fix(people): protect governed mutation runtime types - #64

Scope

Canonical Orgmetra People mutation runtime/contract-integrity lane. HR mutation truth stays in Orgmetra; this PR does not copy mutable shared-kernel, authorization, workflow-owner, People-read, or downstream Assignment source.

Protected base is develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Current exact head is 818950960c4fe0a4e7b026bd5499fe9cca1002be; the PR remains open · Draft · mechanically mergeable. Predecessor checks/reviews are causal evidence only and do not authorize this head.

Retained repair chain

#215–#225 retain hire/generic PostgreSQL trust-boundary hardening. #226–#231 retain post-construction validation, target snapshots, and command detachment. #232/#233 keep Assignment allocation and OpenAPI aligned to the strictly-positive (0, 1.0000] invariant. #246 preserves same-key/same-semantic replay of first-committed generic mutation identity. Packaging/runtime repairs align People with orgmetra-hris-kernel==0.4.0 and Python >=3.12; #260/#261 own runtime-floor and installed-wheel evidence. #262 covers all four #64-owned operational UUID boundaries. #264 binds validated PostgreSQL connection capabilities structurally. #266–#269 detach command/result outer and nested identity aliases. #270 binds replay verification to an inert pre-port digest rather than mutable command/authorization objects.

41a35a5b026d83cefae8d2ca6b2415bf36086d6a is the replay-verification repair head; Foundation 34086056525 later reached terminal SUCCESS and remains historical evidence only.

Invalidated #271 experiment

Fresh causal review showed valid same-Employment writers already serialize through the current converted-worker row, while same-Position writers serialize through the Position root. #271's extra Employment row lock duplicated that conflict boundary without behavioral proof. Ordinary successor 19c6c7e2eb8c05d8317635a0fa66768cc904088b removed the redundant lock and source-shape regression with no net file delta versus pre-#271 41a35a5...; #271 is closed not_planned. No force-push or destructive rebase was used.

PostgreSQL concurrency evidence — #272

fb28b01915cd8bf233260cfa3c4b562879f9ff7b added executable two-session PostgreSQL acceptance in services/people-api/tests/test_postgres_assignment_concurrency_acceptance.py. It drives the real PostgresPeopleMutationPort under READ COMMITTED against an isolated PostgreSQL 16 container and repository migrations. PostgreSQL itself must expose writer B in wait_event_type='Lock' with writer A in pg_blocking_pids(...); sleeps only pace observation.

The two cases are same Employment/Person with different Positions, and different Employments/People with one Position. In each case writer A commits 0.7500 and writer B attempts 0.5000; B must re-read after the conflict boundary and reject an aggregate above 1.0000. Acceptance checks one durable Assignment, matching Assignment audit/outbox/idempotency evidence, no rejected-write residue, and client/server cleanup.

015ba7ce98da5a3100194ec9e3389df8b0cedb5e repaired review findings in the harness (BaseException → Exception, unused pytest removal). 1ea5cb1dcc887cf5b83fa85f926228e146f09d3f corrected evidence terminology: seeded People/Employment/Position/Candidate/Decision records are deterministic synthetic integration fixtures, suitable for transaction/lock mechanism evidence only and not buyer-realistic or scientific claims. Foundation 34107536416 for exact 1ea5cb1d... subsequently reached terminal SUCCESS.

6cf31e8344a39d4490641441c190984533c49360 repaired failure-path barrier release and started-writer joins. 558afdf482af7e6e69ea0694e9f731365f1300be added a forced post-lock failure regression proving server sessions disappear before teardown; 07c2ff1107f9e39fcb74ec844a5972ca0c7d190a added client-handle closure evidence. Test-first fb8eeb9041c0ab838f1c03f0bdfb28500b4397ff showed cleanup joins were unbounded, and 614ee5f2027153223a6cb23773f2b8704674ca2d applied join(timeout=30).

c1fb77bdd87329755008df94b5161df205a96467 forced deadline expiry after a real PostgreSQL lock observation. 0d78299f5d49238fc1228f87b138d2bfca6dd367 added _join_writer_before_teardown(...), which terminates an expired writer only by its captured PID plus internal application_name and then bounded-joins again. b71263918cc59b9ca4177abf1770f1c87b619440 strengthened the regression so the real termination query completes before the held client cleanup seam is released.

Fresh review of b712639... found that termination receipt itself was inconsistent. Ordinary forward 52257a66f68cf0893f2b351cbc0392b3e52f5bb4 changed the query to return count(*)|coalesce(bool_and(pg_terminate_backend(pid)), false)::text and accept only exact 1|true, so zero PID/application-name matches and failed termination both fail closed.

Foundation 34127782377 then supplied a real hosted RED on exact 52257a66.... Exact checkout, compile, runner-image contract, foundation-pack validation, dependency hygiene, and all earlier owned suites passed; People ran 264 passing tests before test_expired_cleanup_join_terminates_live_backend_before_returning failed. RCA: the regression seam forced the first bounded join to expire for both writer A and writer B, even though only writer B's client cleanup was deliberately held. After the pre-COMMIT barrier was released, writer A was allowed to finish naturally; it could quiesce between the synthetic zero-time join and PID/application-name lookup, so the exact termination receipt correctly returned no live owned backend. This was a test-seam defect, not evidence of a production row-lock or backend-termination defect.

