product/science(workforce_validation): make the validity-study registry executable behind its canonical owner boundary

[seonghobae]

Live owner-to-buyer gap — 2026-09-21

Protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f assigns validity studies, exact decision/evidence/outcome linkage, subgroup diagnostics, drift monitoring, selection utility and scientific adapters to workforce_validation. PRD P0 includes a validity-study registry/FR-007; the protected product baseline also already names a P1 Validation dashboard shell.

The executable owner-to-buyer path is still incomplete, but its dependency graph is not one linear branch chain. Fresh live review found an existing Validation presentation owner that earlier #428 wording had missed: Draft PR #145 at exact 45accc8f2405013e4520e76fa70d01cbebf3c5cc. #145 must remain the single-writer source lane for the existing shell. #428 is corrected to own only the later commercial convergence of that protected UI lineage with the protected/released Workforce Validation API.

This umbrella stays open until both owner paths converge into protected buyer truth. Do not create parallel HR/scientific ownership, normalize direct public-schema/cross-service SQL, source-copy mutable branches, or infer scientific authority from UI/HTTP transport.

Backend/scientific/API owner path

#235 — canonical application owner

#235 remains the canonical workforce_validation in-process application/service lane on exact 202d9d87d6a45529497279b881169aab127727f8, open · Draft · mechanically mergeable against protected develop@eb9757....

It retains the governed owner/provenance/currentness/authorization/view-integrity/scientific-reproducibility contracts accumulated through #411–#424. #423 rejects material final-weight adjustments without released/versioned deterministic owner evidence; #424 requires every admitted governed adjustment binding sequence to be contiguous and one-based. Resolver-issued Python views/proof seals remain data/defense-in-depth, not durable authorization; consequential actions re-authorize and re-resolve owner truth.

ValidityStudyRecord.study_status_code currently validates only a stored lower-snake-case code. 01c3da48... repaired the lifecycle-governance docstring overclaim; actual state vocabulary/transitions remain #426 scope. recorded_from / recorded_to remain bitemporal knowledge time, not business lifecycle.

Predecessor 03bf5040... reached 1,441 tests, 5,186/5,186 owned statements, 1,116/1,116 branches and isolated PostgreSQL contracts before the final read-only gate detected untracked wheel-build output. Current 202d9d87... causally moves wheel construction to a disposable pytest area; predecessor counts do not transfer. Exact-head Foundation 35507388584, Security 35507388575, SAST 35507388588, CodeQL 35507388573 remain non-terminal at the latest fresh read, so #235 stays Draft.

#248 — durable owner-schema adoption

#248 remains source-untouched at d54d44d795444df572efbb301a667d74ac574d58 on stale parent snapshot 656a0c41..., Draft/non-mergeable by design until #235 integrates normally. It owns forward PostgreSQL adoption, least-privilege runtime/read roles and durable adapters; it must not copy mutable #235/#57 source, mint resolver views/seals locally, infer owner identity from a digest or persist sparse component bindings.

After #235 protected integration, #248 non-force adopts current develop, preserves the valid persistence delta, and reacquires exact-head PostgreSQL/quality/security/review evidence.

#426 — governed registration/lifecycle

#426 follows durable persistence and owns versioned lifecycle vocabulary/legal transitions, stable study/version registration receipts, actor/purpose/policy provenance, optimistic concurrency, replay-safe idempotency, append-only correction/supersession and legacy-status census/quarantine. Business lifecycle remains orthogonal to recorded-time currentness; unknown legacy strings are not silently mapped.

#425 — scientific design lineage

#425 begins only after #426 is protected truth (or a verified successor fully carries it). Each governed study version must reconstructably bind predictor/assessment/scoring-model version, criterion definition/version, sampling design/frame and denominator/time/failure evidence, decision-policy version, analysis-plan/protocol provenance, FJA/KSAO job-relatedness evidence and immutable specialist scientific-result locations. A digest alone is not a released owner locator.

