**ansible-tower competency rollup.** The ontology answers one single-source and one cross-source question over the `ansible-tower` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R001.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R001.1 to .3 are LANDED.

**ansible-tower single-source question.** "Which job templates failed in their last run, and against which inventory hosts?" Answered from the ansible-tower connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over ansible-tower data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**ansible-tower cross-source question.** "Which hosts that failed their last Tower run also have an open ServiceNow change or incident?" Requires linking ansible-tower to servicenow and systems-manager through the ontology concept: managed host (configuration item). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**ansible-tower acceptance test.** Both questions (EG-CQ-CONN-R001.1 and EG-CQ-CONN-R001.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R001.1 and EG-CQ-CONN-R001.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**archimate competency rollup.** The ontology answers one single-source and one cross-source question over the `archimate` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R002.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R002.1 to .3 are LANDED.

**archimate single-source question.** "Which application components serve a given business process, and through which relationships?" Answered from the archimate connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A fixture query over archimate data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**archimate cross-source question.** "Which ArchiMate application components have no matching LeanIX fact sheet or ServiceNow CI?" Requires linking archimate to leanix and servicenow through the ontology concept: application / configuration item. Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**archimate acceptance test.** Both questions (EG-CQ-CONN-R002.1 and EG-CQ-CONN-R002.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R002.1 and EG-CQ-CONN-R002.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**archivebox competency rollup.** The ontology answers one single-source and one cross-source question over the `archivebox` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R003.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R003.1 to .3 are LANDED.

**archivebox single-source question.** "Which archived snapshots of a given domain failed one or more extractors, and when?" Answered from the archivebox connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/documentation-v1.ttl`. | A fixture query over archivebox data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**archivebox cross-source question.** "Which archived pages were first seen as FreshRSS articles but never captured by ArchiveBox?" Requires linking archivebox to freshrss and searxng through the ontology concept: URL / web resource. Vocabulary: `crates/eg-core/ontology/documentation-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**archivebox acceptance test.** Both questions (EG-CQ-CONN-R003.1 and EG-CQ-CONN-R003.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R003.1 and EG-CQ-CONN-R003.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**aris competency rollup.** The ontology answers one single-source and one cross-source question over the `aris` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R004.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R004.1 to .3 are LANDED.

**aris single-source question.** "Which EPC functions in a process model have no outgoing control-flow connection?" Answered from the aris connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A fixture query over aris data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**aris cross-source question.** "Which ARIS-modelled processes have a deployed Camunda definition, and which do not?" Requires linking aris to camunda and archimate through the ontology concept: business process. Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**aris acceptance test.** Both questions (EG-CQ-CONN-R004.1 and EG-CQ-CONN-R004.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R004.1 and EG-CQ-CONN-R004.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**arr competency rollup.** The ontology answers one single-source and one cross-source question over the `arr` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R005.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R005.1 to .3 are LANDED.

**arr single-source question.** "Which monitored movies and episodes are wanted but have no file, and which indexer last searched them?" Answered from the arr connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over arr data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**arr cross-source question.** "Which wanted Radarr titles are currently downloading in qBittorrent and not yet visible in Jellyfin?" Requires linking arr to qbittorrent and jellyfin through the ontology concept: media item (title). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**arr acceptance test.** Both questions (EG-CQ-CONN-R005.1 and EG-CQ-CONN-R005.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R005.1 and EG-CQ-CONN-R005.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**atlassian competency rollup.** The ontology answers one single-source and one cross-source question over the `atlassian` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R006.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R006.1 to .3 are LANDED.

**atlassian single-source question.** "Which Jira issues in a project are blocked and unassigned, and by which linked issue?" Answered from the atlassian connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over atlassian data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**atlassian cross-source question.** "Which open Jira issues reference a GitHub pull request that is already merged?" Requires linking atlassian to github and plane through the ontology concept: work item / pull request. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**atlassian acceptance test.** Both questions (EG-CQ-CONN-R006.1 and EG-CQ-CONN-R006.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R006.1 and EG-CQ-CONN-R006.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**audiobookshelf competency rollup.** The ontology answers one single-source and one cross-source question over the `audiobookshelf` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R007.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R007.1 to .3 are LANDED.

**audiobookshelf single-source question.** "Which audiobook series have a book with listening progress stopped partway, and for which user?" Answered from the audiobookshelf connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over audiobookshelf data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**audiobookshelf cross-source question.** "Which audiobooks exist both in Audiobookshelf and as a downloaded file from media-downloader, and which are only one side?" Requires linking audiobookshelf to jellyfin and media-downloader through the ontology concept: media item (title). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**audiobookshelf acceptance test.** Both questions (EG-CQ-CONN-R007.1 and EG-CQ-CONN-R007.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R007.1 and EG-CQ-CONN-R007.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**audio-transcriber competency rollup.** The ontology answers one single-source and one cross-source question over the `audio-transcriber` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R008.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R008.1 to .3 are LANDED.

**audio-transcriber single-source question.** "Which recordings were transcribed with a low-confidence segment, and what text was affected?" Answered from the audio-transcriber connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over audio-transcriber data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**audio-transcriber cross-source question.** "Which transcribed recordings mention a topic that also appears in PulseLink social or video transcripts?" Requires linking audio-transcriber to pulselink and paperless-ngx through the ontology concept: document / transcript. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**audio-transcriber acceptance test.** Both questions (EG-CQ-CONN-R008.1 and EG-CQ-CONN-R008.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R008.1 and EG-CQ-CONN-R008.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**caddy competency rollup.** The ontology answers one single-source and one cross-source question over the `caddy` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R009.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R009.1 to .3 are LANDED.

**caddy single-source question.** "Which routes proxy to a given upstream, and which hostnames are served by each site block?" Answered from the caddy connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over caddy data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**caddy cross-source question.** "Which Caddy hostnames have no DNS record in Technitium or no Uptime Kuma monitor?" Requires linking caddy to technitium-dns and uptime through the ontology concept: hostname. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**caddy acceptance test.** Both questions (EG-CQ-CONN-R009.1 and EG-CQ-CONN-R009.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R009.1 and EG-CQ-CONN-R009.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**camunda competency rollup.** The ontology answers one single-source and one cross-source question over the `camunda` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R010.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R010.1 to .3 are LANDED.

**camunda single-source question.** "Which process instances have an open incident, and at which activity did they stop?" Answered from the camunda connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A fixture query over camunda data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**camunda cross-source question.** "Which running Camunda process definitions have an open ServiceNow incident raised against their service?" Requires linking camunda to aris and servicenow through the ontology concept: business process. Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**camunda acceptance test.** Both questions (EG-CQ-CONN-R010.1 and EG-CQ-CONN-R010.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R010.1 and EG-CQ-CONN-R010.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**ciso-assistant competency rollup.** The ontology answers one single-source and one cross-source question over the `ciso-assistant` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R011.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R011.1 to .3 are LANDED.

**ciso-assistant single-source question.** "Which controls in an applied framework are non-compliant and which risk scenarios do they mitigate?" Answered from the ciso-assistant connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A fixture query over ciso-assistant data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**ciso-assistant cross-source question.** "Which CISO Assistant risks map to a ServiceNow CMDB service with an open incident?" Requires linking ciso-assistant to onetrust and servicenow through the ontology concept: control / risk. Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**ciso-assistant acceptance test.** Both questions (EG-CQ-CONN-R011.1 and EG-CQ-CONN-R011.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R011.1 and EG-CQ-CONN-R011.2. Mapping acceptance depends on these producer rows: `RiskScenario`: `EG-CQ-CONN-R073.2` (`government-v1.ttl`); `mitigatesRisk`: `EG-CQ-CONN-R073.3` (`government-v1.ttl`); `inFramework`: `EG-CQ-CONN-R073.4` (`government-v1.ttl`); `riskAffectsService`: `EG-CQ-CONN-R073.5` (`government-v1.ttl`). The acceptance test must preserve `government-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::ciso_assistant` must parse the exact `ciso-assistant` Coverage row and `EG-CQ-CONN-R011.1` / `EG-CQ-CONN-R011.2` Vocabulary cells. It must assert `government-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**clarity competency rollup.** The ontology answers one single-source and one cross-source question over the `clarity` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R012.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R012.1 to .3 are LANDED.

**clarity single-source question.** "Which pages have the highest rage-click or dead-click rate over the last week?" Answered from the clarity connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over clarity data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**clarity cross-source question.** "Which pages with a spike in rage clicks were changed by a pull request merged in the previous week?" Requires linking clarity to plane and github through the ontology concept: web page / release. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**clarity acceptance test.** Both questions (EG-CQ-CONN-R012.1 and EG-CQ-CONN-R012.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R012.1 and EG-CQ-CONN-R012.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**container-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `container-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R013.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R013.1 to .3 are LANDED.

