feat: add normalized analysis-run registry (Milestone 2 slice 1)

ARCHITECTURE.md

@@ -454,6 +454,26 @@ lists the same dated tickets the period-report members already show.
 Re-seed is idempotent. The empty-state copy is only for accounts that
 truly have no dated open tickets.
 
+## Phase 6-M2: authorized analysis-run evidence (read projection)
+
+Issue #79's first buyer-visible Milestone 2 slice is a source-redacting
+read of the #89 registry. `GET /api/analysis-runs` and
+`GET /api/analysis-runs/{id}` require `post_read` and apply the scope
+in SQL: the requester always sees their own run; a corporate-entity or
+process-unit scope is visible only to affiliated accounts; a
+thread-group scope is visible only when the account can already see a
+post in that group; `all_visible` is requester-only. Hidden runs 404. Detail also lists ABAC-visible post titles in the
+run's scope so a buyer can open a post without seeing hidden rows.
+The home list is clickable: `GET /api/analysis-runs/{id}` fills a
+labeled detail (cutoff, requested date, counts, status history)
+without exposing a DSN or raw record. Status history is detail-only
+and uses lookup labels plus occurrence times; a failure event keeps
+its machine `failure_code` rather than an invented caption. The
+payload is lookup labels plus non-negative aggregate counts -- never
+source SQL, a DSN, a raw record, or a provider body. After `make seed`,
+Demo Analyst and Demo Admin see "Lineage reconstruction · Succeeded ·
+Demo Corp" with "3 documents" and Pending / Running / Succeeded times.
+
 ## Phase 6a: fast-mlsirm dependency + Rust toolchain (infra only)
 
 First of three staged slices toward the brief's weekly/monthly

CHANGELOG.d/0.79.0-analysis-run-authorized-read.md

@@ -0,0 +1,9 @@
+# 0.79.0 — Authorized analysis-run read projection
+
+## Added
+
+- `GET /api/analysis-runs` and `GET /api/analysis-runs/{id}` expose
+  source-redacting registry evidence to `post_read` accounts.
+- Home-page Analysis runs panel shows the seeded Demo Corp lineage run
+  after `make seed`. Hidden scopes 404. No raw source, DSN, or provider
+  payload is returned.

CHANGELOG.d/0.80.0-analysis-run-detail-click.md

@@ -0,0 +1,5 @@
+# 0.80.0 analysis-run detail click
+
+Home Analysis runs rows open `GET /api/analysis-runs/{id}`. The
+detail shows labeled aggregates and dates only. Hidden runs stay
+404 / "not visible". Synthetic Demo Corp seed only.

CHANGELOG.d/0.81.0-analysis-run-status-history.md

@@ -0,0 +1,5 @@
+# 0.81.0 analysis-run status history
+
+Detail of `GET /api/analysis-runs/{id}` shows the labeled append-only
+lifecycle. The list stays latest-status only. Hidden runs 404.
+Synthetic Demo Corp seed only.

CHANGELOG.d/0.82.0-analysis-run-post-clickthrough.md

@@ -0,0 +1,4 @@
+# 0.82.0 analysis-run post click-through
+
+Detail lists ABAC-visible post titles in the run scope. Hidden
+other-corp private posts never appear. Synthetic titles only.

CHANGELOG.d/milestone2-analysis-run-registry.md

@@ -0,0 +1,21 @@
+## Added
+
+- Added a normalized PostgreSQL registry for immutable source snapshots,
+  aggregate reconciliation counts, authenticated analysis requests, product
+  scopes, and append-only lifecycle evidence.
+- Added a run-owned knowledge cutoff and snapshot-owned evidence-availability
+  clock so one capture can support multiple historically valid analyses without
+  future-information leakage.
+- Added canonical account-scoped idempotency, immutable request and scope evidence,
+  deletion resistance, serialized count/run locking, scope-required request-time-
+  ordered lifecycle transitions, database-owned record time, and a derived
+  current-status view.
+- Added fail-closed rollback, real-PostgreSQL contract tests, ADR 0013, and APA
+  7th standards traceability.
+
+## Security
+
+- The registry deliberately excludes source SQL, DSNs, raw records, inline
+  images, provider payloads, credentials, private source identifiers, and raw
+  exceptions. Necessary PII remains in purpose-bound authorized product/source
+  contexts rather than being copied into audit metadata or blanket-masked.

CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to this project are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.82.0] - 2026-08-16
+
+### Added
+
+- Analysis-run detail lists ABAC-visible posts in the run's scope.
+  After `make seed`, the Demo Corp lineage run opens the Demo public
+  post. Hidden other-corp private posts never appear. List payloads
+  stay aggregates-only.
+
+## [0.81.0] - 2026-08-16
+
+### Added
+
+- Analysis-run detail shows the labeled lifecycle: Pending, Running,
+  then Succeeded, with occurrence times from `analysis_run_status_event`.
+  The list stays latest-status only. Hidden runs still 404 and never
+  leak events. Failure codes stay machine tokens -- no invented label.
+  Synthetic Demo Corp seed only.
+
+## [0.80.0] - 2026-08-16
+
+### Added
+
+- Home Analysis runs rows are buttons. Clicking the seeded Demo Corp
+  lineage run opens `GET /api/analysis-runs/{id}` and shows cutoff,
+  requested date, and document count. A hidden run is "This analysis
+  run is not visible." -- never a raw 404 or a DSN. Still synthetic
+  aggregates only.
+
+## [0.79.0] - 2026-08-16
+
+### Added
+
+- Authorized analysis-run evidence on the product home page. After
+  `make seed`, Demo Analyst sees "Lineage reconstruction · Succeeded ·
+  Demo Corp" with the synthetic document count. `GET /api/analysis-runs`
+  is scoped in SQL: another tenant's run 404s and never appears in the
+  list. The payload is labels and aggregates -- never source SQL, a DSN,
+  or a raw record. TEPP stays behind `tepp_client`; Null channels are
+  unchanged.
+
 ## [0.78.0] - 2026-08-15
 
 ### Changed
@@ -19,7 +60,7 @@ All notable changes to this project are documented here. Format follows
   and LLM-as-a-Judge consumers now request contextual-orchestrator `auto` mode
   so the orchestration plane can meet the quality requirement and then minimize
   known execution cost. Explicit checked `verify` paths remain unchanged
-  (ADR 0013).
+  (ADR 0015).
 
 ## [0.77.0] - 2026-08-14