Psychometrics Commons / fast-mlsirm / TEPP or equivalent numerical owners remain released/versioned dependencies; no raw person-level scientific payload or mutable source is normalized into Orgmetra for convenience.

#427 — buyer HTTP/OpenAPI

#427 follows protected #425 and owns the versioned buyer-reachable network boundary: current OpenAPI baseline reconciliation, least-privilege Workforce Validation scopes, request validation, replay-safe idempotency, one canonical optimistic-concurrency representation, controlled Problem Details semantics, authenticated PostgreSQL-backed E2E and applicable p95 evidence. The current in-process package name ending in -api does not itself prove a network product boundary.

UI/presentation owner path — existing stack, not #428 source ownership

#53 → #130 → #145

Fresh review found the pre-existing executable Validation shell at #145. Its valid delta includes the bounded Validation dashboard presentation states, Storybook/Figma correlation, exact-value-table requirement, non-authorizing scientific copy, fail-closed permission/stale/error handling and focused exact-coverage tests.

That UI source is not currently adoptable as protected truth because its root stack is stale:

• feat: add evidence-centered HR workspace slice #53 exact 016f27e13f7a47cb78a1c936aa533cc8daa2c66c is now 113 ahead / 3 behind protected develop@eb9757..., merge base 9e3e484..., and GitHub reports mergeable=false.
• The three intervening protected commits consolidated repository-owned quality under canonical Foundation and retired feature-local workflow ownership. feat: add evidence-centered HR workspace slice #53 must ordinary-forward reconcile that protected delta first rather than overwriting it.
• feat(ui): add accessible protected-read request states #130 then adopts/integrates the reconciled protected root.
• feat(ui): add governed validation dashboard states #145 then non-force adopts protected feat(ui): add accessible protected-read request states #130 while preserving its valid Validation UI delta.

#145 still carries .github/workflows/hr-workspace-validation-dashboard.yml, and its focused test/traceability currently name that leaf workflow. The leaf must not simply be deleted while it is the only executor of the focused contract; nor may it survive final adoption and resurrect obsolete feature-local quality ownership. The eventual #145 adoption must first admit its focused UI acceptance into the then-current canonical Foundation/product-browser path, then retire the leaf, reconcile provenance and reacquire exact-head browser/accessibility/security/review evidence.

#428 — convergence/commercial completeness only

#428 no longer claims to be a second UI source owner. It starts source implementation only after both:

• the existing feat: add evidence-centered HR workspace slice #53→feat(ui): add accessible protected-read request states #130→feat(ui): add governed validation dashboard states #145 Validation presentation lineage is protected/released; and
• product/api(workforce-validation): expose governed validity-study HTTP boundary and currentize API standards #427 is protected/released over the backend/scientific path feat(workforce-validation): establish governed validity-study registry boundary #235→feat(workforce-validation): adopt registry into owner persistence #248→product(workforce-validation): govern validity-study lifecycle and idempotent registration #426→science(workforce-validation): version validity-study design lineage before validation claims #425.

Then #428 extends/integrates the protected #145 shell against the released #427 API into the complete buyer workspace: study index/detail; Design/Evidence/Results/History composition; exact study/version/lifecycle/result evidence; predictor/criterion/sample/frame/policy/protocol/FJA-KSAO/specialist-result provenance; correction/as-recorded semantics; governed actions and stale-write conflicts; scientific anti-false-GREEN states; Keyverse-backed auth journey; KO/EN/JA/ZH/VI/ES/DE/FR localization; Figma/design-token/Storybook reuse; responsive/accessibility/browser E2E and browser-runtime evidence.

verification_pending, not_verifiable, unavailable, superseded/corrected and permission-denied remain distinct from successful/negative scientific evidence. HTTP 200/current-recorded rows are never scientific/lifecycle GREEN. Every chart requires exact values and material denominator/method/time/evidence context.

