fix(people): protect governed mutation runtime types - #64

Draft

seonghobae wants to merge 341 commits into

fix/hire-identity-type-integrity

This pull request is big! We're only showing the most recent 250 commits

Commits on Sep 7, 2026

fix(people): enforce UUID integer range
seonghobae
committed
87a3224
fix(people): enforce hire UUID integer range
seonghobae
committed
1406657
fix(people): enforce mutation UUID integer range
seonghobae
committed
598b64a
test(people): cover all People UUID boundaries
seonghobae
committed
f4dac8a
fix(people): harden hire UUID payload validation
seonghobae
committed
3f24bfc
fix(people): harden read UUID payload validation
seonghobae
committed
dab8487
chore(people): preserve dedicated read-owner boundary
seonghobae
committed
0bc1c53
test(people): keep UUID regression in mutation owner
seonghobae
committed
e1f9da8
chore(people): restore read-owner bytes exactly
seonghobae
committed
b5ca7e4
test(people): prove PostgreSQL capability replacement RED
seonghobae
committed
9227ff2
fix(people): bind validated hire connection capability
seonghobae
committed
b6bc808
fix(people): bind validated mutation connection capability
seonghobae
committed
51f132b
test(people): forbid descriptor capability indirection
seonghobae
committed
2a2dd54
fix(people): remove descriptor capability path
seonghobae
committed
368951e
fix(people): remove descriptor capability path
seonghobae
committed
f566fd2
test(people): expose direct hire command drift during DB acquisition
seonghobae
committed
338305f
fix(people): snapshot hire command before database acquisition
seonghobae
committed
e01e825
test(people): expose retained hire UUID alias during authorization
seonghobae
committed
86a346b
fix(people): detach nested hire UUID aliases at command validation
seonghobae
committed
b01ffad
test(people): expose generic nested UUID alias across authorization
seonghobae
committed
728c63d
test(people): expose generic nested UUID alias at PostgreSQL boundary
seonghobae
committed
5a7be53
fix(people): detach generic nested UUID aliases at validation
seonghobae
committed
6c8be6d
test(people): expose retained result alias drift
seonghobae
committed
0cd270f
fix(people): detach generic mutation results from port aliases
seonghobae
committed
6f3a54b
fix(people): detach confirmed-hire results from port aliases
seonghobae
committed
41829e0
test(people): bind replay verification to pre-port semantics
seonghobae
committed
a9848fb
fix(people): bind replay checks to pre-port command semantics
seonghobae
committed
ee7b03d
test(people): bind replay receipt to pre-port authorization evidence
seonghobae
committed
d9cb26e
fix(people): freeze replay evidence before executable persistence
seonghobae
committed
41a35a5
test(people): expose assignment conflict serialization gap
seonghobae
committed
1cdaa06
fix(people): serialize assignment employment portfolio writes
seonghobae
committed
f6a7836
fix(people): restore unrelated position-parent diagnostic
seonghobae
committed
06744f4
fix(people): remove redundant assignment root lock
seonghobae
committed
19c6c7e
test(people): execute real Assignment lock interleavings
seonghobae
committed
fb28b01
test(people): repair Assignment concurrency harness review findings
seonghobae
committed
015ba7c
docs(test): classify synthetic Assignment concurrency evidence honestly
seonghobae
committed
1ea5cb1
test(people): clean up assignment concurrency writers on failure
seonghobae
committed
6cf31e8
test(people): prove concurrency failure cleanup before teardown
seonghobae
committed
558afdf
test(people): prove client cleanup on concurrency failure
seonghobae
committed
07c2ff1
test(people): require bounded Assignment writer cleanup joins
seonghobae
committed
fb8eeb9
fix(people): bound Assignment concurrency writer joins
seonghobae
committed
614ee5f
test(people): require backend termination after cleanup deadline
seonghobae
committed
c1fb77b
fix(people): terminate expired concurrency writer backend
seonghobae
committed
0d78299
test(people): observe backend termination before releasing client
seonghobae
committed
b712639
test(people): bind backend termination receipt to owned session
seonghobae
committed
52257a6
test(people): expire only held concurrency writer join
seonghobae
committed
8189509

