Skip to content

Milestone 2: port verified direct-PostgreSQL analysis into the protected product architecture #79

Open
Open
Milestone 2: port verified direct-PostgreSQL analysis into the protected product architecture#79
Labels
bugSomething isn't workingpriority: hightype: bug

Description

@seonghobae
seonghobae
opened on Aug 15, 2026

Buyer problem

PR #77 contains valuable direct-PostgreSQL analysis and browser/product evidence, but it is a parallel repository replacement that deletes the protected package, migrations, ADRs, ontology profile, license, and reviewed v0.77 lineage. The evidence must be preserved without merging that destructive history.

Source evidence to preserve

Use codex/milestone-2-direct-postgres-product as a read-only source branch. Preserve only claims that can be reproduced from aggregate, privacy-safe evidence and exact source hashes. The historical run records report bounded direct-database analysis, event/semantic graph persistence, report evaluation/calibration, Valkey outbox behavior, browser UX traversal, and evidence-scoped APIs. Do not copy raw records, source identifiers, base64/image bytes, credentials, organization-specific names, or source-table names into the public repository.

Required additive delivery slices

  1. Runtime schema bridge

    • Map the verified analysis_* objects into new migrations after the current v0.77 schema.
    • Keep every database object two-or-more-word snake_case and third-normalized.
    • Provide forward migration, rollback evidence, source-to-target reconciliation, and idempotency.

  2. TEPP measurement port

    • Call TEPP through its versioned import/REST boundary; do not fork or duplicate TEPP arithmetic.
    • Preserve multi-clock evidence, event/document/entity provenance, temporal leakage controls, cross-classified multiple membership, and uncertainty.

  3. contextual-orchestrator port

    • Keep a versioned fail-closed REST adapter until reviewed upstream main exposes the required portable task envelope.
    • Route simple extraction to bounded single-model work and complex ontology/report/multimodal work to deep thinker/worker/verifier/synthesizer workflows with explicit recursion, access lists, reasoning effort, prompt/model hashes, and ablation evidence.

  4. Product UI

    • Port the validated React/PostgreSQL customer, workspace, document popup, source drawer, event DAG, Keyman, issue/todo/calendar, report, and KG surfaces into the existing frontend rather than adding a second web application.
    • Maintain the approved Figma information architecture and automated browser traversal.

  5. Identity and authorization

    • Production compose must bind to real Keyverse. No Keyverse-shaped compose identity service, default account, default client secret, or synthetic production claims.
    • Test doubles belong under test-only fixtures and may never be routable from product compose.
    • Enforce actor-scoped ABAC/RBAC in SQL/API responses and prove hidden-evidence non-disclosure.

  6. Actual-data acceptance

    • Run read-only source profiling first, then write only normalized analysis outputs in a separately governed schema.
    • Reconcile source row/document/thread counts, graph node/edge counts, report/item/calibration rows, outbox delivery, and orphan checks.
    • Store an aggregate-only signed manifest outside public source control; public documentation may contain only non-sensitive aggregate acceptance ranges and reproducibility metadata.

Merge gates

  • Start from the post-Role, responsibility, and agent ontology (v2.10.0) #74 protected head and preserve monotonic versioning.
  • Use the committed universal lock and supported Python/Rust/Node toolchains.
  • 100% production statement and branch coverage for changed production code; public API docstrings complete.
  • Exact-head Python, PostgreSQL, React, browser, SAST, security, migration, and public-content boundary checks.
  • No unaccounted test skips; GPU/LLM live lanes use NVIDIA_NIM_API_KEY, never COPILOT_GITHUB_TOKEN.
  • Independent current-head review and protected auto-merge.

Supersession

Closing PR #77 after creating this issue does not discard its source branch. It removes an unsafe merge candidate while retaining a reproducible source for bounded additive ports.

