fix(people): harden governed People reads

[seonghobae]

Scope and canonical ownership

This PR is the single writer for governed People reads. It preserves authenticated-actor-before-read, tenant/purpose isolation, field minimization, PostgreSQL RLS/read-only transaction, and candidate-worker read contracts while repairing verified People read-boundary defects. People domain truth remains in Orgmetra; no mutable sibling implementation or cross-service SQL is imported.

Protected-parent adoption

Protected truth remains develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. The historical feature head diverged from that parent, so the stale base was repaired rather than closed. 0ce9567b70dc63217b9badbe677523a2ea6b9500 adopted current protected develop through an ordinary two-parent merge without force-push or destructive rebase. Subsequent ordinary-forward commits restored both the valid People-read changelog delta and the protected workflow-consolidation history, then resealed manifest.json from Foundation-produced exact file evidence.

#263 — UUID retained-payload trust boundary

Test-first b8ea2732f4f1c7956361f7ba111b63a1200e84f8 proved an exact uuid.UUID can carry a replaced internal .int payload whose comparison is executable or outside the RFC 9562 constructor range. a8333a88217c059518edf8fe1cbe61c7e5b5ae75 applies the minimal fail-closed repair: exact outer UUID, one retained-payload snapshot, exact built-in int, and 0 < identity < (1 << 128) - 1 before downstream use.

#265 — PostgreSQL executable-capability binding

The same test-first head proved the former frozen/slotted adapter could have its validated connection_factory replaced after construction. a8333a88217c059518edf8fe1cbe61c7e5b5ae75 structurally binds the accepted callable in immutable tuple payload and invokes that exact capability while preserving the public constructor, read-only transaction, transaction-local tenant context, parameterized SQL, and duplicate-lineage fail-closed behavior.

#276 — People repository capability binding

Fresh review of predecessor 41d00e70f5e62b1039aff7c401eae524d0b3bc11 found read_worker_people_record() still performed a fresh dynamic read_port.read_worker(...) lookup after purpose-bound authorization. A caller-controlled descriptor/__getattribute__ could therefore substitute executable repository behavior after the access decision, and a concrete class inheriting only the PeopleReadPort.read_worker Protocol declaration was not rejected as a missing implementation.

Test-only d7e508b814b8116ab06c0f61061d04509099c0f4 adds both causal regressions; no hosted RED is claimed for that short-lived head. Production f84eaf099b076a9143713490842631d5b830ed0d captures the ordinary class method inertly with inspect.getattr_static, rejects both non-FunctionType dependencies and the canonical Protocol declaration itself, and invokes that same captured function directly after authorization without a second dynamic lookup. 2ba4b6fd3fa2d9ebfd06741a6d553dec4d6db12f makes the People service contract code-current.

Current-head code-quality review then found the hostile test double raised a non-standard AssertionError from __getattribute__. The finding was valid but did not invalidate the production repair. Ordinary-forward 147b8fc2f1938cb69b45532a0418ae78dca0be30 changes only the trap to AttributeError, preserving the causal RED against a vulnerable post-authorization lookup while honoring Python attribute-resolution semantics. The inline thread was answered with exact evidence and resolved. Issue #276 remains open through hosted acceptance and protected integration.

Exact-head evidence

Current exact head is 147b8fc2f1938cb69b45532a0418ae78dca0be30, direct against protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, and GitHub reports the PR mechanically mergeable.

Fresh exact-head source/review gates are terminal GREEN: Foundation 34281722422, Security 34281722400, SAST 34281722376, Required Noema 34281720641, Required OpenCode 34281720645, Required PR Review Merge Scheduler 34281720646, and Dynamic Code Quality 34281718875 all succeeded.

Two required central-runtime gates remain RED without a new Orgmetra source finding. CodeQL 34281722437 failed because Python compatibility job 102248729053 enforced at 21:44:33Z and Actions compatibility job 102248729269 enforced at 21:44:41Z before Dispatch current-head CodeQL scan job 102249586821 even started at 21:46:56Z; the dispatch then succeeded at 21:47:03Z. This exact consumer canary is handed to canonical combined repair .github#2040; no unchanged-head rerun, synthetic status, sleep/poll workaround, or consumer workflow edit is used.

Required Strix 34281720649 failed only in job 102249156796 at Provision contextual-orchestrator Strix sidecar after current-PR admission, trusted checkout, current-head fetch, workflow self-test and secret gate had succeeded. Actual Strix install/model/quick-scan steps were never reached. This exact sidecar-bootstrap canary is handed to .github#1948; no direct-provider model, paid fallback, rerun, or gate weakening is used.