Commits on Sep 12, 2026

feat(people): add governed employment separation transition
seonghobae
committed
b8ce423
fix(people): bind separation audit time to database clock
seonghobae
committed
2a3b381
test(people): prove governed employment separation history
seonghobae
committed
3cc9322
test(people): keep Foundation contract ownership unchanged
seonghobae
committed
3578026
fix(people): separate the exact current Employment interval
seonghobae
committed
ba4dc19
test(people): add Employment separation PostgreSQL contract
seonghobae
committed
1e17a59
test(people): complete Employment separation acceptance
seonghobae
committed
efa89a6
docs(people): record Employment separation truth decision
seonghobae
committed
57f778a
docs(people): trace Employment separation acceptance
seonghobae
committed
c887b49
fix(people): revoke public separation capability
seonghobae
committed
36e901e
test(people): prove separation SQL capability is fail closed
seonghobae
committed
d297eab
test(people): isolate separation capability probe lifecycle
seonghobae
committed
fdb3379
test(people): require least-privilege separation executor
seonghobae
committed
b249c43
fix(people): isolate separation mutation capability
seonghobae
committed
351e489
test(people): exercise separation executor boundary
seonghobae
committed
a0569d5
docs(people): record separation capability boundary
seonghobae
committed
e408bc8
docs(people): trace separation executor capability
seonghobae
committed
30960c5
test(people): require authorized separation application boundary
seonghobae
committed
b1d2b19
fix(people): add authorized separation application boundary
seonghobae
committed
aadb570
test(people): harden separation application evidence
seonghobae
committed
efa9862
test(people): require PostgreSQL separation adapter
seonghobae
committed
a3d3700
fix(people): add PostgreSQL separation adapter
seonghobae
committed
443a487
fix(people): export separation application port
seonghobae
committed
f08b712
fix(people): make separation error translation total
seonghobae
committed
0254da5
test(people): cover separation adapter trust boundary
seonghobae
committed
cb7b61b
fix(people): make separation validation branches explicit
seonghobae
committed
6a734db
test(people): cover separation validation boundary
seonghobae
committed
6c49abd
docs(people): trace separation application boundary
seonghobae
committed
320fb01
test(people): require governed separation HTTP boundary
seonghobae
committed
d5cc990
feat(people): expose governed separation HTTP boundary
seonghobae
committed
54761aa
feat(people): export separation HTTP boundary
seonghobae
committed
40aa7dd
test(people): fail server-generated separation ids as operational errors
seonghobae
committed
cb14494
fix(people): classify separation server identity failures correctly
seonghobae
committed
4a142ef
fix(people): repair separation adapter authorization fixtures
seonghobae
committed
b11440d
docs(people): document governed separation buyer route
seonghobae
committed
8172c64
docs(people): trace separation HTTP boundary
seonghobae
committed
1d7b157
feat(people): publish Employment separation OpenAPI contract
seonghobae
committed
af5d6d6
test(people): require exact separation OpenAPI contract
seonghobae
committed
faaf190
fix(people): publish separation state conflict semantics
seonghobae
committed
1e1b9aa
fix(people): reseal separation OpenAPI manifest
seonghobae
committed
872230e
fix(people): use exact OpenAPI manifest provenance
seonghobae
committed
36502fb
fix(ci): remove deprecated setup-node runtime
seonghobae
committed
2206e47
fix(ci): reseal Foundation workflow after Node runtime update
seonghobae
committed
2818fa2
fix(validation): allow PostgreSQL public schema qualification
seonghobae
committed
881fdba
fix(validation): reseal naming contract provenance
seonghobae
committed
e999f31
fix(validation): accept qualified FORCE RLS owner tables
seonghobae
committed
a726479
fix(validation): reseal qualified RLS validator
seonghobae
committed
efd94d7
fix(foundation): seal separation validation contracts
seonghobae
committed
607ef0e
fix(foundation): reseal exact workflow provenance
seonghobae
committed
b86c831
test(people): construct governed denial evidence
seonghobae
committed
0e6e332
test(people): require separation result validation before commit
seonghobae
committed
4ba75c0
fix(people): validate separation receipt before commit
seonghobae
