Canonical owner: PR #55 governed People-read model boundary.
Audit after #335 found WorkerPeopleRecord accepted any exact non-blank persistence display_name, while protected confirmed-hire ingress already defines the canonical Person-name scalar contract: valid Unicode scalar content, 1–512 usable characters, and no C0 control characters. person_name_record.display_name is PostgreSQL text, so existing/imported rows cannot be assumed to have traversed the current write boundary.
Repair lineage: test-first 31e01f5603ba814d86f803f03bc1c363ee41df1c; causal repair 566039df8661b2568ae675d95b2e641e65e3feab adds the 512-character bound, UTF-8 scalar validation, and C0 rejection before authorized response projection while preserving #335 UUID detachment. #337 subsequently advances the same owner without weakening #336.
Current #55 exact head is 947ecf15b5a0e1d88758a2fdc118ce0157034e0b, direct to protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, Draft and mechanically mergeable. Ordinary-forward descendants are #149 73464ddfe9b3563a717919ff8dabf7b36b5d9c44, #155 e164a2d046972ea0d6bfb138734c19bfae3084ff, #156 5f508c28b253db2b89bd854435da38c437182a49. Current exact-head runs are Foundation 34858404911, Security 34858404825, SAST 34858404605, CodeQL 34858404718, all queued at the latest sweep. No predecessor evidence transfer and no hosted GREEN is claimed.
Keep open until exact-head acceptance and normal protected integration. Do not copy mutable owner source, rewrite protected database history, self/model approve, routine-bypass, no-op retrigger, synthesize status, force-push, destructively rebase, or weaken gates.
Canonical owner: PR #55 governed People-read model boundary.
Audit after #335 found
WorkerPeopleRecordaccepted any exact non-blank persistencedisplay_name, while protected confirmed-hire ingress already defines the canonical Person-name scalar contract: valid Unicode scalar content, 1–512 usable characters, and no C0 control characters.person_name_record.display_nameis PostgreSQLtext, so existing/imported rows cannot be assumed to have traversed the current write boundary.Repair lineage: test-first
31e01f5603ba814d86f803f03bc1c363ee41df1c; causal repair566039df8661b2568ae675d95b2e641e65e3feabadds the 512-character bound, UTF-8 scalar validation, and C0 rejection before authorized response projection while preserving #335 UUID detachment. #337 subsequently advances the same owner without weakening #336.Current #55 exact head is
947ecf15b5a0e1d88758a2fdc118ce0157034e0b, direct to protecteddevelop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, Draft and mechanically mergeable. Ordinary-forward descendants are #14973464ddfe9b3563a717919ff8dabf7b36b5d9c44, #155e164a2d046972ea0d6bfb138734c19bfae3084ff, #1565f508c28b253db2b89bd854435da38c437182a49. Current exact-head runs are Foundation34858404911, Security34858404825, SAST34858404605, CodeQL34858404718, all queued at the latest sweep. No predecessor evidence transfer and no hosted GREEN is claimed.Keep open until exact-head acceptance and normal protected integration. Do not copy mutable owner source, rewrite protected database history, self/model approve, routine-bypass, no-op retrigger, synthesize status, force-push, destructively rebase, or weaken gates.