fix(people): protect governed mutation runtime types - #64
seonghobae wants to merge 341 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughPeople 변이와 채용 수락 경계가 서브클래스를 거부하도록 변경되었습니다. UUID, 문자열, Decimal, 명령, 결과, 권한 결정, 시간값, PostgreSQL 행 형태에 정확한 타입 검사를 적용했습니다. 런타임 무결성 회귀 테스트와 변경 기록을 갱신했습니다. ChangesPeople 런타임 무결성
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This change hardens People mutation and hire-acceptance inputs against executable subtype values while preserving supported built-in values and persistence behavior. No concrete current-head merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
changed the title
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact-head repair/evidence update for the current branch state:
Fresh exact-current-head hosted evidence is terminal GREEN: People API Quality Live protected base remains |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Current exact-head follow-up after fresh review: A new review correctly identified that the three direct
Fresh exact-current-head hosted evidence is terminal GREEN:
Live protected base remains |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@opencode-agent Please review the current unchanged head against protected |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@coderabbitai review Please review exact head |
|
|
|
Adjacent-owner freshness update: #65 advanced non-force to exact head |
|
Adjacent-owner successor update: #65 is now exact head |
|
@coderabbitai review Please review only exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="3de318b69d8c01d98edf788ed087574f514049bd"
echo '== Exact revision and pull request state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
gh pr view 64 --repo "$repo" --json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Exact-head scope and whitespace =='
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "${head}^" "$head"
git diff --stat "${head}^" "$head"
git diff --unified=180 "${head}^" "$head"
echo '== Focused current production implementations =='
for file in \
services/people-api/src/orgmetra_people_api/separation_http.py \
services/people-api/src/orgmetra_people_api/postgres_separation.py \
services/people-api/src/orgmetra_people_api/hire_http.py \
services/people-api/src/orgmetra_people_api/auth.py; do
echo "== $file =="
ast-grep outline "$file" --items all
git show "${head}:${file}" | nl -ba | sed -n '1,620p'
done
echo '== Focused regression sources =='
for file in \
services/people-api/tests/test_employment_separation_http_request_metadata_integrity.py \
services/people-api/tests/test_employment_separation_integrity_http.py \
services/people-api/tests/test_uuid_payload_integrity.py; do
echo "== $file =="
git show "${head}:${file}" | nl -ba
done
echo '== Scope validation and malformed receipt call-path references =='
git grep -n -C 20 -E \
'(type\(scope\)|scope\.get\(|for .* in scope|scope.*key|_read_json_object|_require_transactional_connection|autocommit|MalformedReceiptCursor|fetchmany\()' \
"$head" -- services/people-api/src/orgmetra_people_api services/people-api/tests
echo '== `#382` ordering-hook definitions and counter assertions =='
git grep -n -C 16 -E \
'(class _ExecutableUUIDPayload|def __(lt|le|gt|ge)__|\.calls|comparison)' \
"$head" -- services/people-api/tests/test_uuid_payload_integrity.py
echo '== Exact-head checks and review state =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"' || true
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"' || trueLength of output: 202884
I found no defect in the requested scope.
|
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="cb459f0e46f9f56b86974991dbe14754c8dc5729"
test_file="services/people-api/tests/test_people_defensive_boundary_integrity.py"
echo '== Exact revision and pull-request state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
gh pr view 64 --repo "$repo" --json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Exact commit scope and patch =='
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "${head}^" "$head"
git diff --stat "${head}^" "$head"
git diff --unified=220 "${head}^" "$head"
echo '== Focused test structure and complete exact-head source =='
ast-grep outline "$test_file" --items all
git show "${head}:${test_file}" | nl -ba
echo '== Production defensive boundary symbols and receipt implementations =='
git grep -n -C 20 -E \
'(def _detach_authenticated_principal|def _principal_authority|def _require_port_operation|def _require_port|def _validated_payload|class (EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult|EmploymentSeparationResult)|def _snapshot_(employment|position|assignment)_result|def separate_employment_record|def create_(employment|position|assignment)_record)' \
"$head" -- services/people-api/src/orgmetra_people_api
echo '== Existing related adversarial tests and receipt tampering uses =='
git grep -n -C 12 -E \
'(tuple\.__new__\((EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult|EmploymentSeparationResult)|object\.__setattr__\(.*(record_id|replay|recorded_at)|_snapshot_(employment|position|assignment)_result|def test_.*(defensive|tamper|corrupt|receipt|boundary))' \
"$head" -- services/people-api/tests
echo '== Coverage configuration and owned quality workflow references =='
fd -HI -t f -a 'pyproject.toml' 'setup.cfg' '.coveragerc' 'tox.ini' '.' | while IFS= read -r file; do
echo "== $file =="
rg -n -C 12 '(coverage|branch|fail_under|fail-under|100|people-api)' "$file" || true