committed
1e69528
docs(people): trace separation commit-boundary validation
seonghobae
committed
cd92071
test(people): cover separation HTTP failure boundaries
seonghobae
committed
c8d1c39
test(people): classify malformed separation receipts as internal errors
seonghobae
committed
01ca8e8
fix(people): distinguish separation persistence integrity faults
seonghobae
committed
362329d
fix(people): type separation persistence integrity failures
seonghobae
committed
1ae78e1
fix(people): keep persistence integrity faults server-side
seonghobae
committed
05b400d
test(people): preserve separation error taxonomy contracts
seonghobae
committed
f6db78d
docs(people): trace separation integrity error taxonomy
seonghobae
committed
6f89e6c
test(people): remove unused separation integrity imports
seonghobae
committed
ba766db
test(people): prove distinct-key separation serialization
seonghobae
committed
a67ed4b
docs(people): trace distinct-key separation acceptance
seonghobae
committed
fbcaee1
test(people): observe distinct-key pre-commit boundary in PostgreSQL
seonghobae
committed
b3a30d8
test(people): prove separation failure cleanup
seonghobae
committed
92e4c36
test(people): qualify separation cleanup by durable rollback
seonghobae
committed
ea9d534
docs(people): trace separation failure cleanup
seonghobae
committed
52db8ff
test(people): cover separation uncertain commit recovery
seonghobae
committed
07cf114
docs(people): trace uncertain commit recovery
seonghobae
committed
c099e36
test(people): expose assignment separation lock race
seonghobae
committed
7fdde5c
fix(people): serialize assignment against employment separation
seonghobae
committed
acd99ac
test(people): bind assignment separation guard to database owner
seonghobae
committed
0bd405a
test(people): prove assignment separation serialization
seonghobae
committed
f3d6bf8
fix(people): least-privilege assignment separation guard
seonghobae
committed
012005d
test(people): assert least-privilege assignment guard
seonghobae
committed
ef5facd
docs(people): define assignment separation conflict boundary
seonghobae
committed
dba7ff5
docs(people): trace assignment separation serialization
seonghobae
committed
0d0b18e
fix(foundation): provenance-index assignment separation artifacts
seonghobae
committed
d565ed9
fix(foundation): regenerate exact provenance manifest
seonghobae
committed
c110547
fix(foundation): reconcile Node provenance inventory
seonghobae
committed
9a64933
fix(foundation): reseal reconciled Node inventory
seonghobae
committed
77c8e02
test(people): require exact conversion Employment binding
seonghobae
committed
aa277fb
fix(people): bind conversion to exact Employment
seonghobae
committed
c6f72b0
revert(people): drop circular pre-insert conversion binding
seonghobae
committed
6ea491b
test(people): reject conversion as generic Employment authority
seonghobae
committed
20e2996
fix(people): serialize generic Employment on Person anchor
seonghobae
committed
7f9fbd0
test(people): bind recorded-time regression to Person anchor
seonghobae
committed
5eb7d15
test(people): cover Person anchor temporal integrity
seonghobae
committed
ec3fb59
test(people): reject recruiting provenance as generic Assignment authority
seonghobae
committed
079eb79
docs(people): separate recruiting provenance from generic writes
seonghobae
committed
3fa5849
fix(people): serialize generic Assignment on Employment root
seonghobae
committed
c7a0d15
test(people): bind Assignment concurrency to Employment root
seonghobae
committed
3918d2a
test(people): order Assignment Employment and Position locks
seonghobae
committed
63f0d94
test(people): cover canonical Assignment conflict anchors
seonghobae
committed
acff887
test(people): prove Assignment without recruiting conversion
seonghobae
committed
aae2a7f
docs(adr): align People conflict roots with canonical aggregates
seonghobae
committed
252f418
fix(foundation): reseal People conflict-root ADR
seonghobae
committed
854ae87
fix(people): restore governed mutation boundary integrity
seonghobae
committed
31ce6a6
test(people): make Assignment provenance fixture time-safe
seonghobae
committed
842a28b
fix(people): detach mutation identities at construction
seonghobae
committed
15fa5ca
test(people): align generic Assignment fixture coverage window
seonghobae
committed
02e412b
test(people): cover detached snapshot fail-closed guards
seonghobae
committed
af87c0f

