fix(core): protect canonical evidence runtime types

[seonghobae]

Scope

Canonical shared HRIS-kernel audit/runtime-evidence lane for Orgmetra. It owns shared audit and Job Analysis value integrity; consumer lanes do not copy mutable #63 source.

Current exact head is d88800a5ca3ca15df332e8def5e25064c46e4005 on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, open · Draft · mechanically mergeable. Draft remains intentional because current-head CodeQL and Strix are terminal RED and independent approval is absent; no predecessor verdict transfers.

Retained Job Analysis repairs

The prior runtime hardening remains intact: #211–#214 moved audit/time evidence to exact detached standard-library authority and removed process-local issuance authority. Intervening ordinary-forward Job Analysis commits 74f7f2c444be421deec08557ef46ae8da6aca90a, b846304b7da4d97529461b3db5e4eb1e049da345, and 510b50b9faa4fae8c3404752e464fd17ba8124ae were read and adopted rather than treated as a race.

#277 owns the Job Analysis nested UUID finding. Test-first 3bb641bd... added executable nested-payload/caller-alias regressions; 03ba635e... captures .int once, requires an exact built-in int, enforces range/nil/max, reconstructs owned UUID values, and stores the detached result. 4ab735df... scopes the focused regressions. Foundation 34292861193 then exposed a real compatibility RED in the old custom-timezone test contract; 4ad9363af660f137b4c8c575b68113e7883c8129 corrected only that superseded expectation and Foundation 34293147207 was terminal SUCCESS.

#278 audit nested UUID RED -> source repair -> manifest GREEN

Fresh intervening ordinary-forward commits after 4ad9363... implemented the dedicated audit slice already reserved for #278:

• Test-first c423de6205fd22f654d4602cc4eab54295709515 adds audit regressions for executable/non-int nested UUID payloads, exact integers outside the 128-bit range, and caller UUID alias mutation after construction.
• Causal source repair afd47f07408f03048f9cac89ee60e2b03614615f adds _freeze_uuid: capture .int once, require exact built-in int, range-check before nil/max equality, then reconstruct owned UUID(int=identity) event/tenant values before tuple storage.
• Exact afd47f... Foundation run 34293586152 produced a real RED at Validate foundation pack: audit.py is part of the deterministic manifest subset, but the branch still carried predecessor SHA/bytes/lines. This was not treated as a reason to revert the security repair.
• Ordinary-forward d88800a5ca3ca15df332e8def5e25064c46e4005 reseals the existing audit.py manifest entry to SHA-256 f7e1d56073bdabcd7051f9757c17b9f009d9384a6bad07cf4ef9c936f2ff7876, 12,950 bytes, 314 lines. It does not expand the canonical manifest path set.

The earlier CodeRabbit suggestion to add Job Analysis files to manifest.json remains invalid: tests/validate_repository.py requires exact set equality and those Job Analysis paths are intentionally outside REQUIRED. #278 differs because audit.py is already sealed and therefore its existing inventory entry had to be updated.

Exact-head verification

On exact d88800a5...:

• Foundation 34294884750: SUCCESS — the manifest repair and owned 100% statement/branch coverage gate pass.
• Security 34294884604: SUCCESS.
• SAST 34294884676: SUCCESS.
• Required OpenCode 34294885141: SUCCESS.
• Required PR Review Merge Scheduler 34294884932: SUCCESS.
• Dynamic Code Quality 34294883368: SUCCESS.
• Required Noema 34294884955: SUCCESS.
• CodeQL 34294884616: FAILURE. Actions consumer 102289273879 failed enforcement at 00:26:32Z and Python consumer 102289273811 at 00:26:56Z; only afterward did current-head dispatch 102289748560 start at 00:27:01Z and complete SUCCESS at 00:27:08Z. This is the central publication/settlement ordering RED already handed to .github#2040; no unchanged-head rerun or leaf workaround is used.
• Required Strix 34294884985: FAILURE. Admission, trusted materialization, CO sidecar provisioning, Strix installation, and orchestrator/free preparation all succeeded; Run Strix (quick) emitted artifact 10083683583 (sha256:0936587636b5689136fb28221d55b84982fa8241950d087cb52818cb2299887f) but terminal evidence is internally inconsistent and the reported HIGH IDOR is not established against the authoritative application boundary.

All visible inline review threads are resolved. Fresh review enumeration still has no ruleset-qualifying independent APPROVED; no self-approval or stale review is transferred.

