feat(workforce-validation): establish governed validity-study registry boundary - #235
seonghobae wants to merge 599 commits into
Conversation
📝 WalkthroughWalkthroughChangesworkforce_validation 서비스 기반과 소유 스키마
검증 연구 레지스트리
Authority 해석기
Priority: ➖ Normal Estimated code review effort: 5 (Critical) | ~90 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant AuthorityResolver
participant PurposeBoundAccess
participant OwnerReadPort
Caller->>AuthorityResolver: authority 좌표와 used_at 전달
AuthorityResolver->>PurposeBoundAccess: 목적·리소스·필드 접근 평가
PurposeBoundAccess-->>AuthorityResolver: 승인 또는 거부
AuthorityResolver->>OwnerReadPort: 요청 좌표로 출시 증거 조회
OwnerReadPort-->>AuthorityResolver: authority record 또는 None
AuthorityResolver-->>Caller: 검증된 최소화 view 또는 오류
Merge Risk: 🟡 Moderate · up to These contract defects can authorize overlapping validation results or reject valid weight/variance evidence. They should be corrected before merge. 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 55.60% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 687 functions across 54 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="b59f9cadfab1d4571efd62d805b9d319f9cb9741"
echo "== Exact commits =="
git show -s --format='%H%n%P%n%s' "$base"
git show -s --format='%H%n%P%n%s' "$head"
echo "== Merge base =="
git merge-base "$base" "$head"
echo "== Changed files =="
git diff --name-status "$base" "$head"
echo "== Diff summary =="
git diff --stat "$base" "$head"
echo "== Candidate outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Relevant documentation/CI references =="
rg -n -i -C 3 \
'workforce_validation|validity.study|validity_study|foundation-ci|pytest|coverage|public\.' \
.github ARCHITECTURE.md README.md 2>/dev/null || trueLength of output: 22416 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Changed package contents =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/pyproject.toml \
services/workforce-validation-api/README.md
do
echo "--- $file"
cat -n "$file"
done
echo "== Keyverse authorization API candidates =="
fd -t f . packages/keyverse-adapter | sort
ast-grep outline packages/keyverse-adapter/src --items all 2>/dev/null || true
rg -n -C 5 \
'class PurposeBoundAccess|def require_purpose_bound_access|AuthorizationDeniedError|PurposeBoundAccessRequest|runtime_checkable' \
packages/keyverse-adapter/src packages/keyverse-adapter/tests
echo "== Foundation CI unit-test and install steps =="
sed -n '35,75p' .github/workflows/foundation-ci.yml
echo "== Existing service port patterns =="
rg -n -C 4 \
'`@runtime_checkable`|class .*ReadPort\(Protocol\)|isinstance\(.*Port|def read_.*\(' \
services/job-analysis-api/src services/people-api/src 2>/dev/null || trueLength of output: 65327 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Validity-study schema and migration references =="
rg -n -i -C 8 \
'create table.*validity|validity_study|criterion_blueprint|recorded_from|recorded_to|study_status_code' \
-g '*.sql' -g '*.md' -g '*.py' . \
| head -n 800
echo "== Keyverse authorization implementation =="
sed -n '1,330p' packages/keyverse-adapter/src/orgmetra_keyverse_adapter/authorization.py
echo "== Comparable port validation helpers and read functions =="
sed -n '70,160p' services/people-api/src/orgmetra_people_api/people.py
sed -n '330,510p' services/job-analysis-api/src/orgmetra_job_analysis_api/snapshot.py
echo "== Complete changed-diff scan for persistence/schema dependencies =="
git diff --unified=40 eb9757f8649aaad026a9865508d9aad50c1a7a4f b59f9cadfab1d4571efd62d805b9d319f9cb9741 \
-- services/workforce-validation-api \
| rg -n -i -C 3 'public|postgres|sql|schema|select|insert|validity_study|read_port|callable|timezone|zoneinfo'Length of output: 143503 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Base validity_study table definition =="
rg -n -i -A 80 -B 5 'CREATE TABLE validity_study\s*\(' database/migrations -g '*.sql'
echo "== Repository inventory validation mechanism =="
sed -n '1,130p' tests/validate_repository.py
rg -n -C 3 \
'manifest\.json|REQUIRED|EXPECTED|inventory|services/job-analysis-api|services/people-api|workforce-validation' \
tests scripts package.json .github/workflows/foundation-ci.yml \
-g '*.py' -g '*.mjs' -g '*.json' -g '*.yml'
echo "== New package references outside its own directory =="
rg -n -C 2 \
'workforce-validation-api|orgmetra_workforce_validation_api' \
. \
-g '!services/workforce-validation-api/**'
echo "== Current CI workflow context around unit commands =="
nl -ba .github/workflows/foundation-ci.yml | sed -n '52,74p'Length of output: 36146
I found two blocking issues:
The remaining requested boundary checks are sound in the reviewed slice:
|
|
@coderabbitai review Current exact head moved to |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="b59f9cadfab1d4571efd62d805b9d319f9cb9741"
test_first="b22383c27ec3da6c8111e78fc862363e84399822"
head="3fe809250c86b328dedf3cb46c3d5953966cfc72"
echo "== Exact commit identity and ancestry =="
for commit in "$base" "$prior" "$test_first" "$head"; do
git show -s --format='%H%n%P%n%s%n' "$commit"
done
echo "merge-base:"
git merge-base "$base" "$head"
echo "base ancestor of head:"
git merge-base --is-ancestor "$base" "$head" && echo yes
echo "test-first ancestor of head:"
git merge-base --is-ancestor "$test_first" "$head" && echo yes
echo "== Changed files from protected base to exact head =="
git diff --name-status "$base" "$head"
echo "== Repair diff =="
git diff --stat "$test_first" "$head"
git diff --unified=80 "$test_first" "$head" -- \
services/workforce-validation-api \
packages/keyverse-adapter
echo "== Changed Python outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all || true
;;
esac
done
echo "== Registry, tests, package definition, and CI =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/pyproject.toml \
services/workforce-validation-api/README.md \
.github/workflows/foundation-ci.yml
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
done
echo "== Keyverse authorization contract =="
fd -t f . packages/keyverse-adapter/src | sort
rg -n -C 8 \
'class PurposeBoundAccess|def require_purpose_bound_access|PurposeBoundAccessRequest|AuthorizationDeniedError' \
packages/keyverse-adapter/srcLength of output: 71392 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Executable-policy regression test =="
cat -n services/workforce-validation-api/tests/test_policy_runtime_integrity.py
echo "== Complete Keyverse evaluator =="
sed -n '1,340p' packages/keyverse-adapter/src/orgmetra_keyverse_adapter/authorization.py
echo "== Owner package exports and all direct dependency imports =="
cat -n services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py
rg -n -C 3 \
'^(from|import) |public\.|SELECT |INSERT |UPDATE |DELETE |psycopg|sqlalchemy|database|postgres|people|talent|performance|job_analysis|psychometric|fast_mlsirm|tepp' \
services/workforce-validation-api
echo "== Architecture and protected table evidence =="
rg -n -i -C 6 \
'workforce_validation|validity_study|CREATE TABLE validity_study|CREATE TABLE.*validity_study' \
ARCHITECTURE.md database/migrations -g '*.md' -g '*.sql'
echo "== Read-port runtime protocol behavior test shape =="
python - <<'PY'
from typing import Protocol, runtime_checkable
`@runtime_checkable`
class Port(Protocol):
def read_validity_study(self) -> object: ...
