feat: publish direct-PostgreSQL LineageWeave product

[seonghobae]

Superseded by an additive delivery plan

The branch contains valuable direct-PostgreSQL analysis and browser/product evidence, but this pull request is a parallel repository replacement: it deletes the protected package, migrations, ADRs, ontology profile, license, and reviewed v0.77 lineage; regresses version/runtime/dependency contracts; and places a Keyverse-shaped identity stand-in beside product compose.

The source branch is retained read-only. Issue #79 defines the bounded additive port into the post-#74 architecture, including TEPP/contextual-orchestrator boundaries, real Keyverse, normalized migrations, React/PostgreSQL surfaces, privacy-safe aggregate acceptance evidence, and exact-head product/security/browser gates.

Closing this PR prevents an unsafe replacement merge without discarding the verified implementation evidence.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 230 files, which is 130 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b1d38f7-2650-4f20-8291-1841a6fafc7f

📥 Commits

Reviewing files that changed from the base of the PR and between 02cf4cc and 96116aa.

⛔ Files ignored due to path filters (5)

• frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• frontend/public/favicon.svg is excluded by !**/*.svg
• frontend/public/icons.svg is excluded by !**/*.svg
• uv.lock is excluded by !**/*.lock
• web/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (230)

• .adr-config.yml
• .dockerignore
• .env.example
• .github/workflows/hourly-product-gap.yml
• .github/workflows/tests.yml
• .gitignore
• AGENTS.md
• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• Dockerfile
• LICENSE
• Makefile
• README.md
• TRACEABILITY.md
• backend/Dockerfile
• backend/__init__.py
• backend/app/__init__.py
• backend/app/activity_stream.py
• backend/app/affiliate_tree_ingestion.py
• backend/app/auth.py
• backend/app/config.py
• backend/app/db.py
• backend/app/entity_relationship_ingestion.py
• backend/app/issue_ticket_ingestion.py
• backend/app/keyman_ingestion.py
• backend/app/knowledge_graph.py
• backend/app/lineage_ingestion.py
• backend/app/main.py
• backend/app/post_chat_ingestion.py
• backend/app/post_evaluation_ingestion.py
• backend/app/post_summary_ingestion.py
• backend/app/relation_verification_ingestion.py
• backend/app/report_ingestion.py
• backend/tests/__init__.py
• backend/tests/test_api.py
• backend/tests/test_config.py
• compose.yaml
• compose/Dockerfile
• compose/http_standin.py
• compose/keyverse_oidc.py
• compose/local-keyverse.env.example
• compose/searxng/Dockerfile
• compose/searxng/entrypoint.sh
• compose/searxng/settings.yml
• design-qa.md
• docker-compose.yml
• docker/keycloak/Dockerfile
• docker/keycloak/realm-export.json
• docker/postgres-init/01-create-keycloak-db.sql
• docker/postgres-init/Dockerfile
• docker/searxng/Dockerfile
• docker/searxng/settings.yml
• docs/adr/0001-demo-identity-and-data-boundary.md
• docs/adr/0002-figma-access-boundary.md
• docs/adr/0003-fast-mlsirm-report-integration.md
• docs/adr/0004-knowledge-graph-ontology.md
• docs/adr/0005-relation-verification-agent.md
• docs/codebase/.codebase-scan.txt
• docs/codebase/ARCHITECTURE.md
• docs/codebase/CONCERNS.md
• docs/codebase/CONVENTIONS.md
• docs/codebase/INTEGRATIONS.md
• docs/codebase/STACK.md
• docs/codebase/STRUCTURE.md
• docs/codebase/TESTING.md
• docs/doctoring/tepp-literature-review.md
• docs/image-content-schema.md
• docs/lineage-bi-research-notes.md
• docs/ontology/lineageweave-kg.ttl
• docs/operations/hourly-product-gap-loop.md
• docs/planning/adrs/0001-lineageweave-runtime-and-governance.md
• docs/planning/adrs/0002-verified-inline-image-inspection.md
• docs/planning/adrs/0003-keyverse-authorization-code-pkce.md
• docs/planning/adrs/0004-evidence-verified-ontology-inference.md
• docs/planning/adrs/0005-live-provenance-and-method-paper-attachments.md
• docs/planning/adrs/0006-ragas-report-evaluation.md
• frontend/.env.example
• frontend/.gitignore
• frontend/.oxlintrc.json
• frontend/Dockerfile
• frontend/README.md
• frontend/index.html
• frontend/mise.toml
• frontend/nginx.conf
• frontend/package.json
• frontend/src/App.css
• frontend/src/App.test.tsx
• frontend/src/App.tsx
• frontend/src/LineageDag.tsx
• frontend/src/api.ts
• frontend/src/config.ts
• frontend/src/index.css
• frontend/src/lineageLayout.test.ts
• frontend/src/lineageLayout.ts
• frontend/src/main.tsx
• frontend/src/setupTests.ts
