feat(ui): add governed validation dashboard states

[seonghobae]

Current owner authority — 2026-09-21

This PR is the pre-existing single-writer lane for the Validation dashboard presentation-state shell. Exact head remains 45accc8f2405013e4520e76fa70d01cbebf3c5cc, open · Draft · mechanically mergeable on recorded parent snapshot feat/hr-workspace-protected-read-state@68896baa692ecf6fec8f21cfe5d981440be6071c.

The earlier assumption elsewhere that no executable Validation UI owner existed was incorrect. Preserve this delta; do not recreate it under another branch. Its scope remains presentation/interaction only and does not own validity-study registration, persistence, scientific computation, buyer HTTP semantics, or employment-decision authority.

The live parent stack has advanced materially. Current #130 is c92749cf5889a39de1ba8036742f96fd3451f459 and remains open · Draft. Root #53 is exact 016f27e13f7a47cb78a1c936aa533cc8daa2c66c; fresh comparison against protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f is 113 ahead / 3 behind, merge base 9e3e4847510e1e612b48474ba42b177b8ed824df, with GitHub reporting #53 mergeable=false. This child must therefore not be restacked now merely to manufacture current-parent evidence. Process #53 → #130 first; after normal protected integration, non-force adopt protected truth into this existing branch and preserve the valid Validation UI delta.

Buyer-visible validation shell retained

The protected product baseline names the Validate surface. Figma Orgmetra Baseline Storybook Inventory node 1:64 publishes ValidationMetric and the shared interaction vocabulary. This slice implements bounded states idle / loading / ready / empty / denied / stale / scopeBlocked / error, fail-closed exact-state parsing, read-only/non-authorizing copy, purpose/scope denial, staleness/error handling, visible focus, and the rule that every chart requires an exact-value table.

Contract-only head 2f6aec8940f557a3df93cb584648facfc068ab88 produced genuine hosted RED in run 33153931622, job 98792136260: exact checkout and Node setup succeeded, then the focused test failed with ERR_MODULE_NOT_FOUND because apps/hr-workspace/validation-dashboard-state.js did not yet exist. The current source is the ordinary-forward implementation of that presentation contract.

Exact current head 45accc8... has focused hosted GREEN in HR Workspace Validation Dashboard State Quality run 33285376235; fresh workflow enumeration still returns that completed-success run only. Fresh review enumeration is empty and there are zero review threads. This is stack-local focused evidence only, not protected-main/product-release evidence.

Foundation reconciliation finding

The branch still carries .github/workflows/hr-workspace-validation-dashboard.yml, and tests/hr-workspace-validation-dashboard.test.mjs plus the traceability document explicitly require that dedicated workflow. That was valid for this historical stack, but it is not acceptable as the final adoption shape.

Protected develop has since consolidated repository-owned quality under the canonical Foundation lane and retired the feature-local quality-workflow family. The current protected Foundation runs on exact ubuntu-24.04 and owns repository validation; this branch's dedicated workflow still uses ubuntu-latest and actions/setup-node@49933ea... and therefore also carries the known action-runtime debt owned by #339/#340.

Do not simply delete the leaf workflow now: the focused UI contract is currently executed through it, so deletion without replacement would weaken acceptance. When #53/#130 become protected truth, adoption must perform this causal sequence on one ordinary-forward branch:

1. preserve the current Validation presentation source/tests/Storybook/traceability delta;
2. admit tests/hr-workspace-validation-dashboard.test.mjs (or an equivalent owner-neutral browser/UI contract) into the then-current canonical Foundation/product-browser acceptance path with exact candidate proof and existing 100% line/branch/function expectations where applicable;
3. update traceability/test strategy to name the canonical owner rather than the historical leaf workflow;
4. retire .github/workflows/hr-workspace-validation-dashboard.yml instead of resurrecting feature-local quality ownership;
5. reconcile/reseal any protected manifest/provenance artifacts from final bytes;
6. reacquire exact-head Foundation/browser/accessibility/Security/SAST/CodeQL/model-review evidence and then-live review governance.

No sample/test reduction, workflow skip, predecessor-verdict transfer or leaf shim is an acceptable substitute.

Relationship to Workforce Validation commercialization

Backend/scientific ownership remains separate: #235 application boundary → #248 durable persistence → #426 governed registration/lifecycle → #425 scientific design lineage → #427 buyer HTTP/OpenAPI. This PR must not import mutable source from any of those lanes or talk directly to PostgreSQL/service internals.

Issue #428 is therefore not a replacement UI owner. It is the downstream commercial-convergence gap: after this #53→#130→#145 UI lineage is protected and #427 exposes a protected/released Workforce Validation API, #428 extends/integrates the protected shell into the complete API-backed buyer workspace (study index/detail, provenance/evidence/result/history, scientific anti-false-GREEN states, Keyverse auth journey, KO/EN/JA/ZH/VI/ES/DE/FR localization, responsive/a11y/browser-runtime evidence). Reuse this shell through normal protected adoption rather than source-copying or starting a shadow dashboard.

Keep Draft. Do not self-approve, use routine administrator bypass, weaken a gate, force-push/destructively rebase, transfer parent/predecessor checks, resurrect obsolete feature-local quality ownership, or create a statistical/selection-decision shadow authority.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}