feat(job-analysis): add governed qualification-rule review

[seonghobae]

Buyer-visible gap

Orgmetra needs governed evidence showing which Job Analysis evidence supports a proposed qualification rule before that rule can influence recruiting or selection. This lane remains a human-reviewed, PII-minimized qualification-rule review boundary; it does not evaluate candidates, reject applicants, mutate Job/Job Analysis, or write foreign CWL repositories.

Retained domain contract

The original RED/implementation chain remains intact: d92ac4cb... hardened malformed Job references, 79adb799... sealed JobQualificationRuleReviewPacket against subclass override, and 14eab4eb... repaired deterministic test-quality defects. Canonical evidence stays fixed to job_qualification_rule_review, mandatory human review, reviewed_for_authoritative_resolution, and not_authorized_for_candidate_or_employment_decision.

Candidate/person PII, candidate qualification outcomes, assessment/cut scores, compensation, raw rule text, prompts and model output remain excluded. Before authoritative persistence/use, the host must re-resolve tenant/Job/Job Analysis, rule artifact, Task/KSAO/source provenance and reviewer authority at the business-effective coordinate and preserve immutable audit/outbox evidence.

Protected-parent reconciliation completed

Protected adoption authority is develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. The branch adopted it through ordinary non-force two-parent successor 5bc1663afbd363dc75524afb0cebcf856595d421 and then advanced docs-only to current exact fde420ae11680a8b54eada785683db1afecca6bd.

The previously verified synthetic merge tree would have resurrected .github/workflows/job-qualification-rule-review-quality.yml with runs-on: ubuntu-latest, undoing protected #161's repository-quality consolidation. That defect remains repaired: the package-local workflow stays retired; canonical Foundation preserves exact CPython 3.14.7, SHA-256-bound installed-wheel, isolated test-toolchain, package-import provenance and 100% statement/branch coverage; test_artifact_execution.py rejects leaf-workflow reintroduction; and manifest.json remains sealed to the final Foundation bytes from that repair.

The follow-up traceability successor corrected stale develop@9e3e484... and retired-workflow claims without changing production behavior or the Foundation manifest.

Current exact-head acceptance — 2026-09-06

GitHub reports this PR open · Draft · mechanically mergeable at exact fde420ae11680a8b54eada785683db1afecca6bd on protected develop@eb9757f....

• Foundation 34017994517: terminal SUCCESS.
• SAST 34017994471: terminal SUCCESS.
• Security 34017994490: terminal FAILURE only in dependency-review. Exact head checkout succeeds; Check dependency review support fails before the Dependency Review action runs. OSV, Scorecard and Trivy are terminal SUCCESS. This remains the central Dependency Review availability/control-plane class of failure, not an Orgmetra source finding.
• CodeQL 34017994488: terminal FAILURE only after both Python and Actions compatibility shards successfully request current-head dispatch; each then fails Release runner or enforce current-head CodeQL verdict. No source/SARIF finding is established by this wrapper failure.

Submitted formal reviews remain COMMENTED-only; no qualifying independent APPROVED review exists. All currently visible review threads are resolved. Keep Draft; do not synthesize verdicts, no-op retrigger, self-approve, use routine administrator bypass, weaken gates, transfer predecessor evidence, force-push/destructively rebase, or simply Close the valid delta.

Stack order

#105 remains Draft at child exact e9e4731b... on predecessor parent snapshot d92ac4cb...; it does not yet contain the current #104 trust-boundary/protected-parent/traceability repairs. Required order is: restore current-head central gate availability/authorization and obtain qualifying review for #104 → normal protected integration → #105 non-force adoption/retarget preserving its full persistence/search-path/PostgreSQL/provenance delta → retire/reconcile #105's own historical package-local workflow without resurrecting leaf CI → reseal final tracked bytes → fresh descendant acceptance.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head correction: production implementation is now present at 4c42b422fbca9d4bc79c04b67f778632d0be2aca. The earlier body section describing f0649807… as the current RED head is stale; that RED contract was superseded before terminal execution and is not passing evidence. Exact-current-head Job Qualification Rule Review, Foundation, Recovery, SAST, and Security workflows are materialized but queued, so this PR remains Draft and no predecessor result is promoted. The current source binds reviewed Job/Job-Analysis/rule-artifact Task/KSAO/source provenance, generates system-recorded UTC time inside the owner boundary, keeps canonical evidence value-minimized, and remains non-authoritative for downstream personnel actions.

[seonghobae]

Current-head evidence update: d92ac4cb798b3bd32b632c0ab677c03f944070e4 adds a realistic malformed-but-correctly-namespaced UUID regression (job_record:not-a-uuid) so the shared reference parser's fail-closed exception path is exercised rather than relying on only wrong-namespace/sentinel/version cases. Production behavior is unchanged. The prior head's queued results do not transfer, and no hosted run has materialized yet for d92ac4c…; under the repository evidence policy this remains non-passing and #104 remains Draft. Protected base remains develop@9e3e4847510e1e612b48474ba42b177b8ed824df.

[devin-ai-integration]

Devin Review found 2 potential issues.

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Lifecycle correction: live protected develop is now eb9757f8649aaad026a9865508d9aad50c1a7a4f, not the 9e3e484... snapshot recorded in the body. This PR has been returned to Draft. Its qualification-rule review delta and prior exact-source evidence remain valid historical evidence, but current integration must first non-force adopt protected truth, preserve the current #104 trust-boundary/test repairs, reconcile any repository-quality/provenance changes introduced since the old base, reseal exact artifacts if bytes change, then rerun all applicable current-head local/central gates. Descendant #105 remains dependency-first and must not inherit #104 checks/reviews. The body’s older non-draft/live-base statements are superseded by this live correction.