feat: deliver workspace evidence board and source-grounded ontology surface

.env.example

@@ -27,6 +27,20 @@ OIDC_AUDIENCE=lineageweave-api
 
 BACKEND_PORT=18420
 
+# Dedicated authenticated Streamable HTTP MCP resource server (ADR 0031).
+# A browser client requires an exact Origin; leave empty for non-browser
+# clients such as Codex. Never use `*` and never include a path.
+MCP_PORT=18001
+MCP_REQUIRED_SCOPES=
+MCP_ALLOWED_ORIGINS=
+# The server counts actual streamed bytes before OAuth or SDK JSON parsing.
+# Valid range: 8192..1048576; default: 65536 bytes (ADR 0119).
+MCP_MAX_REQUEST_BYTES=65536
+# Shared Valkey quota for provisioned MCP accounts (ADR 0146).
+# Requests: 1..10000; window seconds: 1..3600.
+MCP_RATE_LIMIT_REQUESTS=30
+MCP_RATE_LIMIT_WINDOW_SECONDS=60
+
 # Optional. Empty = every LLM/vision channel is unavailable (Null client,
 # dropped and renormalized -- never a placeholder score). Point these at a
 # running contextual-orchestrator to turn the channels on.

AGENTS.md

@@ -170,6 +170,26 @@ adjudication does -- never a raw LLM API. Demo TEPP seed goes through
 envelope is Failed (`tepp_not_available` / `tepp_result_not_persisted`),
 never a fabricated theta or a local psychometric substitute.
 