done
fd -HI -t f -e yml -e yaml .github services | while IFS= read -r file; do
if rg -q '(coverage|People API|people-api|fail-under|fail_under)' "$file"; then
echo "== $file =="
rg -n -C 12 '(coverage|People API|people-api|fail-under|fail_under|100)' "$file"
fi
done
echo '== Test-only repair check and exact-head check state =='
git diff --name-only "${head}^" "$head" -- services/people-api/src
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"' || true
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"' || trueLength of output: 225204
I found no defect in the requested
This test exercises the independent fail-closed checks in The test uses a valid Python runtime mechanism. The repair does not replace the existing forged-storage tests. Existing tests still cover low-level The repair does not weaken or mask the owned coverage gate:
I did not execute repository tests. The exact-head check runs were queued when inspected. You are interacting with an AI system. |
|
Owner-path handoff only; no #64 source change from this lane. Fresh live authority is #64 exact |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="2afd3699992985abd305517eab84dcdb065a17bf"
echo '== Exact revision and pull-request state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
gh pr view 64 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Exact commit scope, patch, and whitespace =='
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "${head}^" "$head"
git diff --stat "${head}^" "$head"
git diff --unified=180 "${head}^" "$head"
echo '== Receipt implementation map =='
ast-grep outline services/people-api/src/orgmetra_people_api/mutations.py --items all
git show "${head}:services/people-api/src/orgmetra_people_api/mutations.py" \
| nl -ba \
| sed -n '1,760p'
echo '== All tuple-backed receipt equality, inequality, hash, and storage checks =='
git grep -n -C 20 -E \
'(class (EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult|EmploymentSeparationResult)\b|def __eq__|def __ne__|def __hash__|tuple\.__new__|_validated_payload|_snapshot_(employment|position|assignment)_result)' \
"$head" -- services/people-api/src/orgmetra_people_api services/people-api/tests
echo '== Focused equality and forged-storage test inventory =='
git ls-tree -r --name-only "$head" services/people-api/tests \
| rg -i '(mutation.*(result|receipt|equal|identity|integrity|alias|snapshot)|separation.*(result|receipt|equal|identity|integrity|alias|snapshot))' \
| sort \
| while IFS= read -r file; do
echo "== $file =="
git show "${head}:${file}" | nl -ba
done
echo '== Comparison assertions and direct construction across all tests =='
git grep -n -C 12 -E \
'((EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult|EmploymentSeparationResult)\(|(EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult|EmploymentSeparationResult).*[!=]=|[!=]=.*(EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult|EmploymentSeparationResult)|hash\()' \
"$head" -- services/people-api/tests
echo '== Exact-head workflow and review state =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"' || true
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"' || trueLength of output: 203063 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="2afd3699992985abd305517eab84dcdb065a17bf"
source="services/people-api/src/orgmetra_people_api/mutations.py"
echo '== Exact commit metadata and changed paths =='
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
git diff-tree --no-commit-id --name-status -r "$head"
echo '== Exact patch =='
git diff --unified=100 "${head}^" "$head"
echo '== Result classes, equality, inequality, and hash at exact head =='
git show "${head}:${source}" | nl -ba | sed -n '250,560p'
echo '== Parent result classes for comparison =='
git show "${head}^:${source}" | nl -ba | sed -n '250,560p'
echo '== Test definitions added or changed by this commit =='
git diff-tree --no-commit-id --name-only -r "$head" -- services/people-api/tests \
| while IFS= read -r file; do
echo "== $file =="
git show "${head}:${file}" | nl -ba
done
echo '== All exact-head tests that compare People mutation results with tuples or sibling result types =='
git grep -n -C 12 -E \
'(assert(Not)?Equal\(|assert .* [!=]= |!= .*|== .*)' \
"$head" -- services/people-api/tests/test_people_defensive_boundary_integrity.py \
services/people-api/tests/test_people_mutation_result_identity_integrity.py \
services/people-api/tests/test_people_mutation_returned_receipt_integrity.py \
services/people-api/tests/test_people_mutation_post_construction_integrity.py \
| rg -C 10 '(MutationResult|EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult|tuple\()' || true
echo '== Source references to `__ne__` and all result-class definitions =='
git grep -n -C 8 -E 'def __ne__|class (EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult)\b' \
"$head" -- services/people-api/src/orgmetra_people_api services/people-api/testsLength of output: 108707
I found no defect in the requested scope. The two receipt implementations now use matching inequality rules:
Each method returns
The hash contract remains correct. Both receipt implementations hash The repair does not change receipt storage or validation. Existing focused checks cover ordinary-tuple inequality for both mutation and separation receipts. The implementation also makes sibling-result inequality deterministic through the exact runtime type gate.
