fix: strip Keycloak OIDC callback params from the post share link

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.codegraph
+.venv
+node_modules
+frontend/node_modules
+frontend/dist
+frontend/coverage
+**/__pycache__
+**/.pytest_cache
+**/.ruff_cache
+**/.mypy_cache

.github/workflows/tests.yml

@@ -28,6 +28,15 @@ jobs:
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
+      valkey:
+        image: valkey/valkey:8-alpine@sha256:a038175878d66b9d274fbf8be73c0305e93798b83917647f167e18cef3c71eec
+        ports:
+          - 16379:6379
+        options: >-
+          --health-cmd "valkey-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
     env:
       LINEAGEWEAVE_TEST_POSTGRES_ADMIN_DSN: postgresql://postgres:postgres@localhost:5432/postgres
     steps:
@@ -36,6 +45,25 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Start synthetic Keycloak realm
+        run: |
+          docker build --tag lineageweave-keycloak-test docker/keycloak
+          docker run --detach --name lineageweave-keycloak-test \
+            --publish 18080:8080 \
+            --env KEYCLOAK_ADMIN=admin \
+            --env KEYCLOAK_ADMIN_PASSWORD=admin_dev_only \
+            lineageweave-keycloak-test start-dev --import-realm
+          for _ in {1..60}; do
+            if curl --fail --silent \
+              http://localhost:18080/realms/lineageweave-demo/.well-known/openid-configuration \
+              >/dev/null; then
+              exit 0
+            fi
+            sleep 2
+          done
+          docker logs lineageweave-keycloak-test
+          exit 1
+
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # actions/setup-python@v6
         with:

AGENTS.md

@@ -34,7 +34,7 @@ reimplementing them:
   tree assembly (`reconstruct.py`'s `_walk`/`thread_messages` calls).
 - [RankWeave](https://github.com/ContextualWisdomLab/RankWeave) for
   multi-channel score fusion (`weighted_convex_fuse` in
-  `reconstruct.py`) and the buyer-facing Rankings port
+  `reconstruct.py`) and the reader-facing Rankings port
   (`rankweave_client.py`) -- never invent a fused score or a theta.
 - [TEPP](https://github.com/ContextualWisdomLab/TEPP)'s published wire
   contract for calibrated measurement (`tepp_client.py`) -- never
@@ -127,7 +127,7 @@ contextual-orchestrator owns model discovery and selection.
   retaining the original asset and provenance. Recognize image DOM/visual
   regions before OCR, descriptions, Keyman extraction, or embeddings. Store
   region-level evidence; never show an internal LLM instruction such as
-  `This post is an image` to a buyer.
+  `This post is an image` to a reader.
 
 ## Source parsing and semantic units
 
@@ -146,10 +146,10 @@ contextual-orchestrator owns model discovery and selection.
 - Remove presentation-only visual line alignment inside a paragraph (for
   example continuation lines manually aligned after `-`, `*`, `1.`, or `.`)
   from derived semantic text, while retaining the source body and meaningful
-  list/heading nesting. A buyer-facing post view must render semantic
+  list/heading nesting. A reader-facing post view must render semantic
   paragraphs, not the authoring application's spacing workaround.
 - Image descriptions, OCR text, and region evidence are analysis artifacts,
-  not buyer-facing prompt instructions. Buyer UI shows the source content and
+  not reader-facing prompt instructions. The workspace UI shows the source content and
   useful captions/evidence only, with provenance where appropriate.
 
 ## Pluggable channels: never fake a missing signal
@@ -208,6 +208,11 @@ A run-bearing analysis-run registry empties only after an unrevoked
 (ADR 0020 / v0.87.0). The documented phrase is not a secret. Do not
 expose purge on a public HTTP route.
 
