fix: repair frontend build and publish ontology Pages

.github/workflows/ontology-pages.yml

@@ -0,0 +1,138 @@
+name: Ontology Pages
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "docs/ontology/**"
+      - "scripts/build_ontology_site.py"
+      - "scripts/publish_ontology_site.py"
+      - "scripts/ontology_site_contract.py"
+      - "tests/test_ontology.py"
+      - "tests/test_ontology_site.py"
+      - "tests/test_publish_ontology_site.py"
+      - ".github/workflows/ontology-pages.yml"
+      - "pyproject.toml"
+      - "uv.lock"
+  push:
+    branches: [main]
+    paths:
+      - "docs/ontology/**"
+      - "scripts/build_ontology_site.py"
+      - "scripts/publish_ontology_site.py"
+      - "scripts/ontology_site_contract.py"
+      - "tests/test_ontology.py"
+      - "tests/test_ontology_site.py"
+      - "tests/test_publish_ontology_site.py"
+      - ".github/workflows/ontology-pages.yml"
+      - "pyproject.toml"
+      - "uv.lock"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate ontology publication
+    if: github.event_name == 'pull_request'
+    concurrency:
+      group: ontology-pages-validation-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Set up locked Python dependency manager
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.28"
+          enable-cache: false
+
+      - name: Install committed dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Verify ontology and publication contracts
+        run: |
+          uv run --frozen python -m pytest -q tests/test_ontology.py
+          uv run --frozen python -m coverage run --branch \
+            -m pytest -q tests/test_ontology_site.py tests/test_publish_ontology_site.py
+          uv run --frozen python -m coverage report \
+            --include=scripts/build_ontology_site.py,scripts/publish_ontology_site.py \
+            --fail-under=100
+
+      - name: Build static ontology site
+        run: uv run --frozen python scripts/publish_ontology_site.py --output-dir _site
+
+      - name: Compile owned Python surface
+        run: >-
+          uv run --frozen python -m compileall -q
+          scripts/build_ontology_site.py scripts/publish_ontology_site.py
+          scripts/ontology_site_contract.py
+          tests/test_ontology_site.py tests/test_publish_ontology_site.py
+
+  publish:
+    name: Publish ontology to GitHub Pages
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    concurrency:
+      group: ontology-pages-publication
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Set up locked Python dependency manager
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.28"
+          enable-cache: false
+
+      - name: Install committed dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Verify exact protected source before publication
+        run: |
+          uv run --frozen python -m pytest -q tests/test_ontology.py
+          uv run --frozen python -m coverage run --branch \
+            -m pytest -q tests/test_ontology_site.py tests/test_publish_ontology_site.py
+          uv run --frozen python -m coverage report \
+            --include=scripts/build_ontology_site.py,scripts/publish_ontology_site.py \
+            --fail-under=100
+
+      - name: Build deterministic publication artifact
+        run: uv run --frozen python scripts/publish_ontology_site.py --output-dir _site
+
+      - name: Configure GitHub Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload GitHub Pages artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: _site
+
+      - name: Deploy GitHub Pages artifact
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

AGENTS.md

@@ -36,6 +36,8 @@ reimplementing them:
   multi-channel score fusion (`weighted_convex_fuse` in
   `reconstruct.py`) and the buyer-facing Rankings port
   (`rankweave_client.py`) -- never invent a fused score or a theta.
+  Rankings disclose Cormack RRF channel contributions from owned
+  rank lists (ADR 0167).
 - [TEPP](https://github.com/ContextualWisdomLab/TEPP)'s published wire
   contract for calibrated measurement (`tepp_client.py`) -- never
   reimplement TEPP's model here.
@@ -148,6 +150,10 @@ contextual-orchestrator owns model discovery and selection.
   from derived semantic text, while retaining the source body and meaningful
   list/heading nesting. A buyer-facing post view must render semantic
   paragraphs, not the authoring application's spacing workaround.
+- Quantity HTML `<sup>`/`<sub>` and caret exponents such as `m^3` become
+  Unicode in derived units and React `<sup>`/`<sub>` in the post view
+  (ADR 0165). Never assign the body to `innerHTML`. Do not treat
+  `qty < 50` or a leading footnote `^1` as an exponent.
 - Image descriptions, OCR text, and region evidence are analysis artifacts,
   not buyer-facing prompt instructions. Buyer UI shows the source content and
   useful captions/evidence only, with provenance where appropriate.
@@ -186,12 +192,15 @@ in the same spirit) -- never against real data, per the hard rule above.
 against a live local stack (`make up`) and self-skip without one -- see
 [README.md](README.md#local-product-stack-docker-compose).
 
