chore: retain milestone-2 audit follow-up as read-only source evidence

[seonghobae]

Superseded by the protected additive Milestone 2 delivery path

This branch is a direct descendant of the read-only codex/milestone-2-direct-postgres-product source branch: its first parent is the exact retained source head 96116aa4c44d0fe5dd2515b2e348a75f8f025a48. It therefore reopens the same parallel repository replacement that PR #77 intentionally removed from the merge queue.

The branch contains useful follow-up work for run audit fields and abstention-safe metric parsing, but the PR diff still replaces the protected LineageWeave product across 235 files. It brings a second web application, resets the migration/product lineage, duplicates current runtime and documentation surfaces, and includes a compose/keyverse_oidc.py Keyverse-shaped identity implementation with local credentials. Those changes cannot be merged into the post-PROV-O product architecture as one unit.

Issue #79 is the canonical delivery contract. Preserve this branch read-only and port only bounded, reproduced slices after the protected #74 result:

1. normalized runtime-schema migrations with forward/rollback and reconciliation evidence;
2. TEPP through its versioned import/REST boundary;
3. contextual-orchestrator through a fail-closed versioned adapter;
4. React/PostgreSQL surfaces inside the existing frontend;
5. real Keyverse integration with actor-scoped ABAC/RBAC;
6. aggregate-only actual-data acceptance evidence outside public source control.

The run-audit and abstention-safe parsing delta should be isolated as a small additive commit against that protected line, with failing regressions first and exact-head product, PostgreSQL, frontend, browser, security, and public-content gates.

Closing this PR prevents an unsafe replacement merge without deleting its branch or its reproducible implementation evidence.

Superseded by #79.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 230 files, which is 130 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a9d3d9f5-a6de-46dc-901a-d798baa9bccb

📥 Commits

Reviewing files that changed from the base of the PR and between 02cf4cc and dc8b536.

⛔ Files ignored due to path filters (5)

• frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• frontend/public/favicon.svg is excluded by !**/*.svg
• frontend/public/icons.svg is excluded by !**/*.svg
• uv.lock is excluded by !**/*.lock
• web/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (230)