+Unauthenticated **Log in** must call `returnUrlFromLocation()` then
+`rememberOidcReturnUrl` before `signinRedirect` (ADR 0109) so a
+shared `/?post=` link still opens that post. Do not mount tenant admin
+settings on the signed-out login shell.
+
 `POST /api/analysis-runs` records Pending lineage only (ADR 0017 /
 v2.7.1). TEPP and period-report kinds 422 before any snapshot write.
 `POST /api/analysis-runs/{id}/start` reconstructs a Pending lineage

ARCHITECTURE.md

@@ -64,7 +64,7 @@ flowchart LR
 | `chunking.py` | Splits a document into meaning-identifiable units (paragraph, sentence, DOM, conversation-turn) plus embedded-image extraction, in document order |
 | `embedding_client.py` | Pluggable text-embedding channel (`Null` default, `OpenAiCompatible` real impl) + `chunked_max_similarity` |
 | `adjudication_client.py` | Pluggable LLM-judgment channel (`Null` default, `ContextualOrchestrator` real impl) |
-| `image_content.py` | Pluggable vision channel: OCR + object recognition/tagging for embedded images (`Null` default, `OpenAiCompatibleVisionClient` real impl). The product popup (`frontend/src/PostBody.tsx`) renders each `data:image` payload in document order so the buyer sees the picture, not the base64 string; GET does not call the vision client. |
+| `image_content.py` | Pluggable vision channel: OCR + object recognition/tagging for embedded images (`Null` default, `OpenAiCompatibleVisionClient` real impl). The product popup (`frontend/src/PostBody.tsx`) renders each `data:image` payload in document order so the reader sees the picture, not the base64 string; GET does not call the vision client. |
 | `tepp_client.py` | TEPP's published `AnalysisRunRequest` wire contract, pluggable transport |
 | `rankweave_client.py` | Fail-closed RankWeave ranking port (`weighted_reciprocal_rank_fuse` in-process; never invent a fused score or a theta) |
 | `reconstruct.py` | The pipeline: group → candidate window → score → fuse → thread |
@@ -301,7 +301,9 @@ config baked in at build time from the same `.env` ports every other
 service uses (Vite embeds `import.meta.env.VITE_*` at build time, not
 runtime, so these are Docker build args, not container env vars).
 `src/App.test.tsx` mocks `react-oidc-context`'s `useAuth` to test the
-component's own render logic (login button -> `signinRedirect()`; the
+component's own render logic (login button stores a safe return path
+then `signinRedirect()`; the signed-out shell never mounts tenant
+admin settings; the
 A-100 fork DAG shows a branch point and rec-006 as its own root;
 `post_admin` can rebuild; fetch posts with the token -> render list ->
 click -> popup shows the fetched body and every panel; ask a chat
@@ -326,7 +328,7 @@ Keymen are affiliated with (`lineageweave/affiliate_tree.py`, loaded by
 set of those leaves, not the whole company directory -- a sibling the
 post never mentions is omitted. People on the tree are buttons that
 reuse `GET /api/keymen/{person_id}/related` so the popup Keyman walk
-starts from the affiliation the buyer clicked. A resolved organization
+starts from the affiliation the reader clicked. A resolved organization
 is the same walk via `GET /api/corporate-entities/{id}/related`. An affiliation that did not resolve to
 a `corporate_entity` row stays as its own root (`resolved=false`); that
 is the same never-guess-a-parent rule
@@ -467,15 +469,15 @@ truly have no dated open tickets.
 
