feat(document-records): add governed HR document evidence

[seonghobae]

Current authority — 2026-09-06

Current exact head is 6a9f3e214079e2b46bba9776a862f194b899f0e4. Protected truth is develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; this branch still retains the older develop@9e3e4847510e1e612b48474ba42b177b8ed824df snapshot. Live state is open · Draft · non-mergeable. The document-record evidence delta remains valid and is not a Close candidate.

The previous PR prose stopped at predecessor 59b809bead617d9045357396df684991548bdc30. Intervening ordinary successor 6a9f3e214079e2b46bba9776a862f194b899f0e4 is a real production+test trust-boundary repair: _validate_received_at(...) now requires recorded_at itself to be an exact built-in UTC datetime before chronology/canonical-seal processing, and test_rejects_forged_recorded_time_before_seal_verification proves a caller-defined datetime subtype cannot spoof the original serialized time while retaining a different underlying instant. This successor is adopted as current branch truth; it is not treated as race/noise.

Exact-head historical evidence on 6a9f3e... is locally strong: Document Record Evidence Quality, Foundation CI, Recovery, SAST, Security Scan, coverage source/evidence, Dependency Review, and applicable PostgreSQL integrity contracts completed successfully. The exact-head central OpenCode, Noema, and Strix checks are terminal failures, so this historical old-base head is not merge-passing. No predecessor result is promoted over those failures or over the current protected-parent gap.

Before Ready, non-force adopt current protected develop, preserve #161 repository-workflow consolidation and the complete document-evidence trust-boundary delta, resolve semantic/provenance conflicts, reseal deterministic artifacts from the final resolved bytes, then reacquire 100% owned coverage, PostgreSQL evidence where applicable, every then-current central security/review gate, resolved conversations, and a qualifying independent approval on the reconciled exact head. Do not self-approve, use administrator bypass, force-push, create no-op retriggers, weaken gates, or copy foreign-owner source.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a046702-6121-4e2e-b736-1025ff57d931

📥 Commits

Reviewing files that changed from the base of the PR and between 9e3e484 and 9aeeb20.

📒 Files selected for processing (10)

• .github/workflows/document-record-evidence-quality.yml
• docs/adr/0098-governed-document-record-evidence.md
• docs/doctoring/document-record-evidence-references.md
• docs/traceability/document-record-evidence.md
• packages/document-record-evidence/CHANGELOG.md
• packages/document-record-evidence/README.md
• packages/document-record-evidence/pyproject.toml
• packages/document-record-evidence/src/orgmetra_document_record_evidence/__init__.py
• packages/document-record-evidence/src/orgmetra_document_record_evidence/evidence.py
• packages/document-record-evidence/tests/test_evidence.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

DocumentRecordEvidence 패키지를 추가했습니다. 최소화된 HR 문서 메타데이터와 무결성 digest를 검증합니다. 관련 ADR, 참조 문서, 추적성 문서 및 설치 휠 품질 검증 워크플로를 추가했습니다.

Changes

Document Record Evidence

Layer / File(s)	Summary
증거 계약과 무결성 구현 packages/document-record-evidence/pyproject.toml, packages/document-record-evidence/src/..., packages/document-record-evidence/tests/test_evidence.py	DocumentRecordEvidence와 build_document_record_evidence를 공개했습니다. UUID, SHA-256, UTC 시각, 허용 분류를 검증하고 canonical payload digest로 변경을 감지합니다. 생성, 직렬화, 오류 조건 및 마스킹 동작을 테스트합니다.
거버넌스와 추적성 문서 docs/adr/0098-governed-document-record-evidence.md, docs/doctoring/document-record-evidence-references.md, docs/traceability/document-record-evidence.md, packages/document-record-evidence/README.md, packages/document-record-evidence/CHANGELOG.md	증거의 포함·제외 범위, provenance, 보존정책, 시간 구분, 권한·감사 책임 및 후속 persistence 경계를 문서화합니다.
설치 휠 품질 검증 .github/workflows/document-record-evidence-quality.yml	develop 대상 변경과 수동 실행을 처리합니다. 고정된 checkout과 Python 3.14.7 환경에서 wheel을 빌드하고, 해시 고정 설치, pip check, 테스트, 100% 커버리지 및 checkout 상태를 검증합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to 9aeeb

The PR adds a constrained, evidence-only HR document boundary with successful exact-head validation and no actionable merge-blocking risk remaining beyond normal independent review and repository protection checks.

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant build_document_record_evidence
  participant DocumentRecordEvidence
  Caller->>build_document_record_evidence: 키워드 인자 전달
  build_document_record_evidence->>DocumentRecordEvidence: 객체 생성 및 입력 검증
  Caller->>DocumentRecordEvidence: canonical_json 호출
  DocumentRecordEvidence-->>Caller: 검증된 canonical JSON 반환

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 governed HR document evidence 패키지와 주요 변경 내용을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/document-record-evidence

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.