feat: expose authenticated MCP Global Ask

AGENTS.md

@@ -177,10 +177,12 @@ Opening a Calendar commitment uses the same focus path (ADR 0094). Do not
 invent a week, a theta, a cutoff body, or a CalDAV event.
 Opening a Customer master related post uses the same focus path (ADR 0095).
 Do not invent a week, a theta, a cutoff body, a CalDAV event, or a customer.
-Opening an Ask Agent cited post uses the same focus path (ADR 0096). Do not
-invent a cited post.
-A linked Event Lineage node opened from that focused popup keeps the
-originating flags (ADR 0097). Do not invent a cited post.
+ Opening an Ask Agent cited post uses the same focus path (ADR 0096).
+ Do not invent a cited post.
+ A linked Event Lineage node opened from that focused popup keeps the
+ originating flags (ADR 0097). That open then focuses Keyman as the named
+next read (ADR 0100). Do not invent a week, a theta, a cutoff body,
+ a CalDAV event, a customer, or a cited post.
 
 
 ## Tests

ARCHITECTURE.md

@@ -45,7 +45,7 @@ flowchart LR
 
     subgraph External services, all optional
         EMB[Embedding provider<br/>swap in for the text channel]
-        ORC[contextual-orchestrator<br/>mode=verify, llm channel]
+        ORC[contextual-orchestrator<br/>mode=auto, llm and vision channels]
         TEPP[TEPP<br/>AnalysisRunRequest v1,<br/>calibrated measurement]
     end
 
@@ -82,19 +82,15 @@ flowchart LR
 | `period_report.py` | Fit GRM/GPCM on persisted IRT rows, FIPC-select, EAP-score a period (ADR 0003 slice 3; Bock & Mislevy, 1982) |
 | `fixtures.py` | Synthetic demo dataset -- no real data ships in this repo |
 | `server.py` | Legacy stdlib HTTP server for the library-level synthetic fixture demo; production uses FastAPI/PostgreSQL |
+| `backend/app/mcp_server.py` | OAuth-protected Streamable HTTP MCP resource server exposing read-only, evidence-grounded Global Ask |
 | `web/index.html` | Legacy self-contained SVG DAG viewer; production UI is the React/Vite frontend |
 
-> **Known local-test-environment limitation:** `adjudication_client.py`'s
-> `mode="verify"` call depends on contextual-orchestrator's
-> `TaskOrchestrator.route_and_verify`, which as of this writing is still
-> an open, unmerged upstream PR
-> (`ContextualWisdomLab/contextual-orchestrator#149`). Until it merges,
-> the four adjudication/chat tests that exercise `mode="verify"` against
-> a real orchestrator fail with `invalid_mode` (the deployed `main` only
-> accepts `auto`/`route`/`conduct`) -- confirmed by reproducing the same
-> `400` directly against the orchestrator's own `/v1/chat/completions`,
-> not caused by anything in this repo. `mode="route"` (every other
-> pluggable client) is unaffected.
+> **Contextual-orchestrator contract:** Post Ask and MCP Global Ask use
+> `mode="auto"` and `reasoning_effort="auto"`; the gateway owns model
+> discovery, provider protocol, and multi-agent reasoning. Requests carry a
+> stable post-scoped session id and non-secret evidence metadata. Structured
+> responses use `json_schema`. LineageWeave never calls a provider directly
+> or falls back to the rejected legacy `verify` mode.
 
 ## Design decisions worth naming
 
@@ -281,12 +277,14 @@ HTML. `src/api.ts` calls the FastAPI backend directly with the token
 Keycloak issued; `src/App.tsx` renders a git-branch SVG of
 `GET /api/lineage` (click a node to open that post; `post_admin` can
 rebuild), the post list with a named Weekly VOC ISO-8601 week filter
-(ADR 0092; opening that filtered post focuses Event Lineage, ADR 0093),
-Calendar commitments use the same Event Lineage focus path (ADR 0094),
+(ADR 0092; opening that filtered post focuses Event Lineage, ADR 0093).
+Calendar commitments use the same Event Lineage focus path (ADR 0094).
 Customer master related posts use the same Event Lineage focus path
 (ADR 0095). Ask Agent cited posts use the same Event Lineage focus path
-(ADR 0096). A linked Event Lineage node opened from a focused popup keeps
-those flags (ADR 0097), and the full detail popup includes Korean
+(ADR 0096). A linked Event Lineage node opened from a focused popup
+keeps those flags (ADR 0097) and then focuses Keyman as the named next
+read (ADR 0100).
+The full detail popup includes Korean
 summary/key-events/R&R, VOC evidence excerpts, an Event Lineage panel
 (direct vs. indirect links; a link opens that post), the Keyman
 affiliate tree (resolved ancestors plus unresolved org roots), Keyman +