Activity

  1. seonghobae commented on Aug 15, 2026

    @seonghobae
    seonghobae
    on Aug 15, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Canonical Milestone 2 source and ownership handoff

    Fresh queue cleanup established the following immutable source-evidence boundaries:

    First additive implementation lane after #74

    The next canonical PR must start from the exact protected result of #74 and implement only the runtime schema bridge:

    1. inventory the analysis_* objects from the read-only feat: publish direct-PostgreSQL LineageWeave product #77 branch;
    2. classify each object as reusable, renamed, split, rejected, or already represented by the post-Role, responsibility, and agent ontology (v2.10.0) #74 schema;
    3. allocate new sequential migrations without replacing existing migrations or package history;
    4. retain source evidence, event/document/entity provenance, model/prompt hashes, temporal clocks, uncertainty, run status, and outbox state in third-normalized tables;
    5. provide forward migration, downgrade/rollback evidence, idempotent replay, orphan checks, and source-to-target aggregate reconciliation;
    6. add no second React application, no Keyverse-shaped compose identity service, no public raw-data fixture, and no direct cross-service table access.

    Adapter sequence

    After the schema bridge is protected-main truth:

    • TEPP is consumed through its versioned import/REST boundary; LineageWeave does not duplicate semantic-unit or psychometric arithmetic.
    • contextual-orchestrator remains a fail-closed versioned REST adapter until the required task envelope is on reviewed upstream main.
    • the existing React frontend receives the document/customer/workspace/DAG/report/admin vertical slices incrementally.
    • actual-data acceptance writes only aggregate signed manifests outside public source control and never commits organization-specific names, source-table identifiers, raw records, base64 payloads, credentials, or source identifiers.

    This comment is the continuation pointer for the next bounded TDD branch; it does not promote any closed-branch behavior to shipped product truth.

  2. seonghobae commented on Aug 15, 2026

    @seonghobae
    seonghobae
    on Aug 15, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Canonical Milestone 2 delivery update — corrected 2026-08-16

    The runtime-schema lane now has one canonical merge candidate: PR #89 (feat/analysis-run-registry-v079-clean). It is deliberately Draft and stacked directly on #74.

    The earlier pointer to #83 is superseded. #83, #84, #85, #86, and the broader #88 prototype remain closed branch evidence only; none may be reopened as a competing migration 0018 or ADR 0013 authority.

    Current bounded contract on #89 includes:

    • immutable source captures and aggregate count evidence without public raw records;
    • snapshot-owned maximum_available_time and run-owned knowledge_cutoff, enforcing maximum_available_time <= knowledge_cutoff;
    • real user_account requester identity and requester-scoped idempotency;
    • immutable run requests and append-only legal lifecycle evidence;
    • one scope shape per run and a derived current-status view;
    • forward and fail-closed rollback migrations;
    • real-PostgreSQL, naming, idempotency, temporal-leakage, lifecycle, and rollback tests;
    • APA 7 doctoring and explicit TEPP/contextual-orchestrator ownership boundaries.

    Dependency order:

    1. complete Role, responsibility, and agent ontology (v2.10.0) #74's source-aware person-projection repair and protected integration;
    2. complete feat: show related-person business-side labels (v0.78.0) #80's accessible business-side label repair, retarget to protected main, and integrate;
    3. rebase or rebuild feat: add normalized analysis-run registry (Milestone 2 slice 1) #89 on the exact protected result, then run all PostgreSQL/product/security/review gates;
    4. port the source-redacting repository/API and service-run references as a separate slice using the preserved closed branches as read-only evidence;
    5. add the DB-grounded Analysis Run Console to the existing React product after its API contract is protected;
    6. consume TEPP and contextual-orchestrator only through reviewed versioned boundaries;
    7. execute private aggregate-only actual-data acceptance outside public source control.

    This correction removes competing ownership without discarding the useful closed-branch evidence.

  3. seonghobae commented on Aug 16, 2026

    @seonghobae
    seonghobae
    on Aug 16, 2026
    ContributorAuthor

    Continuation (2026-08-16 hourly loop)

    Protected main is still v0.71.0. #92 (0.72.0 person chips + stacked #93 0.73.0 org chips) is auto-merge + review-blocked; ruleset merge of #74/#91 returned policy prohibition — no admin retry.

    Next buyer-felt #77 port is PR #95 (feat/analysis-run-authorized-read, v0.79.0), stacked on #89:

    • authorized GET /api/analysis-runs + home-page Analysis runs panel
    • SQL scope; hidden tenant runs 404
    • labels + aggregate counts only (3 synthetic documents after make seed)
    • no AGENTS.md rewrite, no real-org data, TEPP unwired except existing tepp_client

    Do not merge #95 or #89 ahead of #74. #77 stays closed.

  4. seonghobae commented on Aug 16, 2026

    @seonghobae
    seonghobae
    on Aug 16, 2026
    ContributorAuthor

    Continuation (2026-08-16 hourly loop)

    Protected main is still v0.71.0. Inventory:

    Next #79 slice after #74+#89+#95: Analysis Run Console click-through on the existing GET /api/analysis-runs/{id} contract. No AGENTS.md rewrite, no real-org data, TEPP unwired except existing tepp_client.

  5. seonghobae commented on Aug 16, 2026

    @seonghobae
    seonghobae
    on Aug 16, 2026
    ContributorAuthor

    Continuation (2026-08-16 hourly loop)

    Protected main is still v0.71.0. No admin merge retry (405).

    Inventory:

    Shipped this loop: PR #102 (feat/analysis-run-status-history, v0.81.0), stacked on #89:

    • buyer gap after feat: open analysis-run detail from the home list (v0.80.0) #100: detail had cutoff/counts but not the legal lifecycle
    • GET /api/analysis-runs/{id} now returns labeled status_history (Pending → Running → Succeeded)
    • list stays latest-status only; hidden runs 404 and never leak events
    • no AGENTS.md rewrite, no real-org data, TEPP unwired except existing tepp_client

    Next #79 slice after #74+#89+#102: scope-bounded post click-through from the run detail, or TEPP measurement through tepp_client only.

  6. seonghobae commented on Aug 16, 2026

    @seonghobae
    seonghobae
    on Aug 16, 2026
    ContributorAuthor

    Continuation (2026-08-16 hourly loop)

    Protected main is still v0.71.0. No admin merge retry (405).

    Inventory (task description was stale):

    Shipped this loop: PR #110 (feat/analysis-run-cutoff-posts, v0.83.0), stacked on current #74:

    • buyer gap after feat: open visible posts from an analysis-run detail (v0.82.0) #103: detail listed every ABAC-visible post in scope, including posts written after the run cutoff
    • GET /api/analysis-runs/{id} now applies created_at <= knowledge_cutoff
    • make seed stamps Demo public/private at 2026-01-10 so default now() does not empty the January run; Late Demo public post (2026-01-13) is the counter-example
    • detail shows revision/config digest prefixes; empty cutoff has a later-run empty state
    • no AGENTS.md rewrite, no real-org data, TEPP unwired except existing tepp_client

    Next #79 slice after #74+#110: TEPP measurement through tepp_client only, or run-scoped post bodies. Do not merge #110 before #74.

  7. seonghobae commented on Aug 16, 2026

    @seonghobae
    seonghobae
    on Aug 16, 2026
    ContributorAuthor

    Continuation (2026-08-17 hourly loop)

    Task description was stale. Protected main is still c93d449 / v0.71.0. No admin merge retry (405).