Fresh review enumeration contains no qualifying independent non-author APPROVED. All returned inline review threads, including the current-head code-quality finding, are resolved. The PR therefore remains Draft until the required central owners produce normal protected GREEN and current-head review policy is satisfied.

Baseline handoff

The durable checked-versus-used capability invariant was handed to the canonical baseline writer #100 without modifying docs/product-technical-gap-baseline.md from this branch. The baseline handoff records People #276 as a second bounded-context application of the existing repository-capability invariant while explicitly forbidding mutable Workforce Validation source copying.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Root-cause repair on exact current head f22225700723b46625372844a06205c3dc9b46e4: Strix’s MEDIUM finding was valid. The hire ASGI route now rejects paths over the existing 256-character transport budget before route-shape/UUID parsing, rejects query strings over the existing 4096-byte budget before parsing, and caps parsed query fields at two. Added regressions proving oversized path/query input never reaches _looks_like_hire_route or parse_qsl. Local exact-current-tree People API evidence: 153 passed, 100% statement coverage, 100% branch coverage. No approval evidence is asserted; required hosted checks for this head are still queued.

[seonghobae]

Exact-current-head local review for f22225700723b46625372844a06205c3dc9b46e4: People API suite passed 153 passed; owned statement and branch coverage are both 100%. CodeGraph was initialized and healthy for the review worktree. I found no additional correctness or boundary defect in the changed authentication-error and request-budget paths. This is review evidence only: no approval is submitted, hosted required checks remain pending/queued, and no merge/protected-branch truth is claimed.

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

• CHANGELOG.md — repository behavior
• manifest.json — repository behavior
• services/people-api/README.md — repository behavior
• services/people-api/src/orgmetra_people_api/hire_http.py — Python module behavior
• services/people-api/src/orgmetra_people_api/http.py — Python module behavior
• services/people-api/src/orgmetra_people_api/people.py — Python module behavior
• services/people-api/tests/test_hire_http_error_schema.py — regression suite
• services/people-api/tests/test_hire_http_route.py — regression suite
• services/people-api/tests/test_http_query_limits.py — regression suite
• services/people-api/tests/test_http_route.py — regression suite
• services/people-api/tests/test_people_read_runtime_integrity.py — regression suite
• services/people-api/tests/test_read_auth_backend_failure.py — regression suite

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: CHANGELOG.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: CHANGELOG.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Repository file: manifest.json"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: manifest.json"]
  R2 --> V2["required checks"]
  Evidence --> S3["Repository file: README.md"]
  S3 --> I3["repository behavior"]
  I3 --> R3["Review risk: Repository file: README.md"]
  R3 --> V3["required checks"]
  Evidence --> S4["Python: hire_http.py (3 files)"]
  S4 --> I4["Python module behavior"]
  I4 --> R4["Review risk: Python: hire_http.py (3 files)"]
  R4 --> V4["pytest plus coverage"]
  Evidence --> S5["Test: test_hire_http_error_schema.py (6 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test: test_hire_http_error_schema.py (6 files)"]
  R5 --> V5["targeted test run"]

Loading

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

• Head SHA: 27f09897507182f8ddcb090dd7273dcbaf182e36
• Workflow run: 33448176544
• Workflow attempt: 1
• Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: CHANGELOG.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: CHANGELOG.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Repository file: manifest.json"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: manifest.json"]
  R2 --> V2["required checks"]
  Evidence --> S3["Repository file: README.md"]
  S3 --> I3["repository behavior"]
  I3 --> R3["Review risk: Repository file: README.md"]
  R3 --> V3["required checks"]
  Evidence --> S4["Python: hire_http.py (3 files)"]
  S4 --> I4["Python module behavior"]
  I4 --> R4["Review risk: Python: hire_http.py (3 files)"]
  R4 --> V4["pytest plus coverage"]
  Evidence --> S5["Test: test_hire_http_error_schema.py (6 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test: test_hire_http_error_schema.py (6 files)"]
  R5 --> V5["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 27f09897507182f8ddcb090dd7273dcbaf182e36
• Workflow run: 33448176544
• Workflow attempt: 1
• Gate result: COVERAGE_BLOCKED
• Coverage gate: failure
• Model pool: unknown
• Verdict: COVERAGE_BLOCKED
• Formal review: fix(people): harden governed People reads #55 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.