`]
+};
+
+export default preview;
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 1bdc13b5a..c645ed750 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -76,7 +76,7 @@ The initial deployment may share one physical PostgreSQL cluster. Logical isolat
|---|---|---|
| `people_core` | `people_core`: person, name, employment, assignment, compensation, and candidate-worker linkage records | `people_core_role` |
| `organization_core` | `organization_core`: organization units and position records | `organization_core_role` |
-| `job_architecture` | `job_architecture`: job profiles, publication evidence, and persisted `job_analysis_snapshot` / task / KSAO rows | `job_architecture_role` |
+| `job_architecture` | `job_architecture`: job profiles and publication evidence; persistent `job_analysis_snapshot`, `job_analysis_task_item`, and `job_analysis_ksao_item` tables | `job_architecture_role` |
| `talent_acquisition` | `talent_acquisition`: candidate profiles, selection decisions, and decision evidence | `talent_acquisition_role` |
| `performance_management` | `performance_management`: criterion blueprints and observations | `performance_management_role` |
| `workforce_validation` | `workforce_validation`: validity-study registry and external result references | `workforce_validation_role` |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 16454da3d..88755cebd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,22 +6,41 @@ All notable changes to Orgmetra will be documented in this file.
### Added
+- Active-PR isolated-runner PostgreSQL client repair: host `psql` availability on the `CWL CI isolated` runners varies by job; the logs do not show a fixed per-runner client. Restore rehearsal job 112192671013 on `orgmetra-ci-01` (attempt 3) was the first to stop at `.github/scripts/restore-rehearsal-postgres.sh` line 59 with `psql: command not found` (exit 127), and job 112199226633 on `keyverse-ci-01` (attempt 4) stopped the same way. Foundation job 112192669065 on `keyverse-ci-01` stopped after 30 failed `psql` readiness probes, while Foundation job 112199223734 on `orgmetra-ci-01` reached PostgreSQL. Both workflows now install Ubuntu `postgresql-client-16`, put `/usr/lib/postgresql/16/bin` first on the job path, and prove in a later step that the selected `psql` is that binary with major version 16 before the first host `psql` use. The source contract detects host `psql` written as a bare or absolute command, after `env` or `bash -c`, or chained after a `docker exec` segment, and host scripts that call `psql` when run through `bash` (with or without flags), `sh`, `source`, `.` or `./`; it ignores `psql` only inside a `docker exec` segment. Commands that do not name `psql` or the script path literally, such as a variable that holds the command, are not detected. Database images, contract scripts, runner selectors and all quality gates are unchanged; this source change is not a passing hosted run, approval, or release.
+
+- Active-PR traceability correction: distinguish unchanged baseline People business/persistence boundaries from this PR's read HTTP error handling and regression changes. Paragraph-scoped provenance contracts retain the unverified-protection limit and reject the earlier blanket unchanged attribution, including wrapped contradictory text. This correction does not change People runtime behavior or certify deployment, hosted checks, approval, or release.
+
+- Active-PR People read error-boundary repair: contain unexpected authentication-backend exceptions before protected reads and retain existing 400/401/403/404/405/409/500 responses while adding canonical `error_code`, `next_action`, and random `support_reference` metadata. Bounded local rejection logs share the support reference without credentials, HR values, request identities, or exception text. Existing canonical mutation error envelopes and successful payloads remain unchanged; local regression and coverage evidence do not establish hosted CI, independent approval, deployed authentication, or release.
+
+- Active-PR recovery port wiring repair: each PostgreSQL service exposes container `5432` with an allocated host port, and each administrator URL consumes its own service's `ports[5432]` mapping. Recording-only source contracts use distinct synthetic ports and paired fixed/swapped/shared/wrong/missing controls. PostgreSQL images, health checks, cluster-identity/destructive-operation guards and isolated runner selectors are unchanged. Actual runner capacity, service allocation, cross-cluster restore, hosted execution and independent approval remain separate obligations.
+
+- Active-PR credential-wait dispatch repair: People and Job Analysis submit handlers reuse their existing generation to reject an obsolete read after credential acquisition and before fetch, settling through the existing version-fenced catch without clearing a newer result. Permanent synthetic Node regressions cover authority/repeated/away-and-back notification, input/change with reversion, newer submit, late valid credentials, provider rejection, and missing credentials with nonempty fresh-read controls. Direct two-argument helper callers have no generation protection; already-dispatched transport is not cancelled. Existing explicit credentials, no-storage/cookie-free reads, authorization denial and response fences remain unchanged. Host notification, actual issuer/identity integration, native-browser successor evidence, hosted CI, independent approval, and protected release remain open.
+
+- Active-PR, source-only CI routing proposal: bind Foundation and Recovery to the dedicated `CWL CI isolated` group and exact labels, reject hosted or privileged fallback selectors, and declare only the custom label needed by actionlint. Runtime capacity, repository access, isolation, cleanup, canary, and managed Code Quality routing remain separate acceptance conditions. Existing quality and security gates remain required.
+
+- Active-PR browser harness ownership repair: refuse existing HTTP servers in every environment and validate optional `ORGMETRA_WORKSPACE_PORT` overrides as canonical decimal TCP ports 1–65535 before fixture launch. Unset overrides retain 4173; browser assertions, 15-second case deadlines, and failure recording remain unchanged. Actual config-import regressions join the existing Foundation integration test; local evidence does not authorize merge or deployment.
+
+- Dependency-free HR Home and Employee Profile fixture at `apps/hr-workspace/`, using the Figma role frames and shared tokens with explicit API-boundary, permission-denied, evidence-drawer, high-impact confirmation, exact-allocation, focus, and English/Korean states. The fixture is not connected or deployed evidence.
+- Local Storybook `10.5.10` runtime using `@storybook/web-components-vite` and native HTML/CSS stories for the HR action states, field errors, permission denial, evidence drawer, high-impact confirmation, and exact assignment values. It is local component/state evidence, not connected People API or browser E2E evidence.
+- Chromium Playwright browser E2E for the HR workspace, covering keyboard-accessible human review, locale changes, purpose-bound denial, host-injected People and Job Analysis reads, authorization headers, and no-fallback error behavior. The test is local/CI evidence and does not claim protected deployment.
+- Product and technical gap baseline with protected-branch truth, full current open-PR inventory, buyer-priority acceptance evidence, Figma source ID, standards/research ledger, and central integration-loop contract. The baseline distinguishes shipped runtime from active PR, accepted architecture, planned, research-only, superseded, and out-of-scope work.
+- Project-local `uv` source resolution and a checked lockfile for `services/people-api`, so local tests discover the owned Keyverse adapter without an undocumented `PYTHONPATH` workaround.
+- Project-local `uv` source resolution, Python compatibility metadata, test extras, and a checked lockfile for `services/job-analysis-api`, so its full test command resolves owned packages without an undocumented `PYTHONPATH` workaround.
- Accepted ADRs 0001–0003 now include buyer-facing Context, Decision, and Consequences grounded in verified ISO 30400:2022, ISO 30414:2025, Uniform Guidelines (29 C.F.R. Part 1607), SIOP (2018), OpenAPI Specification v3.2.0, OpenID Connect Core 1.0 errata set 2, CloudEvents v1.0.2, Jensen and Snodgrass (1999), Snodgrass (1999), and Allen (1983) records already listed in `docs/doctoring/REFERENCES.md`. ADRs 0004 and 0005 gained APA 7th References pointers to that same bibliography without changing their Decision bodies.
-- Active-PR governed Job Analysis persistence/API on the canonical `JobAnalysisSnapshot` model: migration `0013_job_analysis_snapshot.sql` stores immutable tenant-scoped snapshot, Task, KSAO, Task–KSAO, FJA and write-command evidence; `POST /v1/tenants/{tenant_record_id}/job-analysis-snapshots` and matching GET enforce purpose-bound Keyverse scope, authenticated-principal actor authority, bounded/strict JSON handling, transactional Idempotency-Key serialization, parent-scope fail-closed integrity, forced RLS, and atomic audit/outbox evidence. ADR 0014 records the persistence decision while ADR 0007 remains the domain/evidence authority; validated evidence still requires accountable human review and non-LLM provenance, and the service does not make a high-impact employment decision.
-- Active-PR `orgmetra_selection_review` packet for PII-minimized, evidence-bound human selection review: canonical operational tenant identity, UUID-backed opaque candidate/Job/sealed-evidence/reviewer references, explicit purpose/reason/evidence version, deterministic canonical JSON and SHA-256 correlation, mandatory human decision state, redacted packet repr, and provenance-paired model evidence that remains `untrusted_draft`, with exact 100% owned statement and branch coverage required by its quality gate.
-- Active performance-criterion scope hardening: `criterion_observation_scope_guard` rejects criterion outcomes for a Job the worker did not effectively hold at the observation date, observations before the relevant assignment, and observations outside the referenced performance cycle while preserving valid multiple-assignment cases and existing bitemporal correction semantics. The guard evaluates current-recorded facts, derives the date coordinate from `observed_at` in UTC so session `TimeZone` cannot alter the result, uses a trusted function search path, and adds no PII or automated employment decision authority. The Foundation PostgreSQL contract also rejects a closed `recorded_to` on each time-coordinate lookup and proves UTC midnight plus non-UTC session `TimeZone` boundaries.
+- Protected `orgmetra_selection_review` packet for PII-minimized, evidence-bound human selection review: canonical operational tenant identity, UUID-backed opaque candidate/Job/sealed-evidence/reviewer references, explicit purpose/reason/evidence version, deterministic canonical JSON and SHA-256 correlation, mandatory human decision state, redacted packet repr, and provenance-paired model evidence that remains `untrusted_draft`, with exact 100% owned statement and branch coverage required by its quality gate.
+- Protected performance-criterion scope hardening: `criterion_observation_scope_guard` rejects criterion outcomes for a Job the worker did not effectively hold at the observation date, observations before the relevant assignment, and observations outside the referenced performance cycle while preserving valid multiple-assignment cases and existing bitemporal correction semantics. The guard evaluates current-recorded facts, derives the date coordinate from `observed_at` in UTC so session `TimeZone` cannot alter the result, uses a trusted function search path, and adds no PII or automated employment decision authority. The Foundation PostgreSQL contract also rejects a closed `recorded_to` on each time-coordinate lookup and proves UTC midnight plus non-UTC session `TimeZone` boundaries.
- Bitemporal tenant-scoped organization hierarchy validation that rejects visible indirect parent cycles and reuses single-valued recorded-time reconstruction before graph traversal.
