test(ontology): JobPosition identity is fail-closed on receipt results

[jason931225]

Draft. Disjoint from UI/GATE/AUTH/inbox/#897–#910. Independent review before merge. Base 2f99f9ea.

Candidate SHA: 24f5f07b40f1138c923c69d2a31bb222de6ec3fa

identity_from_receipt_result is fail-closed: missing or non-UUID canonical ids are refused. Extra recruiting/PII keys (title, phone, salary) on a receipt result are ignored; serialized JobPositionIdentity contains only job_position_id, org_unit_id, version. Recruiting posting {title, department} without canonical ids is Err. OrgEntitySummary remains refused.

Lease: backend/crates/ontology/rest/src/job_position.rs only. No new #[test]. No /api/v1/job-positions. No OpenAPI.

Tests

SQLX_OFFLINE=true cargo test --locked --manifest-path backend/Cargo.toml -p console-ontology-rest --lib -- --nocapture

discovered 19, executed 19, passed 19. #[test] attributes in job_position.rs remain 3.

Filtered job_position tests: 3 passed, 16 filtered out.

merge-tree

0 vs origin/main (2f99f9ea) and pairwise vs 897–910 (all CLEAN, no overlapping paths):
897 c9d8c558e6a1, 898 e390a25e4ab1, 899 f861f7150bc8, 900 b4ca34abb886, 901 149445136642, 902 11645e482753, 903 5d30ddec3f0a, 904 e5164a429e8b, 905 0c2b572c52c2, 906 65fa2123621d, 907 6b8d2de89a12, 908 053b96cda1e9, 909 00ccfb2012da, 910 af25cbca7835.

Pre-mortem / blast radius

• Wrong extra-key ignore could leak phone/salary/title into identity wire JSON. Detection: serialization assertions in receipt_result_round_trips_canonical_ids.
• Treating recruiting {title, department} as a position would fabricate identity. Detection: free_text_title_alone_is_not_a_job_position_identity.
• Missing/non-UUID org_unit_id succeeding would be fail-open. Detection: assertions in the round-trip test.
• Blast radius is this decoder + its unit tests. No HTTP surface, no OpenAPI, no adapter DML.

Detection / rollback / stop

• Detection: cargo test -p console-ontology-rest --lib job_position tests.
• Rollback: revert this commit; the previous decoder remains on main.
• Stop: any OpenAPI or /api/v1/job-positions expansion; merge-tree conflict with 897–910; new #[test] function.

Review

Independent adversarial review required before merge. Not merge/release.

HOLDs

• Not merge/release. No live promo.
• JobPosition projection fan-out remains HOLD until PRODUCT owning-port conditions (already recorded there) stay checked.
• No /api/v1/job-positions route. Identity stays on ontology action receipt results.
• Frontend / /_ui HOLD unchanged.

[jason931225]

Independent adversarial review APPROVE on 24f5f07b40f1138c923c69d2a31bb222de6ec3fa (self-approval is blocked on GitHub; required_approving_review_count is 0). Binds only that SHA. Re-review after rebase.