fix(people): protect governed mutation runtime types - #64
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueNo actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughPeople 변이와 채용 수락 경계가 서브클래스를 거부하도록 변경되었습니다. UUID, 문자열, Decimal, 명령, 결과, 권한 결정, 시간값, PostgreSQL 행 형태에 정확한 타입 검사를 적용했습니다. 런타임 무결성 회귀 테스트와 변경 기록을 갱신했습니다. ChangesPeople 런타임 무결성
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This change hardens People mutation and hire-acceptance inputs against executable subtype values while preserving supported built-in values and persistence behavior. No concrete current-head merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
changed the title
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact-head repair/evidence update for the current branch state:
Fresh exact-current-head hosted evidence is terminal GREEN: People API Quality Live protected base remains |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Current exact-head follow-up after fresh review: A new review correctly identified that the three direct
Fresh exact-current-head hosted evidence is terminal GREEN:
Live protected base remains |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Current execution receipt — exact head New verified finding: Assignment INSERT and Employment separation previously did not share one database conflict boundary. Separation locked Ordinary-forward lineage in this increment: RED contract The new PostgreSQL root is not claimed GREEN yet. Canonical Foundation #311 has received registration/reconciliation guidance, including the cluster-global guard-owner role lifecycle; #314 remains open; #100 received baseline invariants without a competing source write. Current-head hosted workflows are still non-terminal/queued, so predecessor success is not transferred. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="0d0b18ef9204077463d044073c92722d455dcd14"
migration="database/migrations/0017_assignment_separation_serialization.sql"
script="tests/test_assignment_separation_serialization_postgres.sh"
echo '== Exact revision and PR state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
gh pr view 64 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Commit scope and whitespace =='
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "${head}^" "$head"
git diff --unified=160 "${head}^" "$head" -- "$migration" "$script"
echo '== Target migration structure =='
ast-grep outline "$migration" --items all || true
rg -n -C 18 \
'(CREATE( OR REPLACE)? FUNCTION|SECURITY DEFINER|SECURITY INVOKER|search_path|row_security|FORCE ROW LEVEL SECURITY|ENABLE ROW LEVEL SECURITY|CREATE POLICY|GRANT|REVOKE|SET ROLE|FOR UPDATE|LOCK TABLE|pg_advisory|assignment|separation|employment_record|current|recorded_to|idempotency|audit|outbox|EXCEPTION|RAISE)' \
"$migration"
echo '== Target migration in bounded sections =='
sed -n '1,260p' "$migration"
sed -n '261,560p' "$migration"
echo '== Target test script =='
cat -n "$script"
echo '== Test lifecycle, interleavings, role handling, and assertions =='
rg -n -C 14 \
'(set -e|set \+e|trap|cleanup|wait\b|kill\b|pg_terminate_backend|pg_stat_activity|pg_blocking_pids|mkfifo|FIFO|barrier|release|COMMIT|ROLLBACK|psql|application_name|transactionid|tuple|advisory|FOR UPDATE|stale|current|role|CREATE ROLE|DROP ROLE|DROP OWNED|collision|quiescen|idempotency|audit|outbox|COUNT\(|row_security|SET ROLE|exit.status|status=)' \
"$script"
echo '== Existing related database contracts and access model =='
rg -n -C 12 \
'(separate_employment_record_once|create_assignment|assignment.*separation|employment.*assignment|FOR UPDATE|SECURITY DEFINER|FORCE ROW LEVEL SECURITY|GRANT .*separation|GRANT .*assignment|REVOKE .*assignment)' \
database/migrations services/people-api/src/orgmetra_people_api tests \
-g '*.sql' -g '*.py' -g '*.sh'
echo '== Script registration and references =='
rg -n -C 6 --glob '*.{yml,yaml,sh,py,mjs,md,json}' \
'(test_assignment_separation_serialization_postgres|assignment_separation_serialization)' \
.github tests scripts docs 2>/dev/null || true
echo '== Exact-head check and review status =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"'
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"'Length of output: 4049 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="0d0b18ef9204077463d044073c92722d455dcd14"
script="tests/test_assignment_separation_serialization_postgres.sh"
echo '== Locate the target migration and related files =='
fd -t f . database/migrations tests docs services \
