feat(workforce-validation): establish governed validity-study registry boundary

.github/requirements/foundation-test.txt

@@ -1,4 +1,4 @@
-# Reviewed Foundation CI test toolchain for CPython 3.14 on GitHub-hosted Ubuntu x86_64.
+# Reviewed Foundation CI test/build toolchain for CPython 3.14 on GitHub-hosted Ubuntu x86_64.
 # Version and artifact hash changes must be reverified against the official PyPI release JSON.
 coverage==7.14.2 --hash=sha256:cda36d8e7bfd63b3e44e75163265429caa5d935b672b00f71bccc8c010518c64
 iniconfig==2.3.0 --hash=sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12
@@ -7,3 +7,4 @@ pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d83
 Pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
 pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
 pytest-cov==7.1.0 --hash=sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678
+setuptools==82.0.1 --hash=sha256:a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb

.github/workflows/foundation-ci.yml

@@ -68,6 +68,7 @@ jobs:
           PYTHONPATH=packages/selection-review/src COVERAGE_FILE=/tmp/orgmetra-selection-review.coverage python -m pytest -c packages/selection-review/pyproject.toml packages/selection-review/tests
           PYTHONPATH=services/job-analysis-api/src:packages/hris-kernel/src:packages/keyverse-adapter/src COVERAGE_FILE=/tmp/orgmetra-job-analysis-api.coverage python -m pytest -c services/job-analysis-api/pyproject.toml services/job-analysis-api/tests
           PYTHONPATH=services/people-api/src:packages/hris-kernel/src:packages/keyverse-adapter/src COVERAGE_FILE=/tmp/orgmetra-people-api.coverage python -m pytest -c services/people-api/pyproject.toml services/people-api/tests
+          PYTHONPATH=services/workforce-validation-api/src:packages/keyverse-adapter/src COVERAGE_FILE=/tmp/orgmetra-workforce-validation-api.coverage python -m pytest -c services/workforce-validation-api/pyproject.toml services/workforce-validation-api/tests
       - name: Run PostgreSQL contracts in isolated containers
         env:
           PGPASSWORD: orgmetra
@@ -83,6 +84,7 @@ jobs:
             test_audit_outbox_hardening_postgres.sh
             test_candidate_worker_conversion_postgres.sh
             test_validity_study_case_postgres.sh
+            test_workforce_validation_owner_schema_postgres.sh
             test_criterion_observation_scope_postgres.sh
             test_people_mutation_idempotency_postgres.sh
             test_job_analysis_snapshot_postgres.sh

CHANGELOG.md

@@ -7,7 +7,7 @@ All notable changes to Orgmetra will be documented in this file.
 ### Added
 
