fix(people): protect governed mutation runtime types

.github/workflows/foundation-ci.yml

@@ -39,7 +39,7 @@ jobs:
           python-version: "3.14"
           check-latest: false
       - name: Set up Node.js LTS
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           check-latest: false

CHANGELOG.md

@@ -8,6 +8,7 @@ All notable changes to Orgmetra will be documented in this file.
 
 - Accepted ADRs 0001–0003 now include buyer-facing Context, Decision, and Consequences grounded in verified ISO 30400:2022, ISO 30414:2025, Uniform Guidelines (29 C.F.R. Part 1607), SIOP (2018), OpenAPI Specification v3.2.0, OpenID Connect Core 1.0 errata set 2, CloudEvents v1.0.2, Jensen and Snodgrass (1999), Snodgrass (1999), and Allen (1983) records already listed in `docs/doctoring/REFERENCES.md`. ADRs 0004 and 0005 gained APA 7th References pointers to that same bibliography without changing their Decision bodies.
 - Active-PR governed Job Analysis persistence/API on the canonical `JobAnalysisSnapshot` model: migration `0013_job_analysis_snapshot.sql` stores immutable tenant-scoped snapshot, Task, KSAO, Task–KSAO, FJA and write-command evidence; `POST /v1/tenants/{tenant_record_id}/job-analysis-snapshots` and matching GET enforce purpose-bound Keyverse scope, authenticated-principal actor authority, bounded/strict JSON handling, transactional Idempotency-Key serialization, parent-scope fail-closed integrity, forced RLS, and atomic audit/outbox evidence. ADR 0014 records the persistence decision while ADR 0007 remains the domain/evidence authority; validated evidence still requires accountable human review and non-LLM provenance, and the service does not make a high-impact employment decision.
+- Active-PR governed Employment separation via `POST /v1/employment-separations`: exact current-known Employment/version targeting, five controlled separation reasons, human-confirmed versioned evidence, bitemporal supersession instead of in-place termination, append-only `employment_separation_record`, atomic People idempotency plus audit/outbox evidence, capability-separated PostgreSQL execution, and shared Employment-anchor serialization with Assignment creation. ADR 0015 remains Proposed; canonical #311 PostgreSQL execution, remaining security/review gates, protected integration, and downstream #302 rehire are not claimed by this Unreleased entry.
 - Active-PR `orgmetra_selection_review` packet for PII-minimized, evidence-bound human selection review: canonical operational tenant identity, UUID-backed opaque candidate/Job/sealed-evidence/reviewer references, explicit purpose/reason/evidence version, deterministic canonical JSON and SHA-256 correlation, mandatory human decision state, redacted packet repr, and provenance-paired model evidence that remains `untrusted_draft`, with exact 100% owned statement and branch coverage required by its quality gate.
 - Active performance-criterion scope hardening: `criterion_observation_scope_guard` rejects criterion outcomes for a Job the worker did not effectively hold at the observation date, observations before the relevant assignment, and observations outside the referenced performance cycle while preserving valid multiple-assignment cases and existing bitemporal correction semantics. The guard evaluates current-recorded facts, derives the date coordinate from `observed_at` in UTC so session `TimeZone` cannot alter the result, uses a trusted function search path, and adds no PII or automated employment decision authority. The Foundation PostgreSQL contract also rejects a closed `recorded_to` on each time-coordinate lookup and proves UTC midnight plus non-UTC session `TimeZone` boundaries.
 - Bitemporal tenant-scoped organization hierarchy validation that rejects visible indirect parent cycles and reuses single-valued recorded-time reconstruction before graph traversal.
@@ -18,7 +19,7 @@ All notable changes to Orgmetra will be documented in this file.
 - `employment_record_version.employment_concurrency_code` constrained to `exclusive` or `concurrent`.
 - ADR 0005 for exclusive employment and staffable seats.
 - `orgmetra_hris_kernel` 0.3.0 with identity-scoped bitemporal resolution, assignment-employment coverage, allocation-portfolio checks, and a Memorial Hospital RN correction case at 100% statement and branch coverage.
-- `employment_record_version` and `position_record_version` so employment and position identity stay stable across retroactive corrections.
+- `employment_record_version` and `position_record_version` so corrections no longer mint a new employment or position identifier.
 - `assignment_record.employment_record_id` bound to the same person as the covering employment.
 - `orgmetra_keyverse_adapter` that binds an opaque Keyverse subject to a person and rejects passwords, passkeys, and tokens.
 - Design tokens for the repeating HR actions: approve, review, correct, request evidence, compare, export, and escalate.
@@ -37,6 +38,7 @@ All notable changes to Orgmetra will be documented in this file.
 
