feat: deliver workspace evidence board and source-grounded ontology surface

.env.example

@@ -19,6 +19,7 @@ VALKEY_PORT=16379
 KEYCLOAK_ADMIN=admin
 KEYCLOAK_ADMIN_PASSWORD=admin_dev_only
 KEYCLOAK_PORT=18080
+OIDC_CLOCK_SKEW_SECONDS=5
 
 BACKEND_PORT=18420
 
@@ -28,3 +29,16 @@ BACKEND_PORT=18420
 ORCHESTRATOR_BASE_URL=
 ORCHESTRATOR_API_KEY=
 VISION_MODEL=
+
+# GitHub workflows inject the canonical provider names from masked secrets.
+# Non-GitHub Compose runs also accept the operator's ~/.env compatibility
+# names below; docker-compose maps them to the canonical names without
+# exposing them to the frontend or committing them.
+LLM_GATEWAY_URL=
+LLM_GATEWAY_API_KEY=
+LLM_GATEWAY_MODEL=
+LLM_GATEWAY_EMBEDDING_MODEL=
+LLM_API_GATEWAY=
+LLM_API_KEY=
+CALDAV_BASE_URL=
+CONTEXTUAL_ORCHESTRATOR_ALLOWED_PROVIDER_HOSTS=

.github/workflows/prov-o-contract.yml

@@ -0,0 +1,94 @@
+name: PROV-O contract
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "lineageweave/prov_o.py"
+      - "tests/test_prov_o.py"
+      - "tests/test_prov_o_schema.py"
+      - "migrations/0017_prov_o_standard_relations.sql"
+      - "docs/ontology/prov-o-support-profile.ttl"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/prov-o-contract.yml"
+  push:
+    branches: [main]
+    paths:
+      - "lineageweave/prov_o.py"
+      - "tests/test_prov_o.py"
+      - "tests/test_prov_o_schema.py"
+      - "migrations/0017_prov_o_standard_relations.sql"
+      - "docs/ontology/prov-o-support-profile.ttl"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/prov-o-contract.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: prov-o-contract-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  standards-contract:
+    name: Registry, inference, coverage, PostgreSQL
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      LINEAGEWEAVE_TEST_POSTGRES_ADMIN_DSN: postgresql://postgres:postgres@localhost:5432/postgres
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Set up locked Python dependency manager
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.28"
+          enable-cache: false
+
+      - name: Install the committed universal lock
+        run: uv sync --frozen --extra dev
+
+      - name: Verify complete relation behavior and 100 percent coverage
+        run: |
+          uv run --frozen python -m coverage run --branch --source=lineageweave.prov_o \
+            -m pytest -q tests/test_prov_o.py
+          uv run --frozen python -m coverage report --fail-under=100 lineageweave/prov_o.py
+
+      - name: Require a reachable PostgreSQL service
+        run: |
+          set -euo pipefail
+          for _ in $(seq 1 30); do
+            if pg_isready -h localhost -p 5432 -U postgres; then
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "PostgreSQL service is unreachable; the schema contract would silently skip." >&2
+          exit 1
+
+      - name: Verify normalized PostgreSQL contracts
+        run: uv run --frozen python -m pytest -q tests/test_prov_o_schema.py
+
+      - name: Compile owned Python surface
+        run: uv run --frozen python -m compileall -q lineageweave/prov_o.py tests/test_prov_o.py tests/test_prov_o_schema.py

.github/workflows/tests.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
 
 permissions:
   contents: read
@@ -17,6 +16,20 @@ jobs:
   pytest:
     name: Full test suite
     runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      LINEAGEWEAVE_TEST_POSTGRES_ADMIN_DSN: postgresql://postgres:postgres@localhost:5432/postgres
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
@@ -28,19 +41,22 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Install pinned Rust toolchain
+      - name: Set up locked dependency manager
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.28"
+          enable-cache: false
+
+      - name: Select pinned Rust toolchain
         run: |
-          # Same pin as backend/Dockerfile: fast-mlsirm's PyO3/maturin
-          # core has no wheel, so pip install -e ".[backend]" compiles it.
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
-            sh -s -- -y --profile minimal --default-toolchain 1.97.1
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
 