 - Accepted ADRs 0001–0003 now include buyer-facing Context, Decision, and Consequences grounded in verified ISO 30400:2022, ISO 30414:2025, Uniform Guidelines (29 C.F.R. Part 1607), SIOP (2018), OpenAPI Specification v3.2.0, OpenID Connect Core 1.0 errata set 2, CloudEvents v1.0.2, Jensen and Snodgrass (1999), Snodgrass (1999), and Allen (1983) records already listed in `docs/doctoring/REFERENCES.md`. ADRs 0004 and 0005 gained APA 7th References pointers to that same bibliography without changing their Decision bodies.
-- Active-PR governed Job Analysis persistence/API on the canonical `JobAnalysisSnapshot` model: migration `0013_job_analysis_snapshot.sql` stores immutable tenant-scoped snapshot, Task, KSAO, Task–KSAO, FJA and write-command evidence; `POST /v1/tenants/{tenant_record_id}/job-analysis-snapshots` and matching GET enforce purpose-bound Keyverse scope, authenticated-principal actor authority, bounded/strict JSON handling, transactional Idempotency-Key serialization, parent-scope fail-closed integrity, forced RLS, and atomic audit/outbox evidence. ADR 0014 records the persistence decision while ADR 0007 remains the domain/evidence authority; validated evidence still requires accountable human review and non-LLM provenance, and the service does not make a high-impact employment decision.
+- Active-PR governed Job Analysis persistence/API on the canonical `JobAnalysisSnapshot` model: migration `0013_job_analysis_snapshot.sql` stores immutable tenant-scoped snapshot, Task, KSAO, FJA and write-command evidence; `POST /v1/tenants/{tenant_record_id}/job-analysis-snapshots` and matching GET enforce purpose-bound Keyverse scope, authenticated-principal actor authority, bounded/strict JSON handling, transactional Idempotency-Key serialization, parent-scope fail-closed integrity, forced RLS, and atomic audit/outbox evidence. ADR 0014 records the persistence decision while ADR 0007 remains the domain/evidence authority; validated evidence still requires accountable human review and non-LLM provenance, and the service does not make a high-impact employment decision.
 - Active-PR `orgmetra_selection_review` packet for PII-minimized, evidence-bound human selection review: canonical operational tenant identity, UUID-backed opaque candidate/Job/sealed-evidence/reviewer references, explicit purpose/reason/evidence version, deterministic canonical JSON and SHA-256 correlation, mandatory human decision state, redacted packet repr, and provenance-paired model evidence that remains `untrusted_draft`, with exact 100% owned statement and branch coverage required by its quality gate.
 - Active performance-criterion scope hardening: `criterion_observation_scope_guard` rejects criterion outcomes for a Job the worker did not effectively hold at the observation date, observations before the relevant assignment, and observations outside the referenced performance cycle while preserving valid multiple-assignment cases and existing bitemporal correction semantics. The guard evaluates current-recorded facts, derives the date coordinate from `observed_at` in UTC so session `TimeZone` cannot alter the result, uses a trusted function search path, and adds no PII or automated employment decision authority. The Foundation PostgreSQL contract also rejects a closed `recorded_to` on each time-coordinate lookup and proves UTC midnight plus non-UTC session `TimeZone` boundaries.
 - Bitemporal tenant-scoped organization hierarchy validation that rejects visible indirect parent cycles and reuses single-valued recorded-time reconstruction before graph traversal.
@@ -18,7 +18,7 @@ All notable changes to Orgmetra will be documented in this file.
 - `employment_record_version.employment_concurrency_code` constrained to `exclusive` or `concurrent`.
 - ADR 0005 for exclusive employment and staffable seats.
 - `orgmetra_hris_kernel` 0.3.0 with identity-scoped bitemporal resolution, assignment-employment coverage, allocation-portfolio checks, and a Memorial Hospital RN correction case at 100% statement and branch coverage.
-- `employment_record_version` and `position_record_version` so employment and position identity stay stable across retroactive corrections.
+- `employment_record_version` and `position_record_version` so corrections no longer mint a new employment or position identifier.
 - `assignment_record.employment_record_id` bound to the same person as the covering employment.
 - `orgmetra_keyverse_adapter` that binds an opaque Keyverse subject to a person and rejects passwords, passkeys, and tokens.
 - Design tokens for the repeating HR actions: approve, review, correct, request evidence, compare, export, and escalate.
@@ -37,6 +37,9 @@ All notable changes to Orgmetra will be documented in this file.
 