• .adr-config.yml
• .dockerignore
• .env.example
• .github/workflows/hourly-product-gap.yml
• .github/workflows/tests.yml
• .gitignore
• AGENTS.md
• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• Dockerfile
• LICENSE
• Makefile
• README.md
• TRACEABILITY.md
• backend/Dockerfile
• backend/__init__.py
• backend/app/__init__.py
• backend/app/activity_stream.py
• backend/app/affiliate_tree_ingestion.py
• backend/app/auth.py
• backend/app/config.py
• backend/app/db.py
• backend/app/entity_relationship_ingestion.py
• backend/app/issue_ticket_ingestion.py
• backend/app/keyman_ingestion.py
• backend/app/knowledge_graph.py
• backend/app/lineage_ingestion.py
• backend/app/main.py
• backend/app/post_chat_ingestion.py
• backend/app/post_evaluation_ingestion.py
• backend/app/post_summary_ingestion.py
• backend/app/relation_verification_ingestion.py
• backend/app/report_ingestion.py
• backend/tests/__init__.py
• backend/tests/test_api.py
• backend/tests/test_config.py
• compose.yaml
• compose/Dockerfile
• compose/http_standin.py
• compose/keyverse_oidc.py
• compose/local-keyverse.env.example
• compose/searxng/Dockerfile
• compose/searxng/entrypoint.sh
• compose/searxng/settings.yml
• design-qa.md
• docker-compose.yml
• docker/keycloak/Dockerfile
• docker/keycloak/realm-export.json
• docker/postgres-init/01-create-keycloak-db.sql
• docker/postgres-init/Dockerfile
• docker/searxng/Dockerfile
• docker/searxng/settings.yml
• docs/adr/0001-demo-identity-and-data-boundary.md
• docs/adr/0002-figma-access-boundary.md
• docs/adr/0003-fast-mlsirm-report-integration.md
• docs/adr/0004-knowledge-graph-ontology.md
• docs/adr/0005-relation-verification-agent.md
• docs/codebase/.codebase-scan.txt
• docs/codebase/ARCHITECTURE.md
• docs/codebase/CONCERNS.md
• docs/codebase/CONVENTIONS.md
• docs/codebase/INTEGRATIONS.md
• docs/codebase/STACK.md
• docs/codebase/STRUCTURE.md
• docs/codebase/TESTING.md
• docs/doctoring/tepp-literature-review.md
• docs/image-content-schema.md
• docs/lineage-bi-research-notes.md
• docs/ontology/lineageweave-kg.ttl
• docs/operations/hourly-product-gap-loop.md
• docs/planning/adrs/0001-lineageweave-runtime-and-governance.md
• docs/planning/adrs/0002-verified-inline-image-inspection.md
• docs/planning/adrs/0003-keyverse-authorization-code-pkce.md
• docs/planning/adrs/0004-evidence-verified-ontology-inference.md
• docs/planning/adrs/0005-live-provenance-and-method-paper-attachments.md
• docs/planning/adrs/0006-ragas-report-evaluation.md
• frontend/.env.example
• frontend/.gitignore
• frontend/.oxlintrc.json
• frontend/Dockerfile
• frontend/README.md
• frontend/index.html
• frontend/mise.toml
• frontend/nginx.conf
• frontend/package.json
• frontend/src/App.css
• frontend/src/App.test.tsx
• frontend/src/App.tsx
• frontend/src/LineageDag.tsx
• frontend/src/api.ts
• frontend/src/config.ts
• frontend/src/index.css
• frontend/src/lineageLayout.test.ts
• frontend/src/lineageLayout.ts
• frontend/src/main.tsx
• frontend/src/setupTests.ts
• frontend/src/vite-env.d.ts
• frontend/tsconfig.app.json
• frontend/tsconfig.json
• frontend/tsconfig.node.json
• frontend/vite.config.ts
• lineageweave.py
• lineageweave/__init__.py
• lineageweave/adjudication_client.py
• lineageweave/affiliate_tree.py
• lineageweave/channels.py
• lineageweave/chunking.py
• lineageweave/commitment_extraction.py
• lineageweave/corporate_hierarchy_resolution.py
• lineageweave/embedding_client.py
• lineageweave/entity_relationship_classification.py
• lineageweave/fixtures.py
• lineageweave/http_client.py
• lineageweave/image_content.py
• lineageweave/keyman_extraction.py
• lineageweave/knowledge_graph.py
• lineageweave/lineage_persistence.py
• lineageweave/models.py
• lineageweave/ontology.py
• lineageweave/period_report.py
• lineageweave/post_chat.py
• lineageweave/post_content_normalization.py
• lineageweave/post_evaluation.py
• lineageweave/post_summary.py
• lineageweave/reconstruct.py
• lineageweave/relation_verification.py
• lineageweave/server.py
• lineageweave/tepp_client.py
• lineageweave/voc_evidence.py
• lineageweave_embeddings.py
• lineageweave_server.py
• migrations/0001_initial_schema.sql
• migrations/0002_thread_grouping_keys.sql
• migrations/0003_ticket_commitment_calendar.sql
• migrations/0004_relation_verification.sql
• migrations/0005_post_evaluation.sql
• migrations/0006_report_period_score.sql
• migrations/0007_report_fipc_linking.sql
• migrations/0008_post_summary_result.sql
• migrations/0009_shared_metric_bank.sql
• migrations/0010_report_item_information.sql
• migrations/0011_post_chat_result.sql
• mise.toml
• notes/lineageweave_milestone2_run_summary.md
• notes/tepp_research_notes.md
• pyproject.toml
• scripts/__init__.py
• scripts/check_compose_identity_boundary.py
• scripts/check_runtime_schema_contract.py
• scripts/preflight_product_compose.sh
• scripts/run_contract_lineageweave.sh
• scripts/run_oidc_conformance_e2e.sh
• scripts/run_real_lineageweave.sh
• scripts/seed_demo_data.py
• scripts/smoke_test_oidc.py
• sql/analysis_result_tables.sql
• sql/common_enum_values.sql
• tests/Dockerfile.oidc-conformance
• tests/_contract_utils.py
• tests/compose.oidc-conformance-idp.yml
• tests/compose.oidc-e2e.yml
• tests/conftest.py
• tests/oidc-e2e-import/lw-e2e-realm.json
• tests/resources/compose_identity_boundary_contract.json
• tests/resources/compose_oidc_worker_route_contract.json
• tests/resources/lineageweave_real_audit_event_schema.json
• tests/test_activity_stream.py
• tests/test_affiliate_tree.py
• tests/test_application_data_flow_contract.py
• tests/test_application_methods.py
• tests/test_channels.py
• tests/test_chunking.py
• tests/test_commitment_extraction.py
• tests/test_compose_keyverse_oidc_contract.py
• tests/test_corporate_hierarchy_resolution.py
• tests/test_embedding_client.py
• tests/test_enrichment_operations.py
• tests/test_entity_relationship_classification.py
• tests/test_fast_mlsirm_infra.py
• tests/test_hourly_product_gap_workflow.py
• tests/test_http_client.py
• tests/test_http_contract.py
• tests/test_identity_boundary_lock.py
• tests/test_image_content.py
• tests/test_indirect_lineage_linking.py
• tests/test_keyman_extraction.py
• tests/test_keyverse_server_contract.py
• tests/test_knowledge_graph.py
• tests/test_lineage_dag.py
• tests/test_lineage_ingestion.py
• tests/test_lineage_persistence.py
• tests/test_lineage_runtime_contract.py
• tests/test_oidc_e2e_compose_contract.py
• tests/test_oidc_standin_lock.py
• tests/test_ontology.py
• tests/test_period_report.py
• tests/test_post_chat.py
• tests/test_post_content_normalization.py
• tests/test_post_evaluation.py
• tests/test_post_summary.py
• tests/test_postgres_and_valkey_contract.py
• tests/test_preflight_product_compose.py
• tests/test_product_payload_flow.py
• tests/test_prototype_surfaces.py
• tests/test_real_provider_integration.py
• tests/test_reconstruct.py
• tests/test_relation_verification.py
• tests/test_run_real_lineageweave_script.py
• tests/test_runtime_edge_contract.py
• tests/test_schema.py
• tests/test_semantic_embeddings.py
• tests/test_server.py
• tests/test_tepp_client.py
• tests/test_tepp_contract.py
• tests/test_voc_evidence.py
• tests/test_worker_contract.py
• web/e2e/lineageweave.mjs
• web/e2e/login-gate.mjs
• web/index.html
• web/lineageweave-login-probe.mjs
• web/lineageweave.html
• web/package.json
• web/src/App.jsx
• web/src/main.jsx
• web/src/styles.css
• web/src/ui-model.js
• web/src/ui-model.test.js
• web/vite.config.js
• web/vitest.config.js

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}