrectly deriving supervision from Person/Assignment or Organization parentage.

This Orgmetra-only slice defines a tenant-scoped, bitemporal reporting contract. Managerial hierarchy is Position-to-Position, not Person-to-Person; Assignment remains an independent multiple-membership fact.

RED → root-cause implementation retained

• RED 36f8f7d0605688c95ddebdc6d6f513eb81d4e144 defined deterministic subordinate→manager evidence, tenant isolation, effective/system-time visibility, one visible solid-line manager per subordinate, staffable endpoint seats, cycle/self-report rejection, trust-bearing runtime-type hardening and redacted routine representation before production position_reporting existed.
• Foundation 32616830004 / job 97138821309 checked out that exact RED SHA and failed with ModuleNotFoundError: No module named 'orgmetra_hris_kernel.position_reporting'.
• Root implementation f75ef9a7d785229d2e8a11fe3a5257ce40a5e0c8 added PositionReportingRelationship, PositionReportingSnapshot and bitemporal reconstruction over authoritative PositionVersion evidence only.
• The first implementation exposed a real 95% coverage RED; adversarial UUID/type/timezone regressions closed the untested trust-boundary branches without weakening the 100% gate.
• Public API regression fb78cbb9f85fd1c7765b98afbcd609829dba543d and repair 3f67182bb3065f2fc8fd974bfdd75a390d8a8fdc expose the governed types/function from the package root and __all__.

Protected-parent adoption

Current exact head: e950286e0ed867eb7b20061b0495360b57503487
Protected base: develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f
Live state: open · Draft · mergeable.

e950286e... is an ordinary non-force two-parent adoption of prior feature head 2ff1262b976029e447dc736e6472eebbac30a7f5 and protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Protected #161 repository-workflow consolidation is preserved rather than resurrected or overwritten. Historical checks against the older parent remain causal evidence only.

Current exact-head acceptance

Current-head hosted results are now terminal:

• Foundation 34005387510: SUCCESS.
• Security Scan 34005387493: SUCCESS.
• SAST Semgrep 34005387374: SUCCESS.
• CodeQL PR 34005387422: FAILURE, but not from a source/SARIF finding. Both Python and Actions compatibility jobs successfully requested the exact-head CodeQL dispatch and then failed only at Release runner or enforce current-head CodeQL verdict; this is the same central verdict-production/authorization owner boundary already affecting other Orgmetra lanes.

Do not convert that central handoff failure into leaf churn, a synthetic verdict, a no-op retrigger, or a weakened security gate. Formal reviews remain COMMENTED-only; no qualifying APPROVED review exists, so the PR remains Draft.

Governed behavior

A visible solid-line reporting edge must reference exactly one same-tenant active or open PositionVersion at the requested business/system coordinate for both subordinate and manager. One subordinate can have only one visible solid-line manager; self-reporting and cycles fail closed. Caller-defined relationship/PositionVersion/date/datetime subclasses cannot control trust-bearing identity or temporal comparisons, and caller-owned timezone behavior is resolved once and detached into a built-in UTC instant. Routine representations redact position-correlation UUIDs.

The snapshot is descriptive organizational evidence only. It does not identify the worker occupying either seat, infer a manager from Assignment, reinterpret Organization parentage as supervisory authority, authorize an employment decision, or claim authoritative reporting-line mutation.

Remaining buyer gap and merge governance

Persistence/mutation remains a bounded follow-up: normalized tenant-qualified persistence, immutable audit/outbox evidence, bitemporal write/correction semantics, purpose-bound authorization and database-level integrity. Accessible organization-chart UI remains separate and requires Product Design/Figma/Storybook/accessibility evidence when it enters scope.

Keep this PR Draft until the central CodeQL owner produces a valid exact-head verdict, every other required central workflow is terminal passing, required conversations are resolved, and the live one-approval policy is satisfied. Do not self-approve, use routine administrator bypass, weaken gates, transfer predecessor evidence, force-push/destructively rebase, or copy mutable foreign-owner source.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/position-reporting-hierarchy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Lifecycle correction: protected develop is eb9757f8649aaad026a9865508d9aad50c1a7a4f; the PR body still describes the old 9e3e484... base and a non-Draft state. #94 is now Draft. Preserve the Position-to-Position reporting hierarchy, public API repair, bitemporal invariants, and all valid review/test deltas, but do not treat old-base mechanical mergeability or predecessor gates as current integration evidence. Before Ready, non-force adopt current protected truth, reconcile HRIS-kernel/repository-quality changes semantically, regenerate deterministic provenance affected by the final tree, and rerun all current-head gates/reviews. No Close, force-rebase, or one-side overwrite.