**container-manager single-source question.** "Which containers or pods are restarting repeatedly, and from which image?" Answered from the container-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over container-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**container-manager cross-source question.** "Which running images have a newer tag on Docker Hub than the one deployed?" Requires linking container-manager to dockerhub and portainer through the ontology concept: container image. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**container-manager acceptance test.** Both questions (EG-CQ-CONN-R013.1 and EG-CQ-CONN-R013.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R013.1 and EG-CQ-CONN-R013.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**data-science competency rollup.** The ontology answers one single-source and one cross-source question over the `data-science` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R014.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R014.1 to .3 are LANDED.

**data-science single-source question.** "Which trained models have validation metrics below their baseline run, and on which dataset?" Answered from the data-science connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over data-science data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**data-science cross-source question.** "Which fine-tuned models have no evaluation dataset trace in Langfuse and no stored artifact in the object store?" Requires linking data-science to langfuse and objectstore through the ontology concept: model / dataset. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**data-science acceptance test.** Both questions (EG-CQ-CONN-R014.1 and EG-CQ-CONN-R014.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R014.1 and EG-CQ-CONN-R014.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**dockerhub competency rollup.** The ontology answers one single-source and one cross-source question over the `dockerhub` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R015.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R015.1 to .3 are LANDED.

**dockerhub single-source question.** "Which repositories in an organization have not been pushed to in a year, and what are their pull counts?" Answered from the dockerhub connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over dockerhub data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**dockerhub cross-source question.** "Which Docker Hub repositories correspond to a GitHub repository with recent commits but no recent image push?" Requires linking dockerhub to container-manager and github through the ontology concept: container image / repository. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**dockerhub acceptance test.** Both questions (EG-CQ-CONN-R015.1 and EG-CQ-CONN-R015.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R015.1 and EG-CQ-CONN-R015.2. Mapping acceptance depends on these producer rows: `lastPushedAt`: `EG-CQ-CONN-R068.13` (`infrastructure-v1.ttl`); `pullCount`: `EG-CQ-CONN-R068.14` (`infrastructure-v1.ttl`); `Repository`: `EG-CQ-CONN-R069.2` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `infrastructure-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::dockerhub` must parse the exact `dockerhub` Coverage row and `EG-CQ-CONN-R015.1` / `EG-CQ-CONN-R015.2` Vocabulary cells. It must assert `infrastructure-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**documentdb competency rollup.** The ontology answers one single-source and one cross-source question over the `documentdb` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R016.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R016.1 to .3 are LANDED.

**documentdb single-source question.** "Which collections have the most documents and which fields are missing in more than half of them?" Answered from the documentdb connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over documentdb data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**documentdb cross-source question.** "Which documentdb collections duplicate a table in the SQL database, and which side is newer?" Requires linking documentdb to sql and objectstore through the ontology concept: dataset / collection. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**documentdb acceptance test.** Both questions (EG-CQ-CONN-R016.1 and EG-CQ-CONN-R016.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R016.1 and EG-CQ-CONN-R016.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**egeria competency rollup.** The ontology answers one single-source and one cross-source question over the `egeria` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R017.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R017.1 to .3 are LANDED.

**egeria single-source question.** "Which glossary terms are linked to a data asset with a confidential classification?" Answered from the egeria connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A fixture query over egeria data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**egeria cross-source question.** "Which Egeria-cataloged assets correspond to a live SQL table, and which are cataloged but missing?" Requires linking egeria to sql and jena through the ontology concept: data asset. Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**egeria acceptance test.** Both questions (EG-CQ-CONN-R017.1 and EG-CQ-CONN-R017.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R017.1 and EG-CQ-CONN-R017.2. Mapping acceptance depends on these producer rows: `GlossaryTerm`: `EG-CQ-CONN-R074.2` (`core-foundation-v1.ttl`); `termAssignedTo`: `EG-CQ-CONN-R074.3` (`core-foundation-v1.ttl`). The acceptance test must preserve `core-foundation-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::egeria` must parse the exact `egeria` Coverage row and `EG-CQ-CONN-R017.1` / `EG-CQ-CONN-R017.2` Vocabulary cells. It must assert `core-foundation-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**emerald-exchange competency rollup.** The ontology answers one single-source and one cross-source question over the `emerald-exchange` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R018.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R018.1 to .3 are LANDED.

**emerald-exchange single-source question.** "Which open orders on an exchange are partially filled and what is their remaining quantity?" Answered from the emerald-exchange connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A fixture query over emerald-exchange data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**emerald-exchange cross-source question.** "Which exchange fills correspond to a deposit or withdrawal recorded in the Firefly III ledger?" Requires linking emerald-exchange to firefly-iii and home-assistant through the ontology concept: account / currency. Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**emerald-exchange acceptance test.** Both questions (EG-CQ-CONN-R018.1 and EG-CQ-CONN-R018.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R018.1 and EG-CQ-CONN-R018.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**erpnext competency rollup.** The ontology answers one single-source and one cross-source question over the `erpnext` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R019.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R019.1 to .3 are LANDED.

**erpnext single-source question.** "Which open purchase orders are late, and from which supplier?" Answered from the erpnext connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A fixture query over erpnext data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**erpnext cross-source question.** "Which ERPNext suppliers with late orders are also marked as active accounts in the Twenty CRM or paid in Firefly III?" Requires linking erpnext to twenty and firefly-iii through the ontology concept: party (supplier / customer). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**erpnext acceptance test.** Both questions (EG-CQ-CONN-R019.1 and EG-CQ-CONN-R019.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R019.1 and EG-CQ-CONN-R019.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**fan-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `fan-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R020.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R020.1 to .3 are LANDED.

**fan-manager single-source question.** "Which fans ran above 80 percent duty while the host temperature stayed above its threshold?" Answered from the fan-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over fan-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**fan-manager cross-source question.** "Which hosts had fan duty at maximum during a window in which Grafana alerted on temperature?" Requires linking fan-manager to systems-manager and lgtm through the ontology concept: host. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**fan-manager acceptance test.** Both questions (EG-CQ-CONN-R020.1 and EG-CQ-CONN-R020.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R020.1 and EG-CQ-CONN-R020.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**firefly-iii competency rollup.** The ontology answers one single-source and one cross-source question over the `firefly-iii` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R021.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R021.1 to .3 are LANDED.

**firefly-iii single-source question.** "Which budgets were exceeded this month, and by which transactions?" Answered from the firefly-iii connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A fixture query over firefly-iii data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**firefly-iii cross-source question.** "Which Firefly III expenses match an ERPNext purchase invoice by amount and date?" Requires linking firefly-iii to erpnext and emerald-exchange through the ontology concept: account / transaction. Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**firefly-iii acceptance test.** Both questions (EG-CQ-CONN-R021.1 and EG-CQ-CONN-R021.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R021.1 and EG-CQ-CONN-R021.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**freshrss competency rollup.** The ontology answers one single-source and one cross-source question over the `freshrss` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R022.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R022.1 to .3 are LANDED.

**freshrss single-source question.** "Which unread articles from a given feed were published in the last 48 hours?" Answered from the freshrss connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over freshrss data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**freshrss cross-source question.** "Which FreshRSS articles also appear in SearXNG results for the same query, and which are new?" Requires linking freshrss to archivebox and searxng through the ontology concept: URL / article. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**freshrss acceptance test.** Both questions (EG-CQ-CONN-R022.1 and EG-CQ-CONN-R022.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R022.1 and EG-CQ-CONN-R022.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**github competency rollup.** The ontology answers one single-source and one cross-source question over the `github` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R023.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R023.1 to .3 are LANDED.

**github single-source question.** "Which open pull requests have failing checks and no reviewer assigned?" Answered from the github connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over github data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**github cross-source question.** "Which GitHub pull requests close a Jira issue that is still in an open state?" Requires linking github to gitlab and atlassian through the ontology concept: repository / change request. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**github acceptance test.** Both questions (EG-CQ-CONN-R023.1 and EG-CQ-CONN-R023.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R023.1 and EG-CQ-CONN-R023.2. Mapping acceptance depends on these producer rows: `requestedReviewer`: `EG-CQ-CONN-R069.12` (`sdlc_lifecycle-v1.ttl`); `closesTicket`: `EG-CQ-CONN-R069.10` (`sdlc_lifecycle-v1.ttl`); `proposalState`: `EG-CQ-CONN-R069.11` (`sdlc_lifecycle-v1.ttl`); `Repository`: `EG-CQ-CONN-R069.2` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `sdlc_lifecycle-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::github` must parse the exact `github` Coverage row and `EG-CQ-CONN-R023.1` / `EG-CQ-CONN-R023.2` Vocabulary cells. It must assert `sdlc_lifecycle-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**gitlab competency rollup.** The ontology answers one single-source and one cross-source question over the `gitlab` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R024.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R024.1 to .3 are LANDED.