Strix finding verification and owner handoff

The Strix artifact reports HIGH CWE-863 against JobAnalysisSnapshot.__post_init__, claiming that direct construction with arbitrary tenant/job UUIDs bypasses authorization. Current code does not support that exploit model:

• JobAnalysisSnapshot is a pure immutable HRIS-kernel evidence value; construction has no persistence side effect and the kernel deliberately does not depend on authenticated application context.
• services/job-analysis-api/src/orgmetra_job_analysis_api/snapshot.py authorizes the job_analysis_snapshot:<id> resource with authorize_resource_fields(...), rebuilds the posted tenant against the authorized route tenant, and only then invokes the write port.
• Existing API regression coverage denies unauthorized persistence and asserts the write port receives zero calls.
• The scanner PoC itself uses empty tasks, ksao_requirements, and task_ksao_links, which violates the constructor's non-empty evidence invariants.

Adding session/auth dependencies to the kernel value object would invert the DDD dependency direction and is therefore rejected. The bounded-context selection gap has been handed to central .github#695: when kernel Job Analysis changes, Strix should receive the narrow trusted-base job-analysis API authorization/persistence context and require an IDOR to demonstrate a path to an authoritative port. Separately, .github#2026 received this artifact as a terminal-evidence consistency canary because run.json says completed/success and the narrative says no high-impact vulnerability while SARIF/vulnerability ledger contains one HIGH finding; the gate then misclassifies the terminal run as STRIX_PROVIDER_UNAVAILABLE.

Dependencies and owner boundaries

#64 remains the canonical generic People mutation writer and #65 the purpose-bound authorization/Job Analysis consumer owner. Both consume #63 only after normal protected integration. #163/#165 remain downstream. docs/product-technical-gap-baseline.md remains #100 single-writer; this branch does not compete for it.

Central CodeQL repair remains .github#2040, currently open · Ready · mechanically mergeable at exact 6706c231ab06a3c91c43fdb5b989cfcd79fff593 against protected .github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db. #63 will not use blind reruns, sleeps, synthetic statuses, predecessor verdicts, or leaf gate weakening while the exact consumer canary reproduces the settlement defect.

No force push, destructive rebase, source-copy dependency, no-op retrigger, administrator bypass, gate weakening, self-approval, premature Ready, merge, Close, or release claim is used.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

감사 이벤트와 작업 분석 증거의 런타임 타입 검증을 강화했습니다. 내장 타입 서브클래스를 거부하고, 허용된 타임스탬프를 UTC로 고정합니다. 생성 후 변조와 변환 예외에 대한 회귀 테스트를 추가했습니다.

Changes

런타임 타입 무결성

Layer / File(s)	Summary
감사 이벤트 검증 및 불변 canonical export packages/hris-kernel/src/orgmetra_hris_kernel/audit.py, packages/hris-kernel/tests/test_audit_*.py, CHANGELOG.md, manifest.json	AuditOutboxEvent를 namedtuple 기반의 구조적 불변 객체로 변경했습니다. 정확한 UUID, 문자열, datetime 및 허용된 타임존만 수락합니다. to_cloudevent()는 정확한 이벤트 타입과 필드를 재검증합니다. 생성 후 변조, 위조된 서브클래스, 변경 가능한 tzinfo 및 오프셋 오버플로를 검증합니다.
작업 분석 증거 검증 및 정규화 packages/hris-kernel/src/orgmetra_hris_kernel/job_analysis.py, packages/hris-kernel/tests/test_job_analysis_temporal_type_integrity.py	작업 분석 모델이 정확한 UUID, 문자열, 숫자, 날짜, datetime 및 중첩 모델 타입만 허용합니다. retrieved_at, recorded_at, reviewed_at을 UTC datetime으로 분리합니다. 서브클래스, 변경 가능한 tzinfo, 변환 예외 및 오프셋 오버플로를 테스트합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to 72070

This change hardens audit and job-analysis evidence validation, but the changed job-analysis file may bypass manifest integrity tracking, and one regression test can accept an incorrect error message. Resolve these release-integrity and test-contract gaps before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 95.65% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 92 functions across 7 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 canonical evidence의 runtime type 보호라는 PR의 주요 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/job-analysis-temporal-evidence-types

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

[seonghobae]

@coderabbitai review

Please review exact head f2229342d7c3fb538020c53e9752b8179e7e7269 against protected develop@ef1b143368cb6249c9520ca8cae10ebe844a5aa1. Focus on canonical HRIS-kernel runtime integrity after the non-force restack: exact datetime rejection/detachment/canonicalization in AuditOutboxEvent, hostile runtime-type regressions, temporal evidence invariants in Job Analysis, and whether the protected-base merge introduced any semantic or compatibility regression. #197 is routed here as the canonical owner; do not transfer predecessor-head review, approval, or GREEN evidence.

