feat: add project lifecycle history timeline (v2.18.4)

[seonghobae]

Buyer result

Closes #278.

Adds a Buyer-facing Project history destination so an authorized user can select one exact project identity and read its complete visible chronology in one screen: award/order → specification change → delivery → VOC → rebid, with the actual event sequence determined only by persisted records.

The selected event exposes its source post, project evidence, related predecessor/successor history, observed source-author evidence, persisted responsibility evidence, and responsibility-evidence changes or gaps. Opening the source post retains the Project History origin while walking linked Event Lineage nodes.

Truth and authorization boundaries

• Project identity uses exact source_project_code, source name only when code is absent, or persisted post_project_mention.project_key; fuzzy search never binds project identity.
• Source project fields and source author are observed evidence.
• Semantic project mentions, summary responsibilities, and persisted lineage are inferred evidence.
• post_lineage_edge is exposed as related history, not causation.
• Source-author and responsibility changes are evidence changes, not an authoritative HR assignment ledger.
• The existing post_read RBAC and public/same-corporate-entity ABAC boundary applies to the project index, timeline, edges, and event details.
• A supplied knowledge cutoff excludes records unavailable after that clock. Existing records currently use the explicit source_post_created_at_fallback time-semantics code.

API and Buyer surface

The bounded implementation payload adds:

• GET /api/projects
• GET /api/project-history?project_key=...&knowledge_cutoff=...
• bounded project-index and timeline limits
• Buyer GNB Project history
• accessible horizontal timeline with Arrow/Home/End navigation
• exact-value table, responsive overflow, and print support
• event detail, predecessor/successor open actions, source-post open action
• English, Korean, Chinese, Japanese, and Vietnamese copy
• Storybook inventory, ADR, product/operator documentation, doctoring, and changelog

Exact stack identity

• Declared parent branch: feat/event-lineage-node-keeps-gnb-focus-v2170
• Exact current feat: keep GNB Event Lineage focus on a linked DAG node (v2.17.0) #264 head and PR base: bbb88cfe68f736fa0edab38369e666d627cb64e8
• Current implementation-runner head: f8f05cbcbcfd9d0b5eec0567fc8023a42c1e58a8
• The branch was rebuilt directly on the exact parent rather than retaining the stale divergent ancestry.

Test-first execution

A bounded one-shot workflow currently carries only the reviewed implementation payload. It must:

1. commit the backend and frontend RED contracts;
2. prove both fail before production implementation;
3. apply the narrow GREEN slice;
4. run focused PostgreSQL/API tests and 100% statement/branch coverage for the new production module;
5. run the complete Python/PostgreSQL suite;
6. run frontend lint, complete tests, production build, and Storybook;
7. confirm release/documentation invariants;
8. remove all repair-only workflow/payload files before publishing the production commit.

The first run failed before RED because independently encoded payload fragments were concatenated before decoding. The runner now decodes each fragment independently, concatenates the decoded gzip bytes, verifies the reconstructed helper SHA-256, and verifies the exact remote parent both before execution and immediately before publication.

Run 32330494007 is the current exact-head RED→GREEN run. No passing result is claimed while it is queued, running, failed, or superseded.

Draft and merge gates

• feat: deliver buyer evidence board and source-grounded ontology surface #258 → feat: name Weekly VOC and focus Event Lineage (v2.13.0) #260 → feat: open Calendar commitments onto Event Lineage (v2.14.0) #261 → feat: open Customer master related posts onto Event Lineage (v2.15.0) #262 → feat: open Ask Agent cited posts onto Event Lineage (v2.16.0) #263 → feat: keep GNB Event Lineage focus on a linked DAG node (v2.17.0) #264 must be landed or otherwise reconciled in order.
• If feat: keep GNB Event Lineage focus on a linked DAG node (v2.17.0) #264 moves, this branch must be restacked and the complete exact-head verification repeated.
• The implementation workflow and payload files must be absent from the final PR head.
• Current-head Tests, PostgreSQL integration, frontend, Storybook, security, SAST, CodeQL/organization gates, supply-chain checks, and documentation contracts must be terminal-success.
• All valid review threads must be resolved.
• A qualifying independent exact-head approval is required.
• Do not self-approve, force-merge, or promote inferred history to causal or HR authority.

Out of scope

• reimplementing feat: compose evidence-bound Event Intelligence (v2.18.3) #275 Event Intelligence Dossier
• TEPP or fast-mlsirm numerical inference
• fuzzy project identity
• causal claims
• authoritative HR assignment history
• arbitrary cross-tenant project aggregation

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ff11618e-db85-4994-afed-9853a3090ba3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Work on this PR's existing branch feat/project-history-timeline-v2184-r3; do not merge or modify the parent branch. Reconstruct .github/scripts/project_history_patch.py.gz.b64.* as /tmp/apply_project_history.py, verify SHA-256 aca6e0effc9993bafdeefca85601fde4a0505077510d49b8f5a272eb9dc3d753, then preserve the test-first sequence already encoded by .github/workflows/project-history-red-green.yml: commit the RED backend/frontend contracts, prove both fail, apply GREEN, run focused 100% statement/branch coverage for backend/app/project_history.py, real PostgreSQL/API tests, the complete Python suite, frontend lint/tests/build/Storybook, and release/doc hygiene. Publish only if all pass; remove the one-shot workflow and payload files from the production head. Do not force-cancel workflows, self-approve, mark Ready, or merge. If an anchor or verification fails, report the exact first causal failure on this PR rather than weakening a test.