 ### Changed
 
+- Active-PR Workforce Validation wheel acceptance now builds both owned distributions from temporary source copies, proving RECORD integrity without mutating the checkout. Offline wheel subprocesses also treat Python warnings as errors, and the service publishes its Apache-2.0 license through the current SPDX string form instead of deprecated setuptools table metadata.
+- Active-PR Workforce Validation coverage recovery now exercises exact owner-capability admission, immutable release-view identities, version and chronology rejection, digest independence, approximation semantics, final-weight component corroboration, and base/nonresponse/trimming supersession edge contracts. An earlier exact head passed 1,306 tests with 4,487/4,487 owned statements and 1,070/1,070 owned branches covered; subsequent authorized-view sealing repairs add new production and hostile-regression branches, so that verdict does not transfer and final exact-head functional, statement, branch, docstring, and edge evidence must be reacquired before integration.
+- Active-PR Workforce Validation acceptance fixtures now track released owner contracts, supersession cutovers, owner-read field sets, and standard-library timezone-provider failures exactly; wheel acceptance validates every owned wheel's internal identity and metadata before producing any outer artifact hash.
 - Consolidated repository-owned PR validation from twelve workflows into one Foundation CI job, while keeping the dual-cluster recovery rehearsal separately path-scoped. Central required review and security workflows remain organization-owned.
 - New predictive-validity membership must use one normalized worker-level case; the three independent validity-study decision/evidence/outcome link relations are historical read surfaces only and can no longer accept new rows. A case insert also rejects a criterion observation whose recorded interval is already closed at `linked_at`.
 - Canonicalized service identifiers as two-or-more-word `snake_case` across architecture, deployment, ACL, metrics, and client contracts.
@@ -57,6 +60,9 @@ All notable changes to Orgmetra will be documented in this file.
 
 ### Security
 
+- Active-PR Workforce Validation final-weight adjustment admission now fails closed for any material adjustment code without a released governed owner-evidence family. Evidence digests are integrity coordinates, not owner-record locators; adding a future adjustment family requires a versioned receipt namespace, exact reference/version/digest identity, purpose-bound deterministic owner resolution, canonical reconstruction, and binding/corroboration of transform semantics plus release/currentness before it can enter a released final-weight lineage. The component-binding owner now also requires every governed adjustment receipt binding to be contiguous and one-based, so an intrinsically incomplete sequence such as `(1, 3)` cannot be persisted and deferred to the later corroboration service. The corroborator requires a binding for every admitted adjustment and removes the obsolete path that treated an ungoverned generic transform as owner-local.
+- Active-PR Workforce Validation all 24 exported resolver-issued evidence views now keep their issuance seals in closure-private runtime state. Package-wide hostile marker-copy regressions reject importable module sealing capabilities and caller-populated raw exact-runtime objects; purpose authorization, canonical owner reconstruction, scientific-coordinate matching, effective-time currentness, field minimization, detached identities, and marker-last issuance remain unchanged. Runtime view type or seal is not durable authorization.
+- Active-PR Workforce Validation authorized evidence views reject low-level base-constructor forging across the complete 24-class public export census. Every exported `*View` is a sealed non-tuple data object whose public constructor rejects, whose raw allocations cannot expose state, and whose only supported issuer remains its purpose-authorized owner-resolution path. The executable package-surface census now fails closed on an added, removed, tuple-backed, unsealed, or mutable public view; `CalibrationBenchmarkAuthorityView` was the final omission exposed by that census and is covered by its own issuance-integrity regression.
 - Predictive-validity cases fail closed when selection evidence, Job scope, study criterion, converted worker, or system-recorded visibility does not match; the normalized case relation is tenant-qualified, append-only, TRUNCATE-protected, and forced through row-level security.
 - Purpose-bound PII authorization now fails closed across active tenant, authenticated actor tenant, resource tenant, resource kind, purpose, operation, operation-specific Keyverse scope, and requested-field subset; malformed/wildcard-like attributes, mutable field/scope collections, reserved UUID sentinels, and cross-tenant confused-deputy contexts are rejected before protected values are returned. Authorization requests and allow/deny evidence now also require and preserve one namespaced opaque target-resource reference, so immutable audit correlation identifies the exact HR record without copying its protected values. Authorization evidence otherwise contains governance metadata and field names only, with stable denial reasons and actionable next steps rather than PII.
 - LLM output constrained to draft evidence.
@@ -74,4 +80,4 @@ All notable changes to Orgmetra will be documented in this file.
 