You are interacting with an AI system. |
|
@coderabbitai review Exact-head refresh: please review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="0b4409e50a1fd646c1f960164012df5984cbde0c"
mutation_source="services/people-api/src/orgmetra_people_api/mutations.py"
separation_source="services/people-api/src/orgmetra_people_api/separation.py"
test_source="services/people-api/tests/test_people_defensive_boundary_integrity.py"
echo '== Exact revision and pull-request state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
gh pr view 64 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Exact-head scope and whitespace =='
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "${head}^" "$head"
git diff --stat "${head}^" "$head"
git diff --unified=180 "${head}^" "$head"
echo '== Receipt implementation and regression maps =='
ast-grep outline "$mutation_source" --items all
ast-grep outline "$separation_source" --items all
ast-grep outline "$test_source" --items all
echo '== Exact receipt equality, inequality, hash, and validation implementations =='
git show "${head}:${mutation_source}" | nl -ba | \
rg -n -C 35 \
'(class (_MutationResultReceipt|EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult)|def __eq__|def __ne__|def __hash__|def _validated_payload|def _snapshot_(employment|position|assignment)_result)'
git show "${head}:${separation_source}" | nl -ba | \
rg -n -C 35 \
'(class EmploymentSeparationResult|def __eq__|def __ne__|def __hash__|def _validated_payload)'
echo '== Complete current defensive regression =='
git show "${head}:${test_source}" | nl -ba
echo '== All exact-head receipt comparisons and hash assertions =='
git grep -n -C 14 -E \
'(assert(Equal|NotEqual)\(|assert .*([!=]=).*|hash\(|EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult|EmploymentSeparationResult)' \
"$head" -- services/people-api/tests \
| sed -n '1,2800p'
echo '== Forged storage and snapshot validation coverage =='
git grep -n -C 18 -E \
'(tuple\.__new__\((EmploymentMutationResult|PositionMutationResult|AssignmentMutationResult|EmploymentSeparationResult)|_snapshot_(employment|position|assignment)_result|_validated_payload|forged|malformed|corrupt)' \
"$head" -- services/people-api/tests \
| sed -n '1,2400p'
echo '== Current workflow and review state for the exact commit =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"' || true
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"' || trueLength of output: 203282 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="0b4409e50a1fd646c1f960164012df5984cbde0c"
log="/tmp/coderabbit-shell-logs/shell-output-v3kb6H"
mutation_source="services/people-api/src/orgmetra_people_api/mutations.py"
separation_source="services/people-api/src/orgmetra_people_api/separation.py"
test_source="services/people-api/tests/test_people_defensive_boundary_integrity.py"
echo '== Exact revision and PR state from retained log =='
sed -n '1,80p' "$log"
echo '== Exact changed paths and patch =='
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "${head}^" "$head"
git diff --unified=120 "${head}^" "$head" -- "$test_source" "$mutation_source" "$separation_source"
echo '== Generic mutation receipt methods =='
git show "${head}:${mutation_source}" | nl -ba | sed -n '275,430p;610,685p'
echo '== Employment separation receipt methods =='
git show "${head}:${separation_source}" | nl -ba | sed -n '100,240p'
echo '== Full extended equality and inequality regressions =='
git show "${head}:${test_source}" | nl -ba | sed -n '84,195p'
echo '== Exact receipt comparison behavior by isolated standard-library model =='
python3 - <<'PY'
class Receipt(tuple):
def __new__(cls, payload):
return tuple.__new__(cls, payload)
def __eq__(self, other):
return type(self) is type(other) and tuple.__eq__(self, other)
def __ne__(self, other):
return not self.__eq__(other)
def __hash__(self):
return hash((type(self), tuple.__hash__(self)))
class SiblingReceipt(Receipt):
pass
receipt = Receipt((1, None))
same = Receipt((1, None))
sibling = SiblingReceipt((1, None))
plain = (1, None)
checks = {
"same_eq": receipt == same,
"same_ne": receipt != same,
"same_hash": hash(receipt) == hash(same),
"sibling_ne_forward": receipt != sibling,
"sibling_ne_reverse": sibling != receipt,
"tuple_ne_forward": receipt != plain,
"tuple_ne_reverse": plain != receipt,
"tuple_eq_forward": receipt == plain,
"tuple_eq_reverse": plain == receipt,
}
for name, value in checks.items():
print(f"{name}={value}")
PYLength of output: 37541
I found no defect in the requested scope. The commit changes only The production comparison contract remains correct:
The extended mutation receipt regression now proves:
The generic result classes inherit the same The extended Employment-separation regression now proves:
The existing forged-storage assertions remain present. They still verify that malformed tuple-backed receipt storage fails closed when receipt properties validate the retained payload.