| rg -i '(0017|assignment.*separation|separation.*assignment)' || true
echo '== Recent migration and test history =='
git log --reverse --format='commit %H%nparents %P%nsubject %s%n' \
-- database/migrations tests/test_assignment_separation_serialization_postgres.sh \
| tail -n 120
echo '== Current-head paths introduced since the PR base =='
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
git diff --name-status "$base" "$head" \
| rg '(database/migrations|test_assignment_separation|employment-separation)' || true
echo '== Target script =='
cat -n "$script"
echo '== Target script lifecycle and verification constructs =='
rg -n -C 14 \
'(set -e|set \+e|trap|cleanup|wait\b|kill\b|pg_terminate_backend|pg_stat_activity|pg_blocking_pids|mkfifo|FIFO|barrier|release|COMMIT|ROLLBACK|psql|application_name|transactionid|tuple|advisory|FOR UPDATE|stale|current|role|CREATE ROLE|DROP ROLE|DROP OWNED|collision|quiescen|idempotency|audit|outbox|COUNT\(|row_security|SET ROLE|exit.status|status=)' \
"$script"
echo '== Target script diff and exact head context =='
git log -n 8 --format='commit %H%nparents %P%nsubject %s%n' -- "$script"
git show --format='commit %H%nparents %P%nsubject %s' --stat -- "$script"
git diff --unified=160 "${head}^" "$head" -- "$script"
echo '== Migration candidates: database contracts and privileges =='
for file in $(fd -t f -e sql . database/migrations); do
if rg -q '(assignment|separation)' "$file"; then
echo "== $file =="
rg -n -C 12 \
'(CREATE( OR REPLACE)? FUNCTION|SECURITY DEFINER|search_path|row_security|FORCE ROW LEVEL SECURITY|ENABLE ROW LEVEL SECURITY|CREATE POLICY|GRANT|REVOKE|FOR UPDATE|pg_advisory|assignment|separation|employment_record|recorded_to|idempotency|audit|outbox|EXCEPTION|RAISE)' \
"$file"
fi
done
echo '== Registration and status =='
rg -n -C 6 --glob '*.{yml,yaml,sh,py,mjs,md,json}' \
'(test_assignment_separation_serialization_postgres|assignment_separation_serialization)' \
.github tests scripts docs 2>/dev/null || true
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")"' || true
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"' || trueLength of output: 141787
High — Verify PostgreSQL backend quiescence in
However,
The application names are fixed:
A later run can therefore detect or conflict with a surviving backend from an earlier failed run. This can produce non-deterministic false failures and can let live work overlap test-environment cleanup. Make The migration itself has the required serialization order. This finding is static review evidence for the exact head only. I did not use predecessor approval or workflow evidence. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="20e29962311b17eb004412cd775dd5ada0ca4cba"
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
test_file="services/people-api/tests/test_conversion_employment_binding_regression.py"
echo '== Exact head, ancestry, and PR state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
gh pr view 64 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeable,url
echo '== Head commit scope and whitespace =='
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "${head}^" "$head"
git diff --unified=160 "${head}^" "$head" -- "$test_file"
echo '== Locate candidate-conversion, employment creation, and lock artifacts =='
fd -t f . services/people-api database tests docs \
| rg -i '(conversion.*employment|employment.*conversion|employment.*separation|separation.*employment|mutation|001[0-9].*\.sql)' \
| sort
echo '== Test structure and complete test source =='
ast-grep outline "$test_file" --items all
cat -n "$test_file"
echo '== Current implementation: conversion references and employment creation =='
rg -n -C 14 \
'(candidate_worker_conversion_record|conversion_record|create_employment|EmploymentMutationCommand|employment_record_id|employment_record)' \
services/people-api/src database/migrations \
-g '*.py' -g '*.sql'
echo '== FK definitions and employment/conversion insert order =='
rg -n -C 16 \
'(FOREIGN KEY|REFERENCES .*employment|REFERENCES .*candidate_worker_conversion|candidate_worker_conversion_record|INSERT INTO .*employment|INSERT INTO .*candidate_worker_conversion)' \
database/migrations -g '*.sql'
echo '== Existing serialization and lock order for Person/Employment and Assignment/Employment =='
rg -n -C 18 \
'(FOR UPDATE|pg_advisory|advisory|guard_assignment_employment_coverage|create_employment|candidate_worker_conversion_record|person_record)' \
database/migrations services/people-api/src \
