Skip to content

feat(core): add governed Position reporting-change review - #95

Draft
seonghobae wants to merge 7 commits into
developfrom
feat/position-reporting-change-review
Draft

feat(core): add governed Position reporting-change review#95
seonghobae wants to merge 7 commits into
developfrom
feat/position-reporting-change-review

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

Buyer-visible scope

This Orgmetra-only PR adds a bounded, transport-neutral pre-mutation review boundary for solid-line Position-to-Position reporting reassignment. The packet keeps subordinate/current/proposed manager Position references distinct, rejects self-report/no-op proposals, separates business-effective from system-recorded time, binds reviewed scope with SHA-256 evidence, requires requester/reviewer separation, and remains requires_human_review, requires_authoritative_resolution, not_authorized_to_apply, and human_review_only. It carries no Person PII, compensation, ratings, free-form personal reasons or employment-decision authority.

Protected-parent adoption and causal repair

Current exact head is 9b50b4f3f42e1698c634a73e7f4580e9cfae4c8e on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; the PR remains open · Draft.

Ordinary non-force adoption 2317c367... preserved protected #161 and imported no mutable #94 source. Successor c0975db9... added protected-parent traceability, then hosted Foundation 34005946944 exposed the semantic adoption RED: .github/workflows/position-reporting-change-review-quality.yml had been resurrected with ubuntu-latest, violating the protected exact ubuntu-24.04 runner/inventory contract.

9b50b4f... is an ordinary fast-forward causal repair. It retires the leaf, preserves exact installed-wheel execution, hash-bound wheel installation, pinned CPython 3.14.7 and the unchanged 100% statement/branch threshold in canonical Foundation CI, rewrites the package repository contract to require the canonical path and retired leaf, updates traceability/changelog, and reseals manifest.json against exact Foundation bytes (sha256=81ae584c9c3dd89d7e86011550d9afec439f17b46a1b21db2fc8104f9149aab3, 9199 bytes, 148 lines). No Position domain behavior, review authority, coverage threshold, protected history, mutable #94 source or central gate was weakened.

Current acceptance

Foundation 34009658313 and SAST Semgrep 34009658300 are terminal SUCCESS on exact 9b50b4f.... Security Scan 34009658302 is terminal FAILURE only because dependency-review job 101428767239 checks out and verifies the exact head, then fails at Check dependency review support; the authoritative Dependency Review action is skipped. OSV and Trivy complete successfully, but they do not replace that missing gate.

CodeQL PR 34009658290 is terminal FAILURE at the central verdict handoff rather than from a demonstrated Position source/SARIF finding. Language detection succeeds; Python job 101428499016 and Actions job 101428499024 successfully request current-head CodeQL dispatch and fail only at Release runner or enforce current-head CodeQL verdict. Orgmetra does not synthesize a verdict, weaken the gate, or churn the head to retrigger central infrastructure.

Historical predecessor GREEN and the failed c0975db9... run do not transfer. The PR remains Draft while authoritative Dependency Review/CodeQL and the then-applicable independent review gates remain non-passing.

Before authoritative mutation the host must still re-resolve tenant, subordinate/current/proposed manager Positions, business-effective coordinate, current recorded cutoff, solid-line relationship, Position validity/staffability, reviewer separation, cycle/cardinality constraints, and immutable audit/outbox evidence. This packet neither mutates HRIS truth nor grants employment-decision authority.

No self-approval, routine administrator bypass, gate weakening, predecessor-evidence transfer, no-op retrigger, force-push/destructive rebase, mutable sibling-source import, or release claim.

@coderabbitai

coderabbitai Bot commented Aug 23, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 93a7ee99-f034-47c9-a5f2-59f0722c5ae8

📥 Commits

Reviewing files that changed from the base of the PR and between 9e3e484 and adf055d.