**gitlab single-source question.** "Which pipelines on the default branch failed in the last day, and at which job?" Answered from the gitlab connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over gitlab data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**gitlab cross-source question.** "Which repositories exist in GitLab and GitHub with diverging default-branch heads?" Requires linking gitlab to github and repository-manager through the ontology concept: repository / pipeline. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**gitlab acceptance test.** Both questions (EG-CQ-CONN-R024.1 and EG-CQ-CONN-R024.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R024.1 and EG-CQ-CONN-R024.2. Mapping acceptance depends on these producer rows: `PipelineJob`: `EG-CQ-CONN-R069.13` (`sdlc_lifecycle-v1.ttl`); `pipelineJobOf`: `EG-CQ-CONN-R069.14` (`sdlc_lifecycle-v1.ttl`); `Branch`: `EG-CQ-CONN-R069.3` (`sdlc_lifecycle-v1.ttl`); `branchOf`: `EG-CQ-CONN-R069.4` (`sdlc_lifecycle-v1.ttl`); `headCommit`: `EG-CQ-CONN-R069.5` (`sdlc_lifecycle-v1.ttl`); `isDefaultBranch`: `EG-CQ-CONN-R069.6` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `sdlc_lifecycle-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::gitlab` must parse the exact `gitlab` Coverage row and `EG-CQ-CONN-R024.1` / `EG-CQ-CONN-R024.2` Vocabulary cells. It must assert `sdlc_lifecycle-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**gramps competency rollup.** The ontology answers one single-source and one cross-source question over the `gramps` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R025.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R025.1 to .3 are LANDED.

**gramps single-source question.** "Which people in the tree were born in a given place before a given year, and who are their parents?" Answered from the gramps connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A fixture query over gramps data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**gramps cross-source question.** "Which Gramps people have a photo or document reference that exists as a file in Nextcloud?" Requires linking gramps to nextcloud through the ontology concept: person / media. Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**gramps acceptance test.** Both questions (EG-CQ-CONN-R025.1 and EG-CQ-CONN-R025.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R025.1 and EG-CQ-CONN-R025.2. Mapping acceptance depends on these producer rows: `birthPlace`: `EG-CQ-CONN-R076.1` (`personal-v1.ttl`); `birthYear`: `EG-CQ-CONN-R076.2` (`personal-v1.ttl`). The acceptance test must preserve `personal-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::gramps` must parse the exact `gramps` Coverage row and `EG-CQ-CONN-R025.1` / `EG-CQ-CONN-R025.2` Vocabulary cells. It must assert `personal-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**home-assistant competency rollup.** The ontology answers one single-source and one cross-source question over the `home-assistant` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R026.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R026.1 to .3 are LANDED.

**home-assistant single-source question.** "Which sensors reported a value outside their normal range in the last 24 hours?" Answered from the home-assistant connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over home-assistant data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**home-assistant cross-source question.** "Which Home Assistant devices went unavailable at the same time as an Uptime Kuma monitor failure?" Requires linking home-assistant to fan-manager and uptime through the ontology concept: device / host. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**home-assistant acceptance test.** Both questions (EG-CQ-CONN-R026.1 and EG-CQ-CONN-R026.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R026.1 and EG-CQ-CONN-R026.2. Mapping acceptance depends on these producer rows: `entityState`: `EG-CQ-CONN-R068.15` (`infrastructure-v1.ttl`); `unavailableSince`: `EG-CQ-CONN-R068.16` (`infrastructure-v1.ttl`). The acceptance test must preserve `infrastructure-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::home_assistant` must parse the exact `home-assistant` Coverage row and `EG-CQ-CONN-R026.1` / `EG-CQ-CONN-R026.2` Vocabulary cells. It must assert `infrastructure-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**jellyfin competency rollup.** The ontology answers one single-source and one cross-source question over the `jellyfin` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R027.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R027.1 to .3 are LANDED.

**jellyfin single-source question.** "Which movies in a library have never been played and were added more than a year ago?" Answered from the jellyfin connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over jellyfin data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**jellyfin cross-source question.** "Which Jellyfin items have no matching Radarr or Sonarr entry, and so cannot be re-fetched?" Requires linking jellyfin to arr and qbittorrent through the ontology concept: media item (title). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**jellyfin acceptance test.** Both questions (EG-CQ-CONN-R027.1 and EG-CQ-CONN-R027.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R027.1 and EG-CQ-CONN-R027.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**jena competency rollup.** The ontology answers one single-source and one cross-source question over the `jena` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R028.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R028.1 to .3 are LANDED.

**jena single-source question.** "Which named graphs contain the most triples and which have no recent update?" Answered from the jena connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/virtual_graph-v1.ttl`. | A fixture query over jena data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**jena cross-source question.** "Which Jena named graphs describe the same entities as an Egeria-cataloged asset?" Requires linking jena to egeria and sql through the ontology concept: graph / dataset. Vocabulary: `crates/eg-core/ontology/virtual_graph-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**jena acceptance test.** Both questions (EG-CQ-CONN-R028.1 and EG-CQ-CONN-R028.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R028.1 and EG-CQ-CONN-R028.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**kafka competency rollup.** The ontology answers one single-source and one cross-source question over the `kafka` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R029.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R029.1 to .3 are LANDED.

**kafka single-source question.** "Which consumer groups lag by more than a threshold on which topic partitions?" Answered from the kafka connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over kafka data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**kafka cross-source question.** "Which Kafka consumer groups with sustained lag belong to a service that Grafana is alerting on?" Requires linking kafka to langfuse and lgtm through the ontology concept: topic / service. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**kafka acceptance test.** Both questions (EG-CQ-CONN-R029.1 and EG-CQ-CONN-R029.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R029.1 and EG-CQ-CONN-R029.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**keycloak competency rollup.** The ontology answers one single-source and one cross-source question over the `keycloak` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R030.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R030.1 to .3 are LANDED.

**keycloak single-source question.** "Which clients can a given user sign in to, and through which role?" Answered from the keycloak connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A fixture query over keycloak data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**keycloak cross-source question.** "Which people have access to a service that has an open security incident?" Requires linking keycloak to okta and servicenow through the ontology concept: person / service. Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**keycloak acceptance test.** Both questions (EG-CQ-CONN-R030.1 and EG-CQ-CONN-R030.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R030.1 and EG-CQ-CONN-R030.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**langfuse competency rollup.** The ontology answers one single-source and one cross-source question over the `langfuse` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R031.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R031.1 to .3 are LANDED.

**langfuse single-source question.** "Which traces had the highest token cost and which prompt version produced them?" Answered from the langfuse connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/orchestration-v1.ttl`. | A fixture query over langfuse data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**langfuse cross-source question.** "Which prompt versions with falling evaluation scores were last changed by a merged GitHub pull request?" Requires linking langfuse to data-science and github through the ontology concept: prompt / model. Vocabulary: `crates/eg-core/ontology/orchestration-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**langfuse acceptance test.** Both questions (EG-CQ-CONN-R031.1 and EG-CQ-CONN-R031.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R031.1 and EG-CQ-CONN-R031.2. Mapping acceptance depends on these producer rows: `promptVersion`: `EG-CQ-CONN-R079.2` (`orchestration-v1.ttl`); `tokenCost`: `EG-CQ-CONN-R079.3` (`orchestration-v1.ttl`); `tracePrompt`: `EG-CQ-CONN-R079.4` (`orchestration-v1.ttl`); `evaluationScore`: `EG-CQ-CONN-R079.5` (`orchestration-v1.ttl`). The acceptance test must preserve `orchestration-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::langfuse` must parse the exact `langfuse` Coverage row and `EG-CQ-CONN-R031.1` / `EG-CQ-CONN-R031.2` Vocabulary cells. It must assert `orchestration-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**leanix competency rollup.** The ontology answers one single-source and one cross-source question over the `leanix` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R032.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R032.1 to .3 are LANDED.

**leanix single-source question.** "Which fact sheets of type application have lifecycle phase end-of-life but still have active users?" Answered from the leanix connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/enterprise-v1.ttl`. | A fixture query over leanix data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**leanix cross-source question.** "Which end-of-life LeanIX applications still have an active ServiceNow CI and open incidents?" Requires linking leanix to archimate and servicenow through the ontology concept: application. Vocabulary: `crates/eg-core/ontology/enterprise-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**leanix acceptance test.** Both questions (EG-CQ-CONN-R032.1 and EG-CQ-CONN-R032.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R032.1 and EG-CQ-CONN-R032.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**legal-peripherals competency rollup.** The ontology answers one single-source and one cross-source question over the `legal-peripherals` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R033.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R033.1 to .3 are LANDED.

**legal-peripherals single-source question.** "Which contracts expire within 90 days and have no renewal action recorded?" Answered from the legal-peripherals connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A fixture query over legal-peripherals data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**legal-peripherals cross-source question.** "Which expiring contracts have a scanned copy in Paperless-ngx and a matching OneTrust vendor assessment?" Requires linking legal-peripherals to paperless-ngx and onetrust through the ontology concept: contract / document. Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**legal-peripherals acceptance test.** Both questions (EG-CQ-CONN-R033.1 and EG-CQ-CONN-R033.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R033.1 and EG-CQ-CONN-R033.2. Mapping acceptance depends on these producer rows: `counterparty`: `EG-CQ-CONN-R074.4` (`core-foundation-v1.ttl`); `agreementExpiresAt`: `EG-CQ-CONN-R074.5` (`core-foundation-v1.ttl`); `hasRenewalAction`: `EG-CQ-CONN-R074.6` (`core-foundation-v1.ttl`). The acceptance test must preserve `core-foundation-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::legal_peripherals` must parse the exact `legal-peripherals` Coverage row and `EG-CQ-CONN-R033.1` / `EG-CQ-CONN-R033.2` Vocabulary cells. It must assert `core-foundation-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**lgtm competency rollup.** The ontology answers one single-source and one cross-source question over the `lgtm` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R034.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R034.1 to .3 are LANDED.