class NonCallable:
read_validity_study = None
print(isinstance(NonCallable(), Port))
PYLength of output: 61765
I found one blocking issue.
The requested boundary checks are correct in this head:
The prior read-port finding does not apply to this runtime. The You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="b609b0a46b835e4ba4c7f46f51088c5673dcbdb7"
echo "== Commit identity and ancestry =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$base"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
echo "merge_base=$(git merge-base "$base" "$head")"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
echo "== Changed files =="
git diff --name-status "$base" "$head"
echo "== Diff summary =="
git diff --stat "$base" "$head"
echo "== Changed Python outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Exact full diff for service, workflow, and inventory-related files =="
git diff --unified=80 "$base" "$head" -- \
services/workforce-validation-api \
.github/workflows/foundation-ci.yml \
tests/validate_repository.py \
package.json \
manifest.json \
| sed -n '1,5000p'
echo "== Locate repository inventory and Foundation test contracts =="
rg -n -i -C 6 \
'workforce-validation|workforce_validation|foundation-ci|pytest|PYTHONPATH|manifest|inventory|required|expected' \
.github tests scripts package.json \
-g '*.py' -g '*.json' -g '*.yml' -g '*.yaml' -g '*.mjs' \
| sed -n '1,5000p'
echo "== Current relevant files =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/tests/test_policy_runtime_integrity.py \
services/workforce-validation-api/pyproject.toml \
.github/workflows/foundation-ci.yml \
tests/validate_repository.py
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
doneLength of output: 194155 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="b609b0a46b835e4ba4c7f46f51088c5673dcbdb7"
echo "== Head commit and immediate `#236` patch =="
git show --format=fuller --stat "$head"
git show --format=fuller --unified=120 "$head" -- \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests/test_registry.py \
tests/test_foundation_ci_dependency_hygiene.sh \
.github/workflows/foundation-ci.yml
echo "== Complete Foundation CI dependency-hygiene contract =="
cat -n tests/test_foundation_ci_dependency_hygiene.sh
echo "== Base-to-head diff for the hygiene contract =="
git diff --unified=100 "$base" "$head" -- tests/test_foundation_ci_dependency_hygiene.sh
echo "== All Foundation CI test commands and hygiene assertions =="
rg -n -C 4 \
'PYTHONPATH=|python -m pytest|workforce-validation|candidate-evidence|keyverse-adapter|foundation-test' \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
.github/requirements/foundation-test.txt
echo "== Keyverse policy construction and evaluation =="
ast-grep outline packages/keyverse-adapter/src --items all 2>/dev/null || true
rg -n -C 12 \
'class PurposeBoundAccessPolicy|class PurposeBoundAccessRequest|def require_purpose_bound_access|AuthorizationDeniedError|permitted_fields|policy_version_code' \
packages/keyverse-adapter/src \
-g '*.py'
echo "== Service persistence, schema, and dependency references =="
rg -n -i -C 3 \
'public\.|postgres|psycopg|sqlalchemy|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|database|schema|read_validity_study' \
services/workforce-validation-api \
-g '*.py' -g '*.md' -g '*.toml'
echo "== Changed non-service files and gate removals =="
git diff --unified=20 "$base" "$head" -- .github/workflows/foundation-ci.yml tests/test_foundation_ci_dependency_hygiene.sh
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
.github/*|tests/*|scripts/*|package.json|manifest.json)
echo "--- $file"
git diff --numstat "$base" "$head" -- "$file"
;;
esac
doneLength of output: 77396 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="b609b0a46b835e4ba4c7f46f51088c5673dcbdb7"
workflow=".github/workflows/foundation-ci.yml"
echo "== Manifest changed in exact range? =="
git diff --name-status "$base" "$head" -- manifest.json
echo "== Checked-in manifest entry =="
jq -c --arg path "$workflow" '.files[] | select(.path == $path)' manifest.json
echo "== Current workflow metadata =="
printf 'sha256='
sha256sum "$workflow" | awk '{print $1}'
printf 'bytes='
wc -c < "$workflow" | tr -d ' '
printf '\nlines='
awk 'END { print NR }' "$workflow"
echo "== Base workflow manifest metadata =="
git show "$base:$workflow" | sha256sum | awk '{print "base_sha256=" $1}'
git show "$base:$workflow" | wc -c | tr -d ' ' | sed 's/^/base_bytes=/'
git show "$base:$workflow" | awk 'END { print "base_lines=" NR }'
echo "== Required-list and manifest validation logic around the workflow =="
rg -n -C 3 --fixed-strings "$workflow" tests/validate_repository.py scripts/foundation-contract-core.mjs
sed -n '179,202p' tests/validate_repository.pyLength of output: 3837
I found one blocking issue.