    Inventory:

    Shipped this loop: PR #150 (feat/analysis-run-live-write-clock, v0.87.0), stacked on current #74:

    • buyer gap after ADR 0016: every cutoff title had a generic live-body warning, including rows whose updated_at still matched the run
    • GET /api/analysis-runs/{id} now returns updated_at + live_after_cutoff per in-cutoff title — never a body, DSN, or theta
    • make seed backdates Demo private / reconstruct fixtures to updated_at = created_at and stamps Demo public post at 2026-01-13 as the rewritten counter-example
    • detail marks only rewritten titles Updated after cutoff; opening still shows the live body (versioning stays later)
    • no AGENTS.md rewrite, no real-org data, TEPP only via tepp_client

    Do not merge #150 before #74. Next #79 slice after #74+#150: start pending lineage reconstruction (ADR 0017 follow-up) or cutoff body versioning.

  8. seonghobae commented on Aug 17, 2026

    @seonghobae
    seonghobae
    on Aug 17, 2026
    ContributorAuthor

    Continuation (2026-08-17 hourly loop)

    Task description was stale. Protected main is still c93d449 / v0.71.0. No admin merge retry (405).

    Inventory:

    Shipped this loop: PR #199 rebase + leftover (4632dee):

    • buyer gap after feat: open the scored week from a period-report analysis run (v0.97.0) #198: opening 2026-W02 switched the week but left grouping on Process unit, then showed a UUID row
    • Open period report 2026-W02 now sets grouping to Corporate entity, marks Demo Corp current, and names that report
    • scope_grouping_key persists the reconstruct grouping key (entity id), never the week or a theta
    • no AGENTS.md rewrite, no real-org data, TEPP only via tepp_client

    Do not merge #199 before #74. Next #79 slice after #74+#199: land the comparison strip on the opened Demo Corp row when the operator is already on that week, or cutoff body versioning.

  9. seonghobae commented on Aug 17, 2026

    @seonghobae
    seonghobae
    on Aug 17, 2026
    ContributorAuthor

    Continuation (2026-08-17 hourly loop)

    Task description was stale. Protected main is still c93d449 / v0.71.0. No admin merge retry (405).

    Inventory:

    Re-verified this loop: PR #200 rebase (35bdcf1):

    • local Semgrep p/python WARNING/ERROR on backend/app: 0 findings
    • list/detail queries remain complete parameterized literals

    Shipped this loop: PR #201 (feat/analysis-run-comparison-strip-landing, v0.99.0), stacked on #200:

    • buyer gap after feat: open the corp grouping with the scored week (v0.98.0) #199: after make seed the home week is already 2026-W02, so Open period report did not land the comparison strip
    • already on that week: Compare corporate_entity: Demo Corp is current and focused
    • changing the week first still focuses the report period field
    • no AGENTS.md rewrite, no real-org data, TEPP only via tepp_client

    Do not merge #200 or #201 before #74. Next #79 slice after #74+#201: cutoff body versioning, or the next buyer leftover that is not a cursor draft.

  10. seonghobae commented on Aug 17, 2026

    @seonghobae
    seonghobae
    on Aug 17, 2026
    ContributorAuthor

    Continuation (2026-08-17 hourly loop)

    Task description was stale. Protected main is still c93d449 / v0.71.0. No admin merge retry (405).

    Inventory:

    Shipped this loop: PR #202 (feat/analysis-run-opened-report-next-action, v1.0.0), stacked on current #74:

    • buyer gap after feat: land the comparison strip on the opened Demo Corp row (v0.99.0) #201: the focused Demo Corp chip said Compare corporate_entity: Demo Corp and named no next action
    • chip name is now Compare Corporate entity: Demo Corp, mean θ 0.42 (visible caption + persisted mean θ)
    • Period reports panel says Demo Corp is the opened grouping and to read its mean θ and member posts, then open a post
    • changing the week first still focuses the report period field
    • no AGENTS.md rewrite, no real-org data, TEPP only via tepp_client, no cutoff-body invention (ADR 0016)

    Do not merge #202 before #74. Next #79 slice after #74+#202: cutoff body versioning stays later, or the next buyer leftover that is not a cursor draft and is not historical-body invention.