**lgtm single-source question.** "Which alerts are firing right now, with what severity and for how long?" Answered from the lgtm connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over lgtm data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**lgtm cross-source question.** "Which firing Grafana alerts have no open ServiceNow incident, and which incidents have no alert?" Requires linking lgtm to uptime and servicenow through the ontology concept: service / alert. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**lgtm acceptance test.** Both questions (EG-CQ-CONN-R034.1 and EG-CQ-CONN-R034.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R034.1 and EG-CQ-CONN-R034.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**listmonk competency rollup.** The ontology answers one single-source and one cross-source question over the `listmonk` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R035.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R035.1 to .3 are LANDED.

**listmonk single-source question.** "Which campaigns had an open rate below the list average, and to which lists were they sent?" Answered from the listmonk connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over listmonk data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**listmonk cross-source question.** "Which subscribers on a Listmonk list have no matching Twenty contact, and which contacts are unsubscribed?" Requires linking listmonk to twenty and postiz through the ontology concept: contact / audience. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**listmonk acceptance test.** Both questions (EG-CQ-CONN-R035.1 and EG-CQ-CONN-R035.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R035.1 and EG-CQ-CONN-R035.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**mattermost competency rollup.** The ontology answers one single-source and one cross-source question over the `mattermost` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R036.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R036.1 to .3 are LANDED.

**mattermost single-source question.** "Which channels have had no posts in 90 days but still have more than ten members?" Answered from the mattermost connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over mattermost data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**mattermost cross-source question.** "Which Mattermost members have no active identity-provider account, and which people lack a Mattermost account?" Requires linking mattermost to keycloak and okta through the ontology concept: person. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**mattermost acceptance test.** Both questions (EG-CQ-CONN-R036.1 and EG-CQ-CONN-R036.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R036.1 and EG-CQ-CONN-R036.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**mealie competency rollup.** The ontology answers one single-source and one cross-source question over the `mealie` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R037.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R037.1 to .3 are LANDED.

**mealie single-source question.** "Which recipes use an ingredient that is also on the current shopping list?" Answered from the mealie connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A fixture query over mealie data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**mealie cross-source question.** "Which planned Mealie meals exceed the daily calorie target set in wger, and what did the groceries cost in Firefly III?" Requires linking mealie to wger and firefly-iii through the ontology concept: food / ingredient. Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**mealie acceptance test.** Both questions (EG-CQ-CONN-R037.1 and EG-CQ-CONN-R037.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R037.1 and EG-CQ-CONN-R037.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**media-downloader competency rollup.** The ontology answers one single-source and one cross-source question over the `media-downloader` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R038.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R038.1 to .3 are LANDED.

**media-downloader single-source question.** "Which download jobs failed in the last week, with what error, for which source URL?" Answered from the media-downloader connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over media-downloader data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**media-downloader cross-source question.** "Which completed downloads were never added to Jellyfin or Audiobookshelf?" Requires linking media-downloader to audiobookshelf and jellyfin through the ontology concept: media item / URL. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**media-downloader acceptance test.** Both questions (EG-CQ-CONN-R038.1 and EG-CQ-CONN-R038.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R038.1 and EG-CQ-CONN-R038.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**microsoft competency rollup.** The ontology answers one single-source and one cross-source question over the `microsoft` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R039.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R039.1 to .3 are LANDED.

**microsoft single-source question.** "Which meetings tomorrow overlap, and which attendees are double-booked?" Answered from the microsoft connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/calendar-v1.ttl`. | A fixture query over microsoft data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**microsoft cross-source question.** "Which attendees of an upcoming meeting have no identity-provider account or Mattermost presence?" Requires linking microsoft to okta and mattermost through the ontology concept: person. Vocabulary: `crates/eg-core/ontology/calendar-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**microsoft acceptance test.** Both questions (EG-CQ-CONN-R039.1 and EG-CQ-CONN-R039.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R039.1 and EG-CQ-CONN-R039.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**nextcloud competency rollup.** The ontology answers one single-source and one cross-source question over the `nextcloud` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R040.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R040.1 to .3 are LANDED.

**nextcloud single-source question.** "Which shared folders are accessible by external links and when do those shares expire?" Answered from the nextcloud connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A fixture query over nextcloud data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**nextcloud cross-source question.** "Which publicly shared Nextcloud files also exist as Paperless-ngx documents tagged confidential?" Requires linking nextcloud to keycloak and paperless-ngx through the ontology concept: file / person. Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**nextcloud acceptance test.** Both questions (EG-CQ-CONN-R040.1 and EG-CQ-CONN-R040.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R040.1 and EG-CQ-CONN-R040.2. Mapping acceptance depends on these producer rows: `FileShare`: `EG-CQ-CONN-R076.6` (`personal-v1.ttl`); `sharesFile`: `EG-CQ-CONN-R076.7` (`personal-v1.ttl`); `isPublicLink`: `EG-CQ-CONN-R076.8` (`personal-v1.ttl`); `shareExpiresAt`: `EG-CQ-CONN-R076.9` (`personal-v1.ttl`). The acceptance test must preserve `personal-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::nextcloud` must parse the exact `nextcloud` Coverage row and `EG-CQ-CONN-R040.1` / `EG-CQ-CONN-R040.2` Vocabulary cells. It must assert `personal-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**objectstore competency rollup.** The ontology answers one single-source and one cross-source question over the `objectstore` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R041.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R041.1 to .3 are LANDED.

**objectstore single-source question.** "Which buckets hold the most data and which objects have not been read in a year?" Answered from the objectstore connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over objectstore data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**objectstore cross-source question.** "Which object-store artifacts are not referenced by any model or dataset in the data-science connector?" Requires linking objectstore to data-science and documentdb through the ontology concept: dataset / artifact. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**objectstore acceptance test.** Both questions (EG-CQ-CONN-R041.1 and EG-CQ-CONN-R041.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R041.1 and EG-CQ-CONN-R041.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**okta competency rollup.** The ontology answers one single-source and one cross-source question over the `okta` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R042.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R042.1 to .3 are LANDED.

**okta single-source question.** "Which users hold a given application assignment through which group?" Answered from the okta connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A fixture query over okta data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**okta cross-source question.** "Which Okta users were deactivated but still hold a Keycloak role or an open ServiceNow assignment?" Requires linking okta to keycloak and servicenow through the ontology concept: person / role. Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**okta acceptance test.** Both questions (EG-CQ-CONN-R042.1 and EG-CQ-CONN-R042.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R042.1 and EG-CQ-CONN-R042.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**onetrust competency rollup.** The ontology answers one single-source and one cross-source question over the `onetrust` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R043.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R043.1 to .3 are LANDED.

**onetrust single-source question.** "Which privacy assessments are overdue and which processing activities do they cover?" Answered from the onetrust connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A fixture query over onetrust data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**onetrust cross-source question.** "Which vendors with an overdue OneTrust assessment have open ERPNext purchase orders?" Requires linking onetrust to ciso-assistant and erpnext through the ontology concept: processing activity / vendor. Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**onetrust acceptance test.** Both questions (EG-CQ-CONN-R043.1 and EG-CQ-CONN-R043.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R043.1 and EG-CQ-CONN-R043.2. Mapping acceptance depends on these producer rows: `PrivacyAssessment`: `EG-CQ-CONN-R073.6` (`government-v1.ttl`); `ProcessingActivity`: `EG-CQ-CONN-R073.7` (`government-v1.ttl`); `assessmentCovers`: `EG-CQ-CONN-R073.8` (`government-v1.ttl`); `assessmentDueDate`: `EG-CQ-CONN-R073.9` (`government-v1.ttl`); `assessedVendor`: `EG-CQ-CONN-R073.10` (`government-v1.ttl`); `assessmentStatus`: `EG-CQ-CONN-R073.11` (`government-v1.ttl`). The acceptance test must preserve `government-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::onetrust` must parse the exact `onetrust` Coverage row and `EG-CQ-CONN-R043.1` / `EG-CQ-CONN-R043.2` Vocabulary cells. It must assert `government-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**openbao competency rollup.** The ontology answers one single-source and one cross-source question over the `openbao` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R044.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R044.1 to .3 are LANDED.

**openbao single-source question.** "Which secret paths have not been rotated in 180 days, and which policies grant read on them?" Answered from the openbao connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over openbao data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**openbao cross-source question.** "Which services running in container-manager read a secret path that has no recent rotation?" Requires linking openbao to keycloak and container-manager through the ontology concept: secret / service. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**openbao acceptance test.** Both questions (EG-CQ-CONN-R044.1 and EG-CQ-CONN-R044.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R044.1 and EG-CQ-CONN-R044.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**owncast competency rollup.** The ontology answers one single-source and one cross-source question over the `owncast` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R045.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R045.1 to .3 are LANDED.

