feat(hris): add governed Employment work-capacity review - #103
feat(hris): add governed Employment work-capacity review#103seonghobae wants to merge 8 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughEmployment work-capacity review 패킷 패키지와 관련 문서, 테스트, GitHub Actions 품질 워크플로를 추가했다. 패킷은 입력 검증, canonical 증거, SHA-256 무결성, 시스템 기록 시각을 지원하며 운영 데이터를 변경하지 않는다. ChangesEmployment work-capacity review
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to This PR adds a bounded, non-mutating employment work-capacity review packet with deterministic evidence and system-generated issuance time. No actionable merge-blocking risk remains after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant 호출자
participant 패킷빌더 as build_employment_work_capacity_review_packet
participant 패킷 as EmploymentWorkCapacityReviewPacket
participant 증거 as Canonical 증거
호출자->>패킷빌더: 검토 입력 전달
패킷빌더->>패킷: 시스템 recorded_at으로 생성
패킷->>증거: 정규화 및 SHA-256 digest 생성
증거-->>패킷: canonical 문서와 digest 반환
패킷-->>호출자: 검증된 패킷 반환
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| def _validate_utc_timestamp(value: object, field_name: str) -> datetime: | ||
| """Require an exact built-in datetime whose timezone is the UTC singleton.""" | ||
| if type(value) is not datetime or value.tzinfo is not timezone.utc: | ||
| raise ValueError(f"{field_name} must be an exact built-in UTC datetime") | ||
| return value |
There was a problem hiding this comment.
📝 Info: UTC check requires the exact singleton
_validate_utc_timestamp (review.py:130) rejects any reviewed_at whose tzinfo is not the timezone.utc singleton. A numerically-UTC datetime built from timezone(timedelta(0)) or ZoneInfo("UTC") fails. This strictness is intentional, but callers that normalize via astimezone(ZoneInfo("UTC")) will be rejected.
Was this helpful? React with 👍 or 👎 to provide feedback.
| def _verified_payload(self) -> dict[str, object]: | ||
| """Return one verified snapshot or fail closed after post-issuance mutation.""" | ||
| payload = self._payload() | ||
| digest = sha256(_canonical_json(payload).encode("utf-8")).hexdigest() | ||
| with self._issuance_lock: | ||
| issued_digest = self._issuance_digests.get(self) | ||
| if issued_digest != digest: | ||
| raise ValueError("Employment work-capacity evidence was modified after issuance") | ||
| return payload |
There was a problem hiding this comment.
📝 Info: Tamper detection is process-local only
The issuance digest lives in an identity-keyed WeakKeyDictionary (review.py:181-184, 241-242), so tamper detection works only for packets created in the current process. A packet obtained via deserialization has no stored digest, so _verified_payload at review.py:272-280 raises 'modified after issuance' on every access. The PR frames this as defense-in-depth, not durable evidence.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
@opencode-agent Please review the current unchanged head against protected |
1 participant
Buyer-visible gap
Protected
develop@9e3e4847510e1e612b48474ba42b177b8ed824dfhas authoritative Employment and Assignment truth, but no bounded review evidence for a proposed change in one Employment's contracted work capacity before downstream bitemporal mutation. This Orgmetra-only lane adds that boundary without changing compensation, payroll, leave, scheduling, Assignment, or any foreign CWL repository.Test-first repair sequence
c5c55827557662b77d99e5f5cd5d4b438f70cb02: package contract, adversarial tests and exact-head workflow were introduced while productionreview.pywas deliberately absent. Runs materialized but were superseded before terminal completion, so no terminal hosted RED is claimed.3dab4d8dc57659ffb82991f50099f5defc07808a: added the governed packet, deterministic evidence, docs and artifact-quality lane.53a6998e022cc30067a749254e7cd2c95b0bfe55→ repairaf7dd8c4bda2fe177ebcb11590dd0775ccc4ef42: zero capacity now has one canonical evidence representation (0.0000);Decimal('-0.0000')fails closed.a411603a0f124920a4d3999fb3d45459b1a0b8d0→ root repair/current head645d2f3b2db10e2bdfbe60422837a5986d8f39f8: callers can no longer inject or backdaterecorded_at. Orgmetra generates system-recorded UTC issuance time inside the constructor, independently from businesseffective_onand humanreviewed_at.Current contract
EmploymentWorkCapacityReviewPacketbinds authoritative tenant/Employment scope, exact finite four-decimal current/proposed capacity ratios, business effective date, human review time, owner-generated system-recorded time, exact SHA-256 employment-terms/capacity-policy/reviewer-identity evidence, distinct requester/reviewer correlations, controlled non-sensitive reason, and bounded evidence version.The packet remains PII/value-minimized and fixed to
employment_work_capacity_review,reviewed_for_authoritative_resolution,not_authorized_to_change_employment_or_compensation, and mandatory human review. It does not classify legal full-time/part-time status, infer suitability/availability for work, or authorize Employment, Assignment, compensation, payroll, leave, or scheduling mutation.Nil/Max UUID sentinels, malformed digests, runtime subclasses, noncanonical Decimal scale, signed negative zero, actor overlap, review time later than owner-generated issuance, mutable governance constants, and post-issuance field mutation fail closed. Canonical JSON is deterministic and routine repr is redacted. The process-local weak issuance registry is defense in depth only, not durable authorization/signature evidence.
Exact-current-head evidence
Base:
develop@9e3e4847510e1e612b48474ba42b177b8ed824dfHead:
645d2f3b2db10e2bdfbe60422837a5986d8f39f8Every applicable exact-current-head workflow is terminal GREEN:
32670611249— success32670611206— success32670611211— success32670611285— success32670611245— successFresh review verification finds no submitted review and no review thread. GitHub reports the PR open, ready-for-review, and mergeable.
Merge governance
Ready-for-review is not merge authorization. Keep unmerged until a qualifying independent non-author approval exists on this unchanged head and issue #89's enforceable
developprotection defect is actually repaired. Immediately before any future merge, refetch exact head, live base, reviews, unresolved threads, effective rules/protection and exact-current-head checks and use expected-head protection only if every live gate is satisfied. Do not self-approve, weaken or simulate protection, manufacture passing evidence, or transfer predecessor checks/reviews.Summary by CodeRabbit
새 기능
문서
품질 개선