CHANGELOG.d/2.18.2-authenticated-mcp-global-ask.md

@@ -0,0 +1,67 @@
+# 2.18.2 — Authenticated MCP Global Ask
+
+## Added
+
+- Dedicated Streamable HTTP MCP resource server for Codex and other MCP clients.
+- Read-only, idempotent `global_ask` tool over authorized source-post and
+  Event-Lineage evidence, with bounded retrieval and citation identities.
+- Explicit `verify_external=true` open-web verification lane: Searxng retrieves
+  bounded public evidence and contextual-orchestrator classifies the internal
+  answer as `supported`, `refuted`, or `insufficient_evidence` using only those
+  retrieved passages.
+- External verification returns separately cited public evidence URLs; those
+  URLs never become LineageWeave posts or internal source authority.
+- Codex bearer-token configuration and production OAuth deployment guidance.
+- A bounded, idempotent Keycloak Admin REST reconciliation job for the demo
+  client's `lineageweave-mcp-audience` mapper. It updates a persistent realm
+  after `MCP_PORT` or the exact resource audience changes without replacing the
+  realm.
+
+## Changed
+
+- Post Ask and MCP Global Ask use contextual-orchestrator's `mode="auto"` and
+  `reasoning_effort="auto"`; the gateway selects models and provider protocol
+  instead of receiving a caller-selected model or a direct-provider fallback.
+- Structured reason-and-cite calls use `json_schema`, `system` instructions,
+  and a stable post-scoped session id with non-secret post/author/PU/corp
+  metadata.
+- `global_ask` advertises `open_world_hint=true` because callers can explicitly
+  opt into Searxng web verification; the default remains `verify_external=false`.
+- The evidence-chat timeout is 300 seconds so orchestrated reasoning is finite
+  but not cut off by the previous 60-second default.
+- Local Compose now starts MCP only after the one-shot Keycloak mapper
+  reconciliation succeeds. Startup realm import remains a fresh-environment
+  bootstrap and is no longer treated as an update mechanism for persisted
+  identity state.
+
+## Security
+
+- Exact MCP audience, issuer, expiry, and mandatory JWKS `kid` validation with
+  one bounded JWKS refresh for issuer key rotation.
+- Malformed issuer JWKS key collections fail closed as service-unavailable
+  instead of escaping as an untyped error.
+- Existing database-backed `post_read`, affiliation, and public-or-corporate
+  ABAC checks apply to every retrieved internal source.
+- MCP Host, Origin, and POST content-type validation now executes at the outer
+  ASGI boundary before OAuth authentication, so a hostile DNS-rebinding request
+  is rejected without a bearer challenge or token-verifier invocation.
+- Inbound tokens are never forwarded to contextual-orchestrator or Searxng.
+- An internal answer with no citation inside the authorized source bundle is
+  rejected instead of returning unsupported prose.
+- Open-web verification never runs without explicit caller opt-in, and the
+  private internal answer body is never used as the Searxng search query.
+- External snippets are treated as untrusted data. `supported` and `refuted`
+  require at least one valid cited HTTP(S) evidence URL; otherwise the verdict
+  is downgraded to `insufficient_evidence`.
+- Global Ask returns an authorized source timeline ordered by `created_at`, with
+  `anchor`, `direct_lineage`, or `indirect_knowledge_graph` relation labels.
+- MCP Global Ask returns up to three bounded raster images from cited posts as
+  `ImageContent`; SVG, remote images, and oversized payloads are excluded.
+- Citation IDs no longer act as media authorization leases. Immediately before
+  returning inline image bytes, LineageWeave re-checks the requesting account's
+  live `post_read` grant and current database affiliations; revoked access
+  removes the affected media.
+- Keycloak audience reconciliation owns only the named OIDC audience mapper,
+  rejects duplicate or conflicting mapper contracts, validates credential-free
+  HTTP(S) audience URLs, uses bounded startup retries, and never overwrites the
+  realm for a one-field change.