The requested current-head checks are otherwise sound:
You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="cf498b96c0308e5037ebe11441e77c3677b0bdac"
echo "== Commit identity and ancestry =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$base"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
echo "== Changed files and diff summary =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Full exact-range diff for review scope =="
git diff --unified=100 "$base" "$head" -- \
services/workforce-validation-api \
.github/workflows/foundation-ci.yml \
manifest.json \
tests/validate_repository.py \
tests/test_foundation_ci_dependency_hygiene.sh \
.github/requirements/foundation-test.txt \
package.json \
| sed -n '1,9000p'
echo "== Changed Python outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Current application, tests, documentation, CI, and manifest =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/tests/test_policy_runtime_integrity.py \
services/workforce-validation-api/README.md \
services/workforce-validation-api/pyproject.toml \
.github/workflows/foundation-ci.yml \
manifest.json \
tests/validate_repository.py \
tests/test_foundation_ci_dependency_hygiene.sh
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
done
echo "== Manifest seal for Foundation workflow =="
workflow=".github/workflows/foundation-ci.yml"
echo "manifest_entry:"
jq -c --arg path "$workflow" '.files[] | select(.path == $path)' manifest.json
echo "current_sha256=$(sha256sum "$workflow" | awk '{print $1}')"
echo "current_bytes=$(wc -c < "$workflow" | tr -d ' ')"
echo "current_lines=$(awk 'END {print NR}' "$workflow")"
echo "base_manifest_entry:"
git show "$base:manifest.json" | jq -c --arg path "$workflow" '.files[] | select(.path == $path)'
echo "== Authorization, persistence, and forbidden dependency scan =="
rg -n -i -C 5 \
'require_purpose_bound_access|read_validity_study|_detach_policy|ValidityStudyRecord|object\.__setattr__|public\.|postgres|psycopg|sqlalchemy|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|people-api|job-analysis-api' \
services/workforce-validation-api \
packages/keyverse-adapter/src/orgmetra_keyverse_adapter \
-g '*.py' -g '*.md' -g '*.toml'
echo "== Gate and contract removals in exact range =="
git diff --diff-filter=D --name-status "$base" "$head"
git diff --unified=40 "$base" "$head" -- \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
.github/requirements/foundation-test.txt \
manifest.json \
package.jsonLength of output: 200831
I found no blocking issue in the requested scope.
Hosted CI must still provide terminal results for this exact head. The README states that condition correctly. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="d264b89dad290887d265a1010ff2622b96f9909a"
echo "== Commit identity and ancestry =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$base"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
echo "== Exact-range changed files and summary =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Changed Python and SQL outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py|*.sql)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Exact-range diff for requested scope =="
git diff --unified=100 "$base" "$head" -- \
services/workforce-validation-api \
.github/workflows/foundation-ci.yml \
manifest.json \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/validate_repository.py \
| sed -n '1,10000p'
echo "== Current application, tests, migration, documentation, and CI files =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/tests/test_policy_runtime_integrity.py \
services/workforce-validation-api/tests/test_principal_runtime_integrity.py \
services/workforce-validation-api/tests/test_owner_schema_migration.py \
services/workforce-validation-api/database/migrations/0001_owner_schema.sql \
services/workforce-validation-api/README.md \
services/workforce-validation-api/pyproject.toml \
.github/workflows/foundation-ci.yml \
manifest.json \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/validate_repository.py
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
done
echo "== Service persistence and cross-context dependency scan =="
rg -n -i -C 5 \
'public\.|validity_study|postgres|psycopg|sqlalchemy|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|database|schema|read_validity_study|require_purpose_bound_access|object\.__setattr__|ValidationPrincipal|ValidityStudyRecord' \
services/workforce-validation-api \
-g '*.py' -g '*.sql' -g '*.md' -g '*.toml'
echo "== Global migration lanes and migration-number inventory =="
fd -t f -e sql . | sort | sed -n '1,3000p'
echo "--- numbered migration filenames ---"
fd -t f -e sql . | rg '/[0-9]{4,}.*\.sql$|/[0-9]+.*\.sql$' | sort | sed -n '1,3000p'
echo "== Architecture and repository migration rules =="
rg -n -i -C 8 \
'workforce_validation|migration history|migration|public\.validity_study|validity_study|bounded context|schema' \
ARCHITECTURE.md README.md services/workforce-validation-api/README.md \
-g '*.md'
echo "== Foundation workflow manifest seal =="
workflow=".github/workflows/foundation-ci.yml"
jq -c --arg path "$workflow" '.files[] | select(.path == $path)' manifest.json
printf 'current_sha256='; sha256sum "$workflow" | awk '{print $1}'
printf 'current_bytes='; wc -c < "$workflow" | tr -d ' '; printf '\n'
printf 'current_lines='; awk 'END {print NR}' "$workflow"
echo "== Deletions and weakening candidates in gate files =="
git diff --diff-filter=D --name-status "$base" "$head"
git diff --unified=60 "$base" "$head" -- \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/validate_repository.py \
manifest.jsonLength of output: 167248 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="cf498b96c0308e5037ebe11441e77c3677b0bdac"
head="d264b89dad290887d265a1010ff2622b96f9909a"
echo "== Increment identity, ancestry, and changed files =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$prior"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$prior" "$head" && echo "prior_is_ancestor=yes"
git diff --name-status "$prior" "$head"
git diff --stat "$prior" "$head"
echo "== Complete incremental patch =="
git diff --unified=120 "$prior" "$head" -- \
services/workforce-validation-api \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json \
tests/validate_repository.py
echo "== Owner migration =="
cat -n services/workforce-validation-api/database/migrations/0001_owner_schema.sql
echo "== Persistence-layout contract =="
cat -n services/workforce-validation-api/tests/test_persistence_layout.py
echo "== Registry value objects and authorization order =="
sed -n '1,345p' services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py
echo "== Principal and persisted-record regression tests =="
rg -n -A35 -B8 \
'principal|ValidationPrincipal|structurally_immutable|object\.__setattr__|ValidityStudyRecord|authorization_denial|dependency_and_request' \
services/workforce-validation-api/tests \
-g '*.py'
echo "== All service migration and legacy-schema references =="
rg -n -i -C 3 \
'public\.validity_study|validity_study|CREATE TABLE|ALTER TABLE|SELECT |INSERT |UPDATE |DELETE |GRANT |REVOKE |search_path|CREATE ROLE|CREATE SCHEMA' \
services/workforce-validation-api \
-g '*.sql' -g '*.py' -g '*.md'
echo "== Global migration lane modifications in exact range =="
git diff --name-status "$base" "$head" -- database/migrations
git diff --unified=30 "$base" "$head" -- database/migrations
echo "== Gate-file changes from the protected base, excluding additions =="
git diff --word-diff=plain "$base" "$head" -- \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/validate_repository.py \
manifest.json \
| sed -n '1,5000p'Length of output: 120236
I found no blocking issue in the requested scope.