📒 Files selected for processing (11)
  • .github/workflows/position-reporting-change-review-quality.yml
  • docs/adr/0095-governed-position-reporting-change-review.md
  • docs/doctoring/position-reporting-change-review-references.md
  • docs/traceability/position-reporting-change-review.md
  • packages/position-reporting-change-review/CHANGELOG.md
  • packages/position-reporting-change-review/README.md
  • packages/position-reporting-change-review/pyproject.toml
  • packages/position-reporting-change-review/src/orgmetra_position_reporting_change_review/__init__.py
  • packages/position-reporting-change-review/src/orgmetra_position_reporting_change_review/review.py
  • packages/position-reporting-change-review/tests/test_repository_contract.py
  • packages/position-reporting-change-review/tests/test_review.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

PositionReportingChangeReviewPacket 패키지와 관련 거버넌스 문서를 추가했습니다. 패킷은 입력 검증, canonical JSON, SHA-256 무결성 검증을 제공합니다. 테스트와 GitHub Actions 워크플로는 wheel 설치, 해시 검증, 100% 브랜치 커버리지와 깨끗한 checkout을 확인합니다.

Changes

포지션 보고 변경 검토

Layer / File(s) Summary
거버넌스 계약과 패키지 공개 범위
docs/adr/..., docs/doctoring/..., docs/traceability/..., packages/position-reporting-change-review/README.md, CHANGELOG.md, pyproject.toml, src/.../__init__.py
검토 패킷의 범위, 제외 정보, 식별자 규칙, 권한 경계와 추적성을 문서화했습니다. 패키지 빌드 설정과 공개 API를 추가했습니다.
패킷 데이터 구조와 입력 검증
packages/position-reporting-change-review/src/.../review.py
패킷 상태와 참조를 정의했습니다. UUID, digest, 코드, 시간, 행위자 분리, 관계 및 개인정보 최소화 규칙을 검증합니다.
정규화와 증거 무결성
packages/position-reporting-change-review/src/.../review.py
canonical JSON을 생성합니다. 생성 후 필드 변경을 탐지하고 SHA-256 evidence digest를 반환합니다.
테스트와 재현 가능한 품질 게이트
packages/position-reporting-change-review/tests/*, .github/workflows/position-reporting-change-review-quality.yml
정상·오류 입력, 타입 위조, UTC 정규화, 변조 탐지와 문서 경로를 테스트합니다. 고정 Python, 해시 검증 wheel, 의존성 검사, 테스트, 100% 브랜치 커버리지와 깨끗한 checkout을 자동 실행합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to adf05

The change adds a bounded pre-mutation review boundary without changing reporting-line data, and no user-facing or production defect is identified. The current head should not merge yet because the required independent non-author approval is still missing.

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant build_position_reporting_change_review_packet
  participant PositionReportingChangeReviewPacket
  participant QualityWorkflow
  Caller->>build_position_reporting_change_review_packet: reporting-change 입력 전달
  build_position_reporting_change_review_packet->>PositionReportingChangeReviewPacket: 검증된 패킷 생성
  PositionReportingChangeReviewPacket-->>Caller: canonical evidence와 SHA-256 digest 제공
  QualityWorkflow->>PositionReportingChangeReviewPacket: 설치된 wheel 테스트 실행
  QualityWorkflow-->>Caller: 커버리지와 checkout 검증 결과 반환
Loading
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed PR 제목은 핵심 변경인 거버넌스 기반 Position reporting-change review 기능 추가를 정확히 설명합니다. 제목은 간결하고 변경 범위와 일치합니다.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/position-reporting-change-review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

github-code-quality[bot]

This comment was marked as resolved.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 potential issue.

Open in Devin Review

…tively

Preserve the complete governed reporting-change review delta while adopting protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f using GitHub's conflict-free exact merge tree. Keep #94 as an active read-only hierarchy dependency claim only; do not import mutable sibling source.

No force-push, gate weakening, foreign-owner source copy, or release claim.
Repair the exact-head Foundation runner/inventory RED after protected-parent adoption. Retire the resurrected package-local workflow, preserve its exact CPython 3.14.7 installed-wheel and 100% statement/branch coverage contract inside canonical one-job Foundation CI, update the package regression and traceability, and reseal the Foundation manifest.

No Position domain behavior, review authority boundary, coverage threshold, protected history, or central gate is weakened.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant