feat(document-records): add governed HR document evidence

[seonghobae]

Current authority — 2026-09-12

Current exact head is ec39bfa9bcb73b2b7730a0a6115b2e484d78acb2, based on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Live state is open · Draft · mergeable. The document-record evidence delta remains valid and is not a Close candidate.

This head is an ordinary two-parent, non-force reconciliation of predecessor 6a9f3e214079e2b46bba9776a862f194b899f0e4 with current protected develop. The resolved tree preserves the governed DocumentRecordEvidence ADR/doctoring/traceability and package source/tests while keeping #161 repository-owned workflow consolidation authoritative. The obsolete feature-local .github/workflows/document-record-evidence-quality.yml is intentionally not resurrected.

The old-base root CHANGELOG.md line describing an “Active-PR” slice and its corresponding old manifest reseal were not carried forward as authoritative data. That status prose was stale after protected-parent reconciliation and is already represented by the package changelog plus this PR authority; protected CHANGELOG.md and manifest.json remain byte-current from develop, avoiding reintroduction of old workflow inventory/provenance. No production/test/fixture/contract/evidence delta from the document-record package was dropped.

Exact-head evidence

• Foundation run 34625702215: SUCCESS, but not package acceptance. Protected Foundation’s explicit owned-test list does not execute packages/document-record-evidence, so this is a demonstrated false-green for a newly introduced owned package. Current-head adopter evidence was handed to canonical package-neutral Foundation owner ci: enforce declared Python package compatibility #259 (5637945375).
• SAST run 34625702203: SUCCESS on this exact head.
• Required Noema run 34625700486: SUCCESS on exact ec39bfa... (completed 2026-09-11 17:21:08Z).
• Required Strix run 34625700536: SUCCESS on exact ec39bfa... (completed 2026-09-11 17:49:32Z). This terminal result supersedes the earlier in-progress snapshot; elapsed time was not treated as a timeout verdict.
• Security run 34625702181: terminal FAILURE only at central Dependency Review support detection after exact checkout/verification; actual Dependency Review was skipped while Trivy/Scorecard/OSV siblings succeeded. Current-head canary remains with .github#810 (5637952624).
• CodeQL run 34625702267: terminal FAILURE reproducing the central consumer-before-producer ordering defect. The authoritative dispatch producer later succeeded, but both required compatibility consumers had already failed. Current-head chronology remains with .github#2040 (5637967282).

All predecessor hosted results are historical after the merge commit. All currently visible inline review threads are resolved, but there is still no qualifying current-head independent APPROVED review. Before Ready, this exact head still needs actual package discovery/execution with 100% owned statement/branch coverage, repaired applicable central Security/CodeQL gates, and a qualifying independent approval.

Stack / owner order

#107 is the durable PostgreSQL persistence child and currently stacks on this exact #98 authority. #107 must not transfer predecessor GREEN and remains Draft until canonical Foundation can actually discover its new package/PostgreSQL contracts. Issue #309 owns the later document_records uncertain-retry/idempotent persistence command/result contract; #308 owns return/delete completion receipts and recovery-aware deletion. Consumers such as #307 may consume only released/versioned owner contracts.

Do not revive feature-local workflows, self-approve, routinely bypass, force-push, destructively rebase, create no-op retriggers, add sleeps/polling to leaf workflows, or weaken gates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a046702-6121-4e2e-b736-1025ff57d931

📥 Commits

Reviewing files that changed from the base of the PR and between 9e3e484 and 9aeeb20.

📒 Files selected for processing (10)

• .github/workflows/document-record-evidence-quality.yml
• docs/adr/0098-governed-document-record-evidence.md
• docs/doctoring/document-record-evidence-references.md
• docs/traceability/document-record-evidence.md
• packages/document-record-evidence/CHANGELOG.md
• packages/document-record-evidence/README.md
• packages/document-record-evidence/pyproject.toml
• packages/document-record-evidence/src/orgmetra_document_record_evidence/__init__.py
• packages/document-record-evidence/src/orgmetra_document_record_evidence/evidence.py
• packages/document-record-evidence/tests/test_evidence.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

DocumentRecordEvidence 패키지를 추가했습니다. 최소화된 HR 문서 메타데이터와 무결성 digest를 검증합니다. 관련 ADR, 참조 문서, 추적성 문서 및 설치 휠 품질 검증 워크플로를 추가했습니다.

Changes

Document Record Evidence

Layer / File(s)	Summary
증거 계약과 무결성 구현 packages/document-record-evidence/pyproject.toml, packages/document-record-evidence/src/..., packages/document-record-evidence/tests/test_evidence.py	DocumentRecordEvidence와 build_document_record_evidence를 공개했습니다. UUID, SHA-256, UTC 시각, 허용 분류를 검증하고 canonical payload digest로 변경을 감지합니다. 생성, 직렬화, 오류 조건 및 마스킹 동작을 테스트합니다.
거버넌스와 추적성 문서 docs/adr/0098-governed-document-record-evidence.md, docs/doctoring/document-record-evidence-references.md, docs/traceability/document-record-evidence.md, packages/document-record-evidence/README.md, packages/document-record-evidence/CHANGELOG.md	증거의 포함·제외 범위, provenance, 보존정책, 시간 구분, 권한·감사 책임 및 후속 persistence 경계를 문서화합니다.
설치 휠 품질 검증 .github/workflows/document-record-evidence-quality.yml	develop 대상 변경과 수동 실행을 처리합니다. 고정된 checkout과 Python 3.14.7 환경에서 wheel을 빌드하고, 해시 고정 설치, pip check, 테스트, 100% 커버리지 및 checkout 상태를 검증합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant build_document_record_evidence
  participant DocumentRecordEvidence
  Caller->>build_document_record_evidence: 키워드 인자 전달
  build_document_record_evidence->>DocumentRecordEvidence: 객체 생성 및 입력 검증
  Caller->>DocumentRecordEvidence: canonical_json 호출
  DocumentRecordEvidence-->>Caller: 검증된 canonical JSON 반환

Loading

Merge Risk: ⚪ Minimal · up to 9aeeb

The PR adds a constrained, evidence-only HR document boundary with successful exact-head validation and no actionable merge-blocking risk remaining beyond normal independent review and repository protection checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 governed HR document evidence 패키지 추가라는 변경의 핵심을 정확히 설명하며, 간결하고 구체적입니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/document-record-evidence

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Fresh owner-stack repair downstream is complete: #107 no longer points at this PR's predecessor 59b809...; it now ordinary-forward includes current #98 exact head 6a9f3e214079e2b46bba9776a862f194b899f0e4 via two-parent merge a8ca94b1ada6f96f9e4e396970704e6370e1179d, with no child/parent file overlap and unchanged nine-file #107 delta.

This makes #98 the actual next document_records foundation blocker. Its live state remains Draft · non-mergeable against protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Reconciliation must preserve the valid DocumentRecordEvidence package/docs/trust-boundary repairs while adopting the protected repository/workflow consolidation; do not resurrect the old feature-local document-record-evidence-quality.yml merely to manufacture GREEN. Package execution must instead become non-vacuous through #258/#259 (or verified successor). Any manifest/CHANGELOG conflict must be regenerated from the resolved final tree rather than accepting either stale side wholesale. After ordinary non-force develop adoption, reacquire current-head package execution/coverage and all required central gates before Ready.