-Period leftover pairs (ADR 0017 / 0018) are computed in
+Period leftover pairs (ADR 0048 / 0049 / 0119 / 0162 / 0163 / 0164) are computed in
 `lineageweave/leftover_pairs.py` from the residual after a real
-GRM/GPCM score, never invented. Missing cells stay out of the
-Gabriel factorization. Closest and farthest post–criterion pairs
-persist to `report_leftover_pair` and sit above the member list so
-a click opens that post.
+GRM/GPCM score, never invented. Distances are Euclidean on the
+two-dimensional Gabriel leftover map; missing cells stay out of
+the factorization. Closest and farthest post–criterion pairs
+persist to `report_leftover_pair` with signed residual `R`, observed
+`Y`, and expected `E[Y|θ, item]` so `R = Y − E` remains auditable,
+plus leftover-map rank so rank 0 is not read as structure. They sit
+above the member list so a click opens that post.
 
 `frontend/` has its own toolchain (Node pinned via `frontend/mise.toml`,
 pnpm via Corepack -- do not add a second Node package manager or a

ARCHITECTURE.md

@@ -122,7 +122,10 @@ flowchart LR
   `rankweave_client.py`'s default transport raises
   `RankWeaveNotAvailable`. `GET /api/rankings` then returns
   `rankweave_not_available` and an empty ranking list. Hidden posts
-  are omitted from every channel. See ADR 0024.
+  are omitted from every channel. Accepted hits include
+  `channel_evidence` computed from owned temporal/lexical ranks
+  (Cormack weighted RRF contribution); RankWeave extra fields are
+  ignored and no theta is invented. See ADR 0024 and ADR 0167.
 
 ## Standards and citations
 
@@ -195,7 +198,9 @@ it fetches a genuine access token from a live Keycloak, verifies the
 allow/deny ABAC boundary against a throwaway migrated Postgres database
 (a private post scoped to a *different* corporate entity is proven
 excluded from the list and 403s on direct fetch), and proves a forged
-token is rejected. `scripts/seed_demo_data.py` populates the docker-compose
+token is rejected. Its dev-only FastAPI `TestClient` uses Starlette with the
+project's official `httpx` dev dependency; no alternate transport package is
+introduced. `scripts/seed_demo_data.py` populates the docker-compose
 stack itself with the same shape of synthetic data for manual/frontend use.
 `CORSMiddleware` (`backend/app/main.py`) allows exactly the frontend's
 origin(s) (`FRONTEND_ORIGINS`), `GET` and `POST` (the extract-keymen
@@ -588,8 +593,10 @@ on those same fixed parameters (Kim, 2006 FIPC). After scoring,
 `information_polytomous` ranks the shared-bank items by Fisher
 information at the group's mean θ (Lord, 1980 max-info CAT). Rankings
 persist to `report_item_information`. After those IRT main effects,
-residual SVD leftover pairs (Jeon et al., 2021; ADR 0017) persist to
-`report_leftover_pair`. Results persist to
+residual SVD leftover pairs on two Gabriel axes (Jeon et al., 2021;
+ADR 0048 / 0119 / 0162 / 0163 / 0164) persist to `report_leftover_pair` with
+signed residual `R`, observed `Y`, expected `E[Y|θ, item]`, and full
+leftover-map rank. Results persist to
 `report_period_score` / `report_member_score`.
 `GET /api/reports/{grouping}` lists the trend;
 `GET /api/reports/{grouping}/{period}` is ABAC-filtered;
@@ -601,7 +608,9 @@ bank as the dummy high/low band rows, so comparison-strip click
 through opens those DAG posts. Report members include the earliest
 open ticket title, status lookup label, and due date when one exists. The home page renders
 the actual mean θ, the FIPC delta, the CAT-selected item, leftover
-closest/farthest pairs above the member list, and the
+closest/farthest pairs (signed residual `R`, observed `Y`, expected
+`E`, full rank, and two-axis leftover-map distance `d` after IRT main
+effects) above the member list, and the
 PU / corp / thread comparison -- never a placeholder. TEPP is unchanged.
 