Correct dependency graph

Backend/API path:

#235 → #248 → #426 → #425 → #427

UI/presentation path:

#53 → #130 → #145

Commercial convergence:

(#427 protected/released) + (#145 protected/released) → #428

Scientific #57 remains independently integrable; it becomes a consumer dependency only through an exact released contract, never via mutable source.

Documentation / scientific authority / completion

#51 remains canonical protected-truth documentation writer where its owned files apply; #100 remains sole writer for docs/product-technical-gap-baseline.md. Metadata may describe this live graph, but active PR/Issue contracts are not shipped truth.

Current normative/scientific sources recorded by the owner lanes continue to govern interpretation (including relevant ISO 10667, AERA/APA/NCME testing standards, SIOP Principles and current HTTP/OpenAPI standards); they do not certify an individual study or UI.

Keep #234 open until the canonical application owner, durable persistence, governed lifecycle/registration, scientific design lineage, buyer network contract, existing Validation presentation owner and final API-backed buyer workspace all reach normal protected integration with code-current PRD/TRD/ARCHITECTURE/ERD/UML/UX/STORYBOOK/API_CONTRACT/SECURITY/THREAT_MODEL/TEST_STRATEGY/OPERABILITY/TRACEABILITY/baseline evidence as applicable. Source, issue prose, Figma/Storybook artifacts or an OpenAPI document alone are not completion.

[seonghobae]

Fresh owner-path progress without changing Workforce Validation source: #235 remains exact dd95dd7256f37aab2c4f26aa1fb43e8c867f4e4d with Foundation and SAST GREEN. Central CodeQL prerequisites have materially advanced (.github#1926 repaired dispatched matrix/env handling and .github#1929 records the actor allowlist repair), so the previously failed exact-head CodeQL run 33986151302 was retried via supported failed-jobs rerun rather than a no-op commit. Attempt 2 now has fresh exact-head python job 101790508855 and actions job 101790509059 queued; language detection is successful. Keep #234's dependency order unchanged: #235 must obtain terminal authoritative central/security/governance evidence and integrate normally before #248 non-force adopts protected owner truth. Security remains separately blocked by the unresolved public dependency-review HTTP 403 owner incident .github#810; do not leaf-churn or substitute scanners.

[seonghobae]

Canonical owner-path progress: PR #235 has advanced ordinary-forward to exact 64d14e589a460f638a54a9e6484554685815a8c9 (protected develop@eb9757f..., 67 ahead / 0 behind). In addition to the existing validity-study registry read/bootstrap, it now defines a purpose-bound CalibrationAuxiliaryAuthorityReadPort and resolver for #407. The application boundary requires owner-corroborated projection/purpose/released-contract/authorization/scientific-use coordinates and an owner-resolved use instant; caller used_at must equal that owner evidence and cannot be backdated merely to fit an authorization interval. No protected auxiliary values or mutable #57 source are copied.

This does not reorder #234's persistence sequence. #235 remains Draft with fresh exact-head Foundation/Security/SAST/CodeQL nonterminal. Child #248 remains intentionally on its older parent snapshot. After #235 normal protected integration, #248 (or verified successor) must non-force adopt the integrated parent and implement the durable schema-qualified scientific-authority resolver/evidence exchange together with its existing owner-persistence delta; then reacquire exact-head PostgreSQL/coverage/security/review evidence. No parent evidence transfers.

[seonghobae]

2026-09-20 current-authority refresh: canonical parent #235 is now exact 03bf5040e7eb307c4df55ebd01453dcbd1ae0cef, open · Ready · mergeable on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. #423/#424 now fail closed for ungoverned final-weight transforms and require one contiguous one-based exact component binding per admitted governed adjustment; 03bf5040... removes the stale contrary wording from the service README. The last independent exact-tree functional/coverage verdict remains predecessor 731b5e9605f0d4d8f27e45920c68b73da2d44be0 (1,441/1,441 tests; 5,186/5,186 statements; 1,116/1,116 branches); those counts are not transferred to the documentation successor. Current-head hosted Foundation/Security/SAST/CodeQL runs are queued and qualifying approval is still absent.

