feat: recover TEPP validation on canonical Project history (v2.19.0)

CHANGELOG.d/2.20.0-global-ask-cutoff-safety.md

@@ -0,0 +1,5 @@
+### Fixed
+
+- Bind the Global Ask knowledge cutoff in the final authorized-source query.
+- Give the post-chat cutoff migration a unique `0054` identity and remove
+  self-modifying stabilization workflows.

CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to this project are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.20.0] - 2026-08-21
+
+### Added
+
+- Post-scoped Ask and Global Ask now attach exact project-history links derived
+  only from currently authorized cited posts. Opening a link reuses the canonical
+  Project history timeline and its optional TEPP validation at the answer cutoff.
+
+### Security
+
+- Persisted post answers are withheld when any citation is no longer visible, and
+  stale Global Ask sessions are restarted before hidden prior prose can re-enter
+  conversation context (ADR 0113).
+
+## [2.19.0] - 2026-08-21
+
+### Added
+
+- Recovered the credential-free TEPP project-history validation boundary on top of
+  the canonical Buyer timeline. TEPP may return only cutoff-safe temporal
+  associations over the exact authorized events; the timeline remains readable
+  when TEPP is absent, and no result is labelled as a cause (ADR 0127).
+
 ## [2.18.0] - 2026-08-20
 
 ### Added

backend/app/analysis_run_start.py

@@ -11,7 +11,7 @@
 
 import hashlib
 import json
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from typing import Any
 from uuid import UUID
 
@@ -21,13 +21,13 @@
     AnalysisRunCreateError,
     fetch_visible_analysis_run,
 )
-from backend.app.post_eligibility import SOURCE_POST_ELIGIBILITY_SQL
 from backend.app.analysis_run_outbox import (
     latest_outbox_delivery_is_claimed,
     latest_outbox_delivery_is_delivered,
     outbox_request_digest,
 )
 from backend.app.lineage_ingestion import records_from_source_posts
+from backend.app.post_eligibility import SOURCE_POST_ELIGIBILITY_SQL
 from lineageweave.adjudication_client import AdjudicationClient
 from lineageweave.http_client import HttpClientError, post_json
 from lineageweave.lineage_persistence import lineage_edge_specs
@@ -119,12 +119,12 @@ def tepp_run_request(
     """Build TEPP's published request from the frozen run, never a theta."""
     cutoff = knowledge_cutoff
     if cutoff.tzinfo is None:
-        cutoff = cutoff.replace(tzinfo=timezone.utc)
+        cutoff = cutoff.replace(tzinfo=UTC)
     return AnalysisRunRequest(
         idempotency_key=idempotency_key,
         tenant_workspace_id=str(corporate_entity_id),
         snapshot_id=snapshot_sha256,
-        knowledge_cutoff=cutoff.astimezone(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+        knowledge_cutoff=cutoff.astimezone(UTC).strftime("%Y-%m-%dT%H:%M:%SZ"),
         model_contract_version=_TEPP_MODEL_CONTRACT,
         output_profile=_TEPP_OUTPUT_PROFILE,
     )
@@ -610,7 +610,7 @@ async def deliver_queued_analysis_run(
         return await _visible_or_404(
             conn, analysis_run_id, account_id, affiliated_entity_ids
         )
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     try:
         if not latest_outbox_delivery_is_claimed(latest):
             await _append_outbox_delivery(
@@ -636,9 +636,8 @@ async def deliver_queued_analysis_run(
                 affiliated_entity_ids=affiliated_entity_ids,
                 adjudication_client=adjudication_client,
             )
-        finished = datetime.now(timezone.utc)
-        if finished < now:
-            finished = now
+        finished = datetime.now(UTC)
+        finished = max(finished, now)
         await _append_outbox_delivery(
             conn,
             analysis_run_id,
@@ -699,7 +698,7 @@ async def _deliver_lineage_reconstruction(
     adjudication_client: AdjudicationClient | None = None,
 ) -> None:
     """Persist ThreadWeave parent choices for the frozen bag."""
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     member_rows = await _snapshot_member_posts(
         conn,
         locked["analysis_source_snapshot_id"],
@@ -715,9 +714,8 @@ async def _deliver_lineage_reconstruction(
         )
     edges = lineage_edge_specs(records_from_source_posts(rows), llm=adjudication_client)
     digest = reconstruction_result_digest(edges)
-    finished = datetime.now(timezone.utc)
-    if finished < now:
-        finished = now
+    finished = datetime.now(UTC)
+    finished = max(finished, now)
     await conn.execute(
         """
         insert into analysis_run_reconstruction
@@ -759,25 +757,23 @@ async def _deliver_tepp_measurement(
     tepp_client: TeppClient,
 ) -> None:
     """Submit the frozen snapshot through ``tepp_client``. Never persist a theta."""
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     request = tepp_run_request(
         idempotency_key=str(locked["idempotency_key"]),
         snapshot_sha256=str(locked["snapshot_sha256"]),
         knowledge_cutoff=locked["knowledge_cutoff"],
         corporate_entity_id=str(locked["corporate_entity_id"]),
     )
     status_code, failure_code, envelope = _tepp_submission(tepp_client, request)
-    if status_code == _SUCCEEDED and envelope is not None:
-        if not await _persist_tepp_result(
-            conn,
-            analysis_run_id=analysis_run_id,
-            envelope=envelope,
-        ):
-            status_code = _FAILED
-            failure_code = "tepp_result_not_persisted"
-    finished = datetime.now(timezone.utc)
-    if finished < now:
-        finished = now
+    if status_code == _SUCCEEDED and envelope is not None and not await _persist_tepp_result(
+        conn,
+        analysis_run_id=analysis_run_id,
+        envelope=envelope,
+    ):
+        status_code = _FAILED
+        failure_code = "tepp_result_not_persisted"
+    finished = datetime.now(UTC)
+    finished = max(finished, now)
     await _append_status(
         conn,
         analysis_run_id,