Ordinary forward 818950960c4fe0a4e7b026bd5499fe9cca1002be is the minimal causal repair. _ExpireHeldWriterJoinThread derives the targeted writer from the factory passed to _run_writer; only the deliberately held writer (factory._barrier is None) receives a synthetic first-join expiry. Writer A receives the real bounded cleanup join and may quiesce normally; writer B remains deliberately live so the real PID + internal application_name termination query and exact 1|true receipt are still exercised. Only test_postgres_assignment_concurrency_failure_cleanup.py changed. Production adapter code, SQL mutation semantics, transaction semantics, row-lock ordering, RLS, audit/outbox, and idempotency are unchanged.

The real/right-cleared commercial/scientific acceptance tier remains separate and unresolved until a permitted provenance-backed source is available. Synthetic rows are not promoted to reality evidence.

Current exact-head acceptance

Foundation 34131641452, job 101772911159, is terminal SUCCESS on exact 818950960c4fe0a4e7b026bd5499fe9cca1002be. It proved exact checkout, compile, runner-image contract, foundation-pack validation, dependency hygiene, the complete owned unit/service invocation, repository PostgreSQL contracts, and read-only validation. The People API invocation runs the full services/people-api/tests tree under the pinned ORGMETRA_POSTGRES_IMAGE, so #272's normal two-session interleavings plus forced post-lock failure/timeout cleanup are current-head hosted GREEN mechanism evidence.

SAST 34131642172 is terminal SUCCESS. Security 34131642055 is terminal FAILURE only at dependency-review support establishment; exact-head checkout succeeded and Scorecard, Trivy, and OSV completed successfully. The authoritative public dependency comparison remains the central fail-closed availability incident in ContextualWisdomLab/.github#810; sibling scanner success is not promoted as a substitute.

CodeQL 34131641597 is terminal FAILURE. Language detection succeeded. Both Python and Actions compatibility jobs successfully read the current-head dispatch verdict and then failed at Release runner or enforce current-head CodeQL verdict at 2026-09-07T15:29Z; the same run's Dispatch current-head CodeQL scan job did not start until 16:01Z and then succeeded. This historical exact-head result remains non-passing and is a canary for the central terminal-receipt ordering/publication owner ContextualWisdomLab/.github#1929; later central repairs do not retroactively transfer GREEN evidence.

Required Strix run 34131638369, job 101787200568, is also terminal FAILURE. Its exact-head artifact strix-reports id 10030120846 has digest sha256:e61c95771ab6c37f7a60431f01eff4ada91adbcfbd2f6eaf79a803aacd7f9d5c. The scanner itself recorded status=completed, scan_completed=true, and success=true, and emitted an empty SARIF result set after 191 LLM requests, but the terminal narrative simultaneously claimed several low-impact potential issues while provider-error traces remained in the report. The central strict gate therefore failed closed and labelled the run STRIX_PROVIDER_UNAVAILABLE. That artifact is not promoted to GREEN: terminal evidence is internally inconsistent, and the provider-exhaustion diagnostic is not by itself proof that no usable route existed after the later completed scan receipt. Central owner issue ContextualWisdomLab/.github#2026 now owns the typed distinction among complete-consistent, incomplete/provider-unavailable, and complete-but-inconsistent Strix evidence while preserving orchestrator/free, no external/paid fallback, and default-null model timeout semantics.

Submitted reviews remain COMMENTED-only; every returned inline review thread is resolved and qualifying independent approval is absent. Keep Draft; no merge/release claim is authorized.

Central Dependency Review availability, CodeQL terminal receipt publication, Strix terminal-evidence classification, and solo-maintainer approval-governance repairs remain .github owner-path concerns (#810, #1929, #2026, #772). Do not churn People source, fabricate verdicts, self/model approve, weaken required gates, transfer predecessor evidence, or use routine administrator bypass.

Owner dependencies

#63 owns shared HRIS-kernel audit/runtime evidence. #55 owns People read semantics. #65 owns purpose-bound authorization/runtime integrity and overlaps People mutation files; after #64 becomes protected truth, #65 must non-force adopt it while preserving #229–#233, #246, packaging/runtime repairs, #262, #264, #266–#270, and #272's measured PostgreSQL behavior, evidence classification, deterministic failure cleanup, bounded waits, verified owned-backend termination, exact termination-receipt contract, and the rule that forced timeout evidence targets only a writer intentionally kept live. #141 follows #64/#65; #163/#165 consume normally integrated protected truth only.

docs/product-technical-gap-baseline.md remains single-writer-owned by #100. Durable concurrency evidence should describe measured conflict serialization, deterministic cleanup, bounded failure waits, verified owned-backend termination, exact one-owned-session termination receipts, and targeted timeout seams; it must not resurrect #271's redundant lock or mislabel synthetic fixtures as real/right-cleared data.

Causal order remains #63 protected integration as gates allow → #64 remaining exact-head gates/governance → #65 non-force protected adoption/reconciliation → #141 → Assignment descendants. No force-push, destructive rebase, self-approval, routine administrator bypass, gate weakening, no-op retrigger, mutable sibling source copy, or predecessor-evidence transfer.