 ## Phase 6-M2: authorized analysis-run evidence (read projection)
 
-Issue #79's first buyer-visible Milestone 2 slice is a source-redacting
+Issue #79's first reader-visible Milestone 2 slice is a source-redacting
 read of the #89 registry. `GET /api/analysis-runs` and
 `GET /api/analysis-runs/{id}` require `post_read` and apply the scope
 in SQL: the requester always sees their own run; a corporate-entity or
 process-unit scope is visible only to affiliated accounts; a
 thread-group scope is visible only when the account can already see a
 post in that group; `all_visible` is requester-only. Hidden runs 404. Detail also lists ABAC-visible post titles in the
 run's scope whose `created_at` is at or before `knowledge_cutoff`
-(ADR 0016) so a buyer can open a post the run was allowed to know
+(ADR 0016) so a reader can open a post the run was allowed to know
 without seeing later live rows or hidden bodies. Detail also returns
 revision and configuration digest prefixes.
 `POST /api/analysis-runs` records a Pending lineage run on a new
@@ -925,7 +927,7 @@ code. Wired into both `keyman_ingestion.py`'s affiliation loop and
 ## Standards-complete W3C PROV-O provenance layer
 
 ADR 0011 separates standards-complete provenance from the compact
-buyer-facing navigation graph. `lineageweave/prov_o.py` validates
+reader-facing navigation graph. `lineageweave/prov_o.py` validates
 and materializes all 50 normative PROV-O properties, including
 literal-valued times/values and qualified Influence resources.
 `migrations/0017_prov_o_standard_relations.sql` stores definitions,

CHANGELOG.d/2.12.19-oidc-login-return-remember.md

@@ -0,0 +1,6 @@
+## 2.12.19 — Remember the login return path
+
+- Log in now stores a validated same-origin return path (ADR 0109)
+  before the OIDC redirect, so a shared `/?post=` link still opens that
+  post after callback. Tenant admin settings stay off the signed-out
+  login shell so the production frontend build type-checks.

CHANGELOG.d/2.12.6-frontend-build-gate.md

@@ -0,0 +1,3 @@
+## Fixed
+
+- Keep the unauthenticated login surface free of authenticated admin controls and remove unused OIDC imports so TypeScript production builds pass.

CHANGELOG.d/2.12.6-provider-error-boundary.md

@@ -0,0 +1,4 @@
+## Fixed
+
+- Keep contextual-orchestrator, OIDC, RankWeave, TEPP, and durable-ingestion diagnostics behind stable product error boundaries while retaining the original exception for server-side chaining.
+- Keep browser 5xx and transport failures behind the same stable client error boundary.

CHANGELOG.d/2.12.6-related-posts-unavailable.md

@@ -0,0 +1 @@
+Fixed post details to replace an endless related-post loading state with a fail-closed availability message when lineage evidence cannot be loaded.

CHANGELOG.d/2.12.6-remove-self-modifying-repair-workflows.md

@@ -0,0 +1,5 @@
+## Fixed
+
+- Removed completed repair-only GitHub Actions that could write to feature
+  branches. Product fixes now require ordinary reviewed commits and the normal
+  protected Checks path.

CHANGELOG.d/2.12.6-temporal-semantic-order.md

@@ -0,0 +1,32 @@
+### Fixed
+
+- Preserve every explicit earlier-to-later product-introduction relation as
+  OWL-Time milestone evidence, including a named base product followed by its
+  multi-stage variant.
+- Return persisted older summaries immediately as stale while operator
+  regeneration performs the dedicated relation extraction.
+- Show Knowledge Graph direction and source evidence without relying on hover.
+- Add a reproducible full-production-source frontend coverage command using
+  Vitest's matching V8 provider; the measured gap remains visible instead of
+  excluding uncovered application files.
+- Enforce repository-wide public Python docstrings with an AST contract and
+  document all 51 public definitions missing on this exact branch head.
+- Cover the frontend bootstrap and OIDC return callback at 100%, removing the
+  only production entrypoint with zero measured coverage.
+- Fail closed on unknown analysis-evidence diagnoses and keep untrusted 5xx
+  payloads behind reader-safe next-action copy.
+- Cover Global Search focus/keyboard behavior, Source Research retry and
+  reader-safe failure states, R&R affiliation navigation, and malformed
+  Lineage DAG edges without changing production behavior.
+- Cover list-filter serialization, bookmark writes, and explicit source
+  research at the shared frontend API boundary.
+- Route empty embedded-image payloads through the existing reader-facing
+  decode failure instead of rendering an empty body.
+- Fail closed on unknown analysis-run kinds/statuses and cover its lifecycle,
+  reporting, TEPP, FiveW1H, and cyclic-layout guidance boundaries.
+- Cover Knowledge Graph zoom limits, keyboard/pointer panning, post selection,
+  drag-click suppression, and dangling-edge evidence fallback.
+- Keep an unknown analysis-run kind or status reader-safe and non-interactive
+  without crashing the workspace or exposing the backend code.
+- Remove unreachable admin handoff screens while preserving direct Board
+  routing, and cover account scope, shortcuts, and tenant-save outcomes.