**owncast single-source question.** "Which streams had the highest peak viewer count and how long did they run?" Answered from the owncast connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over owncast data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**owncast cross-source question.** "Which Owncast broadcasts were announced through a Postiz post, and what was the audience versus the post reach?" Requires linking owncast to postiz and mattermost through the ontology concept: broadcast / audience. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**owncast acceptance test.** Both questions (EG-CQ-CONN-R045.1 and EG-CQ-CONN-R045.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R045.1 and EG-CQ-CONN-R045.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**paperless-ngx competency rollup.** The ontology answers one single-source and one cross-source question over the `paperless-ngx` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R046.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R046.1 to .3 are LANDED.

**paperless-ngx single-source question.** "Which documents tagged as invoice have no correspondent or no due date?" Answered from the paperless-ngx connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A fixture query over paperless-ngx data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**paperless-ngx cross-source question.** "Which Paperless-ngx invoices have no matching ERPNext purchase invoice or Firefly III expense?" Requires linking paperless-ngx to erpnext and firefly-iii through the ontology concept: document / invoice. Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**paperless-ngx acceptance test.** Both questions (EG-CQ-CONN-R046.1 and EG-CQ-CONN-R046.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R046.1 and EG-CQ-CONN-R046.2. Mapping acceptance depends on these producer rows: `documentType`: `EG-CQ-CONN-R076.3` (`personal-v1.ttl`); `dueDate`: `EG-CQ-CONN-R076.4` (`personal-v1.ttl`); `totalAmount`: `EG-CQ-CONN-R076.5` (`personal-v1.ttl`). The acceptance test must preserve `personal-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::paperless_ngx` must parse the exact `paperless-ngx` Coverage row and `EG-CQ-CONN-R046.1` / `EG-CQ-CONN-R046.2` Vocabulary cells. It must assert `personal-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**plane competency rollup.** The ontology answers one single-source and one cross-source question over the `plane` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R047.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R047.1 to .3 are LANDED.

**plane single-source question.** "Which work items in the active cycle are overdue and which module do they belong to?" Answered from the plane connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over plane data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**plane cross-source question.** "Which Plane work items link to a GitHub pull request that has merged but are not marked done?" Requires linking plane to github and atlassian through the ontology concept: work item. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**plane acceptance test.** Both questions (EG-CQ-CONN-R047.1 and EG-CQ-CONN-R047.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R047.1 and EG-CQ-CONN-R047.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**portainer competency rollup.** The ontology answers one single-source and one cross-source question over the `portainer` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R048.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R048.1 to .3 are LANDED.

**portainer single-source question.** "Which stacks have services with fewer running replicas than desired, and on which endpoint?" Answered from the portainer connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over portainer data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**portainer cross-source question.** "Which Portainer stacks deploy from a Git repository whose latest GitLab pipeline failed?" Requires linking portainer to container-manager and gitlab through the ontology concept: stack / repository. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**portainer acceptance test.** Both questions (EG-CQ-CONN-R048.1 and EG-CQ-CONN-R048.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R048.1 and EG-CQ-CONN-R048.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**postiz competency rollup.** The ontology answers one single-source and one cross-source question over the `postiz` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R049.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R049.1 to .3 are LANDED.

**postiz single-source question.** "Which scheduled posts failed to publish and on which channel?" Answered from the postiz connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over postiz data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**postiz cross-source question.** "Which Postiz posts promote a campaign that Listmonk also sent, and which got the better engagement?" Requires linking postiz to owncast and listmonk through the ontology concept: campaign / channel. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**postiz acceptance test.** Both questions (EG-CQ-CONN-R049.1 and EG-CQ-CONN-R049.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R049.1 and EG-CQ-CONN-R049.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**pulselink competency rollup.** The ontology answers one single-source and one cross-source question over the `pulselink` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R050.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R050.1 to .3 are LANDED.

**pulselink single-source question.** "Which videos on a topic had transcripts mentioning a given term this week?" Answered from the pulselink connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over pulselink data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**pulselink cross-source question.** "Which topics appear in PulseLink video transcripts and SearXNG news but not in any archived page?" Requires linking pulselink to searxng and audio-transcriber through the ontology concept: topic / transcript. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**pulselink acceptance test.** Both questions (EG-CQ-CONN-R050.1 and EG-CQ-CONN-R050.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R050.1 and EG-CQ-CONN-R050.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**qbittorrent competency rollup.** The ontology answers one single-source and one cross-source question over the `qbittorrent` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R051.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R051.1 to .3 are LANDED.

**qbittorrent single-source question.** "Which torrents are stalled, with what ratio and how long since last activity?" Answered from the qbittorrent connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over qbittorrent data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**qbittorrent cross-source question.** "Which stalled torrents belong to a wanted Radarr or Sonarr title, and so block it from import?" Requires linking qbittorrent to arr and jellyfin through the ontology concept: media item (torrent). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**qbittorrent acceptance test.** Both questions (EG-CQ-CONN-R051.1 and EG-CQ-CONN-R051.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R051.1 and EG-CQ-CONN-R051.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**repository-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `repository-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R052.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R052.1 to .3 are LANDED.

**repository-manager single-source question.** "Which worktrees are stale or dangling relative to their base branch?" Answered from the repository-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over repository-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**repository-manager cross-source question.** "Which local worktrees track a branch whose pull request has already been merged on GitHub or GitLab?" Requires linking repository-manager to github and gitlab through the ontology concept: repository / branch. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**repository-manager acceptance test.** Both questions (EG-CQ-CONN-R052.1 and EG-CQ-CONN-R052.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R052.1 and EG-CQ-CONN-R052.2. Mapping acceptance depends on these producer rows: `Worktree`: `EG-CQ-CONN-R069.20` (`sdlc_lifecycle-v1.ttl`); `worktreeState`: `EG-CQ-CONN-R069.21` (`sdlc_lifecycle-v1.ttl`); `tracksBranch`: `EG-CQ-CONN-R069.22` (`sdlc_lifecycle-v1.ttl`); `proposalBranch`: `EG-CQ-CONN-R069.23` (`sdlc_lifecycle-v1.ttl`); `Repository`: `EG-CQ-CONN-R069.2` (`sdlc_lifecycle-v1.ttl`); `Branch`: `EG-CQ-CONN-R069.3` (`sdlc_lifecycle-v1.ttl`); `proposalState`: `EG-CQ-CONN-R069.11` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `sdlc_lifecycle-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::repository_manager` must parse the exact `repository-manager` Coverage row and `EG-CQ-CONN-R052.1` / `EG-CQ-CONN-R052.2` Vocabulary cells. It must assert `sdlc_lifecycle-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**rom-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `rom-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R053.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R053.1 to .3 are LANDED.

**rom-manager single-source question.** "Which ROMs in a platform collection fail a checksum match against the reference set?" Answered from the rom-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over rom-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**rom-manager cross-source question.** "Which ROMs were obtained by a media-downloader job and which are still unconverted?" Requires linking rom-manager to media-downloader and jellyfin through the ontology concept: game / file. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**rom-manager acceptance test.** Both questions (EG-CQ-CONN-R053.1 and EG-CQ-CONN-R053.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R053.1 and EG-CQ-CONN-R053.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**salesforce competency rollup.** The ontology answers one single-source and one cross-source question over the `salesforce` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R054.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R054.1 to .3 are LANDED.

**salesforce single-source question.** "Which open opportunities close this quarter, with what amount and owner?" Answered from the salesforce connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A fixture query over salesforce data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**salesforce cross-source question.** "Which Salesforce accounts have an open ServiceNow incident and an opportunity closing this quarter?" Requires linking salesforce to twenty and servicenow through the ontology concept: account / customer. Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**salesforce acceptance test.** Both questions (EG-CQ-CONN-R054.1 and EG-CQ-CONN-R054.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R054.1 and EG-CQ-CONN-R054.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**scholarx competency rollup.** The ontology answers one single-source and one cross-source question over the `scholarx` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R055.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R055.1 to .3 are LANDED.

**scholarx single-source question.** "Which papers cite a given paper and were published in the last two years?" Answered from the scholarx connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over scholarx data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**scholarx cross-source question.** "Which papers on a topic are in ScholarX but were never surfaced by a SearXNG query for that topic?" Requires linking scholarx to searxng and langfuse through the ontology concept: paper / topic. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**scholarx acceptance test.** Both questions (EG-CQ-CONN-R055.1 and EG-CQ-CONN-R055.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R055.1 and EG-CQ-CONN-R055.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**searxng competency rollup.** The ontology answers one single-source and one cross-source question over the `searxng` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R056.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R056.1 to .3 are LANDED.