[seonghobae]

Fresh exact-head evidence update for 42ef99ae272d78aeeeea7aac6cfd533b800a40a4: Foundation 34089818143, Security 34089818168, and SAST 34089818051 are now all terminal SUCCESS. The SAST multi-language job checked out the exact head, verified the pinned manifest, completed Semgrep SARIF generation/upload, and completed successfully.

CodeQL 34089818084 is terminal FAILURE, but the jobs show the central handoff shape rather than a leaf CodeQL finding: language detection succeeded; both CodeQL compatibility analysis (actions) and (python) successfully executed Request current-head CodeQL scan dispatch, then failed only at Release runner or enforce current-head CodeQL verdict. Do not convert that workflow conclusion into a source-vulnerability claim or transfer predecessor verdicts.

PR remains Draft. No Ready/merge transition is justified while CodeQL lacks the authoritative current-head terminal verdict and the live ruleset still requires one qualifying approval.

[seonghobae]

Fresh unchanged-head CodeQL canary result on 42ef99ae272d78aeeeea7aac6cfd533b800a40a4: rerun 34089818084 attempt 2 is terminal FAILURE, not queued. Detect-languages job 101790612558 succeeded; compatibility jobs 101790611504 (python) and 101790611860 (actions) both failed at Read current-head CodeQL dispatch verdict and then Release runner or enforce current-head CodeQL verdict; dispatch job 101799295414 was skipped. Foundation 34089818143, Security 34089818168, and SAST 34089818051 remain exact-head SUCCESS. This is fresh evidence for .github#1929 terminal verdict/publication ownership, not an Orgmetra source/SARIF RED; the exact canary receipt was handed to #1929. Keep #63 Draft because CodeQL authority and qualifying independent approval are still absent. No leaf source churn or bypass.

[seonghobae]

Fresh owner-path update: central CodeQL has now produced terminal SUCCESS on independent Orgmetra exact head b05210f60479dc71f4e26b56416c82d037143f99 (#275, run 34178933569). Because that is a material causal-owner change rather than a no-op leaf churn, I used the supported rerun failed jobs path on this unchanged exact head 42ef99ae272d78aeeeea7aac6cfd533b800a40a4. CodeQL run 34089818084 is now attempt 3 and was queued at the immediate refetch (run_started_at=2026-09-08T03:04:16Z). Foundation/Security/SAST predecessor evidence remains current for this unchanged head, but CodeQL is not GREEN until attempt 3 reaches an authenticated terminal result. No source commit, force update, self/model approval, or bypass was used.

[seonghobae]

Central owner checkpoint (Orgmetra source unchanged): ContextualWisdomLab/.github#1902 is now at exact head aed803d9516dfdfbb82f6ca5f803604d7f90e5ba, Ready, mechanically mergeable, and unresolved-thread count 0. An independent exact-head run of its CodeQL PR/dispatch contract passed 136 tests under GITHUB_ACTIONS=true -W error.

The owner is still mutable and unintegrated. Its fresh Security/SAST/Python Security/CodeQL evidence and qualifying independent approval are not terminal, so Orgmetra #63's exact-head CodeQL failure remains authoritative. No attempt-5 rerun or product-source change is justified until normal protected owner integration is verified.

[seonghobae]

Central owner checkpoint update (2026-09-08 UTC; product head unchanged)

.github#1902@aed803d9516dfdfbb82f6ca5f803604d7f90e5ba is now Draft after exact hosted run 34220806323 proved a producer/consumer protocol cutover failure: the PR-head producer sends nested rerun_request.required_jobs, while the protected handler reads only top-level required_jobs and received null.

The protected handler also reproduced the multi-language wake race in 34220757095: actions started required run 34219724160 attempt 2, then python's sibling POST failed HTTP 403 because the run was already running. The canonical handler prerequisite is .github#2040@e17d1e74e57789141feda99f542759dc99bde6cc, now Draft with exact RED→GREEN requirements recorded.

Orgmetra #63 remains 42ef99ae272d78aeeeea7aac6cfd533b800a40a4; Foundation, Security, and SAST evidence remains valid, but its CodeQL failure cannot be refreshed until the handler prerequisite merges and #1902 is non-force restacked and proven GREEN. No Orgmetra source mutation or manual rerun was performed.