CHANGELOG.d/2.12.7-lineage-dag-evidence.md

@@ -0,0 +1,8 @@
+### Changed
+
+- Made the buyer Event Lineage DAG explicitly directional with parent-to-child arrowheads whose paths stop outside node circles.
+- Preserved authored graph width behind a keyboard-focusable horizontal scroll region instead of shrinking deep lineages.
+- Added visible event dates, a redundant visual/text legend, and an accessible exact-value evidence table for lineage relations, dates, and fused scores.
+- Added five-locale buyer copy stating that reconstructed continuation edges do not prove causality or authoritative fact.
+- Replaced the internal "seed posts" empty-state language with an actionable five-locale instruction to add eligible source records and rebuild Event Lineage.
+- Added synthetic Storybook states for branching, selected-root, isolated-root, and empty lineage surfaces.

CHANGELOG.d/2.16.1-planned-facility-relation.md

@@ -0,0 +1,7 @@
+## 2.16.1
+
+- Add the fail-closed `lw_plans_to_operate` semantic relationship for planned
+  facilities backed by the same literal actor/facility evidence, a matching
+  R&R actor, and an independently extracted project mention (ADR 0142).
+- Migration 0138 admits the predicate at the database write boundary on new
+  and existing Compose volumes.

CHANGELOG.d/fivew1h-empty-evidence-guidance.md

@@ -0,0 +1,6 @@
+## Buyer 5W1H evidence guidance
+
+- Explain what to inspect when a 5W1H dimension has no persisted source-grounded
+  evidence.
+- Keep the backend action code internal and provide the guidance in all supported
+  buyer locales.

CHANGELOG.d/global-ask-history-compose-replay.md

@@ -0,0 +1,4 @@
+### Fixed
+
+- Replay the Global Ask conversation-history migration in the Compose database
+  initializer so existing volumes create the tables required by Ask history.

CHANGELOG.d/image-evidence-queue.md

@@ -0,0 +1,4 @@
+## Image evidence queue
+
+- Requeue posts whose parent image or visual region VISION evidence is still
+  unavailable instead of marking them complete from text embeddings alone.

CHANGELOG.d/post-content-explicit-retry.md

@@ -0,0 +1,5 @@
+## Post-content explicit retry
+
+- Added a bounded operator command path for retrying selected terminal-failed
+  post-content jobs without reopening synthetic, draft, deleted, or writing
+  posts and without touching analysis-run registries.

CHANGELOG.d/source-identity-eligibility.md

@@ -0,0 +1,7 @@
+## Source identity eligibility
+
+- Preserve source system, record identity, stage, and detail-state metadata
+  when distinguishing imported posts from synthetic Demo seed rows and when
+  selecting content, summary, Keyman, and Valkey backfill work.
+- Reject writing-in-progress posts in direct content, Keyman, and explicit
+  retry operator paths before they can create derived evidence.

CHANGELOG.d/synthetic-seed-source-context.md

@@ -0,0 +1,6 @@
+# Synthetic seed cleanup source context
+
+- Require every `source_*` field, including lifecycle markers, system and record
+  identity, order metadata, and inspection metadata, to be empty before a
+  Demo-scoped post can be considered synthetic cleanup material.
+- Preserve imported rows that carry metadata without author or customer names.