feat(ask): persist public-claim envelopes for Global Ask verification

AGENTS.md

@@ -295,6 +295,14 @@ when the event instant is missing. Cited evidence names **Time
 axis** so the reader can open that post and see which clock
 matched. Do not invent an event date or a theta.
 
+Public-claim verification (ADR 0229 / issue #272) is opt-in
+(`verify_external`). Admission is a persisted `public_claim_envelope`
+bound to a public post. Question-token overlap is not admission.
+Person, Keyman, TEPP, and fast-mlsirm kinds cannot be stored.
+External URLs stay off `cited_post_ids`. Missing SearXNG is
+unavailable, not a guessed query. Never force
+`contextual-orchestrator` `mode="verify"`.
+
 Organization chips show a unique search-corroborated SKOS companion
 (`Demo Corp (DC)`) and stay unlabeled on a miss or tie (ADR 0008 /
 ADR 0170). Do not invent an abbreviation from letters. Synthetic

ARCHITECTURE.md

@@ -79,6 +79,7 @@ flowchart LR
 | `commitment_extraction.py` | Pluggable LLM derivation of a customer commitment (promise + deadline) from a post; `Null` default, `ContextualOrchestrator` real impl |
 | `temporal_expressions.py` | Pure Korean relative-time resolver for Global Ask (ADR 0150) |
 | `ask_time_axis.py` | Event-time vs ingestion-time clock choice for that window (ADR 0202) |
+| `public_claim_verification.py` | Typed public-claim envelopes for Global Ask; opt-in SearXNG URLs stay off `cited_post_ids` (ADR 0229) |
 | `ontology.py` | Loads `docs/ontology/lineageweave-kg.ttl`, the formal OWL 2/RDFS/SKOS vocabulary for the Knowledge Graph's node/edge types (ADR 0004) |
 | `ontology_neighborhood.py` | Bounded typed ontology/provenance neighborhood (ADR 0184); PostgreSQL stays authoritative, OWL subclass is not an instance edge |
 | `ontology_source_cursor.py` | Opaque HMAC source-window continuation (ADR 0124); keyset pagination, never OFFSET |
@@ -87,18 +88,6 @@ flowchart LR
 | `server.py` | Legacy stdlib HTTP server for the library-level synthetic fixture demo; production uses FastAPI/PostgreSQL |
 | `web/index.html` | Legacy self-contained SVG DAG viewer; production UI is the React/Vite frontend |
 
-> **Known local-test-environment limitation:** `adjudication_client.py`'s
-> `mode="verify"` call depends on contextual-orchestrator's
-> `TaskOrchestrator.route_and_verify`, which as of this writing is still
-> an open, unmerged upstream PR
-> (`ContextualWisdomLab/contextual-orchestrator#149`). Until it merges,
-> the four adjudication/chat tests that exercise `mode="verify"` against
-> a real orchestrator fail with `invalid_mode` (the deployed `main` only
-> accepts `auto`/`route`/`conduct`) -- confirmed by reproducing the same
-> `400` directly against the orchestrator's own `/v1/chat/completions`,
-> not caused by anything in this repo. `mode="route"` (every other
-> pluggable client) is unaffected.
-
 ## Design decisions worth naming
 
 - **Pluggable, never faked, channels.** `NullEmbeddingClient` and
@@ -234,6 +223,10 @@ Each direct edge includes `interval_relation_code` /
 Global Ask merges cited threads from one post/edge fetch pair and
 caps the payload at the landing node bound, keeping cited posts first
 (ADR 0169). Open a cited post to read the focused thread.
+Opt-in public-claim verification (ADR 0229) loads persisted
+egress-eligible envelopes only. External URLs stay off
+`cited_post_ids`. Missing search is unavailable, not a question-token
+query, and this repository never forces `mode="verify"`.
 `POST /api/lineage/rebuild` (`post_admin`) re-runs `reconstruct()` over
 every `source_post` and atomically rewrites edges, channel signals, and
 Allen interval relations. Reconstruct grouping is

CHANGELOG.d/2.22.0-public-claim-envelope.md

@@ -0,0 +1,20 @@
+# 2.22.0 — Persisted public-claim envelope
+
+## Added
+
+- Typed `public_claim_envelope` rows admit Global Ask public verification
+  (issue #272 / [ADR 0229]). Closed kinds are organization presence, public
+  event, and public relationship. Person, Keyman, TEPP, and fast-mlsirm
+  evidence cannot be stored.
+- Ask Agent `verify_external` is opt-in. Off omits the projection. On
+  loads currently authorized egress-eligible envelopes and never nominates
+  a claim from question tokens. SearXNG URLs stay on
+  `external_evidence_urls` and never enter `cited_post_ids`.
+- Organization-presence distinctive-token footprint can read **Supported**.
+  Other polarity stays unavailable until contextual-orchestrator classifies
+  retrieved evidence. This repository does not force `mode="verify"`.
+- After `make seed`, the Demo public post envelope sits above the Ask
+  answer. A click opens that post. Web verification is unavailable when
+  SearXNG is unset.
+
+[ADR 0229]: docs/adr/0229-public-claim-envelope.md

CHANGELOG.md

@@ -8,6 +8,15 @@ All notable changes to this project are documented here. Format follows
 
 ### Added
 
+- Persist typed public-claim envelopes for Global Ask web verification
+  (issue #272 / ADR 0229). Ask Agent can opt into `verify_external`;
+  only egress-eligible public organization-presence, public-event, and
+  public-relationship claims are admitted. Person, Keyman, TEPP, and
+  fast-mlsirm evidence stay inside the workspace. SearXNG URLs never
+  enter `cited_post_ids`, and this repository does not force
+  `mode="verify"`. After `make seed`, the Demo public post envelope sits
+  above the answer; a click opens that post.
+
 - Persist explicit paragraph, list, table, MathML formula, and caller-parsed
   conversation-turn semantic-unit kinds without inferring absent boundaries.
 - Event Lineage now persists each reconstructed connection's independent

CLAUDE.md

@@ -48,7 +48,7 @@ cutoff.
 
 Create/start endpoint rules (ADR 0017 / 0021), tie-vs-miss similarity
 (ADR 0026), R&R catalog ids (ADR 0019 / 0027), leftover pairs
-(ADR 0048–0164 / 0182 / 0201), the text-channel embedding swap and cosine
+(ADR 0048–0164 / 0182 / 0201), public-claim envelopes (ADR 0229), the text-channel embedding swap and cosine
 clamp (ADR 0190), per-edge channel-score persistence (ADR 0195),
 migration replay (ADR 0166), docstring coverage, and the measurement
 boundary are all stated in [AGENTS.md](AGENTS.md) -- read it before