• frontend/src/vite-env.d.ts
• frontend/tsconfig.app.json
• frontend/tsconfig.json
• frontend/tsconfig.node.json
• frontend/vite.config.ts
• lineageweave.py
• lineageweave/__init__.py
• lineageweave/adjudication_client.py
• lineageweave/affiliate_tree.py
• lineageweave/channels.py
• lineageweave/chunking.py
• lineageweave/commitment_extraction.py
• lineageweave/corporate_hierarchy_resolution.py
• lineageweave/embedding_client.py
• lineageweave/entity_relationship_classification.py
• lineageweave/fixtures.py
• lineageweave/http_client.py
• lineageweave/image_content.py
• lineageweave/keyman_extraction.py
• lineageweave/knowledge_graph.py
• lineageweave/lineage_persistence.py
• lineageweave/models.py
• lineageweave/ontology.py
• lineageweave/period_report.py
• lineageweave/post_chat.py
• lineageweave/post_content_normalization.py
• lineageweave/post_evaluation.py
• lineageweave/post_summary.py
• lineageweave/reconstruct.py
• lineageweave/relation_verification.py
• lineageweave/server.py
• lineageweave/tepp_client.py
• lineageweave/voc_evidence.py
• lineageweave_embeddings.py
• lineageweave_server.py
• migrations/0001_initial_schema.sql
• migrations/0002_thread_grouping_keys.sql
• migrations/0003_ticket_commitment_calendar.sql
• migrations/0004_relation_verification.sql
• migrations/0005_post_evaluation.sql
• migrations/0006_report_period_score.sql
• migrations/0007_report_fipc_linking.sql
• migrations/0008_post_summary_result.sql
• migrations/0009_shared_metric_bank.sql
• migrations/0010_report_item_information.sql
• migrations/0011_post_chat_result.sql
• mise.toml
• notes/lineageweave_milestone2_run_summary.md
• notes/tepp_research_notes.md
• pyproject.toml
• scripts/__init__.py
• scripts/check_compose_identity_boundary.py
• scripts/check_runtime_schema_contract.py
• scripts/preflight_product_compose.sh
• scripts/run_contract_lineageweave.sh
• scripts/run_oidc_conformance_e2e.sh
• scripts/run_real_lineageweave.sh
• scripts/seed_demo_data.py
• scripts/smoke_test_oidc.py
• sql/analysis_result_tables.sql
• sql/common_enum_values.sql
• tests/Dockerfile.oidc-conformance
• tests/_contract_utils.py
• tests/compose.oidc-conformance-idp.yml
• tests/compose.oidc-e2e.yml
• tests/conftest.py
• tests/oidc-e2e-import/lw-e2e-realm.json
• tests/resources/compose_identity_boundary_contract.json
• tests/resources/compose_oidc_worker_route_contract.json
• tests/resources/lineageweave_real_audit_event_schema.json
• tests/test_activity_stream.py
• tests/test_affiliate_tree.py
• tests/test_application_data_flow_contract.py
• tests/test_application_methods.py
• tests/test_channels.py
• tests/test_chunking.py
• tests/test_commitment_extraction.py
• tests/test_compose_keyverse_oidc_contract.py
• tests/test_corporate_hierarchy_resolution.py
• tests/test_embedding_client.py
• tests/test_enrichment_operations.py
• tests/test_entity_relationship_classification.py
• tests/test_fast_mlsirm_infra.py
• tests/test_hourly_product_gap_workflow.py
• tests/test_http_client.py
• tests/test_http_contract.py
• tests/test_identity_boundary_lock.py
• tests/test_image_content.py
• tests/test_indirect_lineage_linking.py
• tests/test_keyman_extraction.py
• tests/test_keyverse_server_contract.py
• tests/test_knowledge_graph.py
• tests/test_lineage_dag.py
• tests/test_lineage_ingestion.py
• tests/test_lineage_persistence.py
• tests/test_lineage_runtime_contract.py
• tests/test_oidc_e2e_compose_contract.py
• tests/test_oidc_standin_lock.py
• tests/test_ontology.py
• tests/test_period_report.py
• tests/test_post_chat.py
• tests/test_post_content_normalization.py
• tests/test_post_evaluation.py
• tests/test_post_summary.py
• tests/test_postgres_and_valkey_contract.py
• tests/test_preflight_product_compose.py
• tests/test_product_payload_flow.py
• tests/test_prototype_surfaces.py
• tests/test_real_provider_integration.py
• tests/test_reconstruct.py
• tests/test_relation_verification.py
• tests/test_run_real_lineageweave_script.py
• tests/test_runtime_edge_contract.py
• tests/test_schema.py
• tests/test_semantic_embeddings.py
• tests/test_server.py
• tests/test_tepp_client.py
• tests/test_tepp_contract.py
• tests/test_voc_evidence.py
• tests/test_worker_contract.py
• web/e2e/lineageweave.mjs
• web/e2e/login-gate.mjs
• web/index.html
• web/lineageweave-login-probe.mjs
• web/lineageweave.html
• web/package.json
• web/src/App.jsx
• web/src/main.jsx
• web/src/styles.css
• web/src/ui-model.js
• web/src/ui-model.test.js
• web/vite.config.js
• web/vitest.config.js