You are interacting with an AI system. |
|
Canonical baseline handoff is now materialized in #100 at exact |
|
Child-owner currentization: Draft #317 advanced from #393 is performance-evidence-only: it disables k6 request redirects per request so a final response reached through a redirect chain cannot certify the canonical Employment-separation route. No People source/OpenAPI/domain truth was copied or modified. #317 still has no hosted exact-head k6 acceptance and remains Draft. |
|
Current child-owner receipt: buyer-performance Draft #317 advanced to exact This People exact head now has Foundation CI, Recovery Rehearsal and SAST terminal SUCCESS. Security Scan and CodeQL remain nonterminal, and there is still no qualifying independent APPROVED review, so mechanical mergeability is not merge authorization. |
|
Fresh exact-head gate update for Dependency-review job The 403 is already owned by central |
1 participant
Current execution receipt — 2026-09-17
0b4409e50a1fd646c1f960164012df5984cbde0c; protected base:develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; open · Draft. Mechanical mergeability is not merge authorization.Current hosted RED and causal repair
Foundation CI
34979161633on predecessor exact head49f620031ff9f12e4ce08d44d80518453d56207freached the owned People suite and failed with2 failed, 406 passed; coverage stopped at99.86%. Both failures were in the adversarial structural-receipt contract: mutation and Employment-separation receipts were expected to remain distinct from ordinary tuples under!=.This is a production protocol defect, not a stale test oracle.
_MutationResultReceiptandEmploymentSeparationResultdefine exact-type__eq__but inheritedtuple.__ne__, so inequality compared raw tuple storage and contradicted the documented exact-type identity contract. Ordinary-forwardcff6064c3a83ab15c47304d04959d42a34362d16adds exact-type__ne__to mutation receipts;2afd3699992985abd305517eab84dcdb065a17bfapplies the same repair to Employment separation. The 100% gate, storage model and hash semantics were not weakened.Current
0b4409e50a1fd646c1f960164012df5984cbde0cadds regression coverage for the whole comparison contract: same-type equality/hash consistency, sibling-result inequality, and ordinary-tuple inequality in both operand directions. This turns the hosted RED into a direct protocol regression instead of relying on oneassertNotEqualdirection.Exact-head Foundation
35005652520, Recovery35005652499and SAST35005652434are terminal SUCCESS. Security35005652631is terminal FAILURE in the centrally owned Dependency Review availability path already tracked byContextualWisdomLab/.github#810; OSV/Trivy/Scorecard success does not replace that failed-closed authority. CodeQL35005652507is now terminal FAILURE after both current-head compatibility paths successfully requested central dispatch; the canonical verdict lookup returnedstate=pending,conclusion=null,terminal=falsefor this exact owner/repo/PR/SHA and the job failed closed, matching the shared settlement path tracked byContextualWisdomLab/.github#312. No no-op rerun or leaf shim is authorized; an independent qualifying approval is still absent.Employment / Position / Assignment truth
This branch remains the active canonical People writer for governed generic People mutations and Employment separation. Position creation requires current-recorded Organization Unit / Job Profile roots and current-recorded business-effective versions under the short parent-lock boundary. Assignment creation requires named Employment and Position roots to remain current-recorded under existing minimal conflict boundaries. Employment separation remains bitemporal, append-only in separation evidence, tenant-scoped and atomic with idempotency/audit/outbox. Keyverse remains policy owner; HR domain truth and PostgreSQL transaction ownership do not move.
Current owner paths / buyer gaps
docs/product-technical-gap-baseline.md; durable invariants are handed off rather than competing with its baseline write.151a2269ef6fb21cf5984e6ced9f98bb286cf42a, stacked non-force on this exact fix(people): protect governed mutation runtime types #64 head. Fresh compare has merge base exactly0b4409e..., 0 behind, 300 commits ahead, and 48 child-owned files, all undertests/performance/....runtime.observed_service_sha == candidate_shais only structural consistency. Commercial acceptance must independently authenticate that the deployment/origin actually timed was built from the exact candidate SHA;.github#2162evidence-byte attestation does not by itself prove that deployment identity.No self-approval, routine administrator bypass, force-push, destructive rebase, gate weakening, predecessor-evidence transfer, synthetic status, mutable-owner source copy, or premature merge/release is authorized by this PR.