The new migration preserves the ownership boundary.
The migration-number boundary is correct.
The Foundation admission and seal remain intact.
The new persistence-layout test is a static contract. It does not prove PostgreSQL execution, role membership, or effective privileges in a running database. The README states this limitation correctly. Hosted Foundation results and a PostgreSQL-backed owner-schema acceptance contract remain required for exact-head acceptance. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Oops, something went wrong! Please try again later. 🐰 💔 |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="a04c8b4cd58145f9e74a085d3fdb037d90966012"
echo "== Exact commit identity and ancestry =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$base"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
echo "== Exact-range changed files and summary =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Exact-range diff in requested scope =="
git diff --unified=100 "$base" "$head" -- \
services/workforce-validation-api \
tests/test_workforce_validation_owner_schema_postgres.sh \
.github/workflows/foundation-ci.yml \
manifest.json \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/validate_repository.py \
| sed -n '1,12000p'
echo "== Current relevant files =="
for file in \
services/workforce-validation-api/database/migrations/0001_owner_schema.sql \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/tests/test_policy_runtime_integrity.py \
services/workforce-validation-api/tests/test_principal_runtime_integrity.py \
services/workforce-validation-api/tests/test_persistence_layout.py \
services/workforce-validation-api/README.md \
services/workforce-validation-api/pyproject.toml \
tests/test_workforce_validation_owner_schema_postgres.sh \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
done
echo "== Manifest verification for every changed manifest-tracked file =="
python - <<'PY'
import hashlib
import json
import subprocess
base = "eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head = "a04c8b4cd58145f9e74a085d3fdb037d90966012"
manifest = json.load(open("manifest.json", encoding="utf-8"))
entries = {item["path"]: item for item in manifest.get("files", [])}
changed = subprocess.check_output(
["git", "diff", "--name-only", base, head], text=True
).splitlines()
for path in changed:
if path in entries:
data = open(path, "rb").read()
entry = entries[path]
print(f"path={path}")
print(f" manifest={json.dumps(entry, sort_keys=True)}")
print(f" sha256={hashlib.sha256(data).hexdigest()} bytes={len(data)} lines={data.count(b'\\n')}")
PY
echo "== PostgreSQL role/search_path semantics and contract assertions =="
rg -n -i -C 8 \
'ALTER ROLE|SET ROLE|SET\s+search_path|SHOW\s+search_path|current_setting|NOLOGIN|NOINHERIT|NOBYPASSRLS|CREATE ROLE|CREATE SCHEMA|GRANT|REVOKE|PUBLIC|schema-qualified|pg_catalog|workforce_validation_role|workforce_validation' \
services/workforce-validation-api tests/test_workforce_validation_owner_schema_postgres.sh \
-g '*.sql' -g '*.sh' -g '*.md' -g '*.py' -g '*.yml'
echo "== Service persistence and cross-context SQL scan =="
rg -n -i -C 4 \
'public\.|validity_study|postgres|psycopg|sqlalchemy|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|database|schema|read_validity_study|require_purpose_bound_access|ValidationPrincipal|ValidityStudyRecord|object\.__setattr__' \
services/workforce-validation-api \
-g '*.py' -g '*.sql' -g '*.md' -g '*.toml'
echo "== Foundation admission and changed-gate deletion check =="
rg -n -C 5 \
'workforce.validation|workforce_validation|postgres|pytest|PYTHONPATH|postgres:|16\.14|manifest|validate' \
.github/workflows/foundation-ci.yml tests/test_foundation_ci_dependency_hygiene.sh \
-g '*.yml' -g '*.sh'
git diff --diff-filter=D --name-status "$base" "$head"
git diff --unified=50 "$base" "$head" -- \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/validate_repository.py \
manifest.json
echo "== Global migration lanes unchanged and numbered migration inventory =="
git diff --name-status "$base" "$head" -- database/migrations
fd -t f -e sql . | rg '/[0-9]+[^/]*\.sql$' | sortLength of output: 139294 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="a04c8b4cd58145f9e74a085d3fdb037d90966012"
parent="$(git show -s --format=%P "$head")"
echo "== Immediate exact-head correction =="
git show -s --format='parent=%H%nsubject=%s' "$parent"
git diff --unified=120 "$parent" "$head" -- \
services/workforce-validation-api/database/migrations/0001_owner_schema.sql \
services/workforce-validation-api/README.md \
services/workforce-validation-api/tests/test_persistence_layout.py \
tests/test_workforce_validation_owner_schema_postgres.sh \
.github/workflows/foundation-ci.yml \
manifest.json
echo "== Manifest seals =="
python - <<'PY'
import hashlib
import json
from pathlib import Path
manifest = json.loads(Path("manifest.json").read_text(encoding="utf-8"))
entries = {entry["path"]: entry for entry in manifest["files"]}
for path in (
".github/workflows/foundation-ci.yml",
"database/migrations/0005_outbox_delivery_finalization.sql",
):
data = Path(path).read_bytes()
actual = {
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": data.count(b"\n"),
}
print(f"{path}: manifest={entries.get(path)} actual={actual}")
PY
echo "== Base and known predecessor 0005 manifest entries, if present =="
for commit in \
"$base" \
a0ccaf0afc1fa26ed979a5181e05c08140f92aff \
83e5c9418f912878f0b829df24c7bf19a11e2b83 \
7ca30f3447169e678269124dbf1fd23180b997b9 \
"$head"
do
if git cat-file -e "${commit}:manifest.json" 2>/dev/null; then
printf '%s ' "$commit"
git show "${commit}:manifest.json" | jq -c \
'.files[] | select(.path == "database/migrations/0005_outbox_delivery_finalization.sql")'
fi
done
echo "== Full requested PostgreSQL semantic evidence =="
rg -n -i -C 8 \
'ALTER ROLE|SET ROLE|RESET ROLE|SET search_path|current_setting|rolconfig|NOLOGIN|NOINHERIT|NOBYPASSRLS|CREATE ROLE|CREATE SCHEMA|REVOKE ALL|PUBLIC|schema-qualified|SECURITY DEFINER|workforce_validation_role|workforce_validation' \
services/workforce-validation-api \
tests/test_workforce_validation_owner_schema_postgres.sh \
-g '*.sql' -g '*.sh' -g '*.md' -g '*.py'
echo "== Cross-context SQL and application dependency scan =="
rg -n -i -C 4 \
'public\.|psycopg|sqlalchemy|asyncpg|postgresql|CREATE TABLE|ALTER TABLE|DROP TABLE|\bSELECT\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b|people-api|job-analysis-api|talent|performance|psychometric|fast-mlsirm|tepp' \
services/workforce-validation-api \
-g '*.py' -g '*.sql' -g '*.md' -g '*.toml' || true