  11. seonghobae commented on Aug 17, 2026

    @seonghobae
    seonghobae
    on Aug 17, 2026
    ContributorAuthor

    Continuation (2026-08-17 hourly loop)

    Task description was stale. Protected main is still c93d449 / v0.71.0. No admin merge retry (405).

    Inventory:

    Shipped this loop: PR #203 (feat/analysis-run-opened-report-members, v1.1.0), stacked on current #74:

    • buyer gap after feat: name the next action on the landed Demo Corp report (v1.0.0) #202: the next action said to read Demo Corp member posts, but Other Corp (empty members) and the week strip sat first
    • Demo Corp mean θ and Public post now land immediately under that next action, ahead of Other Corp and the week strip
    • clicking Public post still opens the live post
    • no AGENTS.md rewrite, no real-org data, TEPP only via tepp_client, no cutoff-body invention (ADR 0016)

    Do not merge #203 before #74. Next #79 slice after #74+#203: cutoff body versioning stays later, or the next buyer leftover that is not a cursor draft and is not historical-body invention.

  12. seonghobae commented on Aug 17, 2026

    @seonghobae
    seonghobae
    on Aug 17, 2026
    ContributorAuthor

    Continuation (2026-08-17 hourly loop)

    Task description was stale. Protected main is still c93d449 / v0.71.0. No admin merge retry (405).

    Inventory:

    Shipped this loop: PR #204 (feat/analysis-run-opened-member-next-action, v1.2.0), stacked on and merged into #74:

    • buyer gap after feat: land Demo Corp members under the opened-report next action (v1.1.0) #203: Public post opened from the landed Demo Corp members, but the panel still said to open a post
    • opening Public post now names the next action: that post is open from Demo Corp, so read Event Lineage, Keyman, and evaluation
    • the opened member is current
    • no AGENTS.md rewrite, no real-org data, TEPP only via tepp_client, no cutoff-body invention (ADR 0016)

    Do not merge #74 to main without independent approval. Next #79 slice after #74+#204: cutoff body versioning stays later, or the next buyer leftover that is not a cursor draft and is not historical-body invention.

  13. seonghobae commented on Aug 17, 2026

    @seonghobae
    seonghobae
    on Aug 17, 2026 – with Grok (by xAI)
    ContributorAuthor

    Milestone 2 item 3 (contextual-orchestrator fail-closed envelope) is now PR #228 on main@8c020aa as v0.84.0 / ADR 0025. Independent exact-head APPROVE still required. Do not close this parent issue — TEPP (#214), schema bridge (#87), identity, and remaining product-UI ports are open.

  14. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    cycle-write-probe 2026-08-23: confirming issue remains open pending Milestone 2 schema/TEPP port. No close.

  15. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    Queue retry 2026-08-23 (Grok Build): leftover-pair persist+UI is already on main (ADR 0048/0049). Ontology #74, analysis-run #89, and structured-auto #91 are merged. Duplicate #96 stays closed.

    Still open and not being fake-closed:

    • Org Strix ModelBehaviorError classifier (Vulnerabilities 0 + trusted LiteLLM/agents same-line context; Vulnerabilities [1-9] remain fail-closed).
    • LineageWeave SKOS alias round-trip so a synthetic short form (AGP) and full form (Aurora Grid Power) bind one corporate_entity row. Real org names stay out of fixtures.

    No self-approval. Independent APPROVE still required to merge.

  16. 2 remaining items

  17. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    Cycle 2026-08-23 (v2.12.10): leftover persist is already PR #481 (v2.12.7). Next independent buyer gap: leftover-map criterion nodes are unlabeled diamonds, not buttons. Pair-member criterion nodes will open the leftover-pair post (onSelectPost only; no #485 leftover-focus). Non-pair criteria stay non-interactive. Stacked on #481; independent of #485/#484. Issues #79 and #87 stay open.