 ## Phase 6b: Knowledge Graph as a real Ontology + Semantic Layer

CHANGELOG.d/2.12.13-leftover-map-two-dimensional-distance.md

@@ -0,0 +1,8 @@
+## 2.12.13 — Two-dimensional leftover-map distances
+
+- Measure closest and farthest leftover post–criterion distances on
+  the two-axis Jeon / Gabriel interaction map (ADR 0119). Hidden SVD
+  axes after the second no longer change `leftover_distance`. Rank-0
+  and rank-1 maps still pad unused axes with zero. After `make seed`,
+  leftover pairs above the member list still open that post. Never
+  invent a leftover score or a theta.

CHANGELOG.d/2.12.14-leftover-observed-expected.md

@@ -0,0 +1,8 @@
+## 2.12.14 — Leftover observed Y and expected E
+
+- Persist observed `Y` and expected `E[Y|θ, item]` on leftover
+  post–criterion pairs (ADR 0163). Residual stays `R = Y − E`. After
+  `make seed`, closest and farthest leftover pairs sit above the member
+  list with `Y` and `E` next to leftover-map distance `d`; click opens
+  that post. Omit the badge when either value is missing. Never invent
+  a leftover score or a theta.

CHANGELOG.d/2.12.15-idempotent-migration-replay.md

@@ -0,0 +1,3 @@
+- Replay every idempotent migration from 0012 onward on existing PostgreSQL
+  volumes through a POSIX `/bin/sh` filename boundary, including tenant settings
+  and leftover evidence migrations, while stopping startup on the first error.

CHANGELOG.d/2.12.15-leftover-map-rank.md

@@ -0,0 +1,8 @@
+## 2.12.15 — Leftover-map rank
+
+- Persist leftover-map rank on leftover post–criterion pairs (ADR 0164).
+  Rank is the number of Gabriel singular values above the floor. After
+  `make seed`, closest and farthest leftover pairs sit above the member
+  list with `rank {n}` next to leftover-map distance `d`; click opens
+  that post. Rank 0 names no leftover structure. Never invent a leftover
+  score or a theta.

CHANGELOG.d/2.12.16-leftover-residual-disclosure.md

@@ -0,0 +1,6 @@
+# 2.12.16 leftover residual disclosure
+
+After `make seed`, closest and farthest leftover pairs sit above the
+period-report member list with signed residual `R`, observed `Y`,
+expected `E`, full leftover-map rank, and two-axis distance `d`.
+Read the named evidence, then click the pair to open that post.

CHANGELOG.d/2.12.17-rankweave-ranking-channel-evidence.md

@@ -0,0 +1,11 @@
+# 2.12.17 — RankWeave ranking channel evidence
+
+Rankings now shows why a fused hit landed.
+
+- `GET /api/rankings` attaches owned-channel evidence: 1-based
+  newest-first and title-overlap ranks plus Cormack RRF contribution
+  `weight / (η + rank)` with η = 60.
+- A channel the post is missing from is omitted. RankWeave extra
+  fields are ignored. No fused score or theta is invented.
+- The Rankings list discloses that evidence under each hit. Copy
+  states this is not a calibrated score. Click still opens the post.

CHANGELOG.d/2.12.18-quantity-superscripts.md

@@ -0,0 +1,8 @@
+# 2.12.18 — Quantity superscript display
+
+## Fixed
+
+- Post popups now show cubic metres and similar quantities as superscripts
+  and subscripts (`12 m³`, `H₂O`) instead of flattened `m^3` or `m3`.
+  Semantic units store Unicode so embeddings keep the exponent. Comparison
+  operators and leading footnote carets stay literal (ADR 0165).

CHANGELOG.d/2.12.6-api-route-contract-tests.md

@@ -0,0 +1,10 @@
+# Verify buyer API failure and authorization boundaries
+
+Exercise Ask Agent, RankWeave rankings, and saved locale preferences through
+their authenticated HTTP routes. Rankings now have deterministic accepted and
+unavailable contract evidence, including proof that another entity's private
+post does not enter a buyer's channels. Ask Agent's explicit empty-question
+response now uses FastAPI's current `HTTP_422_UNPROCESSABLE_CONTENT` status
+name without changing the wire status. Backend integration tests keep
+Starlette's TestClient on the project's official `httpx` dev dependency; no
+alternate look-alike transport package is introduced.

