feat: deliver workspace evidence board and source-grounded ontology surface - #258
Closed
seonghobae wants to merge 1013 commits into
Closed
feat: deliver workspace evidence board and source-grounded ontology surface#258seonghobae wants to merge 1013 commits into
seonghobae wants to merge 1013 commits into
Conversation
|
Important Review skippedToo many files! This PR contains 363 files, which is 263 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (363)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
Queue 2026-08-19T03:01 KST. Exact head |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Contributor
Author
|
Queue 2026-08-19T03:12 KST. Writes work this cycle (push + PR). Buyer increment Weekly VOC is stacked here as This PR (#258) still needs independent current-head APPROVE on |
5 tasks
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
There was a problem hiding this comment.
Semgrep OSS found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
Contributor
Author
|
Cycle 2026-08-19T13:02 KST: retrying independent review request and write path. Exact-head APPROVE still required; no self-approve. |
Contributor
Author
Contributor
Author
|
Buyer increment stacked as #260 ( |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Contributor
Author
Contributor
Author
|
Cycle 2026-08-19T16:31 KST. Writes still work (push + PR #263). Buyer GNB Event Lineage focus is now stacked through Ask Agent (v2.16.0 / ADR 0074) on #262. This PR remains DIRTY against main |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Contributor
Author
|
Cycle 2026-08-20T07:03 KST: GitHub writes recovered (MCP REST/comment/push dry-run succeed). Exact head |
Contributor
Author
|
@opencode-agent Current protected main has advanced to 690f352 and now contains merged #74. PR #258 is currently non-mergeable on stale base 8c020aa. Repair this existing PR branch only: refetch live main, identify #74 commits/content already upstream, then rebase or otherwise reconstruct #258 so the PR contains only #258's Buyer evidence board / source-grounded ontology / Global Ask / runtime hardening delta not already present on main. Do not duplicate or revert merged #74 behavior, migrations, ADRs, or version history. Preserve every resolved review fix on the current #258 head, especially embedding-client Protocol/static-analysis cleanup. Resolve conflicts semantically, not by choosing ours/theirs wholesale. Re-run exact-current-head Python/frontend/Storybook/security/coverage/PROV-O checks applicable to the resulting diff. Do not touch #260-#265, do not merge, and do not force-push unless required by a true rebase/reconstruction; if history rewrite is necessary, verify the resulting tree against both old #258 head and live main before pushing. |
This was referenced Aug 19, 2026
* feat: show project history lineage counts * docs: record project history delivery evidence * fix: label bounded project history counts
* test(red): require exact-origin MCP browser preflight * test(red): bound MCP request bytes before parsing * fix(mcp): bound request bytes before SDK parsing * feat(mcp): configure a bounded request admission limit * fix(mcp): admit exact-origin bounded browser requests * fix(mcp): compare raw admission headers safely * test(mcp): validate request-byte configuration * test(mcp): cover every request admission branch * test(mcp): require origin-aware browser responses * fix(mcp): vary transport rejections by Origin * docs: record MCP browser admission architecture * docs: expose MCP browser admission settings * ops: pass the MCP request-byte limit to the resource server * docs: specify exact MCP browser and byte admission * docs: trace MCP browser admission to transport standards * docs: record MCP browser admission hardening * test(mcp): bind deployment and documentation admission contracts * test(mcp): expose OAuth metadata to browser clients * fix(mcp): expose the OAuth challenge to browser clients * test(mcp): reject unsafe configured browser origins * fix(mcp): validate exact browser origin configuration * docs: record browser-readable OAuth discovery * docs: include browser OAuth discovery in admission ADR * docs: expose browser OAuth discovery and exact origin startup rules * test(mcp): bind browser OAuth discovery documentation --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* docs(adr): define TEPP topic history boundary * feat(analysis-run): add topic-lineage kind mirroring TEPP's fail-closed path Implements the runtime scaffolding for ADR 0132: a new analysis_run_topic_lineage kind (migration 0131) and result envelope table (migration 0132) that request TEPP's TRSL-TM topic identity and CHRONOS/TDT event-intelligence status through the same tepp_client boundary as the existing TEPP measurement kind (ADR 0022), reusing