-g '*.sql' -g '*.py'
echo '== Test registrations and test changes since base =='
rg -n -C 5 \
'(test_conversion_employment_binding_regression|conversion_employment_binding)' \
.github tests services docs -g '*.{py,sh,yml,yaml,md,json}' || true
git diff --name-status "$base" "$head" -- services/people-api/tests database/migrations services/people-api/src
git diff --unified=80 "$base" "$head" -- "$test_file"
echo '== Exact-head check and review status =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")"' || true
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"' || trueLength of output: 203436 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="20e29962311b17eb004412cd775dd5ada0ca4cba"
test_file="services/people-api/tests/test_conversion_employment_binding_regression.py"
source_file="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
echo '== Test introduction and parent context =='
git log --format='commit %H%nparents %P%nsubject %s%n' -n 8 -- "$test_file"
git show --format=fuller --stat --find-renames "$head" -- "$test_file"
git diff --check "${head}^" "$head"
sed -n '1,80p' "$test_file"
echo '== Exact conversion schema and foreign-key constraints =='
for file in $(fd -t f -e sql . database/migrations | sort); do
if rg -q 'candidate_worker_conversion_record' "$file"; then
echo "== $file =="
rg -n -C 18 \
'(CREATE TABLE.*candidate_worker_conversion_record|candidate_worker_conversion_record|FOREIGN KEY|REFERENCES public\.employment_record|employment_record_id)' \
"$file"
fi
done
echo '== Full generic employment write sequence =='
sed -n '50,110p' "$source_file"
sed -n '517,555p' "$source_file"
sed -n '574,720p' "$source_file"
echo '== Existing tests covering generic employment conversion, idempotency, and exclusivity =='
rg -n -C 12 --glob '*.py' \
'(create_employment|_CONVERSION_SQL|candidate-worker conversion|candidate_worker_conversion|person has no governed|validate_person_employment_exclusivity)' \
services/people-api/tests
echo '== Lock statements and their callers in the current generic employment path =='
rg -n -C 10 --glob '*.py' \
'(FOR UPDATE OF conversion|_CONVERSION_SQL|_EMPLOYMENT_VERSIONS_SQL|validate_person_employment_exclusivity)' \
"$source_file" services/people-api/tests
echo '== Status, exact check associations, and recent review state =='
gh pr view 64 --repo ContextualWisdomLab/Orgmetra \
--json state,isDraft,headRefOid,baseRefOid,mergeable,reviews
gh api "repos/ContextualWisdomLab/Orgmetra/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.status != "completed" or .conclusion != "success") | "\(.name)\t\(.status)\t\(.conclusion // "null")"' || trueLength of output: 202616
Medium — Test the authority contract and the replacement serialization boundary.
This is an intentional RED on the current head. The protected conversion FK makes a pre-insert requirement for a conversion already bound to the server-generated generic Employment circular. The confirmed-hire path inserts the Employment before it inserts the conversion. Therefore, the generic Employment path cannot use an existing conversion as authorization for the new Employment. However, the new test does not prove this contract. A later change can move the lookup into a helper, rename The test also does not preserve the required concurrency property. The current conversion row lock is the Person/Employment conflict-serialization boundary. Replace this source-text assertion with behavioral tests. The tests should prove that generic Employment creation succeeds without a candidate conversion, rejects invalid target-aggregate authority, and still serializes competing Employment writes for the same Person. A PostgreSQL concurrency test should verify the replacement lock boundary and fresh post-wait read behavior. The exact head is Draft. Its current checks are queued or pending. The review list contains no qualifying You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="7f9fbd08470e5c5ab9292469ca91f7e42c2d8dc9"
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
source="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
echo '== Exact revision and pull request state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
gh pr view 64 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Exact-head change scope and whitespace =='
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "${head}^" "$head"
git diff --name-status "${head}^" "$head"
git diff --stat "${head}^" "$head"
echo '== Locate changed and related People mutation artifacts =='