echo "== Foundation CI and hygiene contract context =="
sed -n '55,130p' .github/workflows/foundation-ci.yml
sed -n '1,105p' tests/test_foundation_ci_dependency_hygiene.sh
echo "== No gate weakening or global migration modification =="
echo "-- deletions in the exact range --"
git diff --diff-filter=D --name-status "$base" "$head"
echo "-- global migration changes --"
git diff --name-status "$base" "$head" -- database/migrations
echo "-- gate-file changes --"
git diff --unified=70 "$base" "$head" -- \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/validate_repository.py \
.github/requirements/foundation-test.txt \
manifest.json
echo "== Structural immutability and authorization ordering evidence =="
rg -n -C 6 \
'class ValidationPrincipal|class ValidityStudyRecord|__slots__|object\.__setattr__|def read_validity_study|require_purpose_bound_access|read_port\.read_validity_study|type\(persisted\)|_detach_policy' \
services/workforce-validation-api/src \
services/workforce-validation-api/tests \
-g '*.py'Length of output: 103838
I found no blocking issue in the requested scope.
The prior boundaries remain intact.
The Foundation workflow seal is correct. Its manifest SHA-256, byte count, and line count match the checked-in workflow. No existing Foundation gate was removed. No global migration file changed. The Hosted Foundation and applicable security workflows must still provide terminal results for this exact head. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="4ef7ad130e4d0aa314ea59de3dafaea79cc0630c"
echo "== Exact commit identity and ancestry =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$base"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
echo "== Exact-range changed files and summary =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Increment from parent =="
parent="$(git show -s --format=%P "$head")"
git show -s --format='parent=%H%nsubject=%s' "$parent"
git diff --name-status "$parent" "$head"
git diff --unified=120 "$parent" "$head" -- \
services/workforce-validation-api \
packages/keyverse-adapter \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json
echo "== Changed Python outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Current owner boundary and related tests =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests/test_principal_runtime_integrity.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/tests/test_policy_runtime_integrity.py \
services/workforce-validation-api/tests/test_persistence_layout.py \
services/workforce-validation-api/database/migrations/0001_owner_schema.sql \
services/workforce-validation-api/README.md \
services/workforce-validation-api/pyproject.toml \
packages/keyverse-adapter/src/orgmetra_keyverse_adapter/authorization.py \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
done
echo "== Principal construction and evaluation ordering =="
rg -n -C 8 \
'class ValidationPrincipal|def __new__|tuple\.__new__|ValidationPrincipal\(|PurposeBoundAccessRequest|require_purpose_bound_access|read_port\.read_validity_study|type\(.*UUID|isinstance\(.*UUID|tenant_id|actor_reference|scope' \
services/workforce-validation-api \
packages/keyverse-adapter/src/orgmetra_keyverse_adapter \
-g '*.py'
echo "== Cross-context SQL, schema/runtime-role, and field exposure scan =="
rg -n -i -C 5 \
'public\.|validity_study|psycopg|sqlalchemy|asyncpg|postgres|SELECT |INSERT |UPDATE |DELETE |CREATE TABLE|ALTER TABLE|GRANT |REVOKE |ALTER ROLE|SET ROLE|search_path|requested_fields|permitted_fields|field' \
services/workforce-validation-api \
-g '*.py' -g '*.sql' -g '*.md' -g '*.toml'
echo "== Gate deletion and manifest validation =="
git diff --diff-filter=D --name-status "$base" "$head"
python - <<'PY'
import hashlib
import json
import subprocess
from pathlib import Path
base = "eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head = "4ef7ad130e4d0aa314ea59de3dafaea79cc0630c"
manifest = json.loads(Path("manifest.json").read_text(encoding="utf-8"))
entries = {entry["path"]: entry for entry in manifest.get("files", [])}
changed = subprocess.check_output(
["git", "diff", "--name-only", base, head], text=True
).splitlines()
for path in changed:
if path in entries and Path(path).is_file():
data = Path(path).read_bytes()
entry = entries[path]
print(
f"{path}: manifest={entry} "
f"actual={{'sha256': '{hashlib.sha256(data).hexdigest()}', "
f"'bytes': {len(data)}, 'lines': {data.count(b'\\n')}}}"
)
PYLength of output: 252143 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="4ef7ad130e4d0aa314ea59de3dafaea79cc0630c"
parent="$(git show -s --format=%P "$head")"
echo "== Complete Issue `#239` regression =="
cat -n services/workforce-validation-api/tests/test_principal_storage_integrity.py
echo "== Complete exact increment diff =="
git diff --unified=160 "$parent" "$head"
echo "== Changed files after parent, outside registry =="
git diff --name-status "$parent" "$head" -- \
':!services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py'
echo "== Corrected manifest verification =="
python - <<'PY'
import hashlib
import json
import subprocess
from pathlib import Path
base = "eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head = "4ef7ad130e4d0aa314ea59de3dafaea79cc0630c"
entries = {
entry["path"]: entry
for entry in json.loads(Path("manifest.json").read_text(encoding="utf-8")).get("files", [])
}
changed = subprocess.check_output(
["git", "diff", "--name-only", base, head], text=True
).splitlines()
for path in changed:
artifact = Path(path)
if path in entries and artifact.is_file():
data = artifact.read_bytes()
actual = {
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": data.count(b"\n"),
}
print(f"{path}")
print(" manifest=" + json.dumps(entries[path], sort_keys=True))
print(" actual=" + json.dumps(actual, sort_keys=True))
PY
echo "== Manifest validator and current status =="
git diff --unified=60 "$base" "$head" -- manifest.json .github/workflows/foundation-ci.yml tests/test_foundation_ci_dependency_hygiene.sh
git status --short
git diff --diff-filter=D --name-status "$base" "$head"
echo "== Service imports and forbidden runtime integration scan =="
rg -n -C 3 \
'^(from|import) |public\.|psycopg|sqlalchemy|asyncpg|CREATE TABLE|ALTER TABLE|SELECT |INSERT |UPDATE |DELETE |workforce_validation_role|SET ROLE|search_path|openapi|FastAPI|flask' \
services/workforce-validation-api \
-g '*.py' -g '*.sql' -g '*.toml' -g '*.md'
echo "== Keyverse source changed in exact range =="
git diff --name-status "$base" "$head" -- packages/keyverse-adapterLength of output: 43354
I found no blocking issue in the requested scope.