**searxng single-source question.** "Which engines returned no results for a given query, and which returned the most?" Answered from the searxng connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over searxng data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**searxng cross-source question.** "Which URLs from a SearXNG query are not yet archived in ArchiveBox?" Requires linking searxng to freshrss and archivebox through the ontology concept: URL / query. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**searxng acceptance test.** Both questions (EG-CQ-CONN-R056.1 and EG-CQ-CONN-R056.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R056.1 and EG-CQ-CONN-R056.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**servicenow competency rollup.** The ontology answers one single-source and one cross-source question over the `servicenow` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R057.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R057.1 to .3 are LANDED.

**servicenow single-source question.** "Which incidents are open on a given configuration item and who is assigned?" Answered from the servicenow connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A fixture query over servicenow data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**servicenow cross-source question.** "Which open incidents on a CI also show a Grafana alert and a failing Uptime Kuma monitor?" Requires linking servicenow to okta and lgtm through the ontology concept: configuration item / service. Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**servicenow acceptance test.** Both questions (EG-CQ-CONN-R057.1 and EG-CQ-CONN-R057.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R057.1 and EG-CQ-CONN-R057.2. Mapping acceptance depends on these producer rows: `ConfigurationItem`: `EG-CQ-CONN-R070.5` (`archimate-v1.ttl`); `affectsConfigurationItem`: `EG-CQ-CONN-R070.6` (`archimate-v1.ttl`); `incidentState`: `EG-CQ-CONN-R070.7` (`archimate-v1.ttl`); `incidentAssignee`: `EG-CQ-CONN-R070.8` (`archimate-v1.ttl`). The acceptance test must preserve `archimate-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::servicenow` must parse the exact `servicenow` Coverage row and `EG-CQ-CONN-R057.1` / `EG-CQ-CONN-R057.2` Vocabulary cells. It must assert `archimate-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**sql competency rollup.** The ontology answers one single-source and one cross-source question over the `sql` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R058.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R058.1 to .3 are LANDED.

**sql single-source question.** "Which tables have no primary key, and which columns reference tables that do not exist?" Answered from the sql connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over sql data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**sql cross-source question.** "Which SQL tables are not cataloged in Egeria, and which cataloged tables no longer exist?" Requires linking sql to egeria and documentdb through the ontology concept: table / data asset. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**sql acceptance test.** Both questions (EG-CQ-CONN-R058.1 and EG-CQ-CONN-R058.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R058.1 and EG-CQ-CONN-R058.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**stirlingpdf competency rollup.** The ontology answers one single-source and one cross-source question over the `stirlingpdf` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R059.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R059.1 to .3 are LANDED.

**stirlingpdf single-source question.** "Which operations failed on which PDFs and with what error?" Answered from the stirlingpdf connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/action-v1.ttl`. | A fixture query over stirlingpdf data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**stirlingpdf cross-source question.** "Which PDFs processed by Stirling-PDF were stored in Paperless-ngx or Nextcloud, and which were not?" Requires linking stirlingpdf to paperless-ngx and nextcloud through the ontology concept: document. Vocabulary: `crates/eg-core/ontology/action-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**stirlingpdf acceptance test.** Both questions (EG-CQ-CONN-R059.1 and EG-CQ-CONN-R059.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R059.1 and EG-CQ-CONN-R059.2. Mapping acceptance depends on these producer rows: `failureReason`: `EG-CQ-CONN-R082.1` (`action-v1.ttl`). The acceptance test must preserve `action-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::stirlingpdf` must parse the exact `stirlingpdf` Coverage row and `EG-CQ-CONN-R059.1` / `EG-CQ-CONN-R059.2` Vocabulary cells. It must assert `action-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.

**systems-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `systems-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R060.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R060.1 to .3 are LANDED.

**systems-manager single-source question.** "Which hosts have pending OS updates and what is their uptime?" Answered from the systems-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over systems-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**systems-manager cross-source question.** "Which hosts with pending updates have no Ansible Tower patch job scheduled and no ServiceNow change?" Requires linking systems-manager to ansible-tower and servicenow through the ontology concept: host (configuration item). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**systems-manager acceptance test.** Both questions (EG-CQ-CONN-R060.1 and EG-CQ-CONN-R060.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R060.1 and EG-CQ-CONN-R060.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**technitium-dns competency rollup.** The ontology answers one single-source and one cross-source question over the `technitium-dns` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R061.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R061.1 to .3 are LANDED.

**technitium-dns single-source question.** "Which zones contain records pointing to an address that no host answers on?" Answered from the technitium-dns connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over technitium-dns data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**technitium-dns cross-source question.** "Which DNS A records have no Caddy route and no Uptime Kuma monitor?" Requires linking technitium-dns to caddy and uptime through the ontology concept: hostname. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**technitium-dns acceptance test.** Both questions (EG-CQ-CONN-R061.1 and EG-CQ-CONN-R061.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R061.1 and EG-CQ-CONN-R061.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**tunnel-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `tunnel-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R062.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R062.1 to .3 are LANDED.

**tunnel-manager single-source question.** "Which SSH hosts in the inventory failed their last connection, and with what error?" Answered from the tunnel-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over tunnel-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**tunnel-manager cross-source question.** "Which hosts that tunnel-manager cannot reach are still listed as managed in Ansible Tower?" Requires linking tunnel-manager to ansible-tower and systems-manager through the ontology concept: host. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**tunnel-manager acceptance test.** Both questions (EG-CQ-CONN-R062.1 and EG-CQ-CONN-R062.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R062.1 and EG-CQ-CONN-R062.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**twenty competency rollup.** The ontology answers one single-source and one cross-source question over the `twenty` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R063.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R063.1 to .3 are LANDED.

**twenty single-source question.** "Which people at a company have no logged activity in the last 60 days while a deal is open?" Answered from the twenty connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A fixture query over twenty data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**twenty cross-source question.** "Which Twenty contacts also exist as Salesforce contacts with different email addresses?" Requires linking twenty to salesforce and listmonk through the ontology concept: person / company. Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**twenty acceptance test.** Both questions (EG-CQ-CONN-R063.1 and EG-CQ-CONN-R063.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R063.1 and EG-CQ-CONN-R063.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**uptime competency rollup.** The ontology answers one single-source and one cross-source question over the `uptime` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R064.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R064.1 to .3 are LANDED.

**uptime single-source question.** "Which monitored services were down in the last 24 hours and for how long?" Answered from the uptime connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over uptime data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**uptime cross-source question.** "Which services Uptime Kuma saw down had a Grafana alert or a Caddy route error at the same time?" Requires linking uptime to lgtm and caddy through the ontology concept: service / hostname. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**uptime acceptance test.** Both questions (EG-CQ-CONN-R064.1 and EG-CQ-CONN-R064.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R064.1 and EG-CQ-CONN-R064.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**vector competency rollup.** The ontology answers one single-source and one cross-source question over the `vector` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R065.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R065.1 to .3 are LANDED.

**vector single-source question.** "Which collections have the most vectors and which have an embedding dimension that mismatches the model?" Answered from the vector connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over vector data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**vector cross-source question.** "Which Paperless-ngx documents have no embedding stored in the vector database?" Requires linking vector to data-science and paperless-ngx through the ontology concept: embedding / document. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**vector acceptance test.** Both questions (EG-CQ-CONN-R065.1 and EG-CQ-CONN-R065.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R065.1 and EG-CQ-CONN-R065.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**wger competency rollup.** The ontology answers one single-source and one cross-source question over the `wger` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R066.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R066.1 to .3 are LANDED.

**wger single-source question.** "Which workout routines were not completed in the last two weeks and which exercises were skipped?" Answered from the wger connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A fixture query over wger data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**wger cross-source question.** "Which weeks of low workout completion coincide with a Mealie meal plan above the calorie target?" Requires linking wger to mealie and home-assistant through the ontology concept: person / nutrition plan. Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.

**wger acceptance test.** Both questions (EG-CQ-CONN-R066.1 and EG-CQ-CONN-R066.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R066.1 and EG-CQ-CONN-R066.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.

**Contract kinds rollup.** For each access-contract kind the ontology can declare a source of that kind and the engine answers a question by fetching through the contract at query time, with no copy of the source in the engine; delivered as children `EG-CQ-CONN-R067.1` to `EG-CQ-CONN-R067.6`. Mechanism: `specs/federated-query-and-reasoning` and `specs/unified-data-plane`; no new functionality outside them. | All children verified.

**MCP contract answers at query time.** One acceptance test declares a connector that exposes MCP tools and resources in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.

**A2A contract answers at query time.** One acceptance test declares an external agent reached over the A2A protocol in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.

**API (REST) contract answers at query time.** One acceptance test declares a connector that calls an HTTP API described by an operation contract in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.

**GraphQL contract answers at query time.** One acceptance test declares a connector whose source speaks GraphQL in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.

**virtual graph over a relational or document store contract answers at query time.** One acceptance test declares a SQL or document source mapped by a virtual-graph mapping in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.

**Materialisation is declared, never implicit.** A source may be copied into the engine only when its ontology declaration states a materialisation policy with a reason; a source with no such statement is always fetched at query time. | One test asserts a source without a materialisation statement stores no rows after a query, and one with the statement does.

**infrastructure-v1.ttl additions rollup.** 26 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R068.1` to `EG-CQ-CONN-R068.26`. | Children landed.

**shapes companion for infrastructure-v1.** Create `crates/eg-core/ontology/infrastructure-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `infrastructure` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_infrastructure_v1::shapes_module_loads`.

**AutomationJob.** Add owl:Class `:AutomationJob` (subClassOf :Workload-adjacent bfo process; one Tower job run) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: AutomationJob: jobStatus minCount 1, in `infrastructure-v1.shapes.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::AutomationJob_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**AutomationJobTemplate.** Add owl:Class `:AutomationJobTemplate` (template a job instantiates) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::AutomationJobTemplate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**jobStatus.** Add owl:DatatypeProperty `:jobStatus` (AutomationJob -> xsd:string (successful|failed|running|canceled)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: sh:in on jobStatus, in `infrastructure-v1.shapes.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::jobStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**ranAgainstHost.** Add owl:ObjectProperty `:ranAgainstHost` (AutomationJob -> :Host) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::ranAgainstHost_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**routeHostname.** Add owl:DatatypeProperty `:routeHostname` (ProxyRoute -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: routeHostname minCount 1 on ProxyRoute, in `infrastructure-v1.shapes.ttl`. Needed by: caddy. | `ontology_audit_infrastructure_v1::routeHostname_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**upstreamAddress.** Add owl:DatatypeProperty `:upstreamAddress` (ProxyRoute -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: caddy. | `ontology_audit_infrastructure_v1::upstreamAddress_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**Alert.** Add owl:Class `:Alert` (a firing or resolved alert rule instance on a :Service) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: Alert: alertSeverity, alertState minCount 1, in `infrastructure-v1.shapes.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::Alert_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**alertSeverity.** Add owl:DatatypeProperty `:alertSeverity` (Alert -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::alertSeverity_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**alertState.** Add owl:DatatypeProperty `:alertState` (Alert -> xsd:string (firing|resolved|pending)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::alertState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**firingSince.** Add owl:DatatypeProperty `:firingSince` (Alert -> xsd:dateTime) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::firingSince_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**alertsOn.** Add owl:ObjectProperty `:alertsOn` (Alert -> :Service) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::alertsOn_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**lastPushedAt.** Add owl:DatatypeProperty `:lastPushedAt` (ContainerImage -> xsd:dateTime) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: dockerhub. | `ontology_audit_infrastructure_v1::lastPushedAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**pullCount.** Add owl:DatatypeProperty `:pullCount` (ContainerImage -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: pullCount minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: dockerhub. | `ontology_audit_infrastructure_v1::pullCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**entityState.** Add owl:DatatypeProperty `:entityState` (ha :Entity -> xsd:string (value or unavailable)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: home-assistant. | `ontology_audit_infrastructure_v1::entityState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**unavailableSince.** Add owl:DatatypeProperty `:unavailableSince` (ha :Entity -> xsd:dateTime) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: home-assistant. | `ontology_audit_infrastructure_v1::unavailableSince_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**desiredReplicas.** Add owl:DatatypeProperty `:desiredReplicas` (ContainerStack -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::desiredReplicas_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**runningReplicas.** Add owl:DatatypeProperty `:runningReplicas` (ContainerStack -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::runningReplicas_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**stackSourceRepository.** Add owl:ObjectProperty `:stackSourceRepository` (ContainerStack -> :Repository) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::stackSourceRepository_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**ManagementEnvironment.** Add owl:Class `:ManagementEnvironment` (a Portainer environment (named so it does not collide with the probed :Endpoint)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::ManagementEnvironment_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**pendingUpdateCount.** Add owl:DatatypeProperty `:pendingUpdateCount` (OperatingSystem -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: systems-manager. | `ontology_audit_infrastructure_v1::pendingUpdateCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**uptimeSeconds.** Add owl:DatatypeProperty `:uptimeSeconds` (OperatingSystem -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: systems-manager. | `ontology_audit_infrastructure_v1::uptimeSeconds_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**recordType.** Add owl:DatatypeProperty `:recordType` (DnsRecord -> xsd:string (the existing :dnsType is typed on :DNSService, not the record)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: technitium-dns. | `ontology_audit_infrastructure_v1::recordType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**recordValue.** Add owl:DatatypeProperty `:recordValue` (DnsRecord -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: technitium-dns. | `ontology_audit_infrastructure_v1::recordValue_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**lastConnectionStatus.** Add owl:DatatypeProperty `:lastConnectionStatus` (Host -> xsd:string (ok|failed)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: tunnel-manager. | `ontology_audit_infrastructure_v1::lastConnectionStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**lastConnectionError.** Add owl:DatatypeProperty `:lastConnectionError` (Host -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: tunnel-manager. | `ontology_audit_infrastructure_v1::lastConnectionError_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**sdlc_lifecycle-v1.ttl additions rollup.** 23 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R069.1` to `EG-CQ-CONN-R069.23`. | Children landed.

**shapes companion for sdlc_lifecycle-v1.** Create `crates/eg-core/ontology/sdlc_lifecycle-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `sdlc_lifecycle` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_sdlc_lifecycle_v1::shapes_module_loads`.

**Repository.** Add owl:Class `:Repository` (source repository (class used by infra:ContainerImage/aliasOf but never declared)) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: dockerhub, github, repository-manager. | `ontology_audit_sdlc_lifecycle_v1::Repository_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**Branch.** Add owl:Class `:Branch` (a ref in a Repository) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab, repository-manager. | `ontology_audit_sdlc_lifecycle_v1::Branch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**branchOf.** Add owl:ObjectProperty `:branchOf` (Branch -> Repository) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::branchOf_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**headCommit.** Add owl:ObjectProperty `:headCommit` (Branch -> software:Commit) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::headCommit_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**isDefaultBranch.** Add owl:DatatypeProperty `:isDefaultBranch` (Branch -> xsd:boolean) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::isDefaultBranch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**blockedBy.** Add owl:ObjectProperty `:blockedBy` (Ticket -> Ticket) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian. | `ontology_audit_sdlc_lifecycle_v1::blockedBy_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**assignedTo.** Add owl:ObjectProperty `:assignedTo` (Ticket -> :Person) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian. | `ontology_audit_sdlc_lifecycle_v1::assignedTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**ticketStatus.** Add owl:DatatypeProperty `:ticketStatus` (Ticket -> xsd:string) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian, plane. | `ontology_audit_sdlc_lifecycle_v1::ticketStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**closesTicket.** Add owl:ObjectProperty `:closesTicket` (CodeChangeProposal -> Ticket) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian, github. | `ontology_audit_sdlc_lifecycle_v1::closesTicket_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**proposalState.** Add owl:DatatypeProperty `:proposalState` (CodeChangeProposal -> xsd:string (open|merged|closed)) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. SHACL: sh:in, in `sdlc_lifecycle-v1.shapes.ttl`. Needed by: atlassian, github, repository-manager. | `ontology_audit_sdlc_lifecycle_v1::proposalState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**requestedReviewer.** Add owl:ObjectProperty `:requestedReviewer` (CodeChangeProposal -> :Person) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: github. | `ontology_audit_sdlc_lifecycle_v1::requestedReviewer_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**PipelineJob.** Add owl:Class `:PipelineJob` (one job inside a PipelineRun) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::PipelineJob_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**pipelineJobOf.** Add owl:ObjectProperty `:pipelineJobOf` (PipelineJob -> PipelineRun) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::pipelineJobOf_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**IterationCycle.** Add owl:Class `:IterationCycle` (Plane cycle / sprint) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::IterationCycle_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**inCycle.** Add owl:ObjectProperty `:inCycle` (Ticket -> IterationCycle) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::inCycle_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**WorkModule.** Add owl:Class `:WorkModule` (Plane module grouping tickets) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::WorkModule_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**inModule.** Add owl:ObjectProperty `:inModule` (Ticket -> WorkModule) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::inModule_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**ticketDueDate.** Add owl:DatatypeProperty `:ticketDueDate` (Ticket -> xsd:date) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::ticketDueDate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**Worktree.** Add owl:Class `:Worktree` (a linked git worktree of a Repository) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::Worktree_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**worktreeState.** Add owl:DatatypeProperty `:worktreeState` (Worktree -> xsd:string (active|stale|dangling|merged)) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. SHACL: sh:in, in `sdlc_lifecycle-v1.shapes.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::worktreeState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**tracksBranch.** Add owl:ObjectProperty `:tracksBranch` (Worktree -> Branch) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::tracksBranch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**proposalBranch.** Add owl:ObjectProperty `:proposalBranch` (CodeChangeProposal -> Branch) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::proposalBranch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**archimate-v1.ttl additions rollup.** 8 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R070.1` to `EG-CQ-CONN-R070.8`. | Children landed.

**shapes companion for archimate-v1.** Create `crates/eg-core/ontology/archimate-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `archimate` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_archimate_v1::shapes_module_loads`.