git diff --name-only "${head}^" "$head" | sort
fd -t f . services/people-api/tests database/migrations docs \
| rg -i '(employment|assignment|conversion|mutation|serialization|concurrency)' \
| sort
echo '== Source map and current-head targeted diff =='
ast-grep outline "$source" --items all
git diff --unified=180 "${head}^" "$head" -- "$source"
rg -n -C 20 \
'(class PostgresPeopleMutationPort|def create_employment|def create_assignment|_CONVERSION_SQL|person_record|FOR UPDATE|validate_person_employment_exclusivity|candidate_worker_conversion_record|employment_record|assignment)' \
"$source"
echo '== Full relevant source sections =='
rg -n 'def create_employment\b|def create_assignment\b|_CONVERSION_SQL|_PERSON|validate_person_employment_exclusivity' "$source"
sed -n '1,180p' "$source"
sed -n '500,780p' "$source"
echo '== Test changes and existing behavioral/concurrency coverage =='
for file in $(git diff --name-only "${head}^" "$head" | rg '^services/people-api/tests/.*\.py$' || true); do
echo "== $file =="
ast-grep outline "$file" --items all
cat -n "$file"
done
rg -n -C 16 --glob '*.py' \
'(create_employment|create_assignment|candidate_worker_conversion_record|_CONVERSION_SQL|Person.*FOR UPDATE|person.*lock|employment.*concurr|serializ|stale.*version|FOR UPDATE)' \
services/people-api/tests
echo '== Schema constraints, assignment conversion provenance, and lock ordering =='
rg -n -C 20 -g '*.sql' \
'(candidate_worker_conversion_record|CREATE TABLE.*employment_record|CREATE TABLE.*assignment|FOREIGN KEY|REFERENCES public\.employment_record|FOR UPDATE|CREATE( OR REPLACE)? FUNCTION.*assignment|guard_assignment_employment_coverage|person_record)' \
database/migrations
echo '== Relevant migration and service implementation sections =='
for file in $(fd -t f -e sql . database/migrations); do
if rg -q '(candidate_worker_conversion_record|guard_assignment_employment_coverage|CREATE.*assignment)' "$file"; then
echo "== $file =="
rg -n -C 24 \
'(candidate_worker_conversion_record|guard_assignment_employment_coverage|FOR UPDATE|employment_record|assignment_record|person_record|CREATE( OR REPLACE)? FUNCTION)' \
"$file"
fi
done
echo '== Registration or executable Postgres concurrency contracts =='
rg -n -C 10 --glob '*.{py,sh,yml,yaml,md,json}' \
'(conversion_employment|employment.*concurr|person.*anchor|assignment.*conversion|assignment_separation)' \
.github tests services docs 2>/dev/null || true
echo '== Exact-head check and review status =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"' || true
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"' || trueLength of output: 204303 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="7f9fbd08470e5c5ab9292469ca91f7e42c2d8dc9"
source="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
test="services/people-api/tests/test_postgres_people_mutations.py"
echo '== Head delta =='
git show --format=fuller --stat "$head"
git diff --unified=220 "${head}^" "$head" -- "$source" "$test"
echo '== Exact SQL constants and current create paths =='
sed -n '45,115p' "$source"
sed -n '530,575p' "$source"
sed -n '600,735p' "$source"
sed -n '830,1010p' "$source"
echo '== Test setup, fake cursor sequencing, and relevant tests =='
ast-grep outline "$test" --items all --match 'PostgresPeopleMutationPortTests'
rg -n -A140 -B30 \
'(class .*Cursor|def _port\b|def test_employment|def test_assignment|person employment anchor|candidate-worker conversion)' \
"$test"
echo '== Every current use of the conversion and Person anchor SQL constants =='
rg -n -C 15 \
'(_PERSON_EMPLOYMENT_ANCHOR_SQL|_CONVERSION_SQL)' \
"$source" services/people-api/tests -g '*.py'
echo '== Current service entrypoint ordering =='
rg -n -A150 -B20 \
'def create_employment_record\b|def create_assignment_record\b' \
services/people-api/src/orgmetra_people_api -g '*.py'
echo '== Commit ancestry and exact check state =='
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
git merge-base --is-ancestor "${head}^" "$head" && echo 'parent_is_ancestor=true'
gh api "repos/ContextualWisdomLab/Orgmetra/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")"' || trueLength of output: 141825
Medium — Update the Employment concurrency contract to require the Person anchor.
assert "FOR UPDATE OF conversion" in postgres_mutations._CONVERSION_SQLThat assertion does not test the new conflict boundary. The generic Employment path now depends on Update the test to require:
The production ordering is otherwise correct.
