chore: retain broad Milestone 2 prototype as superseded evidence

.github/workflows/verify-milestone2-analysis-run-contract.yml

@@ -0,0 +1,120 @@
+name: Verify Milestone 2 analysis-run contract
+
+on:
+  push:
+    branches:
+      - feat/milestone2-analysis-run-contract-v079
+
+permissions:
+  contents: read
+
+concurrency:
+  group: verify-milestone2-analysis-run-contract
+  cancel-in-progress: true
+
+jobs:
+  contract:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    services:
+      postgres:
+        image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      LINEAGEWEAVE_TEST_POSTGRES_ADMIN_DSN: postgresql://postgres:postgres@localhost:5432/postgres
+    steps:
+      - name: Checkout exact branch head
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Set up locked dependency manager
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.28"
+          enable-cache: false
+
+      - name: Select pinned Rust toolchain
+        run: |
+          set -euo pipefail
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
+
+      - name: Install committed dependency graph
+        run: uv sync --frozen --extra dev --extra backend
+
+      - name: Enforce focused statement and branch coverage
+        run: |
+          set -euo pipefail
+          uv run --frozen coverage erase
+          uv run --frozen coverage run --branch \
+            --source=lineageweave.analysis_run,backend.app.analysis_run_ingestion \
+            -m pytest -q \
+            tests/test_analysis_run.py \
+            backend/tests/test_analysis_run_ingestion.py
+          uv run --frozen coverage report --show-missing --fail-under=100
+
+      - name: Verify real PostgreSQL migration and rollback
+        run: |
+          set -euo pipefail
+          uv run --frozen python -m pytest -q \
+            tests/test_analysis_run_schema.py \
+            tests/test_analysis_run_rollback.py
+
+      - name: Verify complete Python product suite
+        run: |
+          set -euo pipefail
+          uv run --frozen python -m pytest -q
+          uv run --frozen python -m compileall -q backend lineageweave tests
+
+      - name: Reject public source-channel disclosure
+        run: |
+          set -euo pipefail
+          if git grep -nEI \
+            '(postgresql://[^/[:space:]]+@localhost/postgres|select[[:space:]].*from[[:space:]]+public\.[a-z0-9_]+)' \
+            -- ':!docs/adr/0013-analysis-run-provenance-boundary.md'; then
+            echo 'Public tree contains a direct private-source channel or SQL projection.' >&2
+            exit 1
+          fi
+
+      - name: Verify diff hygiene
+        run: git diff --check HEAD^
+
+  frontend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout exact branch head
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # actions/setup-node@v5
+        with:
+          node-version: "24"
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Install, lint, test, and build
+        working-directory: frontend
+        run: |
+          set -euo pipefail
+          pnpm install --frozen-lockfile
+          pnpm run lint
+          pnpm run test
+          pnpm run build

.github/workflows/verify-milestone2-analysis-run-v079.yml

@@ -0,0 +1,127 @@
+name: Verify Milestone 2 analysis-run contract v0.79
+
+on:
+  push:
+    branches:
+      - feat/milestone2-analysis-run-contract-v079
+
+permissions:
+  contents: read
+
+concurrency:
+  group: verify-milestone2-analysis-run-v079
+  cancel-in-progress: true
+
+jobs:
+  exact-branch-verification:
+    name: Exact branch contract verification
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    services:
+      postgres:
+        image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      LINEAGEWEAVE_TEST_POSTGRES_ADMIN_DSN: postgresql://postgres:postgres@localhost:5432/postgres
+    steps:
+      - name: Checkout exact branch head
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Select repository Rust toolchain
+        run: |
+          set -euo pipefail
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
+
+      - name: Set up locked Python dependency manager
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.28"
+          enable-cache: false
+
+      - name: Install committed Python dependencies
+        run: uv sync --frozen --extra dev --extra backend
+
+      - name: Prove focused owned-code coverage
+        run: |
+          set -euo pipefail
+          uv run --frozen coverage erase
+          uv run --frozen coverage run --branch \
+            --source=lineageweave.analysis_run,backend.app.analysis_run_ingestion \
+            -m pytest -q \
+            tests/test_analysis_run.py \
+            backend/tests/test_analysis_run_ingestion.py
+          uv run --frozen coverage report --show-missing --fail-under=100
+
+      - name: Prove normalized schema against PostgreSQL
+        run: uv run --frozen python -m pytest -q tests/test_analysis_run_schema.py
+
+      - name: Run complete Python and PostgreSQL suite
+        run: uv run --frozen python -m pytest -q
+
+      - name: Compile shipped Python
+        run: uv run --frozen python -m compileall -q backend lineageweave tests
+
+      - name: Set up Node
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # actions/setup-node@v5
+        with:
+          node-version: "24"
+
+      - name: Install committed frontend dependencies
+        run: |
+          set -euo pipefail
+          corepack enable
+          cd frontend
+          pnpm install --frozen-lockfile
+
+      - name: Verify React product
+        working-directory: frontend
+        run: |
+          set -euo pipefail
+          pnpm run lint
+          pnpm run test
+          pnpm run build
+
+      - name: Verify repository diff hygiene
+        run: |
+          set -euo pipefail
+          git diff --check HEAD^
+          test ! -e compose/keyverse_oidc.py
+          python - <<'PY'
+          from pathlib import Path
+
+          forbidden_fragments = (
+              "postgresql://seonghobae@localhost/postgres",
+              "zcrht811_export_rows",
+          )
+          changed = [
+              line.strip()
+              for line in __import__("subprocess").check_output(
+                  ["git", "diff", "--name-only", "HEAD^"], text=True
+              ).splitlines()
+              if line.strip()
+          ]
+          for relative in changed:
+              path = Path(relative)
+              if not path.is_file():
+                  continue
+              text = path.read_text(encoding="utf-8", errors="ignore")
+              for forbidden in forbidden_fragments:
+                  if forbidden.casefold() in text.casefold():
+                      raise SystemExit(f"private-source fragment found in {relative}")
+          PY

CHANGELOG.d/milestone2-analysis-run-contract.md

@@ -0,0 +1,19 @@
+## Added
+
+- Added a normalized, aggregate-only provenance root for private PostgreSQL
+  analysis runs, downstream TEPP/contextual-orchestrator/fast-mlsirm service
+  calls, status events, and external acceptance artifacts.
+- Added a no-future-information database and Python contract requiring the
+  source snapshot's latest evidence-availability time not to exceed the run's
+  knowledge cutoff.
+- Added deterministic, source-redacting request digests and transactional
+  idempotency/conflict handling without storing SQL, DSNs, raw content, image
+  bytes, provider credentials, or private source identifiers.
+- Added real-PostgreSQL schema tests and 100% statement/branch coverage for the
+  new Python contracts and repository.
+
+## Security
+
+- Private actual-data acceptance manifests remain external deployment
+  artifacts referenced only by digest and URI; public API projections contain
+  aggregate counts, clocks, opaque IDs, configuration, and status only.