  18. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    Cycle 2026-08-23 (v2.12.10) landed as stacked PR #488 on #481: leftover-map criterion nodes that belong to a leftover pair now open that pair's post. Non-pair criteria stay non-interactive. Independent of #485. Issues #79 and #87 stay open. Author will not self-approve.

  19. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    Cycle note: leftover-map distances on main are being clamped to two Gabriel axes in a separate increment (v2.12.13 / ADR 0119). Milestone 2 (#79) stays open — this does not complete the protected product architecture port.

  20. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    Cycle probe 2026-08-23T18:04Z: GitHub write retry from seonghobae. Issues #79 and #87 stay open. Independent exact-head APPROVE remains required on open heads; this identity will not self-approve.

  21. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    Cycle probe 2026-08-24T03:32KST / 2026-08-23T18:33Z: GitHub write retry from seonghobae (ghu token, empty X-OAuth-Scopes; GraphQL+REST comment/close succeed). Duplicate #96 stays closed. Issues #79 and #87 stay open. Independent exact-head APPROVE remains required; this identity will not self-approve. Next buyer gap after leftover persist #481 / pair landing #485 / residual #502: implement the next unclaimed leftover-map honesty slice without mixing into those stacks.

  22. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    Cycle 2026-08-24T03:32 KST: GitHub writes still succeed via MCP comments (identity seonghobae). #96 stays closed. #79 (Milestone 2 parent) and #87 (schema bridge) stay open — incomplete work is not closed.

    Queue honesty:

    Next unclaimed leftover-map honesty slice targeting protected main: name complete-case coverage (Gabriel 1971 / Jeon 2021). The map already drops incomplete rows rather than treating missing cells as 0, but the period report does not tell the buyer how many scored posts entered the factorization. This cycle ships leftover_map_coverage (map_post_count of scored_post_count; incomplete rows excluded, never zero) as v2.12.17 / ADR 0165 on a fresh branch off main. Not coordinates, not residual disclosure, not criterion landing.

  23. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    Shipped independent leftover complete-case coverage onto protected main: #518 (feat/leftover-map-complete-case-coverage-v21217 @ cec898f, v2.12.17 / ADR 0165).

    Buyer caption: leftover map used N of M scored posts (complete-case). Incomplete rows stay excluded, never zero. Independent of #481 / #485 / #502 / #426.

    Independent exact-head APPROVE required. Not self-approving. #79 and #87 stay open.

  24. seonghobae commented on Aug 23, 2026

    @seonghobae
    seonghobae
    on Aug 23, 2026 – with Grok (by xAI)
    ContributorAuthor

    Continuing Milestone 2 without closing this parent. Landed independent Start-clock slice as #524 (v2.12.19 / ADR 0167): status events share one PostgreSQL clock_timestamp() so live Start no longer hits analysis_run_status_time_check. Leftover two-axis distance remains #522. Neither is self-approved. Schema bridge #87 stays open.

  25. seonghobae
    added 3 commits that reference this issue on Aug 23, 2026

    feat: persist leftover observed Y and expected E (v2.12.20) (#527)

    cf7c675

    feat: name leftover-map rank on leftover pairs (v2.12.21) (#529)

    14baa56

    feat: name leftover residual on period-report pair rows (v2.12.22) (#530

    a8e5e89

  26. seonghobae commented on Aug 27, 2026

    @seonghobae
    seonghobae
    on Aug 27, 2026 – with Grok (by xAI)
    ContributorAuthor

    Cycle 2026-08-27T00:12Z: GitHub write probe (comment). Historic #96 is already gone; leftover-pair persist (v0.71.2 / #211) and subsequent leftover-map honesty slices are on protected main. Issues #79 and #87 remain open parent/schema-bridge work. Next unique buyer gap will be implemented independently of closed #74/#92 stacks. Author will not self-approve.

  27. seonghobae
    added
    priority: high
    bugSomething isn't working
    type: bug
    on Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingpriority: hightype: bug

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions