fix(release): synchronize protected v2.28 runtime identity

[seonghobae]

Problem

Protected main@83eba56149eb802cd63642c507c324c9976ec78e declares Python package version 2.28.0 and frontend version 2.28.0, while lineageweave.__version__ was still 2.20.0. That made runtime provenance disagree with package identities. Fresh release inspection found no immutable repository release evidence that would allow package metadata alone to be treated as a shipped v2.28.0 release.

Realistic RED → minimal causal fix

Commit b99bb931b86ade0e42dc5497df7abe754016f593 adds tests/test_package_version.py, requiring runtime, Python package metadata, and frontend package metadata to be identical. On exact protected-main source this is a realistic RED: 2.20.0 != 2.28.0.

The minimal production fix is 719a284da116c87a8db4e70b0b7f257e45a045db, changing only lineageweave.__version__ to 2.28.0. Current exact head 3bdec0504a65e63f44bd49ba15de37182a1672cc adds the bounded changelog fragment. No provider, domain, DB, UI, or measurement authority changes are introduced.

Exact-candidate validation

automation/release-identity-v2280-20260906@2b9ca5876656c9a67d28f51c24790510cf72bdc1, run 34037919629, completed GREEN. It reproduced the version mismatch on the RED commit, passed the same contract on the fixed candidate, verified (pyproject, frontend, runtime) == (2.28.0, 2.28.0, 2.28.0), checked the exact three-file product delta, and removed the temporary workflow from its clean validation tree.

Fresh exact-head required evidence

The current Ready head is still exact 3bdec0504a65e63f44bd49ba15de37182a1672cc.

• Tests run 34040551185 is now terminal GREEN: frontend lint/test/build/Storybook job 101506389473 succeeded, and full PostgreSQL-backed suite job 101506389705 succeeded after locked dependency installation and pinned Rust selection.
• SAST Semgrep 34037884499: success.
• Security Scan 34037884464: success.
• CodeQL PR 34037884536: failed closed. Language detection succeeded, and actions/python/javascript-typescript jobs each successfully requested the current-head scan dispatch before failing at Release runner or enforce current-head CodeQL verdict; no authenticated terminal CodeQL verdict is available for this head. This is not relabeled as source GREEN.
• Qualifying independent current-head approval: none observed.

Therefore this PR remains Ready as validation admission but is not merge-ready. Do not self-approve, synthesize a status, churn the leaf head to manufacture checks, or weaken required gates.

Release boundary

Even after normal merge, this repair alone is not an immutable v2.28.0 release. A release-ready exact protected head still requires coherent version/CHANGELOG, package artifacts, immutable tag/GitHub Release, SBOM/provenance, reproducibility evidence, and rollback evidence. The broader historical/current-authority convergence in docs/product-technical-gap-baseline.md remains separately owned; this release repair does not rewrite unrelated product decisions.

[coderabbitai]

Warning

Review limit reached

Next included review available in 49 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 66a4a7f3-027c-481c-bc4f-14bbda3113b1

📥 Commits

Reviewing files that changed from the base of the PR and between 83eba56 and 3bdec05.

📒 Files selected for processing (3)

• CHANGELOG.d/2.28.0-release-identity.md
• lineageweave/__init__.py
• tests/test_package_version.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh gate sweep: central dispatcher authorization is no longer blocked by the old single-principal Actions variable. .github#1927 now has execution evidence for the canonical github-actions[bot],opencode-agent[bot] value. However .github#1902 remains Draft with the exact-job wake race unresolved, and this unchanged head still has no codeql-dispatch/*/<base_sha> terminal receipt; its combined commit statuses are only Devin Review and CodeRabbit. No qualifying PR approval exists. Preserve 3bdec050... unchanged and Ready: source/tests/release-identity repair remain valid, but CodeQL recovery + independent approval are still required before normal merge, and immutable tag/package/SBOM/provenance/rollback work still follows only after protected-main convergence.