CHANGELOG.d/2.19.0-gnb-event-lineage-focus-keyman.md

@@ -0,0 +1,5 @@
+# 2.19.0 GNB Event Lineage focuses Keyman as the next read
+
+Opening a GNB-focused post keeps Event Lineage current and moves focus
+to Keyman so the named next action is landable. A home-list open does
+not. No TEPP theta is invented.

CHANGELOG.d/2.19.0-remove-source-fix-artifacts.md

@@ -0,0 +1,8 @@
+# 2.19.0 — Remove one-shot repair artifacts
+
+## Fixed
+
+- Removed the self-modifying pnpm repair workflow and unreferenced root-level
+  source-rewrite scripts after their one-time repairs were completed. Product
+  behavior now lives in reviewed source and normal CI rather than a workflow
+  that edits and pushes its own branch.

CHANGELOG.d/2.19.1-mcp-boundary-hardening.md

@@ -0,0 +1,6 @@
+# 2.19.1 — MCP boundary hardening
+
+## Fixed
+
+- Require JWT expiration during signature validation and serialize one post's
+  image and region analysis so a single request cannot multiply provider calls.

CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.19.0] - 2026-08-20
+
+### Added
+
+- Opening a Board Weekly VOC post, Calendar commitment, Customer master
+  related post, or Ask Agent cited post now keeps Event Lineage current
+  and focuses Keyman as the named next read. A linked Event Lineage DAG
+  walk from that popup keeps the same Keyman focus. A home-list open
+  does not add that focus or copy. No TEPP theta is invented. No cited
+  post, customer, week, or cutoff body is invented (ADR 0100 / ADR 0097
+  / ADR 0016).
+
 ## [2.17.0] - 2026-08-19
 
 ### Added
@@ -22,7 +34,7 @@ All notable changes to this project are documented here. Format follows
   and evaluation as the next read. After an authorized answer, Ask Agent
   names cited posts as current before that open. Home-list opens do not add
   that focus or copy. No TEPP theta is invented. No cited post is invented
-(ADR 0096 / ADR 0039 / ADR 0016).
+  (ADR 0096 / ADR 0039 / ADR 0016).
 
 ## [2.15.0] - 2026-08-19
 
@@ -32,7 +44,7 @@ All notable changes to this project are documented here. Format follows
   Keyman and evaluation as the next read. Customer master names authorized
   customer entities as current before that open. Home-list opens do not add
   that focus or copy. No TEPP theta is invented. No customer is invented
-(ADR 0095 / ADR 0037 / ADR 0016).
+  (ADR 0095 / ADR 0037 / ADR 0016).
 
 ## [2.14.0] - 2026-08-19
 

CLAUDE.md

@@ -105,3 +105,12 @@ cited post.
 From a GNB-focused popup, open a linked Event Lineage node: Event Lineage
 stays focused and names the new post as current (ADR 0097). A home-list
 DAG walk does not. Do not invent a theta.
+
+## GNB Event Lineage focuses Keyman (v2.19.0)
+
+A GNB-origin popup (Weekly VOC, Calendar, Customer master, Ask Agent, or a
+linked Event Lineage DAG walk from one of those) keeps Event Lineage
+current and moves focus to the Keyman heading once Keyman rows have
+settled (ADR 0100). The report-member auto-land chain to related nodes
+and Ask is not used for GNB origins. A home-list open does not gain that
+ focus. Do not invent a theta.

backend/Dockerfile

@@ -35,5 +35,5 @@ RUN uv sync --frozen --no-dev --extra backend --no-editable \
     && chown -R appuser:appuser /app
 
 USER appuser
-EXPOSE 8000
-CMD ["uvicorn", "backend.app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+EXPOSE 8000 8001
+CMD ["uvicorn", "backend.app.main:app", "--host", "0.0.0.0", "--port", "8000"]