-- Stacked governed job-analysis evidence contract via `JobAnalysisSnapshot`, `TaskEvidence`, `KSAORequirement`, `TaskKSAOLink`, `FunctionalJobAnalysisProfile`, and `EvidenceSource`: tenant/Job-scoped observable tasks, explicit Task-to-KSAO linkage, importance/difficulty/proficiency ratings, source/version/retrieval/SHA-256 provenance, deterministic canonical snapshot bytes, current O*NET evidence support, and historical DOT Data/People/Things compatibility. Validated snapshots require accountable human review and complete non-LLM evidence; LLM-origin material remains `analysis_draft`, and the snapshot is evidence input rather than a hiring, promotion, termination, compensation, or other high-impact employment decision.
-- Stacked governed audit/outbox slice via `AuditOutboxEvent`, `audit_event_record`, `outbox_delivery_record`, and `outbox_delivery_escalation_record`: CloudEvents 1.0-compatible PII-minimized metadata, exact canonical JSON bytes, database-verified SHA-256 digests, mandatory human confirmation for high-impact events, immutable audit evidence, tenant RLS, atomic audit/outbox insertion, guarded pending/leased/delivered/dead-lettered delivery state, tenant-safe `claim_outbox_delivery(...)` with deterministic due-work ordering, `FOR UPDATE ... SKIP LOCKED`, opaque worker identity, bounded future leases, immutable envelope return, and atomic takeover of genuinely expired leases only while retry attempts remain; owner-bound `complete_outbox_delivery(...)` and `retry_outbox_delivery(...)`; database-budget-governed `dead_letter_outbox_delivery(...)`; and a separately privileged `operator_dead_letter_expired_outbox_delivery(...)` recovery path for an exhausted final lease whose recorded worker identity is permanently unavailable. `maximum_attempt_count` is persisted on the delivery row, defaults to 5, is constrained to 1 through 100, and cannot be lowered by a dispatcher during finalization. Migration 0007 prevents retry or expired-lease takeover from creating attempt N+1; migration 0008 adds TRUNCATE guards, trusted function search paths, a concurrently built due-work partial index, session-independent immutable envelope validation, and operator recovery backed by separate NOLOGIN/NOBYPASSRLS owner/capability roles so the externally assignable operator role can invoke recovery without receiving direct transport-table read/write rights. Migration 0008 also rejects pre-existing reserved recovery-role names before project DDL, atomically contains the temporary schema-creation privilege used for function ownership handoff, and forces deferred escalation binding while the narrow SECURITY DEFINER owner is still active. Exponential/backoff policy selection, policy-specific producer configuration, and external delivery receipts remain subsequent work.
+- Protected governed job-analysis evidence contract via `JobAnalysisSnapshot`, `TaskEvidence`, `KSAORequirement`, `TaskKSAOLink`, `FunctionalJobAnalysisProfile`, and `EvidenceSource`: tenant/Job-scoped observable tasks, explicit Task-to-KSAO linkage, importance/difficulty/proficiency ratings, source/version/retrieval/SHA-256 provenance, deterministic canonical snapshot bytes, current O*NET evidence support, and historical DOT Data/People/Things compatibility. Validated snapshots require accountable human review and complete non-LLM evidence; LLM-origin material remains `analysis_draft`, and the snapshot is evidence input rather than a hiring, promotion, termination, compensation, or other high-impact employment decision.
+- Protected governed audit/outbox slice via `AuditOutboxEvent`, `audit_event_record`, `outbox_delivery_record`, and `outbox_delivery_escalation_record`: CloudEvents 1.0-compatible PII-minimized metadata, exact canonical JSON bytes, database-verified SHA-256 digests, mandatory human confirmation for high-impact events, immutable audit evidence, tenant RLS, atomic audit/outbox insertion, guarded pending/leased/delivered/dead-lettered delivery state, tenant-safe `claim_outbox_delivery(...)` with deterministic due-work ordering, `FOR UPDATE ... SKIP LOCKED`, opaque worker identity, bounded future leases, immutable envelope return, and atomic takeover of genuinely expired leases only while retry attempts remain; owner-bound `complete_outbox_delivery(...)` and `retry_outbox_delivery(...)`; database-budget-governed `dead_letter_outbox_delivery(...)`; and a separately privileged `operator_dead_letter_expired_outbox_delivery(...)` recovery path for an exhausted final lease whose recorded worker identity is permanently unavailable. `maximum_attempt_count` is persisted on the delivery row, defaults to 5, is constrained to 1 through 100, and cannot be lowered by a dispatcher during finalization. Migration 0007 prevents retry or expired-lease takeover from creating attempt N+1; migration 0008 adds TRUNCATE guards, trusted function search paths, a concurrently built due-work partial index, session-independent immutable envelope validation, and operator recovery backed by separate NOLOGIN/NOBYPASSRLS owner/capability roles so the externally assignable operator role can invoke recovery without receiving direct transport-table read/write rights. Migration 0008 also rejects pre-existing reserved recovery-role names before project DDL, atomically contains the temporary schema-creation privilege used for function ownership handoff, and forces deferred escalation binding while the narrow SECURITY DEFINER owner is still active. Exponential/backoff policy selection, policy-specific producer configuration, and external delivery receipts remain subsequent work.
- `orgmetra_hris_kernel` 0.4.0 with exclusive-versus-concurrent employment, staffable position coverage, exclusive-seat capacity, and `validate_assignment_write` at 100% statement and branch coverage.