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Follow-up: customer snapshot truth and reader vocabulary

Commit ff59812 makes the explicit customer_master payload a replaceable PostgreSQL semantic snapshot: document links, affiliate facts, and account facts are cleared child-first before insertion, including an LLM empty/abstain result. Payloads without that boundary leave narrow operational writes untouched.

The ordinary-user React surfaces no longer expose source · llm, heuristic, or raw public/private codes; they use business terms (근거 연결, 공개, 내부). ADR, architecture, changelog, traceability, and contract tests were updated. Local verification: 351 passed; Python and React coverage/build 100%.

[seonghobae]

Do not merge this 235-file rewrite onto the current synthetic-data demo main.

main is a fixture-only BI prototype (ADR 0001 / AGENTS.md). This branch replaces that contract: it rewrites AGENTS.md and records live-corpus measurements (43k documents, 264k KG nodes) in changelog/docs. Those runtime aggregates belong outside this repository.

Keep this work on a separate product track, or split buyer-visible increments that preserve the synthetic-fixture boundary. Green checks do not make the data-boundary replacement merge-safe.

[seonghobae]

@cwl-noema-review
@opencode-agent

Review the exact current head for product correctness, PostgreSQL data integrity, ABAC/RBAC enforcement, provenance, sensitive-public-content boundaries, and merge readiness. Do not update the branch or merge.

[seonghobae]

@opencode-agent

Review exact current head 96116aa4c44d0fe5dd2515b2e348a75f8f025a48 for merge readiness. Exact-head Tests, Security Scan, and SAST Semgrep are terminal-success and every returned inline thread is resolved. Validate the general-user/admin separation, server-side Keyverse ABAC/RBAC, observed chronological Lineage versus relatedness, persisted Ontology/Semantic Layer evidence, bounded Keyman offsets, projection-preserving writer behavior, direct PostgreSQL contracts, container and network hardening, and deliberate external release gates. Also assess overlap with PR #76's safer canonical hourly commercialization loop so duplicate product-gap schedulers are not merged. Submit a formal exact-head verdict without modifying or merging the branch.

[seonghobae]

@cwl-noema-review

Independently review exact head 96116aa4c44d0fe5dd2515b2e348a75f8f025a48 after primary OpenCode approval. Verify authorization, direct-data contracts, evidence-backed customer semantics, Lineage/relatedness separation, projection-preserving writes, supply-chain and container boundaries, exact-head checks, and scheduler overlap with PR #76. Submit a formal verdict without modifying or merging the branch.

[seonghobae]

This head remains Draft because it is a parallel repository replacement rather than an additive Milestone 2 slice.

Merge blockers:

• It removes the established backend, frontend, package, migrations, ADRs, ontology profile, LICENSE, and their regression contracts while the protected line is already at 0.71.0 and PR feat: ship PROV-O actor lineage, accessible labels, and analysis-run evidence (v0.83.0) #74 advances it through 0.77.0. Declaring 0.2.18 would regress release lineage and discard reviewed work.
• pyproject.toml reopens Python >=3.10 and floating lower-bound runtime dependencies instead of the current locked runtime/supply-chain contract.
• compose/keyverse_oidc.py contains a Keyverse-shaped identity stand-in with default credentials and claims under the compose boundary. A startup guard does not satisfy the production identity boundary; any test double belongs under test-only fixtures, while compose must bind to real Keyverse.
• The PR claims product completion while production identity acceptance, full-corpus enrichment, and upstream integration are explicitly incomplete.

Repair direction: rebase on the protected architecture after #74/#76; port the verified React/PostgreSQL/data-analysis capabilities as bounded additive modules; preserve migrations, ADRs, ontology, package, license, monotonic versioning, and current tests; remove the compose-adjacent identity stand-in; then re-run exact-head Python, React, PostgreSQL, and browser checks before returning Ready.