perf(people): bind Employment-separation evidence to no-store response policy #392

Finding

Draft #317 currently classifies Employment-separation responses as governed commercial evidence after validating the JSON media type and response body semantics, but it does not validate the cache/privacy response policy.

The canonical People owner #64 emits every _send_json(...) response with Cache-Control: no-store and Vary: Authorization. A proxy, gateway, stale deployment, or alternate responder can therefore return the same 200/409 JSON envelope without the owner’s no-store/authorization-vary boundary and still be counted as governed buyer-path evidence.

For high-impact employment responses this is a material false-GREEN: the benchmark can certify latency/outcome evidence for a representation that does not preserve the canonical purpose-bound PII cache policy.

Owner evidence

• services/people-api/src/orgmetra_people_api/http.py::_send_json emits content-type: application/json, cache-control: no-store, and vary: Authorization.
• test(perf): add Employment separation buyer-path workload #317 employment_separation_buyer_path.js::parseJson currently requires only hasGovernedSeparationJsonMediaType(response.headers) before strict JSON parsing.

Repair contract

Test-first on #317:

• accept canonical Cache-Control: no-store and Vary: Authorization case-insensitively by field name/token;
• reject missing Cache-Control: no-store;
• reject cache-permitting/conflicting policy such as public or s-maxage even when JSON/body semantics are otherwise valid;
• require Authorization in Vary, while allowing additional valid Vary field names added by an intermediary;
• reject malformed/collapsed ambiguous header representations rather than inferring safety;
• integrate the cache-policy predicate before response body parsing so first-commit, replay, rejection, and contention share the same fail-closed transport boundary.

Do not weaken #317 latency/sample cardinality, do not claim hosted k6 GREEN from unit-level evidence, and keep this issue open until protected/integration acceptance carries the repair.