The prior boundaries remain intact.
Hosted coverage, PostgreSQL acceptance, and security workflow results remain separate exact-head evidence. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="ccb5c0c58dc74c1d7eee59431e6337c207fcac35"
parent="$(git show -s --format=%P "$head")"
echo "== Commit identity and ancestry =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$base"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
echo "== Exact-range changed files and summary =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Issue `#240` incremental diff =="
git show -s --format='parent=%H%nsubject=%s' "$parent"
git diff --name-status "$parent" "$head"
git diff --unified=160 "$parent" "$head" -- \
services/workforce-validation-api \
packages/keyverse-adapter \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json
echo "== Changed Python outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Owner boundary and all relevant regression tests =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/tests/test_read_port_runtime_integrity.py \
services/workforce-validation-api/tests/test_principal_storage_integrity.py \
services/workforce-validation-api/tests/test_principal_runtime_integrity.py \
services/workforce-validation-api/tests/test_policy_runtime_integrity.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/database/migrations/0001_owner_schema.sql \
services/workforce-validation-api/README.md \
packages/keyverse-adapter/src/orgmetra_keyverse_adapter/authorization.py \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
done
echo "== Static-access, authorization, and persistence order =="
rg -n -C 8 \
'getattr_static|ValidityStudyReadPort|read_validity_study|ValidationPrincipal\(|PurposeBoundAccessRequest|require_purpose_bound_access|_detach_policy|tuple\.__new__|descriptor|__get__|callable\(' \
services/workforce-validation-api \
packages/keyverse-adapter/src/orgmetra_keyverse_adapter \
-g '*.py'
echo "== Scope expansion and forbidden persistence integration scan =="
rg -n -i -C 4 \
'^(from|import) |public\.|psycopg|sqlalchemy|asyncpg|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|CREATE TABLE|ALTER TABLE|GRANT |REVOKE |ALTER ROLE|SET ROLE|search_path|openapi|FastAPI|requested_fields|permitted_fields' \
services/workforce-validation-api \
-g '*.py' -g '*.sql' -g '*.toml' -g '*.md'
echo "== Keyverse changes and gate deletions in the exact range =="
git diff --name-status "$base" "$head" -- packages/keyverse-adapter
git diff --diff-filter=D --name-status "$base" "$head"
git diff --unified=80 "$base" "$head" -- \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/validate_repository.py \
manifest.json
echo "== Manifest entries for changed tracked artifacts =="
python - <<'PY'
import hashlib
import json
import subprocess
from pathlib import Path
base = "eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head = "ccb5c0c58dc74c1d7eee59431e6337c207fcac35"
entries = {
entry["path"]: entry
for entry in json.loads(Path("manifest.json").read_text(encoding="utf-8")).get("files", [])
}
for path in subprocess.check_output(
["git", "diff", "--name-only", base, head], text=True
).splitlines():
artifact = Path(path)
if path in entries and artifact.is_file():
data = artifact.read_bytes()
print(path)
print(" manifest=" + json.dumps(entries[path], sort_keys=True))
print(" actual=" + json.dumps({
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": data.count(b"\n"),
}, sort_keys=True))
PYLength of output: 240722
I found no blocking issue in the requested scope.