 ### Notes
 
-- Protected `develop` at `e7ddb7a78a5e1460410005d10f43ebf18c5e12e4` includes normalized validity-study and criterion integrity, bitemporal workforce composition, governed candidate-to-worker conversion, purpose-bound PII authorization, GET-only People reads, governed People mutation/idempotency API, and the accepted ADR 0001–0003 source expansion integrated by #37. Job Analysis persistence/API and the selection-review packet remain active-PR truth until their unchanged exact heads satisfy fresh gates and merge.
+- Protected `develop` at `eb9757f8649aaad026a9865508d9aad50c1a7a4f` includes normalized validity-study and criterion integrity, bitemporal workforce composition, governed candidate-to-worker conversion, purpose-bound PII authorization, GET-only People reads, governed People mutation/idempotency API, and the accepted ADR 0001–0003 source expansion integrated by #37. Job Analysis persistence/API and the selection-review packet remain active-PR truth until their unchanged exact heads satisfy fresh gates and merge.

manifest.json

@@ -5,9 +5,9 @@
   "files": [
     {
       "path": ".github/workflows/foundation-ci.yml",
-      "sha256": "b6a4365936b66803a8112f034c77d53d33301a7a798ed4f68746a4f2d8b081d7",
-      "bytes": 6651,
-      "lines": 125
+      "sha256": "31c6a46cb81513cdaa2a08eed5cb00a57d8b36f15e3c772d230452cdc3329aed",
+      "bytes": 6974,
+      "lines": 127
     },
     {
       "path": ".gitignore",
@@ -29,9 +29,9 @@
     },
     {
       "path": "CHANGELOG.md",
-      "sha256": "f2d2e0b488c0440533effa821808f2f17e37d92f8fb586174c2fdb594f760ca5",
-      "bytes": 17539,
-      "lines": 77
+      "sha256": "42ef89549edf4aa0d7dd03eece2a386895a2561df06f277761c45f575c4c21e5",
+      "bytes": 21006,
+      "lines": 83
     },
     {
       "path": "CLAUDE.md",
@@ -359,9 +359,9 @@
     },
     {
       "path": "scripts/foundation-contract-core.mjs",
-      "sha256": "9b03efbbdffa60a05f5924e8a61b1cbc3cd75c502df428a5920085e8d0bf3603",
-      "bytes": 28121,
-      "lines": 688
+      "sha256": "5dfc54d40820dfc45962dcc91367c57baf6b011e68efc5f6e8d59e7e82145b2a",
+      "bytes": 28182,
+      "lines": 689
     },
     {
       "path": "scripts/foundation-contract.mjs",
@@ -465,11 +465,17 @@
       "bytes": 14708,
       "lines": 301
     },
+    {
+      "path": "tests/test_workforce_validation_owner_schema_postgres.sh",
+      "sha256": "29f0cd8a7d9040ff86095b68fa2f3d0ed54ea3777e5a816d4a79eb6ceafb9339",
+      "bytes": 2949,
+      "lines": 76
+    },
     {
       "path": "tests/validate_repository.py",
-      "sha256": "091836b2f68600a30b08f7da2cea8b3bef10201a123da720a7369bf10985eec2",
-      "bytes": 27237,
-      "lines": 637
+      "sha256": "244627252e7392e4dbed98392c132cb86dc8e5ead839a1129298e8d022fcf8eb",
+      "bytes": 27300,
+      "lines": 638
     }
   ]
 }

scripts/foundation-contract-core.mjs

@@ -85,6 +85,7 @@ export const REQUIRED_FILES = Object.freeze([
   'tests/test_audit_outbox_hardening_postgres.sh',
   'tests/test_candidate_worker_conversion_postgres.sh',
   'tests/test_validity_study_case_postgres.sh',
+  'tests/test_workforce_validation_owner_schema_postgres.sh',
   'tests/test_criterion_observation_scope_postgres.sh',
   'tests/test_people_mutation_idempotency_postgres.sh',
   'tests/test_job_analysis_snapshot_postgres.sh',
@@ -685,4 +686,4 @@ export function runCli(rootPath, outputStream = process.stdout, errorStream = pr
   }
   errorStream.write(`${JSON.stringify({ status: 'failed', error_count: errors.length, errors }, null, 2)}\n`);
   return 1;
-}
+}