-- `POST /v1/employment-records`, `POST /v1/position-records`, and `POST /v1/assignment-records` with the same Keyverse mutation context, confirmation, and versioned evidence composition as other high-impact commands.
+- Protected governed People mutation and confirmed-hire materialization runtime for `POST /v1/employment-records`, `POST /v1/position-records`, `POST /v1/assignment-records`, and the tenant-bound conversion route, with purpose-bound Keyverse mutation context, explicit confirmation, versioned evidence, atomic audit/outbox persistence, and tenant-scoped idempotency.
- `employment_record_version.employment_concurrency_code` constrained to `exclusive` or `concurrent`.
- ADR 0005 for exclusive employment and staffable seats.
- `orgmetra_hris_kernel` 0.3.0 with identity-scoped bitemporal resolution, assignment-employment coverage, allocation-portfolio checks, and a Memorial Hospital RN correction case at 100% statement and branch coverage.
- `employment_record_version` and `position_record_version` so employment and position identity stay stable across retroactive corrections.
- `assignment_record.employment_record_id` bound to the same person as the covering employment.
- `orgmetra_keyverse_adapter` that binds an opaque Keyverse subject to a person and rejects passwords, passkeys, and tokens.
-- Design tokens for the repeating HR actions: approve, review, correct, request evidence, compare, export, and escalate.
+- Design tokens for the repeating HR actions: approve, review, correct, request evidence, compare, export, escalate.
- ADR 0004 for employment/position versions and assignment-employment binding.
- Foundation product baseline for Orgmetra as an evidence-centered HRIS/HCM.
- CWL federated integration boundary map.
@@ -37,7 +56,21 @@ All notable changes to Orgmetra will be documented in this file.
### Changed
+- Active-PR bibliography repair: Fugu and TRINITY references now list the registered individual authors and pin the observed arXiv versions. Explicit revision dates distinguish TRINITY's 2026 revision from its 2025 first submission. A canonical regression rejects organization-author substitution for these two records; no numerical, runtime, identity, protection, or release behavior changes.
+- Active-PR restore provenance repair: recovery scope now attributes backup requirements and migration source to the immutable observed develop base, not current protected integration or enabled recovery controls. A shared scope regression rejects stale protected-main claims while retaining the actual recovery source, destructive-operation guards, and source manifest integrity. Hosted execution, deployed recovery and release remain unverified.
+- Active-PR maturity evidence repair: the validator rejects obsolete `implemented_on_protected_main` through otherwise-valid matrix regressions. Local source-backed capabilities use `implemented_on_active_pr` as the current assessment bound, not a claim that their implementation is new or absent from the observed develop base. Baseline source presence and historical classifications remain explicit, while current protection, hosted execution and release evidence are unverified. The external Keyverse identity row records accepted architecture rather than claiming issuer integration. No runtime, SQL, authentication or protection policy is changed.
+
+- Active-PR manifest semantic repair: `target_branch: develop` identifies only the intended integration destination; `generated_source_branch: null` explicitly records that this deterministic filesystem producer does not capture generation-source authority, including in named checkouts. The parser rejects missing/non-null source claims, wrong targets, and legacy `generated_for_branch` metadata while retaining exact file/hash/byte/line/path integrity. Offline bounded Python regressions join the canonical Foundation integration module; print remains read-only, deterministic, gitless, and source-agnostic. Unknown source is not authenticated provenance, protected integration, formal approval, or release; any requirement for authenticated non-null provenance remains unmet.
+- Active-PR review-document repair: ADR 0017 separates its accepted decision status from observed source provenance and unverified protection/host integration. Job Analysis traceability now names existing migration 0013 tables, API source, PostgreSQL contract source, and ADR 0014. Two regressions guard these documentation boundaries; no runtime, fresh PostgreSQL, deployed approval, or release claim is added.
+- Active-PR baseline attribution repair: README identifies inspected source on the observed default-branch base; the Gap ledger labels its August 21, 2026 capability, PR inventory, and execution snapshot as historical. Existing snapshot values remain evidence at their original coordinates, not fresh execution, configured protection, deployment, or release. PR #100/#51 branches remain unchanged; browser and Node authority-event coverage are now documented separately.
+- Active-PR host-authority display repair: the payload-free `orgmetra:authority-invalidated` document event reuses both read invalidators to synchronously scrub People/Job results and fence prior responses. The host must notify before another authority can use the retained document or destroy it; local regressions do not establish host integration, transport cancellation, protected merge, or release.
+- Active-PR architecture documentation repair: the Job Architecture ownership row now includes the existing persisted Job Analysis snapshot, task, and KSAO tables. A migration-backed regression preserves the owning schema, role, and original job-profile/publication-evidence description. This does not add database behavior or establish protected integration or release.
+- Active-PR personal-details fixture display repair: changing the access purpose clears both previous allowed and denied review states. Selecting or restoring a purpose does not grant access; a fresh explicit review is required. Node and Chromium regressions preserve fixture-only maturity, existing purpose rules, and browser deadlines.
+- Active-PR protected-read display repair: editing People or Job Analysis request fields clears displayed values and invalidates pending responses, including edit-and-revert sequences. A fresh explicit read remains available. Existing authorization providers, API contracts, no-cookie transport, fixture-only maturity, and browser deadlines are unchanged; Node and Chromium regressions exercise both read views.