+Workspace **Weekly VOC** is an ISO-8601 week list filter (ADR 0092).
+Opening that filtered post focuses Event Lineage (ADR 0093). Do not
+invent a week, a theta, or a cutoff body.
+Opening a Calendar commitment uses the same focus path (ADR 0094). Do not
+invent a week, a theta, a cutoff body, or a CalDAV event.
+Opening a Customer master related post uses the same focus path (ADR 0095).
+Do not invent a week, a theta, a cutoff body, a CalDAV event, or a customer.
+ Opening an Ask Agent cited post uses the same focus path (ADR 0096).
+ Do not invent a cited post.
+ A linked Event Lineage node opened from that focused popup keeps the
+ originating flags (ADR 0097). That open then focuses Keyman as the named
+next read (ADR 0100). Do not invent a week, a theta, a cutoff body,
+ a CalDAV event, a customer, or a cited post.
+
+Ask Agent accepts an optional knowledge cutoff (ADR 0135). A dated
+question uses retained revisions and never substitutes a live body. A
+live query is never labeled as-of. Do not invent a cutoff body or a
+TEPP theta.
+
+
 ## Tests
 
 ```bash

ARCHITECTURE.md

@@ -45,7 +45,7 @@ flowchart LR
 
     subgraph External services, all optional
         EMB[Embedding provider<br/>swap in for the text channel]
-        ORC[contextual-orchestrator<br/>mode=verify, llm channel]
+        ORC[contextual-orchestrator<br/>mode=auto, llm and vision channels]
         TEPP[TEPP<br/>AnalysisRunRequest v1,<br/>calibrated measurement]
     end
 
@@ -69,6 +69,8 @@ flowchart LR
 | `rankweave_client.py` | Fail-closed RankWeave ranking port (`weighted_reciprocal_rank_fuse` in-process; never invent a fused score or a theta) |
 | `reconstruct.py` | The pipeline: group → candidate window → score → fuse → thread |
 | `lineage_persistence.py` | Flattens reconstruct trees into `post_lineage_edge` row specs (parent, child, fused_score) |
+| `external_lineage_contract.py` | Sole versioned, store-agnostic external boundary for bounded authorized evidence and opaque-reference results (ADR 0133) |
+| `external_lineage_analysis.py` | Adapts the external contract to the existing reconstruction kernel without database or provider authority |
 | `knowledge_graph.py` | Random-walk-with-restart relevance + per-node adaptive related-node cutoff (Tong et al., 2006) -- pure graph math, no Postgres |
 | `keyman_extraction.py` | Pluggable LLM extraction of two-sided (our-side/counterparty) person mentions + N:N org affiliations from a post |
 | `entity_relationship_classification.py` | Pluggable LLM classification of a named organization's relationship to the post author (`rel_voc`/`rel_vom`/`rel_vop`/`rel_vocc`/`rel_voco`/`rel_vos`) |
@@ -82,19 +84,15 @@ flowchart LR
 | `period_report.py` | Fit GRM/GPCM on persisted IRT rows, FIPC-select, EAP-score a period (ADR 0003 slice 3; Bock & Mislevy, 1982) |
 | `fixtures.py` | Synthetic demo dataset -- no real data ships in this repo |
 | `server.py` | Legacy stdlib HTTP server for the library-level synthetic fixture demo; production uses FastAPI/PostgreSQL |
+| `backend/app/mcp_server.py` | OAuth-protected Streamable HTTP MCP resource server exposing read-only, evidence-grounded Global Ask |
 | `web/index.html` | Legacy self-contained SVG DAG viewer; production UI is the React/Vite frontend |
 
-> **Known local-test-environment limitation:** `adjudication_client.py`'s
-> `mode="verify"` call depends on contextual-orchestrator's
-> `TaskOrchestrator.route_and_verify`, which as of this writing is still
-> an open, unmerged upstream PR
-> (`ContextualWisdomLab/contextual-orchestrator#149`). Until it merges,
-> the four adjudication/chat tests that exercise `mode="verify"` against
-> a real orchestrator fail with `invalid_mode` (the deployed `main` only
-> accepts `auto`/`route`/`conduct`) -- confirmed by reproducing the same
-> `400` directly against the orchestrator's own `/v1/chat/completions`,
-> not caused by anything in this repo. `mode="route"` (every other
-> pluggable client) is unaffected.
+> **Contextual-orchestrator contract:** Post Ask and MCP Global Ask use
+> `mode="auto"` and `reasoning_effort="auto"`; the gateway owns model
+> discovery, provider protocol, and multi-agent reasoning. Requests carry a
+> stable post-scoped session id and non-secret evidence metadata. Structured
+> responses use `json_schema`. LineageWeave never calls a provider directly
+> or falls back to the rejected legacy `verify` mode.
 
 ## Design decisions worth naming
 
@@ -260,6 +258,11 @@ raw HTTP status. After that 503 the free-text Ask box is hidden and
 only seeded question chips remain -- never a fabricated answer. Evaluate, Extract
 Keymen, Derive commitment, and Verify use the same 503 empty-state
 pattern and then hide the action button so it cannot 503 again.
+Persisted Ask-history reads are bounded to 64 exchanges and 256 citation
+occurrences (ADR 0131). One query loads the ordered history and one query
+reauthorizes every citation against tenant ABAC, publication eligibility, and
+its exchange-specific knowledge cutoff. An over-budget history is withheld
+rather than partially returned.
 `find_linked_post_ids` first expands to every post
 sharing a mentioned person before calling
 `backend/app/knowledge_graph.py::load_visible_subgraph` -- that function
@@ -280,7 +283,17 @@ Keycloak (`src/main.tsx`'s `AuthProvider`) -- no mocked auth, no static
 HTML. `src/api.ts` calls the FastAPI backend directly with the token
 Keycloak issued; `src/App.tsx` renders a git-branch SVG of