This is static review evidence for You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="ec3fb59f269e8b6f6849d3c2e9c3f4ccf53b6a73"
base="eb9757f8649aaad026a9865508d9aad50c1a7a4f"
source="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
echo '== Exact revision and pull request state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
gh pr view 64 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Exact head and immediate history =='
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
git log --format='commit %H%nparents %P%nsubject %s%n' -n 30 "$head"
git diff --check "${head}^" "$head"
git diff --name-status "${head}^" "$head"
git diff --stat "${head}^" "$head"
echo '== Identify the recorded-time reconciliation commit and relevant files =='
git log --all --oneline --decorate --grep='recorded\|anchor\|employment' -i -n 100
git log --all --format='%H %s' -- services/people-api/src/orgmetra_people_api/postgres_mutations.py \
services/people-api/tests | rg -i '5eb7d|recorded|anchor|employment' || true
git diff --unified=180 "${head}^" "$head" -- "$source"
echo '== Source map and production employment path =='
ast-grep outline "$source" --items all
rg -n -C 24 \
'(def create_employment\b|_PERSON_EMPLOYMENT_ANCHOR_SQL|_EMPLOYMENT_VERSIONS_SQL|recorded_at|recorded_to|FOR UPDATE OF person|person_record|validate_person_employment_exclusivity|READ COMMITTED|candidate_worker_conversion)' \
"$source"
sed -n '1,180p' "$source"
sed -n '520,800p' "$source"
echo '== All exact-head changed tests and relevant regression tests =='
git diff --name-only "${head}^" "$head" | while IFS= read -r file; do
case "$file" in
*.py)
echo "== $file =="
ast-grep outline "$file" --items all || true
cat -n "$file"
;;
esac
done
rg -n -C 18 --glob '*.py' \
'(PERSON_EMPLOYMENT_ANCHOR|create_employment|anchor.*recorded|recorded_at|recorded_to|malformed.*anchor|employment.*concurr|FOR UPDATE OF person|current Person)' \
services/people-api/tests
echo '== Data model and transaction contracts =='
rg -n -C 18 --glob '*.sql' \
'(CREATE TABLE.*person_record|CREATE TABLE.*employment_record|recorded_at|recorded_to|FOR UPDATE|person_record|employment_record|validate_person_employment_exclusivity|READ COMMITTED)' \
database/migrations
echo '== Caller boundary and fake cursor sequencing =='
rg -n -A180 -B20 \
'def create_employment_record\b|def create_employment\b' \
services/people-api/src/orgmetra_people_api -g '*.py'
rg -n -C 14 --glob '*.py' \
'(class .*Cursor|fetchone\(|fetchall\(|PERSON_EMPLOYMENT_ANCHOR|employment.*anchor)' \
services/people-api/tests
echo '== Exact-head checks and reviews =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"' || true
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"' || trueLength of output: 203698 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="ec3fb59f269e8b6f6849d3c2e9c3f4ccf53b6a73"
source="services/people-api/src/orgmetra_people_api/postgres_mutations.py"
test_main="services/people-api/tests/test_postgres_people_mutations.py"
test_time="services/people-api/tests/test_postgres_mutation_recorded_time_regression.py"
test_binding="services/people-api/tests/test_conversion_employment_binding_regression.py"
echo '== Exact commit delta =='
git show --format=fuller --stat "$head"
git diff --unified=240 "${head}^" "$head" -- "$source" "$test_main" "$test_time" "$test_binding"
echo '== SQL constants and validation helpers =='
rg -n -A55 -B10 \
'^(_READ_WRITE_SQL|_PERSON_EMPLOYMENT_ANCHOR_SQL|_EMPLOYMENT_VERSIONS_SQL|_POST_LOCK_CLOCK_SQL)|^def (_require_one_person_employment_anchor|_post_lock_recorded_at|_is_aware_datetime|_employment_version_from_row|_unpack_fixed_rows)\b' \
"$source"
echo '== Complete narrow source range =='
sed -n '40,180p' "$source"
sed -n '350,590p' "$source"
sed -n '610,735p' "$source"
echo '== Recorded-time and malformed-anchor tests =='
cat -n "$test_time"
cat -n "$test_binding"
sed -n '250,350p' "$test_main"
echo '== Test fixtures: cursor result sequencing and normal employment path =='
sed -n '40,135p' "$test_main"
rg -n -A80 -B15 \
'def _port\b|def test_employment|test.*anchor|test.*recorded' \
"$test_main"
echo '== History for recorded-time reconciliation =='
git log --all --oneline --decorate -- "$test_time" "$test_binding" "$source" | head -n 100
git log --all --format='%H%n%P%n%s%n' -- "$test_time" | head -n 100
git log --all --format='%H %s' | rg -i 'recorded.time|post.lock|anchor.time|malformed.anchor|5eb7d' || true
echo '== Static production ordering and isolation checks =='
rg -n -C 12 \
'(SET TRANSACTION ISOLATION LEVEL|READ COMMITTED|_PERSON_EMPLOYMENT_ANCHOR_SQL|_POST_LOCK_CLOCK_SQL|_EMPLOYMENT_VERSIONS_SQL)' \
"$source"Length of output: 74528
I found no defect in the requested scope.