+- Active-PR CI dependency-order repair: Foundation installs the reviewed Node lockfile before validation; Recovery provisions the same pinned Node 24 and Python 3.14 runtimes and runs `npm ci` before validation. Existing config-import regressions retain their real Playwright dependency, and integration tests guard the prerequisite order. Dependencies, lockfile, browser behavior, runner selectors, and all quality gates are unchanged; local evidence is not hosted execution or approval.
- Consolidated repository-owned PR validation from twelve workflows into one Foundation CI job, while keeping the dual-cluster recovery rehearsal separately path-scoped. Central required review and security workflows remain organization-owned.
+- Aligned the English/Korean locale toggle's accessible name with its visible target-language label (`한국어` / `English`) and added exact browser assertions for both language states, following WCAG 2.2 Success Criterion 2.5.3 (Label in Name); the APA 7 W3C citation remains in `docs/doctoring/REFERENCES.md`.
+- Reconciled README, traceability, ADR status/index, and changelog maturity claims with capabilities already integrated on protected `develop`; open-PR capabilities remain explicitly non-shipped.
- New predictive-validity membership must use one normalized worker-level case; the three independent validity-study decision/evidence/outcome link relations are historical read surfaces only and can no longer accept new rows. A case insert also rejects a criterion observation whose recorded interval is already closed at `linked_at`.
- Canonicalized service identifiers as two-or-more-word `snake_case` across architecture, deployment, ACL, metrics, and client contracts.
- Separated fast-mlsirm, TEPP, and Psychometrics Commons into immutable external scientific contracts.
@@ -74,4 +107,4 @@ All notable changes to Orgmetra will be documented in this file.
### Notes
-- Protected `develop` at `e7ddb7a78a5e1460410005d10f43ebf18c5e12e4` includes normalized validity-study and criterion integrity, bitemporal workforce composition, governed candidate-to-worker conversion, purpose-bound PII authorization, GET-only People reads, governed People mutation/idempotency API, and the accepted ADR 0001–0003 source expansion integrated by #37. Job Analysis persistence/API and the selection-review packet remain active-PR truth until their unchanged exact heads satisfy fresh gates and merge.
+- Protected `develop` is the shipped repository truth for integrated capability. Open PRs and draft branches are non-shipped until they integrate and satisfy fresh exact-head gates.
diff --git a/README.md b/README.md
index 47bb087a3..b1b227bc3 100644
--- a/README.md
+++ b/README.md
@@ -73,9 +73,17 @@ Job evidence
- `docs/TEST_STRATEGY.md`
- `docs/OPERABILITY.md`
- `docs/TRACEABILITY.md`
+- `docs/product-technical-gap-baseline.md`
- `docs/adr/README.md`
- `docs/doctoring/REFERENCES.md`
## Status
-Protected `develop` includes the employment-truth kernel, governed candidate-to-worker conversion, purpose-bound PII authorization, normalized worker-bound validity studies, criterion-observation scope, bitemporal workforce-composition evidence, the governed Naruon intent adapter, and requisition review packets. This active PR adds durable purpose-bound People mutation and confirmed-hire materialization paths for Employment, Position, and Assignment with atomic audit/outbox evidence and tenant-scoped idempotency; treat those write paths as active-PR truth until this exact head passes all fresh protected-base gates and merges.
+Active PR #53 includes local People and Job Analysis read views. Editing their
+request fields clears displayed values and invalidates pending responses, even
+if an edit is reverted. Changing the fixture's personal-details purpose also
+clears its prior allowed or denied display; only an explicit review shows a new
+outcome. Node and Chromium regressions cover these display boundaries; they do
+not establish released authentication or deployment.
+
+Observed default `develop` base `eb9757f8649aaad026a9865508d9aad50c1a7a4f` contains the employment-truth kernel (`packages/hris-kernel/src/orgmetra_hris_kernel/employment.py`), bitemporal workforce-composition snapshot source (`packages/hris-kernel/src/orgmetra_hris_kernel/workforce.py`) and regression source (`packages/hris-kernel/tests/test_workforce_composition.py` and `test_workforce_composition_boundaries.py`), People read/mutation/confirmed-hire source (`services/people-api/src/orgmetra_people_api/people.py`, `mutations.py`, and `hire.py`; `database/migrations/0012_people_mutation_idempotency.sql`), and Job Analysis snapshot read/write source (`services/job-analysis-api/src/orgmetra_job_analysis_api/snapshot.py`; `database/migrations/0013_job_analysis_snapshot.sql`). This is repository source presence only, not configured branch-protection enforcement, newly executed tests, deployed behavior, or a release. Active PR #53 UI remains unmerged; the 2026-08-21 inventory and local execution results in `docs/product-technical-gap-baseline.md` are historical, not current all-PR or release evidence.