 `GET /api/lineage` (click a node to open that post; `post_admin` can
-rebuild), the post list, and a full detail popup: Korean
+rebuild), the post list with a named Weekly VOC ISO-8601 week filter
+(ADR 0092; opening that filtered post focuses Event Lineage, ADR 0093).
+Calendar commitments use the same Event Lineage focus path (ADR 0094).
+Customer master related posts use the same Event Lineage focus path
+(ADR 0095). Ask Agent cited posts use the same Event Lineage focus path
+(ADR 0096). A linked Event Lineage node opened from a focused popup keeps
+those flags (ADR 0097). Ask Agent accepts an optional knowledge cutoff
+and uses retained `source_post_revision` bodies for that clock (ADR 0135);
+a live query is never labeled as-of. The full detail popup includes Korean
+and focuses Keyman as the named next read (ADR 0100). The full detail
+popup includes Korean
 summary/key-events/R&R, VOC evidence excerpts, an Event Lineage panel
 (direct vs. indirect links; a link opens that post), the Keyman
 affiliate tree (resolved ancestors plus unresolved org roots), Keyman +
@@ -336,6 +349,13 @@ Keyman sides are labeled from `common_lookup_value` (`Our side`,
 codes when a label exists. Related-node person chips use the same
 side lookup label (for example, `Our side` or `Counterparty`) rather
 than exposing the generic PROV-O `Person` class as business context.
+When a person has several distinct affiliation identities, the API emits
+`affiliation_ambiguous` and the reusable `RelatedNodeChip` says
+`multiple organizations`; it never chooses the first row as a primary.
+When exactly one identity remains, the chip includes that organization.
+Organization chips use the cataloged entity-level label and post chips use
+the source title only. The full N:N list stays visible on the Keyman panel,
+which names the next action before the reader continues the walk.
 
 `GET /api/posts` and `GET /api/posts/{post_id}` include
 `voc_type_label` / `visibility_label` from `common_lookup_value` so
@@ -367,7 +387,9 @@ close the one product-brief item with a schema table (`issue_ticket`)
 but no implementation through Phase 4. Deliberately plain CRUD, not a
 pluggable-LLM channel like `keyman_ingestion.py` -- ticket status is a
 closed enum in `common_lookup_value`, and opening or updating a ticket
-is a direct user action, not something extracted from text.
+is a direct user action, not something extracted from text. Ticket writes
+also require `post_admin` plus authorship or corporate affiliation with the
+owning post; public visibility is read access only (ADR 0122).
 `frontend/src/App.tsx`'s `IssueTicketPanel` is the popup's real
 list/create/status-update UI for it. Status options show
 `common_lookup_value` labels (`Open` / `In progress` / `Closed`)

CHANGELOG.d/2.12.0-weekly-voc-iso-week.md

@@ -0,0 +1,5 @@
+# 2.12.0 Weekly VOC ISO-week list filter
+
+Weekly VOC on Board keeps Voice of Customer posts for the latest ISO-8601
+week (UTC Thursday rule). Other VOC types and older weeks drop out. The
+Board names Event Lineage as the next read. No TEPP theta is invented.

CHANGELOG.d/2.12.6-frontend-build-gate.md

@@ -0,0 +1,3 @@
+## Fixed
+
+- Keep the unauthenticated login surface free of authenticated admin controls and remove unused OIDC imports so TypeScript production builds pass.

CHANGELOG.d/2.12.6-oidc-return-storage.md

@@ -0,0 +1,7 @@
+# 2.12.6 — Preserve Buyer deep links during OIDC redirect
+
+## Fixed
+
+- Save the bounded Buyer return URL before SSO redirect so a provider that
+  omits the OIDC state payload can still return the member to the requested
+  evidence page.

CHANGELOG.d/2.12.6-provider-error-boundary.md

@@ -0,0 +1,5 @@
+## Fixed
+
+- Keep contextual-orchestrator, OIDC, RankWeave, TEPP, and durable-ingestion diagnostics behind stable product error boundaries while retaining the original exception for server-side chaining.
+- Route browser transport and tenant-settings failures through the same boundary so 5xx provider details never reach buyer-facing error text.
+- Keep browser 5xx and transport failures behind the same stable client error boundary.

CHANGELOG.d/2.12.6-remove-self-modifying-repair-workflows.md

@@ -0,0 +1,5 @@
+## Fixed
+
+- Removed completed repair-only GitHub Actions that could write to feature
+  branches. Product fixes now require ordinary reviewed commits and the normal
+  protected Checks path.

CHANGELOG.d/2.12.7-korean-search-boundary.md

@@ -0,0 +1,7 @@
+# 2.12.7 — Preserve Korean search corroboration boundaries
+
+## Fixed
+
+- Accept a Korean organization token followed by a grammatical particle in a
+  natural Searxng snippet while still rejecting the token inside a longer
+  unrelated Hangul word.

CHANGELOG.d/2.12.7-lineage-dag-evidence.md

@@ -0,0 +1,8 @@
+### Changed
+
+- Made the buyer Event Lineage DAG explicitly directional with parent-to-child arrowheads whose paths stop outside node circles.
+- Preserved authored graph width behind a keyboard-focusable horizontal scroll region instead of shrinking deep lineages.
+- Added visible event dates, a redundant visual/text legend, and an accessible exact-value evidence table for lineage relations, dates, and fused scores.
+- Added five-locale buyer copy stating that reconstructed continuation edges do not prove causality or authoritative fact.
+- Replaced the internal "seed posts" empty-state language with an actionable five-locale instruction to add eligible source records and rebuild Event Lineage.