Commits on Sep 13, 2026

test(people): require governed separation reason vocabulary
seonghobae
committed
9ed69b6
fix(people): close separation reason vocabulary
seonghobae
committed
279da65
fix(people): enforce separation reason vocabulary in database
seonghobae
committed
4458afa
build: reseal separation reason migration
seonghobae
committed
118c497
test(people): reject unreviewed separation reasons in postgres
seonghobae
committed
c804ca8
build: reseal separation reason contract
seonghobae
committed
fa191e5
test(people): close public separation reason vocabulary
seonghobae
committed
d000c07
fix(people): publish controlled separation reasons
seonghobae
committed
101af52
build: reseal public separation vocabulary
seonghobae
committed
1a094cb
docs(people): publish governed employment separation API
seonghobae
committed
4805eac
docs(people): model authoritative employment separation
seonghobae
committed
1476b48
docs(people): reconcile ERD with separation truth
seonghobae
committed
9ff4f5b
docs(people): show governed separation lifecycle
seonghobae
committed
5e0d863
docs(people): add governed separation product requirement
seonghobae
committed
46d816c
docs(people): specify separation technical boundary
seonghobae
committed
08e6a21
chore(manifest): reseal separation documentation
seonghobae
committed
22e7f26
fix(manifest): restore canonical ADR seal
seonghobae
committed
e38fe69
fix(manifest): apply exact ADR digest
seonghobae
committed
780ba27
docs(security): reconcile governed separation boundary
seonghobae
committed
7f81193
docs(security): model employment separation threats
seonghobae
committed
ffcf4ad
chore(manifest): reseal separation security docs
seonghobae
committed
5b86bb5
docs(test): register separation acceptance matrix
seonghobae
committed
9f42c5c
docs(ops): define employment separation recovery
seonghobae
committed
4981c80
chore(manifest): reseal separation acceptance docs
seonghobae
committed
fb5f5c8
docs(security): preserve published header contract
seonghobae
committed
7899754
chore(manifest): reseal security contract
seonghobae
committed
dbf0f8e
docs(changelog): record governed employment separation
seonghobae
committed
10aa915
chore(manifest): adopt changelog provenance
seonghobae
committed
d9cc516
fix(people): pin separation digest resolution
seonghobae
committed
f4f7e12
test(people): prove separation tenant capability boundary
seonghobae
committed
71d7226
docs(security): state separation tenant GUC trust boundary
seonghobae
committed
120616b
chore(provenance): reseal separation hardening evidence
seonghobae
committed
c0ba482

