feat: add normalized evidence-bound project history authority (v2.18.0)

[seonghobae]

Fixes #280

Buyer outcome

Adds the normalized, evidence-gated project lifecycle authority and reusable timeline required to inspect one project from order/award through specification change, delivery, VOC, and rebid. Missing events, relations, assignments, dates, and gaps remain absent rather than being inferred for visual completeness.

Editable Figma contract

File SBpgot7uTvMxEaxUwvoc0S:

• desktop lifecycle and selected-event detail: node 308:2;
• narrow/mobile vertical lifecycle: node 309:2;
• empty, hidden-evidence, truncated, and single-assignment states: node 309:50;
• narrow/mobile selected-event detail: node 310:2.

The reusable component may be embedded in the established post detail and consumed by a dedicated Project history destination, but those surfaces must share this same authority and must not maintain independent lifecycle truth.

Normalized authority

PostgreSQL remains the source of truth. The slice defines:

• project_history_project — canonical project identity and display name;
• project_history_event — event facts and their evidence post;
• project_event_relation — explicit event relation and its evidence;
• project_responsibility_assignment — observed person/role validity interval and evidence.

Every published event, relation, and assignment is evidence-backed. The API re-applies post_read, public-or-affiliated-corporate ABAC, and the shared source-post eligibility predicate. If an endpoint event becomes invisible, its relations disappear. Handover gaps are calculated only from the visible assignment union.

Temporal and semantic boundary

• Timestamps are offset-aware RFC 3339.
• OWL-Time projects instants, intervals, and ordering.
• PROV-O projects evidence use and derivation without replacing relational authority.
• follows, related_to, and revises remain explicit stored relations and are not labelled causal.
• Responsibility evidence is not promoted into an authoritative HR assignment ledger.

Buyer component

ProjectHistoryTimeline provides:

• horizontal lifecycle progression on wide surfaces and vertical progression on narrow surfaces;
• keyboard-selectable events with exact dates, evidence counts, and source-opening actions;
• selected-event relation trails with explicit non-causal copy;
• responsibility intervals and separately labelled positive handover gaps;
• empty, hidden-evidence, truncated, no-assignment, single-assignment, and complete-lifecycle Storybook states;
• print/export rules preserving the same visible evidence.

Test-first publication gate

The branch must preserve RED→GREEN evidence and verify:

1. clean-install and upgrade PostgreSQL migrations;
2. schema/FK/3NF contracts and rollback;
3. ABAC removal of hidden events, endpoint relations, assignments, counts, and gaps;
4. deterministic RFC 3339 ordering and non-negative gap calculation;
5. ontology/provenance parsing;
6. accessible keyboard interaction and narrow-layout overflow protection;
7. complete Python/PostgreSQL and frontend suites, lint, production build, and Storybook;
8. 100% statement/branch coverage for changed production modules and complete public docstrings;
9. removal of all repair-only workflows and payloads before final review.

Stack and convergence boundary

This remains a Draft child of #258 → #260 → #261 → #262 → #263 → #264. It must be restacked after every parent movement and cannot reuse predecessor checks or approvals.

Project-history PRs #281, #282, and #285 must not create parallel authorities. TEPP may validate or enrich explicit temporal evidence after its own prerequisite stack lands; a dedicated GNB destination may consume this API/component. Neither may bypass this normalized evidence and authorization boundary.

Authoritative external-source ingestion and idempotent reconciliation remain the separate follow-up #284. Event Lineage channel-score persistence #274, MCP Global Ask, TEPP measurement, and fast-mlsirm estimation remain out of scope.

Do not self-approve, force-merge, or treat queued/pending/absent checks as success.

[seonghobae]

Responsive design evidence

The editable Figma specification now covers the implementation states required by this PR:

• desktop lifecycle and selected-event detail: 308:2;
• 390×844 vertical/mobile lifecycle with exact event, responsibility-gap, non-causal relation, and source-evidence text: 309:2;
• empty evidence, hidden-evidence removal, truncation, and single-assignment/no-gap states: 309:50.

These nodes are design evidence only. They do not replace the Storybook/browser implementation comparison or exact-head frontend verification gate.

[seonghobae]

Superseded by draft #285, which now owns the ordinary test-first implementation for the shared #278/#279/#280 Buyer capability. This branch never published a verified product source commit: its one-shot repair stopped at an anchor drift and retained bootstrap payload/workflow files on an obsolete #264 parent. No check, review, or implementation evidence from this head transfers to #285. Closing without merge; the normalized authority, ABAC, temporal/provenance, Figma, Storybook, and evidence-gap requirements remain active on #285 and external-source writer/reconciliation remains #284.

[seonghobae]

Exact-head repair checkpoint: current HEAD is 6707d54e5170b1c5f43cfaecc487482407f631d7. Fixed the failed red-green-project-history gate: the bounded payload now inserts migration 0050 after the current 0049 anchor, applies source-context name migrations 0034/0038/0039 in the PostgreSQL contract fixture, and gives relation evidence buttons a distinct accessible label (근거: ...) when they target the same post as the selected event. Local evidence: project-history Python/PostgreSQL tests 9 passed; frontend targeted 4 passed, full frontend 146 passed, lint/build passed; full backend with external SearxNG disabled 680 passed, 17 skipped, 4 warnings. The one live SearxNG test is environment-dependent and returned corroboration for its deliberately fictitious query, so it remains separated from the deterministic gate. Please rerun and review this exact HEAD.