 ### Changed
 
+- Foundation database validation now treats PostgreSQL-owned `public` as an infrastructure qualifier, continues enforcing multiword naming for organization-owned schemas and created tables, and recognizes the optional qualifier on forced row-level-security declarations.
 - Consolidated repository-owned PR validation from twelve workflows into one Foundation CI job, while keeping the dual-cluster recovery rehearsal separately path-scoped. Central required review and security workflows remain organization-owned.
 - New predictive-validity membership must use one normalized worker-level case; the three independent validity-study decision/evidence/outcome link relations are historical read surfaces only and can no longer accept new rows. A case insert also rejects a criterion observation whose recorded interval is already closed at `linked_at`.
 - Canonicalized service identifiers as two-or-more-word `snake_case` across architecture, deployment, ACL, metrics, and client contracts.
@@ -54,6 +56,7 @@ All notable changes to Orgmetra will be documented in this file.
 - Made assignment coverage status-aware: `active` and `leave` remain staffable while `terminated` and other non-eligible employment statuses fail closed.
 - Made organization hierarchy reconstruction fail closed on a cycle at the requested tenant, effective day, and knowledge cutoff while ignoring future-recorded and foreign-tenant facts.
 - Build the outbox due-work index concurrently during migration 0008, requiring that index step to run outside an explicit transaction block so established queues do not block writers while the index is built; pre-index hardening and post-index privileged role setup use separate explicit transactions.
+- Active-PR People mutation commands now require exact built-in governance text and hire status values before digesting or persisting high-impact employment evidence.
 
 ### Security
 
@@ -67,7 +70,7 @@ All notable changes to Orgmetra will be documented in this file.
 - Expired dispatcher ownership is recoverable only after the recorded lease deadline and while attempts remain; takeover preserves immutable event/audit identity and retry budget, increments the attempt count, issues a new future lease, and records `lease_expired` failure evidence. An expired final-attempt row is not reclaimable beyond the budget.
 - Normal dead-lettering remains restricted to the exact recorded worker identity after the immutable database-owned retry budget is exhausted. If that final worker identity is permanently unavailable, a distinct operator-only function may terminalize only an already-expired exhausted lease, must supply an opaque operator reference and failure code, and must append matching immutable escalation evidence before the existing transition guard accepts the dead-letter state. `PUBLIC` cannot execute the function; the externally assignable `orgmetra_outbox_operator` role receives EXECUTE only, while a separate NOLOGIN/NOBYPASSRLS `orgmetra_outbox_recovery_owner` owns the SECURITY DEFINER function and narrowly scoped table privileges. The operator role cannot SELECT/UPDATE outbox state or INSERT escalation evidence directly. Pre-existing reserved role names are rejected before migration 0008 changes project objects, and the temporary schema `CREATE` used for ownership transfer is transactionally revoked before the role setup can commit.
 - Audit/outbox SQL boundaries pin a trusted `pg_catalog, public, pg_temp` search path while `PUBLIC` loses schema-creation privilege on `public`; immutable envelope validation uses C-collated deterministic comparisons and calendar-field validation rather than session-sensitive timestamp input parsing.
-- Bitemporal reconstruction plus assignment, position-seat, employment-exclusivity, and organization-hierarchy kernel decisions are tenant-scoped so foreign-tenant identifiers cannot leak historical facts, provide coverage, consume capacity, or create false conflicts.
+- Bitemporal reconstruction plus assignment, position-seat, employment-exclusivity, and organization-hierarchy kernel decisions are tenant-scoped so foreign-tenant identifiers cannot leak historical facts, provide coverage, consume capacity, create false conflicts, or enter reconstructed history.
 - Keyverse outage policy that blocks PII and high-risk actions when current authorization cannot be verified.
 - Cross-tenant threat, denial evidence, and negative authorization test contracts.
 - Replaced client-visible internal trace identifiers with random support references and actionable next-step error guidance.