[seonghobae]

Central owner checkpoint updated without changing Orgmetra head 42ef99ae272d78aeeeea7aac6cfd533b800a40a4:

• .github#1999@0caa50ca336f13e9a1ecb785f1ad761d09389886 repaired the forwarded Strix close-cleanup concurrency deadlock test-first; candidate tree passes 472 affected tests and the full 3068 passed, 1 skipped, 21 subtests passed suite. Its current CodeQL run 34225920350 is still terminal FAILURE.
• .github#2040@dd2796d072180dae76dc5e07653f1cbfe7992d6b has one attempt-level settlement implementation, but a new exact-head dual-representation conflict contract is RED.
• .github#1902@9f065583b367df7608ec2bb57ba9337f3926f8fe passes 139 exact contract tests locally, while hosted CodeQL run 34225089444 remains terminal FAILURE.

Orgmetra Foundation, Security, and SAST evidence is preserved, but central owner GREEN plus current-head CodeQL and independent approval remain required. No leaf workaround or source mutation was introduced.

[seonghobae]

Current upstream evidence chain (2026-09-08): .github#1999@c6076046… repaired forwarded Strix close preemption and is exact-tree full-suite GREEN locally (3068 passed, 1 skipped; source threads 0) but hosted CodeQL/Strix and approval remain; canonical handler .github#2040@57c81430… is exact-tree full-suite GREEN locally (3007 passed, 1 skipped; source threads 0) but its protected-consumer CodeQL generation remains blocked until ordinary integration; producer .github#1902@9f065583… passes 139 exact-head contracts with source threads 0, while CodeQL run 34225089444 is terminal FAILURE awaiting #2040. Orgmetra head 42ef99ae272d78aeeeea7aac6cfd533b800a40a4 is unchanged; no predecessor GREEN or approval is transferred.

[seonghobae]

Upstream delta after the prior checkpoint: .github#1999@c6076046… CodeQL run 34227474702 is now terminal SUCCESS for both actions and Python; Strix 34227472781 remains in progress and independent approval is still absent. .github#2040@57c81430… remains Draft with exact local full-suite GREEN, but hosted CodeQL ended Python FAILURE/actions CANCELLED and Strix was cancelled, so no owner release/consumer GREEN is transferred. Orgmetra head remains unchanged.

[seonghobae]

Central owner checkpoint — 2026-09-08

The CodeQL handler repair is now .github#2040@5c309930baba08606df16d037ce38b37896ff12c, carrying run-wide single-writer settlement, typed/conflict-checked head envelopes, and live synthetic PR merge-parent provenance. Local combined evidence is 50 focused plus 3,016 full tests (1 skipped, 21 subtests); hosted exact-head checks are newly queued and the owner remains Draft. Orgmetra head 42ef99ae272d78aeeeea7aac6cfd533b800a40a4 therefore receives no predecessor GREEN and remains blocked on ordinary protected owner merge, producer restack, fresh product CodeQL, and independent approval.

[seonghobae]

Central base correction — 2026-09-08

.github#2040@5c309930baba08606df16d037ce38b37896ff12c has been retargeted from Draft predecessor #2043 directly to protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db; compare is 30 ahead / 0 behind, so the complete typed-envelope and settlement delta remains preserved without force push or rebase. Central CodeQL run 34233449735 is in progress and independent approval is absent. Orgmetra #63 receives no GREEN transfer and remains blocked on ordinary central merge → #1902 restack → fresh product evidence.

[seonghobae]

Central owner checkpoint: product head remains unchanged at 42ef99ae272d78aeeeea7aac6cfd533b800a40a4. Canonical prerequisite ContextualWisdomLab/.github#2040 advanced by ordinary non-force child 91a94a2, tree c7580fd56f59344ea9fee3305c7b2469bf548703. The exact tree separates target synthetic-merge provenance from protected central handler-source identity and repairs host-scoped stale-run revalidation; full warning-error suite is 3088 passed, 1 skipped, 21 subtests passed. #2040 remains Draft with fresh queued hosted checks and no qualifying approval, so #63 inherits no GREEN or merge authority.

[seonghobae]

Central-owner checkpoint — 2026-09-09

.github#2040 advanced non-force to 6706c231ab06a3c91c43fdb5b989cfcd79fff593 after exact handler run 34249932036 exposed the protected-handler envelope cutover. The successor now keeps failed mode compatible with protected main and has a fresh CodeQL run 34251822255 in progress. Orgmetra head 42ef99ae272d78aeeeea7aac6cfd533b800a40a4 is unchanged; central predecessor failures or local GREEN are not transferred, and merge remains gated on terminal central exact-head evidence plus qualifying approval.