Hosted Foundation, PostgreSQL, coverage, and security results remain separate exact-head evidence. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
prior="1a344f8057755ae8b652c31963d787ff8abf2beb"
head="17092c94d180d082d1e389982e0beea9872f53f9"
echo "== Commit identity and ancestry =="
for commit in "$base" "$prior" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$commit"
done
printf 'merge_base='
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
git merge-base --is-ancestor "$prior" "$head" && echo "prior_is_ancestor=yes"
echo "== Exact-range changed files and summary =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Issue `#241` immediate increment =="
git diff --name-status "$prior" "$head"
git diff --unified=160 "$prior" "$head" -- \
services/workforce-validation-api \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json \
tests/validate_repository.py
echo "== Changed Python outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo "== Current owner boundary, Issue `#241` regression, and governance artifacts =="
for file in \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/registry.py \
services/workforce-validation-api/src/orgmetra_workforce_validation_api/__init__.py \
services/workforce-validation-api/tests/test_validity_study_view_integrity.py \
services/workforce-validation-api/tests/test_registry.py \
services/workforce-validation-api/tests/test_read_port_dependency_integrity.py \
services/workforce-validation-api/tests/test_principal_storage_integrity.py \
services/workforce-validation-api/tests/test_policy_runtime_integrity.py \
services/workforce-validation-api/database/migrations/0001_owner_schema.sql \
services/workforce-validation-api/README.md \
services/workforce-validation-api/pyproject.toml \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
manifest.json
do
if [ -f "$file" ]; then
echo "--- $file"
cat -n "$file"
fi
done
echo "== View shape, immutability, authorization order, and read-port validation =="
rg -n -C 8 \
'class ValidityStudyView|ValidityStudyView\(|tenant_record_id|validity_study_id|fields|__slots__|object\.__setattr__|getattr_static|callable\(|ValidationPrincipal\(|_detach_policy|PurposeBoundAccessRequest|require_purpose_bound_access|read_port\.read_validity_study' \
services/workforce-validation-api \
-g '*.py'
echo "== Scope expansion and forbidden persistence integration scan =="
rg -n -i -C 4 \
'^(from|import) |public\.|psycopg|sqlalchemy|asyncpg|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|CREATE TABLE|ALTER TABLE|DROP TABLE|GRANT |REVOKE |ALTER ROLE|SET ROLE|search_path|openapi|FastAPI|requested_fields|permitted_fields' \
services/workforce-validation-api \
-g '*.py' -g '*.sql' -g '*.toml' -g '*.md' || true
echo "== Keyverse, global migration, and gate changes =="
git diff --name-status "$base" "$head" -- packages/keyverse-adapter database/migrations
git diff --diff-filter=D --name-status "$base" "$head"
git diff --unified=80 "$base" "$head" -- \
.github/workflows/foundation-ci.yml \
tests/test_foundation_ci_dependency_hygiene.sh \
tests/validate_repository.py \
.github/requirements/foundation-test.txt \
manifest.json
echo "== Manifest integrity for changed tracked artifacts =="
python - <<'PY'
import hashlib
import json
import subprocess
from pathlib import Path
base = "eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head = "17092c94d180d082d1e389982e0beea9872f53f9"
entries = {
entry["path"]: entry
for entry in json.loads(Path("manifest.json").read_text(encoding="utf-8")).get("files", [])
}
for path in subprocess.check_output(
["git", "diff", "--name-only", base, head], text=True
).splitlines():
artifact = Path(path)
if path in entries and artifact.is_file():
data = artifact.read_bytes()
actual = {
"sha256": hashlib.sha256(data).hexdigest(),
"bytes": len(data),
"lines": data.count(b"\n"),
}
print(path)
print(" manifest=" + json.dumps(entries[path], sort_keys=True))
print(" actual=" + json.dumps(actual, sort_keys=True))
PYLength of output: 246991
I found no blocking issue in the requested scope.
Issue
The prior controls remain intact.
The increment does not broaden the boundary.
Hosted Foundation, PostgreSQL, coverage, and security results remain separate evidence for this exact head. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
head="57214b4968c5968a4009cad56ea9d23a186ee9d9"
service="services/workforce-validation-api"
src="$service/src/orgmetra_workforce_validation_api"
tests="$service/tests"
echo "== Resolve short SHAs =="
for short in d7aa67c6 17b80f9e 9625f95d e4945f0b; do
echo "-- $short --"
git rev-parse "${short}^{commit}" 2>/dev/null || echo "not found"
done
echo "== Exact commits and ancestry =="
for commit in "$base" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$commit" 2>/dev/null || true
done
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
parent="$(git show -s --format=%P "$head" | awk '{print $1}')"
echo "parent=$parent"
echo "== Exact scope =="
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
echo "== recent log of last ~30 commits touching service =="
git log --oneline -30 "$head" -- "$service" CHANGELOG.md manifest.jsonLength of output: 22104 🏁 Script executed: #!/bin/bash
set -euo pipefail
red="d7aa67c6d2550a0b3ff8d790e845667009d02438"
fix="17b80f9e360dc82bf93c6831c2c6d3504af50a90"
align="9625f95dc3b90ba119c462a7587accf2c4f068e1"
docs="e4945f0bcea20aff5cc5dee3f86a9964ddbb3107"
head="57214b4968c5968a4009cad56ea9d23a186ee9d9"
service="services/workforce-validation-api"
src="$service/src/orgmetra_workforce_validation_api"
tests="$service/tests"
echo "== Commit subjects and parents =="
for c in "$red" "$fix" "$align" "$docs" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$c"
done
echo "== Ancestry check =="
for pair in "$red $fix" "$fix $align" "$align $docs" "$docs $head"; do
set -- $pair
git merge-base --is-ancestor "$1" "$2" && echo "$1 -> $2 : ancestor OK" || echo "$1 -> $2 : NOT ANCESTOR"
done
echo "== RED commit diff (d7aa67c6) =="
git show --stat "$red"
git show "$red" -- "$tests" | head -300
echo "== GREEN fix diff (17b80f9e) =="
git show --stat "$fix"
git show "$fix" -- "$src" | head -400
echo "== Test alignment diff (9625f95d) =="
git show --stat "$align"
git show "$align" -- "$tests" | head -300
echo "== Docs commit diff (e4945f0b) =="
git show --stat "$docs"
git show "$docs" | head -200
echo "== Provenance reseal diff (57214b4968c) =="
git show --stat "$head"
git show "$head" | head -200Length of output: 11799 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="57214b4968c5968a4009cad56ea9d23a186ee9d9"
module="services/workforce-validation-api/src/orgmetra_workforce_validation_api/final_weight_authority.py"
echo "== Governed adjustment-code map =="
git show "$head:$module" | rg -n -B2 -A20 '_SPECIALIZED_EVIDENCE_KIND_BY_ADJUSTMENT_CODE\s*='
echo "== Full FinalWeightAdjustmentCoordinate constructor =="
git show "$head:$module" | sed -n '1,200p' | rg -n -B5 -A60 'class FinalWeightAdjustmentCoordinate'
echo "== All usages of adjustment_code in tests referencing ungoverned codes =="
git grep -n -I "adjustment_code=" "$head" -- services/workforce-validation-api/tests | rg -v 'sequence_number' || true
echo "== Manifest CHANGELOG entry at head =="
git show "$head:manifest.json" | rg -n -A4 '"CHANGELOG.md"'
echo "== Compute actual CHANGELOG.md sha256/bytes/lines at head =="
git show "$head:CHANGELOG.md" > /tmp/CHANGELOG_head.md
sha256sum /tmp/CHANGELOG_head.md
wc -c /tmp/CHANGELOG_head.md
wc -l /tmp/CHANGELOG_head.md
echo "== Confirm repository validation script logic for hashing (bytes vs lines definition) =="
rg -n -A20 'def.*manifest|sha256|bytes.*lines' tests/validate_repository.py | head -100
echo "== Check test suite scope for final_weight_authority to ensure other adjustment codes still function =="
git show "$head:services/workforce-validation-api/tests/test_final_analysis_weight_authority.py" | sed -n '1,60p'Length of output: 15066 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="57214b4968c5968a4009cad56ea9d23a186ee9d9"
file="services/workforce-validation-api/tests/test_final_weight_component_evidence_resolution_edges.py"
echo "== Context around replicate_weight_projection usage =="
git show "$head:$file" | sed -n '260,360p'
echo "== Check if FinalWeightAdjustmentCoordinate is imported/used in this test =="
git show "$head:$file" | rg -n 'import|FinalWeightAdjustmentCoordinate|adjustment_code'
echo "== Check final_weight_component_evidence_resolution.py for its own adjustment validation logic (separate from FinalWeightAdjustmentCoordinate) =="
module="services/workforce-validation-api/src/orgmetra_workforce_validation_api/final_weight_component_evidence_resolution.py"
git show "$head:$module" | rg -n 'adjustment_code|_SPECIALIZED_EVIDENCE_KIND|replicate_weight_projection'Length of output: 5073
I found one blocking issue.
