[TEPP Integration] Persist accepted receipts, poll completed results, and keep measurement authority distinct

[seonghobae]

Dependency

Blocked on ContextualWisdomLab/TEPP#156, which must publish a versioned completed analysis-run result/read contract. TEPP's current AnalysisRunAccepted is a durable submission receipt, not a temporal measurement.

Current defect

LineageWeave's TEPP start path accepts only an immediate completed / succeeded envelope with a result. A normal TEPP accepted response therefore becomes tepp_result_not_persisted and the local run fails. Treating accepted as a measurement would be worse: it would manufacture a scientific result from transport evidence.

Required lifecycle

1. Submit the immutable snapshot-bound request.
2. Validate and persist the accepted receipt as transport evidence: remote run_id, idempotency key, request digest, accepted state, provider/model contract, snapshot, cutoff, and received time.
3. Keep the local analysis run Running while the remote run is accepted/running.
4. Poll/read TEPP's versioned result contract with bounded timeout/backoff and durable outbox/inbox semantics.
5. Revalidate tenant/workspace, idempotency key, snapshot identity, knowledge cutoff, model contract, output profile, remote run identity, result schema version, canonical digest, and terminal state.
6. In one transaction, persist the validated completed result and append local Succeeded; terminal remote failure appends a typed local Failed event.
7. Replays must be idempotent. A changed result for the same remote run/digest identity fails closed.

Global Ask boundary

• TEPP accepted receipts never enter answer claims.
• Completed TEPP artifacts are versioned measurement evidence, not public-web truth.
• SearXNG verification may not receive TEPP source text, result payloads, respondent/item information, latent scores, or protected identities.
• Global Ask may cite a TEPP artifact only with its model/result schema/provenance and an explicit measurement_evidence truth status; it may not label it web_verified or authoritative_real_world_fact.

TDD acceptance

• accepted response persists and leaves the local run Running;
• accepted response cannot create analysis_run_tepp_result;
• result polling is bounded and crash-resumable;
• completed result with any request-binding mismatch fails closed;
• duplicate accepted/result deliveries do not duplicate status or result rows;
• changed digest for the same completed remote run is rejected;
• terminal provider failure becomes a typed local failure;
• hidden/cross-tenant runs remain 404/denied without leaking existence;
• Global Ask cannot external-search or truth-promote TEPP artifacts;
• migration clean install/rollback, full integration tests, production statement/branch coverage 100%, and public docstrings 100%.

Scope boundary

Do not mix Global Ask SearXNG UI work, fast-mlsirm estimator changes, new TEPP estimators, or unrelated stack repairs into this PR.

[seonghobae]

Upstream completed-result contract is implemented on TEPP #157 exact current head 0cb9ff6b32afb56849214bbe464ea39004c1e106. Its current checks are terminal-success and formal current-head approval is still required. Keep this consumer issue open until #157 merges and LineageWeave persists accepted receipts separately, polls the versioned terminal result, and proves the lifecycle end to end.

[seonghobae]

Unblocked accepted-receipt slice is in #496 (5c0de352a4186d0ae8f22af476a6e87b3584a3f3, v2.12.11).

• Persist analysis_run_tepp_accepted_receipt as transport evidence.
• Keep the local run Running. Do not stamp Succeeded from an accepted envelope.
• Do not invent a theta. Seed remains Failed / tepp_not_available.
• Completed-result poll remains blocked on [Interchange Gap] Publish a versioned completed analysis-run result contract TEPP#156.

Independent exact-head APPROVE is still required; author will not self-approve. This issue stays open until the completed-result half lands.

[seonghobae]

Upstream terminal status/result contract is now on ContextualWisdomLab/TEPP protected main through merged PR #157 (merge recorded 2026-08-25). The LineageWeave consumer half is no longer contract-blocked: next implementation must persist accepted transport receipts, keep the local run Running, poll GET /v1/analysis-runs/{run_id}, validate every request/receipt binding and canonical digest, and atomically persist only a terminal measurement result. No accepted envelope may become a score.

[seonghobae]

Correction to the prior dependency update: TEPP PR #157 merged the Rust status/result wire types and validation contract, but TEPP's API contract still marks GET /v1/analysis-runs/{run_id} as a target shape without an executable HTTP status route. Consumer schema work is unblocked; durable HTTP polling remains route-blocked. LineageWeave PR #662 therefore keeps the injected status client fail-closed and does not derive or call an unpublished URL.