TEPP's generic AnalysisRunRequest wire shape with a different model_contract_version/output_profile instead of inventing a new type. - backend/app/analysis_run_start.py: topic_lineage_run_request, _deliver_topic_lineage_measurement, _persist_topic_lineage_result, start_kind_rejection and the outbox dispatch branch now handle the new kind, failing closed (tepp_not_available / tepp_result_not_persisted) exactly like TEPP. - backend/app/analysis_run_ingestion.py: POST /api/analysis-runs still 422s this kind (Create cannot invent a Pending topic-lineage row, same as TEPP). - scripts/seed_demo_data.py: make seed now also writes a Demo Corp topic-lineage run; verified end-to-end against the live dev Postgres (Pending -> Running -> Failed/tepp_not_available). - frontend/src/api.ts, App.tsx: AnalysisRunKindCode gains the new variant; every exhaustive switch (TypeScript `never` checks) and the start/retry UI copy is updated per kind. - Tests: mirrors the existing TEPP coverage in test_analysis_run_start.py, test_analysis_run_create.py, and test_migration_replay.py. Full backend suite: 852 passed, 17 skipped. Frontend: 200 passed, lint clean, build clean. Migrations verified idempotent on re-apply against the local Compose Postgres. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mk2aU7vk6Pn4pTnzcKT3Ws * feat(project-history): consume TEPP topic lineage --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This was referenced Aug 23, 2026
Contributor
Author
|
Superseded: closing as part of the 2026-08-24 merge-drain loop. Verified against current
The genuinely valuable idea here — extracting the Global Ask/MCP monolith out of |
seonghobae
added a commit
that referenced
this pull request
Aug 24, 2026
* feat: show persisted image-region locations Render each stored visual-region bounding range beside its caption, OCR, and tags so buyers can locate evidence on the source image (ADR 0133). Hide internal LLM instructions and omit non-finite boxes. * fix: open image-region locations and separate tag rows Keep the region list expanded so the bounding range is the next readable action, and put captions, tags, and locations on separate lines. * fix: validate image evidence and restore frontend build * fix: tolerate normalized image edge rounding * test(a11y): cover blank persisted image captions * fix(a11y): keep image fallback names nonblank * chore: nudge CI re-review (opencode-agent's prior REQUEST_CHANGES was against a transient coverage-evidence flake on this same head; later reruns of the same head passed, but opencode-review only posts once per head SHA) * test: preserve OIDC hash through login redirect * fix: normalize blank image-region evidence * test(frontend): isolate application URL state * fix(docs): renumber ADR 0133 to 0155 to avoid PR #258 collision ADR number 0133 is simultaneously claimed by open PR #258 (docs/adr/0133-external-email-project-lineage-contract.md). Both PRs target main, so main would end up with two different ADR files sharing one number depending on merge order, breaking every ADR-number cross-reference. Renamed docs/adr/0133-buyer-image-region-locations.md to 0155-buyer-image-region-locations.md (0155 checked free on main and across every currently open PR branch, including PR #258's own 0119-0133 range) and updated the four ADR-0133 citations in docs/adr/0110-buyer-image-evidence-rendering.md, AGENTS.md, CHANGELOG.md, and docs/product-technical-gap-baseline.md. * fix(frontend): ignore blank parent image OCR * chore(changelog): renumber the image-region fragment past 2.12.26 The fragment claimed 2.12.8 — a version released long before this PR — and the merged CHANGELOG entry had slid under the released [2.12.19] section. The entry now sits under [Unreleased], the fragment claims 2.12.27 (next after main's 2.12.26), and the heading drops the 'Buyer' wording per the naming rule. Review follow-up on this PR's thread. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VENX71RtEntaUq6nkAWZho --------- Co-authored-by: seonghobae <seonghobae@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
This root stack reconciliation preserves the accumulated customer-facing evidence, ontology, semantic-source, contextual-orchestrator, durable-ingestion, and customer-evidence capability while following protected
mainthrough normal merge history. No product capability is removed to reduce the diff.Product and security boundary
Exact current candidate
main@ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7.f4ebfc684cdd6017255712cc4be37528cbb7d21a.APPROVEDverdict on this exact head.Verification and merge gate
Merge only after:
f4ebfc684cdd6017255712cc4be37528cbb7d21a;Do not self-approve. After this root lands, dependent branches continue by ordinary restack and retain their full customer-visible scope.