The canonical repair order in this issue remains unchanged. #248 must not source-copy or restack onto mutable #235 before normal protected parent integration. After durable owner-schema adoption and idempotent registration are protected truth, the next buyer/scientific increment remains the explicit study-design contract already named here: predictor version, sampling design/frame, decision-policy version, analysis-plan/protocol provenance and immutable specialist-result references. Current registry.py still deliberately carries only the protected foundation fields and explicitly records those coordinates as a later #234 increment, so they are a confirmed gap but not authority to contaminate the current review candidate or bypass the persistence prerequisite.

[seonghobae]

Current scientific-gap handoff: #425 now owns the already-identified post-persistence validity-study design-lineage increment. It formalizes predictor/assessment/scoring-model version, criterion outcome version, sampling design/frame receipts and denominators/time basis, decision-policy version/digest, analysis-plan/protocol provenance, FJA/KSAO job-relatedness evidence references, and immutable specialist-result locators. It also records ISO 10667-1:2020 as current published authority while ISO/AWI 10667-1 Edition 3 remains stage 20.00 change-watch evidence, plus SIOP selection/AI-assessment traceability.

This does not reorder #234: #235 must integrate normally first; #248 then non-force adopts protected owner truth; idempotent registration comes next; only then should #425 become an implementation lane. No #235 source churn or mutable-parent restack is justified by opening #425.

[seonghobae]

Fresh source/DDL reconciliation on current #235 exact 03bf5040e7eb307c4df55ebd01453dcbd1ae0cef found one registration-lifecycle gap that should stay outside the current review candidate but be made explicit before the idempotent-registration increment.

Protected foundation currently defines validity_study.study_status_code as unconstrained text NOT NULL. The current application owner mirrors that shape: ValidityStudyRecord only runs the generic lower-snake-case _require_code(...) check, and the registry tests demonstrate study_draft as a fixture value but do not establish a finite owner vocabulary or a transition graph. Therefore a syntactically valid arbitrary value can presently be represented as owner data; neither the protected schema nor #235 proves which lifecycle states exist or which transitions are legal.

Treat this as a registration/lifecycle-owner prerequisite, not as #425 study-design lineage and not as authority to expand #235 while it is waiting on exact-head acceptance. After #235 integrates and #248 adopts durable owner persistence, the idempotent registration slice should establish, through ADR/domain tests before schema/API commitment:

• a versioned owner-defined validity-study lifecycle vocabulary and legal transition relation rather than accepting arbitrary lower-snake-case status text;
• append-only/currentness semantics for status changes, preserving recorded history instead of in-place scientific-basis mutation;
• actor, purpose, policy/provenance and exact expected-current-version/receipt identity for consequential transitions so replay is idempotent and stale transitions fail closed;
• an explicit forward-adoption rule for legacy rows carrying unknown/out-of-contract status values: detect and quarantine/remediate them rather than silently broadening the new owner contract;
• exact PostgreSQL and application regressions showing that syntactically valid but non-governed codes and illegal transitions are rejected, while reads of admitted legacy/current truth remain canonical and tenant-scoped.

This keeps the order unchanged: #235 protected integration → #248 durable adoption → governed/idempotent registration + lifecycle contract → #425 design lineage. No source change or parent-verdict transfer is implied by this finding.

[seonghobae]

Current authority update: #426 now owns the registration/lifecycle prerequisite that was previously described generically as “idempotent registration.” Fresh source review confirmed validity_study.study_status_code is unconstrained protected-schema text and #235 validates only lower-snake-case syntax; #248 adopts the relation/read boundary but does not define lifecycle semantics. Canonical order is now #235 protected integration → #248 non-force durable adoption/integration → #426 governed idempotent registration + versioned lifecycle transitions → #425 scientific design lineage. Do not pull #426 into #235 or restack #248 early; do not let #425 bind scientific lineage to an arbitrary status string.

[seonghobae]

Canonical stack authority refresh after fresh #235/#248/#425/#426 reads:

1. feat(workforce-validation): establish governed validity-study registry boundary #235 exact 03bf5040e7eb307c4df55ebd01453dcbd1ae0cef must obtain authentic exact-head gates + qualifying independent approval and integrate normally.
2. feat(workforce-validation): adopt registry into owner persistence #248 exact d54d44d795444df572efbb301a667d74ac574d58 stays source-untouched on the old parent snapshot until then; afterwards it non-force adopts protected develop, preserves its valid owner-schema/read-adapter delta and reacquires PostgreSQL/quality/security/review evidence.
3. product(workforce-validation): govern validity-study lifecycle and idempotent registration #426 is the explicit owner of governed idempotent validity-study registration and lifecycle transitions, including legacy-status census/quarantine, optimistic concurrency, replay receipts and the separation of business lifecycle from recorded_* bitemporal knowledge time.
4. science(workforce-validation): version validity-study design lineage before validation claims #425 starts only after product(workforce-validation): govern validity-study lifecycle and idempotent registration #426 (or a verified protected successor) is protected truth and binds predictor/criterion/sample/frame/decision-policy/protocol/FJA-KSAO/specialist-result provenance to that governed registered study version.

The old shorthand “#248 → idempotent registration → #425” should be read as #248 → #426 → #425. This authority update does not expand current #235 scope, copy mutable source, or authorize an early child restack.

[seonghobae]

2026-09-20 current-authority refresh: canonical parent #235 is now exact 202d9d87d6a45529497279b881169aab127727f8, open · Draft · mechanically mergeable on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. 01c3da48... neutralizes the premature lifecycle-governance docstring; actual lifecycle authority remains #426. Hosted predecessor 03bf5040... produced a real Foundation RED only at the final read-only-worktree proof after 1,441 tests, 5,186/5,186 statements, 1,116/1,116 branches and isolated PostgreSQL contracts had passed. RCA: the pinned setuptools wheel acceptance ran pip wheel --no-build-isolation directly against checkout source trees, which materializes build/ (and ignored egg-info) in those source projects; root .gitignore deliberately does not hide generic build/. 202d9d87... repairs the acceptance instead of weakening/ignoring the gate by copying both package sources into pytest temporary build roots and constructing wheels only there. No predecessor GREEN transfers; current-head Foundation/Security/SAST/CodeQL are fresh and non-terminal. Canonical downstream order remains #235 → #248 → #426 → #425.

[seonghobae]

Owner-path refinement: new #427 now explicitly owns the API/performance step that this umbrella previously described generically as “Add versioned OpenAPI/gateway paths and realistic PostgreSQL-backed buyer-path p95 ≤20 ms evidence.”

Canonical order is now #235 protected integration → #248 durable owner-schema adoption → #426 governed/idempotent registration+lifecycle → #425 versioned scientific study-design lineage → #427 governed buyer HTTP/OpenAPI boundary + realistic PostgreSQL-backed performance evidence.

#427 was opened only after re-reading protected TRD/API_CONTRACT and current #235 source. Protected docs advertise POST /v1/validity-studies, but current #235 remains an in-process application/owner package with no HTTP transport/server module or HTTP runtime dependency. Protected API scope documentation also has no Workforce Validation operation scopes. Separately, protected TRD/API_CONTRACT still pin OpenAPI 3.2.0 while OpenAPI 3.2.1 was published 2026-09-10.

Do not expand mutable #235, restack #248 early, or expose mutable #426/#425 contracts to satisfy #427. #51 retains canonical protected-truth docs ownership for the OpenAPI baseline; #100 retains sole ownership of the durable product-technical gap baseline.