The implementation reads the Employment portfolio only after it obtains the Person-row lock. PostgreSQL gives this later statement a new The recorded-time reconciliation is correct. The anchor query returns
The The generic Employment path does not use This is a static review of the exact head. At inspection time, the exact-head required workflows were queued, and no qualifying independent You are interacting with an AI system. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| return authorize_resource_fields( | ||
| principal=principal, | ||
| tenant_record_id=tenant_record_id, | ||
| purpose_code=purpose_code, | ||
| resource_kind=resource_kind, | ||
| resource_id=resource_id, | ||
| requested_fields=requested_fields, | ||
| required_scope_code=required_scope_code, | ||
| permitted_fields=requested_fields, | ||
| policy=policy, | ||
| ) |
| ) -> EmploymentMutationResult: | ||
| """Persist one employment or raise without partial writes.""" | ||
| """Persist one Employment mutation.""" | ||
| ... |
| ) -> PositionMutationResult: | ||
| """Persist one position or raise without partial writes.""" | ||
| """Persist one Position mutation.""" | ||
| ... |
| ) -> AssignmentMutationResult: | ||
| """Persist one assignment or raise without partial writes.""" | ||
| """Persist one Assignment mutation.""" | ||
| ... |
1 participant
Current execution receipt — 2026-09-13
ec3fb59f269e8b6f6849d3c2e9c3f4ccf53b6a73; protected base:develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; open, Draft, mechanically mergeable.20e29962311b17eb004412cd775dd5ada0ca4cbaproduced a real hosted Foundation RED:test_generic_employment_creation_does_not_require_candidate_conversionfailed because genericPostgresPeopleMutationPort.create_employment(...)still depended on_CONVERSION_SQL. The rest of the People lane passed and production coverage remained 100%, so this was a deliberate domain RED rather than gate noise.7f9fbd08470e5c5ab9292469ca91f7e42c2d8dc9is the minimal production repair.5eb7d1524e3a5992d7d575d93f260eb02bbe6061ordinary-forward reconciles the existing post-lock recorded-time regression with the new Person conflict anchor.ec3fb59f269e8b6f6849d3c2e9c3f4ccf53b6a73adds the remaining malformed anchor-time edge so the new helper's fail-closed condition is exercised rather than hidden by the 100% coverage gate.ec3fb59...; predecessor verdicts are not transferred. No qualifying independent APPROVED review is bound to this exact head. Draft-skipped bot status is not approval.Causal People-domain repair: generic Employment serializes on Person, not recruiting provenance
candidate_worker_conversion_recordis recruiting-origin provenance and has a tenant-qualified FK to the resulting Employment. It cannot be the generic precondition for creating an arbitrary future Employment: exact binding would be circular before that Employment exists, while a Person-only historical conversion can incorrectly act as authority for an unrelated later Employment/rehire.The current repair removes
_CONVERSION_SQLfrom the generic Employment persistence path and replaces its incidental serialization role with the canonical current Person conflict anchor:person_recordrow withFOR UPDATE OF person;clock_timestamp()only after that conflict lock is held;This removes recruiting provenance from generic People authorization without opening a different-idempotency-key race between two concurrent Employment creates for one Person. Assignment deliberately retains its candidate-worker conversion requirement; the repair is scoped to generic Employment creation only.
The recorded-time regression now asserts
Person lock < post-lock clock_timestamp() < Employment portfolio read. The additional edge regression rejects a valid Person identity paired with non-database temporal evidence. Neither follow-up weakens the production contract or treats caller time as recorded-history authority.Rehire / separation ownership
Foundation / documentation owner boundaries
docs/product-technical-gap-baseline.md. Durable wording should record that recruiting conversion provenance is not generic Employment authority and that different-key Employment creation serializes on stable Person truth before portfolio re-evaluation.No self-approval, force-push, destructive rebase, mutable sibling consumption, gate weakening, predecessor-evidence transfer, synthetic status, or routine bypass is authorized by this PR.