diff --git a/apps/hr-workspace/app.js b/apps/hr-workspace/app.js
new file mode 100644
index 000000000..caad79d2d
--- /dev/null
+++ b/apps/hr-workspace/app.js
@@ -0,0 +1,480 @@
+const translations = {
+ en: {
+ productLabel: 'Evidence-centered HRIS', workspaceLabel: 'People workspace', apiBoundary: 'Protected People API boundary: not connected in this fixture', fixtureMode: 'Local fixture mode', hrHome: 'HR Home', employeeProfile: 'Employee Profile', fixtureBadge: 'Fixture evidence', hrHomeBreadcrumb: 'Orgmetra / HR Home', employeeProfileBreadcrumb: 'Orgmetra / Employee Profile', today: 'Today', hiringReview: 'hiring decisions need evidence review', positionChanges: 'position changes effective next week', validationApproval: 'validation study needs approval', workQueue: 'Work queue', nextActions: 'Next actions', reviewEvidence: 'Review evidence', reviewEvidenceDetail: 'Approve or return a decision packet', effectiveConflicts: 'Effective-date conflicts', effectiveConflictsDetail: 'Inspect the employee history timeline', validityStudy: 'Open validity study', validityStudyDetail: 'Review the supporting evidence versions', evidenceState: 'Evidence state', readyForReview: 'Ready for human review', reviewState: 'Review', reviewCopy: 'Orgmetra keeps the actor, purpose, reason, and evidence versions visible before a high-impact action.', actor: 'Actor', purpose: 'Purpose', source: 'Source', personSummary: 'Person summary', sampleEmployee: 'Sample employee', syntheticRecord: 'Synthetic record for local interaction proof', authorized: 'HR operations access', person: 'Person', personValue: 'Identity and name facts', employment: 'Employment', employmentValue: 'Worker relationship', position: 'Position', positionValue: 'AI Product Architect', assignment: 'Assignment', assignmentValue: 'Platform 60% · Governance 40%', accessPurpose: 'Access purpose', hrOperations: 'HR operations', recruiting: 'Recruiting', viewPersonalDetails: 'View personal details', correctHistory: 'Correct history', permissionDenied: 'Permission denied', permissionDeniedCopy: 'This purpose does not authorize personal details. Choose a permitted HR purpose or request access.', detailsVisible: 'Personal details visible', detailsVisibleCopy: 'Purpose-bound access was evaluated for this fixture and recorded for audit.', bitemporalHistory: 'Bitemporal history', historyTitle: 'Effective vs recorded time', readOnly: 'Read-only snapshot', historyCaption: 'Employee history with effective and recorded time', record: 'Record', effectiveTime: 'Effective time', recordedTime: 'Recorded time', state: 'State', active: 'Active', pendingReview: 'Pending review', assignmentSplit: 'Assignment split', capacityTitle: 'Visible allocation capacity', assignmentCaption: 'Exact assignment allocation values', assignmentName: 'Assignment', allocation: 'Allocation', nextAction: 'Next action', noAction: 'No action required', credentialBoundary: 'Credential boundary', credentialCopy: 'No identity credential or passkey is stored in the person record.', evidenceDrawer: 'Evidence drawer', evidenceTitle: 'Decision packet evidence', evidenceCopy: 'These references are reviewable inputs. They do not make an autonomous employment decision.', evidenceOne: 'Structured interview criterion ratings', evidenceTwo: 'SME-approved job profile version 4', evidenceThree: 'Human reviewer reason and purpose record', close: 'Close', changeLanguage: 'Change language to 한국어', requestEvidence: 'Request more evidence', highImpactConfirmation: 'High-impact confirmation', correctHistoryTitle: 'Correct history', confirmationCopy: 'A correction remains a draft until a human confirms the actor, purpose, reason, and evidence context.', reason: 'Reason', reasonPlaceholder: 'Required', draftConfirmed: 'Draft correction confirmed for local fixture evidence; no API mutation was sent.', cancel: 'Cancel', confirm: 'Confirm correction'
+ },
+ ko: {
+ productLabel: '근거 중심 HRIS', workspaceLabel: '사람 워크스페이스', apiBoundary: '보호된 People API 경계: 이 픽스처에서는 연결되지 않음', fixtureMode: '로컬 픽스처 모드', hrHome: 'HR 홈', employeeProfile: '직원 프로필', fixtureBadge: '픽스처 근거', hrHomeBreadcrumb: 'Orgmetra / HR 홈', employeeProfileBreadcrumb: 'Orgmetra / 직원 프로필', today: '오늘', hiringReview: '근거 검토가 필요한 채용 결정', positionChanges: '다음 주 효력이 시작되는 직위 변경', validationApproval: '승인이 필요한 타당도 연구', workQueue: '작업 큐', nextActions: '다음 작업', reviewEvidence: '근거 검토', reviewEvidenceDetail: '결정 패킷을 승인하거나 반환', effectiveConflicts: '효력일 충돌', effectiveConflictsDetail: '직원 이력 타임라인 확인', validityStudy: '타당도 연구 열기', validityStudyDetail: '지원 근거 버전 검토', evidenceState: '근거 상태', readyForReview: '사람 검토 대기', reviewState: '검토', reviewCopy: '고위험 작업 전에 행위자, 목적, 사유, 근거 버전을 표시합니다.', actor: '행위자', purpose: '목적', source: '출처', personSummary: '사람 요약', sampleEmployee: '샘플 직원', syntheticRecord: '로컬 상호작용 증명을 위한 합성 레코드', authorized: 'HR 운영 접근', person: '사람', personValue: '식별 및 이름 사실', employment: '고용', employmentValue: '근로자 관계', position: '직위', positionValue: 'AI 제품 아키텍트', assignment: '배정', assignmentValue: '플랫폼 60% · 거버넌스 40%', accessPurpose: '접근 목적', hrOperations: 'HR 운영', recruiting: '채용', viewPersonalDetails: '개인 상세 보기', correctHistory: '이력 정정', permissionDenied: '권한 거부', permissionDeniedCopy: '이 목적에는 개인 상세 접근 권한이 없습니다. 허용된 HR 목적을 선택하거나 접근을 요청하세요.', detailsVisible: '개인 상세 표시', detailsVisibleCopy: '이 픽스처의 목적 기반 접근을 평가하고 감사 기록을 남겼습니다.', bitemporalHistory: '이중 시간 이력', historyTitle: '효력 시간과 기록 시간', readOnly: '읽기 전용 스냅샷', historyCaption: '효력 시간과 기록 시간을 포함한 직원 이력', record: '레코드', effectiveTime: '효력 시간', recordedTime: '기록 시간', state: '상태', active: '활성', pendingReview: '검토 대기', assignmentSplit: '배정 비율', capacityTitle: '표시된 할당 용량', assignmentCaption: '정확한 배정 할당 값', assignmentName: '배정', allocation: '할당', nextAction: '다음 작업', noAction: '조치 필요 없음', credentialBoundary: '자격 증명 경계', credentialCopy: '사람 레코드에 신원 자격 증명이나 패스키를 저장하지 않습니다.', evidenceDrawer: '근거 서랍', evidenceTitle: '결정 패킷 근거', evidenceCopy: '검토 가능한 입력이며 자율적인 고용 결정을 만들지 않습니다.', evidenceOne: '구조화 면접 기준 평정', evidenceTwo: 'SME 승인 직무 프로필 버전 4', evidenceThree: '사람 검토자의 사유 및 목적 기록', close: '닫기', changeLanguage: '언어를 English로 변경', requestEvidence: '추가 근거 요청', highImpactConfirmation: '고위험 작업 확인', correctHistoryTitle: '이력 정정', confirmationCopy: '행위자, 목적, 사유, 근거 맥락을 사람이 확인하기 전까지 정정은 초안으로 남습니다.', reason: '사유', reasonPlaceholder: '필수', draftConfirmed: '로컬 픽스처 근거에 정정 초안을 확인했으며 API 변경은 전송하지 않았습니다.', cancel: '취소', confirm: '정정 확인'
+ }
+};
+
+Object.assign(translations.en, {
+ jobAnalysis: 'Job Analysis',
+ jobAnalysisBadge: 'API-bound read',
+ jobAnalysisBreadcrumb: 'Orgmetra / Job Analysis',
+ jobAnalysisTitle: 'Job Analysis snapshot',
+ jobAnalysisCopy: 'Read one governed, bitemporal job-analysis snapshot from the protected API.',
+ jobAnalysisTenant: 'Tenant record ID',
+ jobAnalysisRecord: 'Analysis record ID',
+ jobAnalysisPurpose: 'Purpose code',
+ jobAnalysisLoad: 'Load snapshot',
+ jobAnalysisReady: 'Ready to request a protected snapshot.',
+ jobAnalysisNotConfigured: 'Not connected: the host must provide an API base URL and authorization provider.',
+ jobAnalysisLoading: 'Loading governed snapshot…',
+ jobAnalysisLoaded: 'Snapshot loaded from the protected Job Analysis API.',
+ jobAnalysisDenied: 'The protected API denied this request. Verify the purpose and host authorization.',
+ jobAnalysisFailed: 'The protected API could not return this snapshot. No local fallback was used.',
+ jobAnalysisSummary: 'Snapshot evidence',
+ jobAnalysisAnalysisId: 'Analysis record',
+ jobAnalysisStatus: 'Status',
+ jobAnalysisEffective: 'Effective from',
+ jobAnalysisRecorded: 'Recorded at',
+ jobAnalysisTasks: 'Tasks',
+ jobAnalysisKsaos: 'KSAO requirements',
+ jobAnalysisNoValues: 'No snapshot values loaded.',
+ peopleApiBadge: 'API-bound read',
+ peopleApiTitle: 'Protected People record',
+ peopleApiCopy: 'Read one authorized worker record from the protected People API.',
+ peopleApiTenant: 'Tenant record ID',
+ peopleApiPerson: 'Person record ID',
+ peopleApiEffective: 'Effective date',
+ peopleApiPurpose: 'Purpose code',
+ peopleApiFields: 'Requested fields',
+ peopleApiLoad: 'Load worker record',
+ peopleApiReady: 'Ready to request a protected worker record.',
+ peopleApiNotConfigured: 'Not connected: the host must provide a People API URL and authorization provider.',
+ peopleApiLoading: 'Loading the authorized worker record…',
+ peopleApiLoaded: 'Worker record loaded from the protected People API.',
+ peopleApiDenied: 'The protected People API denied this request. Verify purpose and authorization.',
+ peopleApiFailed: 'The protected People API could not return this record. No local fallback was used.',
+ peopleApiDisplayName: 'Authorized display name',
+ peopleApiEmploymentStatus: 'Employment status',
+ peopleApiNoValues: 'No protected People API values loaded.',
+});
+Object.assign(translations.ko, {
+ jobAnalysis: '직무 분석',
+ jobAnalysisBadge: 'API 연결 읽기',
+ jobAnalysisBreadcrumb: 'Orgmetra / 직무 분석',
+ jobAnalysisTitle: '직무 분석 스냅샷',
+ jobAnalysisCopy: '보호된 API에서 하나의 거버넌스 적용 이중 시간 직무 분석 스냅샷을 읽습니다.',
+ jobAnalysisTenant: '테넌트 레코드 ID',
+ jobAnalysisRecord: '분석 레코드 ID',
+ jobAnalysisPurpose: '목적 코드',
+ jobAnalysisLoad: '스냅샷 불러오기',
+ jobAnalysisReady: '보호된 스냅샷을 요청할 준비가 되었습니다.',
+ jobAnalysisNotConfigured: '연결되지 않음: 호스트가 API 기본 URL과 인증 제공자를 제공해야 합니다.',
+ jobAnalysisLoading: '거버넌스 적용 스냅샷을 불러오는 중…',
+ jobAnalysisLoaded: '보호된 직무 분석 API에서 스냅샷을 불러왔습니다.',
+ jobAnalysisDenied: '보호된 API가 요청을 거부했습니다. 목적과 호스트 인증을 확인하세요.',
+ jobAnalysisFailed: '보호된 API에서 이 스냅샷을 반환하지 못했습니다. 로컬 대체 데이터는 사용하지 않았습니다.',
+ jobAnalysisSummary: '스냅샷 근거',
+ jobAnalysisAnalysisId: '분석 레코드',
+ jobAnalysisStatus: '상태',
+ jobAnalysisEffective: '효력 시작일',
+ jobAnalysisRecorded: '기록 시각',
+ jobAnalysisTasks: '과업',
+ jobAnalysisKsaos: 'KSAO 요구사항',
+ jobAnalysisNoValues: '불러온 스냅샷 값이 없습니다.',
+ peopleApiBadge: 'API 연결 읽기',
+ peopleApiTitle: '보호된 People 레코드',
+ peopleApiCopy: '보호된 People API에서 권한이 부여된 근로자 레코드 하나를 읽습니다.',
+ peopleApiTenant: '테넌트 레코드 ID',
+ peopleApiPerson: '사람 레코드 ID',
+ peopleApiEffective: '효력 기준일',
+ peopleApiPurpose: '목적 코드',
+ peopleApiFields: '요청 필드',
+ peopleApiLoad: '근로자 레코드 불러오기',
+ peopleApiReady: '보호된 근로자 레코드를 요청할 준비가 되었습니다.',
+ peopleApiNotConfigured: '연결되지 않음: 호스트가 People API URL과 인증 제공자를 제공해야 합니다.',
+ peopleApiLoading: '권한이 부여된 근로자 레코드를 불러오는 중…',
+ peopleApiLoaded: '보호된 People API에서 근로자 레코드를 불러왔습니다.',
+ peopleApiDenied: '보호된 People API가 요청을 거부했습니다. 목적과 인증을 확인하세요.',
+ peopleApiFailed: '보호된 People API에서 레코드를 반환하지 못했습니다. 로컬 대체 데이터는 사용하지 않았습니다.',
+ peopleApiDisplayName: '권한이 부여된 표시 이름',
+ peopleApiEmploymentStatus: '고용 상태',
+ peopleApiNoValues: '불러온 보호된 People API 값이 없습니다.',
+});
+
+/**
+ * Return whether the selected purpose is allowed to reveal personal details.
+ * @param {string} purpose Purpose code selected by the reviewer.
+ * @returns {boolean} True only for the fixture's HR-operations purpose.
+ */
+export function isPurposeAuthorized(purpose) {
+ return purpose === 'hr_operations';
+}
+
+/**
+ * Return the alternate supported workspace locale.
+ * @param {string} locale Current locale code.
+ * @returns {'en'|'ko'} The other supported locale; unknown values fall back to English.
+ */
+export function nextLocale(locale) {
+ return locale === 'en' ? 'ko' : 'en';
+}
+
+/**
+ * Build the protected Job Analysis snapshot URL after validating required identifiers.
+ * @param {{baseUrl: string, tenantRecordId: string, analysisRecordId: string}} config Request coordinates.
+ * @returns {string} Encoded snapshot URL.
+ * @throws {Error} If the base URL, tenant record ID, or analysis record ID is missing.
+ */
+export function jobAnalysisSnapshotUrl(config) {
+ if (!config || typeof config.baseUrl !== 'string' || !config.baseUrl.trim()) {
+ throw new Error('Job Analysis API base URL is not configured.');
+ }
+ if (typeof config.tenantRecordId !== 'string' || !config.tenantRecordId.trim()) {
+ throw new Error('Tenant record ID is required.');
+ }
+ if (typeof config.analysisRecordId !== 'string' || !config.analysisRecordId.trim()) {
+ throw new Error('Analysis record ID is required.');
+ }
+ return `${config.baseUrl.replace(/\/$/, '')}/v1/tenants/${encodeURIComponent(config.tenantRecordId)}/job-analysis-snapshots/${encodeURIComponent(config.analysisRecordId)}`;
+}
+
+/**
+ * Read one protected Job Analysis snapshot using a host-provided short-lived credential.
+ * The credential is used only for this request and is never persisted by the workspace.
+ * @param {{getAuthorization: Function, purposeCode?: string} & Record} config Protected-read configuration.
+ * @param {typeof fetch} fetchImpl Fetch implementation, injectable for tests.
+ * @param {() => boolean} isCurrentRequest Synchronous workspace-generation check before dispatch; omitted callers have no generation fence.
+ * @returns {Promise