+- Added synthetic Storybook states for branching, selected-root, isolated-root, and empty lineage surfaces.

CHANGELOG.d/2.12.8-ontology-org-shacl.md

@@ -0,0 +1,13 @@
+# 2.12.8 Organization ontology and SHACL boundaries
+
+The core Knowledge Graph ontology now distinguishes real organizations from
+the concepts used to classify them. `CorporateEntity` and `Team` reuse W3C ORG
+organization, organizational-unit, containment, and unit-membership semantics;
+SKOS remains responsible for Group, Company, and Plant level concepts and
+canonical/alternative labels.
+
+The ontology now publishes stable version/import metadata and a companion
+versioned SHACL graph. Regression tests cover the ORG/SKOS boundary, direct
+parent and team-owner cardinalities, and the continued relational lookup-code
+round trip. PostgreSQL remains authoritative and ontology imports are never
+network-dereferenced at runtime.

CHANGELOG.d/2.13.0-weekly-voc-open-event-lineage.md

@@ -0,0 +1,6 @@
+# 2.13.0 Opening Weekly VOC focuses Event Lineage
+
+Open a Voice of Customer post from an active Weekly VOC filter and the
+popup Event Lineage heading takes focus. The popup names that post as
+current and to read Keyman and evaluation next. Home-list opens do not.
+No TEPP theta is invented.

CHANGELOG.d/2.13.1-mcp-browser-admission.md

@@ -0,0 +1,23 @@
+# 2.13.1 — MCP browser and request-byte admission
+
+## Fixed
+
+- Browser MCP clients can complete an exact-Origin CORS preflight before OAuth
+  while wildcard, prefix, suffix, `null`, and unrelated Origins fail closed.
+- Unsafe configured Origins now prevent startup instead of weakening the exact
+  allowlist into wildcard, credential-bearing, or path-bearing CORS.
+- Origin-sensitive MCP responses vary by Origin and expose only the protocol,
+  session, and `WWW-Authenticate` headers needed for Streamable HTTP and OAuth
+  protected-resource discovery.
+- MCP POST bodies are bounded by actual streamed bytes before OAuth and SDK JSON
+  decoding. Ambiguous framing, declared/actual mismatches, malformed body
+  streams, and over-limit requests return stable no-store errors without
+  echoing request content.
+- Non-browser MCP clients may continue to omit `Origin`.
+
+## Operations
+
+- Added `MCP_MAX_REQUEST_BYTES` with a 65,536-byte default and an explicit
+  8,192–1,048,576-byte startup-validated range.
+- Docker Compose, `.env.example`, integration guidance, ADR 0119, and MCP
+  standards traceability now share the same browser and body-admission contract.

CHANGELOG.d/2.14.0-calendar-open-event-lineage.md

@@ -0,0 +1,5 @@
+# 2.14.0 Opening a Calendar commitment focuses Event Lineage
+
+Calendar names authorized commitments as current and to open one to read
+Event Lineage. That open focuses the popup Event Lineage heading. Home-list
+opens do not. No TEPP theta is invented.

CHANGELOG.d/2.15.0-customer-hierarchy-boundary.md

@@ -0,0 +1,7 @@
+# 2.15.0 — Keep unresolved customer parents non-authoritative
+
+## Fixed
+
+- A self-parent or cyclic customer relation now remains visibly unresolved in
+  the focus workspace instead of being presented as a valid parent. Review the
+  source hierarchy before using that relationship for navigation.

CHANGELOG.d/2.15.0-customer-master-open-event-lineage.md

@@ -0,0 +1,11 @@
+# 2.15.0 Opening a Customer master related post focuses Event Lineage
+
+Customer master names authorized customer entities as current and to open a
+related post to read Event Lineage. That open focuses the popup Event Lineage
+heading. Home-list opens do not. No TEPP theta is invented.
+
+Customer Master now keeps one customer at the center of a responsive three-pane
+workspace: authorized hierarchy, visible parent/direct-child relationships, and
+source-backed linked evidence. Closing evidence no longer loses the selected
+customer context. Desktop, tablet, and phone layouts use the shared UI tokens
+and the 1024 px / 768 px responsive boundaries.

CHANGELOG.d/2.16.0-ask-agent-open-event-lineage.md

@@ -0,0 +1,5 @@
+# 2.16.0 Opening an Ask Agent cited post focuses Event Lineage
+
+Ask Agent names authorized cited posts as current after an answer and to
+open one to read Event Lineage. That open focuses the popup Event Lineage
+heading. Home-list opens do not. No TEPP theta is invented.

CHANGELOG.d/2.16.0-pr262-hardening.md

@@ -0,0 +1,6 @@
+### Fixed
+
+- Keep embedded source images visible when a post also contains a Markdown
+  table, and remove the privileged self-modifying contract-repair workflow.
+- Align the Python package version and ontology ADR reference with the 2.16.0
+  release.

CHANGELOG.d/2.17.0-event-lineage-node-keeps-gnb-focus.md

@@ -0,0 +1,9 @@
+# 2.17.0 A linked Event Lineage node keeps GNB focus
+
+Opening a linked Event Lineage DAG node from a GNB-focused popup keeps
+Event Lineage focused and names Keyman and evaluation next. A home-list
+DAG walk does not. No TEPP theta is invented.
+
+Ask Agent now replaces an expired saved session once, then stores the new
+session. The Event Lineage timeline heading, list, and post-button
+accessibility labels are translated in the supported locales.

CHANGELOG.d/2.17.0-image-and-summary-boundaries.md

@@ -0,0 +1,8 @@
+# 2.17.0 — Preserve table image boundaries and avoid duplicate summaries
+
+## Fixed
+
+- Inline or invalid images no longer split a table row or surrounding
+  paragraph into disconnected semantic units.
+- Opening a post requests its summary once; the explicit retry action remains
+  the only path that requests another summary.