Verified provenance reseal
This part of the provenance chain is correct. This is static exact-head evidence only. I did not execute the test suite, coverage, or hosted gates. The finding above is based on direct inspection of the constructor logic and the unmodified test that calls it. You are interacting with an AI system. |
Exact-head RCA and verification —
|
|
Canonical repair clarification after the Draft transition: because #426 is downstream of normal #235 integration and #248 durable adoption, this PR cannot wait for #426 to make the current lifecycle wording true. The executable path is ordinary-forward neutralization of the |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
1 participant
Current exact-head authority — 2026-09-21
Protected base remains
develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Current head is202d9d87d6a45529497279b881169aab127727f8; this PR is open · Draft · mechanically mergeable. All changes remain ordinary-forward. No force-push, destructive rebase, self-approval, administrator bypass, predecessor-verdict transfer or gate weakening is authorized.Canonical boundary
Issue #234 owns the P0/FR-007 Workforce Validation owner-to-buyer gap. This lane remains the canonical
workforce_validationin-process application/service owner. #248 is the durable persistence child; #426 owns governed/idempotent registration/lifecycle after durable persistence; #425 owns scientific design lineage after #426; #427 owns the buyer HTTP/OpenAPI boundary after #425.Fresh live review corrected the former assumption that #428 was simply the next UI source lane. There is already an existing Validation presentation owner: #145 (
feat/ui: add governed validation dashboard states) on the separate UI stack #53 → #130 → #145. #428 now owns only the later commercial convergence of protected/released #145 with protected/released #427.Therefore the owner graph is:
Nothing in #145/#428 authorizes expanding this mutable parent into transport/UI. Later product lanes consume only protected/released contracts; they never import this branch, service internals or owner tables directly. Scientific #57 remains an independent leaf and is not a mutable source prerequisite for #248.
The application read model remains deliberately narrower than #426.
ValidityStudyRecord.study_status_codecurrently validates only an exact lower-snake-case stored code; no executable versioned lifecycle vocabulary or transition policy exists here.recorded_from/recorded_toare system-recorded bitemporal knowledge time, not business lifecycle state.Current ordinary-forward repairs
01c3da48b1d013b57ea749bfb4284d314e3ff3a6resolved the lifecycle docs-to-code contradiction:study_status_codenow documents only the executable truth and does not infer lifecycle governance. Actual governed vocabulary/transition authority remains #426 scope.Hosted Foundation on predecessor
03bf5040e7eb307c4df55ebd01453dcbd1ae0cefthen exposed a separate reality RED. All substantive Workforce Validation execution passed before the final repository-cleanliness gate: 1,441 tests, 5,186/5,186 owned statements, 1,116/1,116 branches and isolated PostgreSQL contracts. The job failed only atProve validation is read-only: tracked diff was clean but wheel acceptance had generated untracked build output in the checkout. Those counts are predecessor evidence only.202d9d87d6a45529497279b881169aab127727f8repairs that test causally instead of weakening the gate or hidingbuild/: Keyverse and Workforce Validation package sources are copied to a pytest temporary build area and wheel construction runs only against those disposable copies. The checkout remains evidence input, not build workspace.Retained owner/scientific invariants
#411–#424 remain active owner/provenance/currentness/authorization/view-integrity/scientific-reproducibility dependencies. #423 rejects material final-weight adjustment families without governed released/versioned owner evidence. #424 requires every admitted governed adjustment to have an exact one-based contiguous component binding. Resolver-issued public views remain non-tuple and closure-private-issued; proof/runtime seals are not durable authorization; consequential downstream actions re-authorize and re-resolve owner truth.
Ten earlier
github-code-qualityfindings alleging unusedsuccessor_*locals were re-read against actual supersession dataflow. Each value is consumed in returned successor fields or, forsuccessor_correction, the contiguous-correction invariant; they were false positives and their threads were resolved without source churn.Evidence boundary
No predecessor verdict transfers after the last material source write. Fresh exact-head workflows remain non-terminal at the latest read:
35507388584— queued;35507388575— queued;35507388588— queued;35507388573— pending.Review inventory has no qualifying independent
APPROVED; visible inline threads are resolved. The older Node action-runtime warning remains owned by #339/#340 rather than being suppressed/copied here.This PR stays Draft until this exact head has terminal functional GREEN, 100% owned statement/branch/docstring/edge evidence, pinned installed-wheel acceptance, deterministic repository/manifest validation, isolated PostgreSQL owner-schema evidence, terminal Foundation/Security/SAST/CodeQL/model-review evidence, resolved review threads and then-live non-bypass review governance. No merge, immutable release or release-ready claim is made.