CHANGELOG.d/2.12.6-lineage-dag-stories.md

@@ -0,0 +1,6 @@
+# Verify lineage DAG states before changing graph CSS
+
+Open `Lineage/LineageDag` in Storybook and compare the empty, grouped/forked,
+ungrouped, and long-title states. The graph now omits a relationship from both
+the SVG and its count unless both endpoints are visible in the same reconstruct
+group.

CHANGELOG.d/2.12.7-non-identifying-gap-baseline.md

@@ -0,0 +1,28 @@
+# Restore a non-identifying product and technical gap baseline
+
+- Rewrites `docs/product-technical-gap-baseline.md` without identifying
+  post identifiers, organization names, or production record keys (ADR 0001).
+- Binds remaining gaps to the live PR and issue inventory, Figma File ID
+  `1Su3lDRmiZdcUs47t1QwIX` (ADR 0002), and the org coverage/hourly callers
+  ContextualWisdomLab/.github#1258 and #1259.
+- Does not change login or frontend typecheck; LineageWeave#426 owns the
+  shared unauthenticated AdminPanel/OIDC repair, ontology Pages stack, and this
+  baseline because #497 merged into #426 rather than protected `main`.
+  LineageWeave#494 remains an overlap audit, not a second dependency. Repeated
+  concurrent add/revert oscillation was not chased; its exact `5d9728a` head
+  instead merge-restacks current #426, has a four-file optional-only diff, and
+  passes Frontend while Full suite remains in progress. #426 must land first
+  to retain that dependency order.
+- Records #496's accepted-receipt recheck dependency, #505's non-default #490
+  merge, #509's subsequent merge into that same unprotected stack, and #507's
+  clean protected-main restack without claiming any as protected-release
+  evidence. #507's exact remote tree matches its validated local tree, with 41
+  focused and 770 parent tests passing; hosted Frontend, Full suite, and
+  OpenCode are green, all 12 threads are resolved, and only Strix remains in
+  progress, but zero approvals still require independent review. #509 remains
+  a narrow changelog/parser/test/live-schema diff;
+  its all-green checks and resolved thread do not make #490 protected delivery.
+  #499 remains hidden-stack evidence.
+- Records that a closed unmerged PR and pre-existing public history require an
+  ADR 0001 security/privacy-owner remediation process, without reproducing or
+  hinting at the private runtime source-table identifier involved.

CHANGELOG.d/2.12.7-ontology-pages.md

@@ -0,0 +1,13 @@
+## Added
+
+- Added a deterministic GitHub Pages publication pipeline for the public
+  ontology documentation URL, with fragment-addressable terms and Turtle,
+  JSON-LD, N-Triples, PROV-O profile, and source-digest artifacts.
+- Added semantic round-trip, byte-determinism, fail-closed source, CLI, and
+  100% statement/branch coverage tests for the ontology site renderer.
+- Added a complete manifest inventory for every published ontology artifact.
+- Added a fail-closed publication boundary that prevents duplicate public
+  fragments, unsafe linked IRI schemes, symlink or source-overlapping outputs,
+  and deletion of output directories not marked as generated.
+- Restricted Pages deployment to `main`, preserved non-cancelling publication
+  concurrency, and kept all third-party Actions pinned by full commit SHA.

CHANGELOG.d/2.12.7-optional-extra-collection.md

@@ -0,0 +1,15 @@
+# Skip optional-extra suites when the sandbox did not install them
+
+- OpenCode coverage-evidence supplies pytest and coverage but not
+  LineageWeave's optional backend extras. Collection no longer fails
+  with ``ModuleNotFoundError`` for ``asyncpg``, ``psycopg2``, ``redis``,
+  ``fast_mlsirm``, or its ``numpy`` runtime dependency when those extras
+  are absent. The repository-root hook also covers sibling ``backend/tests``
+  and tests that import an optional dependency through a local module,
+  including ``period_report`` when only NumPy is unavailable.
+- Kept paths defer to pytest's remaining ignore hooks, preserving built-in
+  ``--ignore`` and project collection rules.
+- Hosted CI still installs ``dev`` and ``backend`` extras, so every
+  suite continues to collect and run there.
+- Login typecheck and the ADR 0001 gap baseline remain owned by
+  LineageWeave#426; this PR keeps only optional-extra collection work.