Commits on Sep 14, 2026

test(people): cover separation UUID payload integrity
seonghobae
committed
dc784f6
fix(people): harden separation UUID payload validation
seonghobae
committed
96995a1
test(people): require separation transaction context
seonghobae
committed
d1f2dd9
fix(people): prove separation transaction context
seonghobae
committed
93834df
test(people): require core mutation transaction context
seonghobae
committed
775327d
fix(people): prove core mutation transaction context
seonghobae
committed
53f877d
test(people): pin authorization evidence snapshot integrity
seonghobae
committed
c5878e8
fix(people): snapshot validated authorization evidence
seonghobae
committed
7161bad
test(people): cover authorization evidence trust edges
seonghobae
committed
4dc3ea6
test(people): require current Position parent anchors
seonghobae
committed
416fef7
fix(people): require current Position parents
seonghobae
committed
6700263
test(people): model transactional mutation connection
seonghobae
committed
b477fed
test(people): require post-lock Position clock
seonghobae
committed
52fd1ee
fix(people): stamp Position after parent lock
seonghobae
committed
b944e66
test(people): require effective Position parent coverage
seonghobae
committed
b97d0de
fix(people): require effective Position parent coverage
seonghobae
committed
7a92507
test(people): prove Position parent effective-date parameters
seonghobae
committed
c973a3d
test(people): require current Assignment parent roots
seonghobae
committed
be8f608
fix(people): require current Assignment parent roots
seonghobae
committed
b3aeb5f
test(people): harden separation authorization evidence
seonghobae
committed
a8c5948
fix(people): snapshot separation authorization evidence
seonghobae
committed
476e3b1
test(people): cover separation authorization edge evidence
seonghobae
committed
357d016
test(people): prove returned receipt identity immutability
seonghobae
committed
fda02d2
fix(people): retain mutation receipt identity as inert scalar
seonghobae
committed
8ae0794
test(people): prove mutation request metadata integrity
seonghobae
committed
32b8ea9
fix(people): exact-gate and bound mutation request metadata
seonghobae
committed
9697f11
test(people): prove mutation request dependency binding
seonghobae
committed
51db259
fix(people): bind mutation capabilities before authentication await
seonghobae
committed
e291560
test(people): reject behavior-bearing ASGI body frames
seonghobae
committed
5e17182
fix(people): validate ASGI request body frames before use
seonghobae
committed
4b9819f
test(people): bind separation runtime dependencies
seonghobae
committed
f0832c2
fix(people): bind separation runtime capabilities
seonghobae
committed
152ee48
test(people): gate separation ASGI metadata
seonghobae
committed
aaf61a0
fix(people): gate separation ASGI metadata
seonghobae
committed
1ecfc69
test(people): reject malformed separation UUID payload
seonghobae
committed
8ece6f4
fix(people): validate generated separation UUID payload
seonghobae
committed
c16df92
test(people): freeze separation receipt identity authority
seonghobae
committed
4f3035e
fix(people): make separation receipt identities structural
seonghobae
committed
5eb78d3
test(people): cover forged separation receipt storage
seonghobae
committed
b199994

Commits on Sep 15, 2026

test(people): expose separation port capability lookup gap
seonghobae
committed
d50a78d
fix(people): bind separation port capability before authorization
seonghobae
committed
c7781fe
test(people): require detached authenticated principal authority
seonghobae
committed
b5db8ea
fix(people): detach authenticated principal evidence
seonghobae
committed
a31207d
fix(people): snapshot separation principal before body await
seonghobae
committed
e8a8568
test(people): require principal authority at authorization boundary
seonghobae
committed
f23495a
fix(people): harden shared principal authorization evidence
seonghobae
committed
357d67d
test(people): pin generic mutation port capability gap
seonghobae
committed
45e46c6
fix(people): bind generic mutation port capability
seonghobae
committed
f7583e0
fix(people): preserve mutation port error contract
seonghobae
committed
3286153
fix(people): detach principal tenant identity authority
seonghobae
committed
a2866ac
fix(people): preserve separation port error contract
seonghobae
committed
806cf0e
test(people): adapt result integrity regression to structural receipt
seonghobae
committed
1e1e471
test(people): respect structural mutation receipt immutability
seonghobae
committed
6a85f39
test(people): forge structural result subclass without base validation
seonghobae
committed
51d6553
test(people): forge structural replay digest corruption
seonghobae
committed
f4c73b0
test(people): align parent-currentness temporal query contract
seonghobae
committed
8005bad
test(people): expose explicit libpq transaction mode
seonghobae
committed
93d9091
test(people): complete principal tripwire ordering
seonghobae
committed
b679044
test(people): complete authorization tripwire ordering
seonghobae
committed
ef40cda
test(people): complete authorization scalar ordering
seonghobae
committed
ba88e9a
test(people): complete UUID payload ordering
seonghobae
committed
d8cf4be
test(people): reject executable ASGI scope keys
seonghobae
committed
3d71a82
test(people): keep malformed receipt regression reachable
seonghobae
committed
145ece5
fix(people): validate ASGI scope keys before lookup
seonghobae
committed
3de318b
test(people): cover defensive boundary integrity
seonghobae
committed
bd88c1a
test(people): cover runtime receipt tampering
seonghobae
committed
cb459f0
chore(people): remove unused separation principal import
seonghobae
committed
49f6200
fix(people): make mutation receipt inequality type-safe
seonghobae
committed
cff6064
fix(people): make separation receipt inequality type-safe
seonghobae
committed
2afd369
test(people): prove receipt comparison symmetry
seonghobae
committed
0b4409e