-      - name: Install package and test dependencies
-        run: python -m pip install -e ".[dev,backend]"
+      - name: Install the committed universal lock
+        run: uv sync --frozen --extra dev --extra backend
 
-      - name: Run full test suite
-        run: python -m pytest -q
+      - name: Run full test suite against PostgreSQL
+        run: uv run --frozen python -m pytest -q
 
   frontend:
     name: Frontend lint, test, build
@@ -54,7 +70,6 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # actions/setup-node@v5
         with:
-          # Matches frontend/mise.toml's pin (setup-node doesn't parse mise.toml).
           node-version: "24"
 
       - name: Enable Corepack
@@ -75,3 +90,7 @@ jobs:
       - name: Build
         working-directory: frontend
         run: pnpm run build
+
+      - name: Build Storybook
+        working-directory: frontend
+        run: pnpm run build-storybook

.gitignore

@@ -6,4 +6,4 @@ __pycache__/
 .DS_Store
 .codegraph/
 .env
-
+.coverage

AGENTS.md

@@ -57,7 +57,10 @@ summary/chat, or invented commitment. A missing signal and a
 confidently-negative signal are different things. Keyman extraction,
 entity-relationship classification, post summary, in-popup chat, and
 commitment derivation go through contextual-orchestrator the same way
-adjudication does -- never a raw LLM API.
+adjudication does -- never a raw LLM API. Demo TEPP seed goes through
+`tepp_client` the same way: a missing transport or an unused accepted
+envelope is Failed (`tepp_not_available` / `tepp_result_not_persisted`),
+never a fabricated theta or a local psychometric substitute.
 
 ## Tests
 
@@ -89,11 +92,49 @@ floating Node version):
 ```bash
 cd frontend && pnpm install
 pnpm run lint && pnpm run test && pnpm run build
+# Storybook inventory (ADR 0020 tokens): pnpm run build-storybook
 ```
 
+A run-bearing analysis-run registry empties only after an unrevoked
+`analysis_run_retention_grant` and `GRANT analysis_run_retention_admin`
+(ADR 0020 / v0.87.0). The documented phrase is not a secret. Do not
+expose purge on a public HTTP route.
+
+`POST /api/analysis-runs` records Pending lineage only (ADR 0017 /
+v2.7.1). TEPP and period-report kinds 422 before any snapshot write.
+`POST /api/analysis-runs/{id}/start` reconstructs a Pending lineage
+cutoff bag through `reconstruct()` / `lineage_edge_specs` (ADR 0021 /
+v0.88.0). Do not invent a theta.
+Opening a cutoff-rewritten title shows **Body this run knew** from
+`source_post_revision` beside the live rewrite (ADR 0025 / v2.1.0).
+Do not invent the earlier sentence when no revision covers the cutoff.
+
+A corporate-entity similarity result has three outcomes: unique, miss,
+or tie (ADR 0026). A tie is not a miss. Keep the organization name
+unbound and do not create an `AUTO-` catalog row, even when live name
+resolution, hierarchy inference, and verification are available. Keyman
+must test the raw organization name before any abbreviation rewrite so a
+rewrite cannot turn an existing tie into an apparent creation miss.
+
+R&R chips read the catalog id stored on `post_summary_role`
+(ADR 0019 / 0027), including `cataloged_person_id`. Do not rejoin
+`corporate_entity` or `cataloged_person` by display name. Historical
+backfill leaves a role unbound when two same-named mentions already
+exist on the post.
+
 ## CI gates
 
 `.github/workflows/tests.yml` runs the full suite on every PR to `main`.
 Do not weaken, skip, or `continue-on-error` a failing check -- fix the
 underlying cause or, for a genuine false positive in a third-party scanner,
 add a narrow, documented suppression referencing the specific finding.
+## W3C PROV-O boundary
+
+- Add standard provenance through `lineageweave.prov_o` and the
+  normalized `provenance_*` schema, never by inventing another
+  `edge_type` alias for a W3C property.
+- Qualified relations retain their Influence resource and imply the
+  corresponding unqualified relation.
+- Appendix B inverse names normalize to the preferred W3C direction;
+  do not proliferate private inverse vocabulary.
+- Keep `knowledge_graph_edge` an explicit navigation projection.