**ApplicationComponent.** Add owl:Class `:ApplicationComponent` (subClassOf :ApplicationLayer; anchor for LeanIX/Backstage components) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: archimate. | `ontology_audit_archimate_v1::ApplicationComponent_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**ArchimateRelationship.** Add owl:Class `:ArchimateRelationship` (reified relationship) to `crates/eg-core/ontology/archimate-v1.ttl`. SHACL: ArchimateRelationship: relationshipType, relSource, relTarget minCount 1, in `archimate-v1.shapes.ttl`. Needed by: archimate. | `ontology_audit_archimate_v1::ArchimateRelationship_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**relationshipType.** Add owl:DatatypeProperty `:relationshipType` (ArchimateRelationship -> xsd:string (Serving|Realization|Assignment|...)) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: archimate. | `ontology_audit_archimate_v1::relationshipType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**ConfigurationItem.** Add owl:Class `:ConfigurationItem` (subClassOf :ApplicationLayer; crosswalk anchor for a ServiceNow CI) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::ConfigurationItem_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**affectsConfigurationItem.** Add owl:ObjectProperty `:affectsConfigurationItem` (Incident|Change -> ConfigurationItem) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::affectsConfigurationItem_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**incidentState.** Add owl:DatatypeProperty `:incidentState` (Incident -> xsd:string (new|in_progress|resolved|closed)) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::incidentState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**incidentAssignee.** Add owl:ObjectProperty `:incidentAssignee` (Incident -> :Person) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::incidentAssignee_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**documentation-v1.ttl additions rollup.** 6 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R071.1`, `EG-CQ-CONN-R071.2`, `EG-CQ-CONN-R071.3`, `EG-CQ-CONN-R071.4`, `EG-CQ-CONN-R071.5`, `EG-CQ-CONN-R071.6`. | Children landed.

**shapes companion for documentation-v1.** Create `crates/eg-core/ontology/documentation-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `documentation` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_documentation_v1::shapes_module_loads`.

**WebSnapshot.** Add owl:Class `:WebSnapshot` (subClassOf :Document; a captured URL snapshot) to `crates/eg-core/ontology/documentation-v1.ttl`. SHACL: WebSnapshot: sourceRef minCount 1 (the URL), in `documentation-v1.shapes.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::WebSnapshot_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**ArchiveResult.** Add owl:Class `:ArchiveResult` (one extractor outcome for a snapshot) to `crates/eg-core/ontology/documentation-v1.ttl`. SHACL: ArchiveResult: extractorName, resultStatus minCount 1, in `documentation-v1.shapes.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::ArchiveResult_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**hasArchiveResult.** Add owl:ObjectProperty `:hasArchiveResult` (WebSnapshot -> ArchiveResult) to `crates/eg-core/ontology/documentation-v1.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::hasArchiveResult_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**extractorName.** Add owl:DatatypeProperty `:extractorName` (ArchiveResult -> xsd:string) to `crates/eg-core/ontology/documentation-v1.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::extractorName_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**resultStatus.** Add owl:DatatypeProperty `:resultStatus` (ArchiveResult -> xsd:string (succeeded|failed|skipped)) to `crates/eg-core/ontology/documentation-v1.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::resultStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**process_intelligence-v1.ttl additions rollup.** 7 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R072.1`, `EG-CQ-CONN-R072.2`, `EG-CQ-CONN-R072.3`, `EG-CQ-CONN-R072.4`, `EG-CQ-CONN-R072.5`, `EG-CQ-CONN-R072.6`, `EG-CQ-CONN-R072.7`. | Children landed.

**EpcFunction.** Add owl:Class `:EpcFunction` (subClassOf :ProcessEventType; ARIS EPC function) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: aris. | `ontology_audit_process_intelligence_v1::EpcFunction_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**EpcRuleOperator.** Add owl:Class `:EpcRuleOperator` (ARIS split/join (AND|OR|XOR) between EPC nodes) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: aris. | `ontology_audit_process_intelligence_v1::EpcRuleOperator_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**flowsTo.** Add owl:ObjectProperty `:flowsTo` (model-level control-flow edge: EPC node -> EPC node (distinct from instance-level :directlyFollows)) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: aris. | `ontology_audit_process_intelligence_v1::flowsTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**ProcessInstance.** Add owl:Class `:ProcessInstance` (one running or finished execution of a ProcessModelVersion) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::ProcessInstance_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**instanceOfProcessModel.** Add owl:ObjectProperty `:instanceOfProcessModel` (ProcessInstance -> :ProcessModelVersion) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::instanceOfProcessModel_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**stoppedAtActivity.** Add owl:ObjectProperty `:stoppedAtActivity` (ProcessInstance -> :ProcessEventType) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::stoppedAtActivity_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**raisedIncident.** Add owl:ObjectProperty `:raisedIncident` (ProcessInstance -> :ApplicationEvent (archimate crosswalk)) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::raisedIncident_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**government-v1.ttl additions rollup.** 11 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R073.1` to `EG-CQ-CONN-R073.11`. | Children landed.

**shapes companion for government-v1.** Create `crates/eg-core/ontology/government-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `government` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_government_v1::shapes_module_loads`.

**RiskScenario.** Add owl:Class `:RiskScenario` (a risk scenario in a risk assessment) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::RiskScenario_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**mitigatesRisk.** Add owl:ObjectProperty `:mitigatesRisk` (SecurityControl -> RiskScenario) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::mitigatesRisk_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**inFramework.** Add owl:ObjectProperty `:inFramework` (SecurityControl -> core:Framework) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::inFramework_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**riskAffectsService.** Add owl:ObjectProperty `:riskAffectsService` (RiskScenario -> infra:Service) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::riskAffectsService_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**PrivacyAssessment.** Add owl:Class `:PrivacyAssessment` (DPIA/PIA instance) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::PrivacyAssessment_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**ProcessingActivity.** Add owl:Class `:ProcessingActivity` (a records-of-processing entry) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::ProcessingActivity_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**assessmentCovers.** Add owl:ObjectProperty `:assessmentCovers` (PrivacyAssessment -> ProcessingActivity) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessmentCovers_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**assessmentDueDate.** Add owl:DatatypeProperty `:assessmentDueDate` (PrivacyAssessment -> xsd:date) to `crates/eg-core/ontology/government-v1.ttl`. SHACL: assessmentDueDate minCount 1, in `government-v1.shapes.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessmentDueDate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**assessedVendor.** Add owl:ObjectProperty `:assessedVendor` (PrivacyAssessment -> trm:Vendor) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessedVendor_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**assessmentStatus.** Add owl:DatatypeProperty `:assessmentStatus` (PrivacyAssessment -> xsd:string (draft|in_review|approved); overdue is derived from as-of and assessmentDueDate) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessmentStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**core-foundation-v1.ttl additions rollup.** 6 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R074.1`, `EG-CQ-CONN-R074.2`, `EG-CQ-CONN-R074.3`, `EG-CQ-CONN-R074.4`, `EG-CQ-CONN-R074.5`, `EG-CQ-CONN-R074.6`. | Children landed.

**shapes companion for core-foundation-v1.** Create `crates/eg-core/ontology/core-foundation-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `core-foundation` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_core_foundation_v1::shapes_module_loads`.

**GlossaryTerm.** Add owl:Class `:GlossaryTerm` (subClassOf :Concept; a governed business term) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: egeria. | `ontology_audit_core_foundation_v1::GlossaryTerm_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**termAssignedTo.** Add owl:ObjectProperty `:termAssignedTo` (GlossaryTerm -> :Dataset) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: egeria. | `ontology_audit_core_foundation_v1::termAssignedTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**counterparty.** Add owl:ObjectProperty `:counterparty` (Agreement -> :LegalEntity) to `crates/eg-core/ontology/core-foundation-v1.ttl`. SHACL: counterparty minCount 1, in `core-foundation-v1.shapes.ttl`. Needed by: legal-peripherals. | `ontology_audit_core_foundation_v1::counterparty_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**agreementExpiresAt.** Add owl:DatatypeProperty `:agreementExpiresAt` (Agreement -> xsd:date) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: legal-peripherals. | `ontology_audit_core_foundation_v1::agreementExpiresAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**hasRenewalAction.** Add owl:ObjectProperty `:hasRenewalAction` (Agreement -> :Action) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: legal-peripherals. | `ontology_audit_core_foundation_v1::hasRenewalAction_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**finance-v1.ttl additions rollup.** 7 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R075.1`, `EG-CQ-CONN-R075.2`, `EG-CQ-CONN-R075.3`, `EG-CQ-CONN-R075.4`, `EG-CQ-CONN-R075.5`, `EG-CQ-CONN-R075.6`, `EG-CQ-CONN-R075.7`. | Children landed.

**shapes companion for finance-v1.** Create `crates/eg-core/ontology/finance-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `finance` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_finance_v1::shapes_module_loads`.

**orderQty.** Add owl:DatatypeProperty `:orderQty` (VersionedOrder -> xsd:float) to `crates/eg-core/ontology/finance-v1.ttl`. SHACL: filledQty sh:lessThanOrEquals orderQty, in `finance-v1.shapes.ttl`. Needed by: emerald-exchange. | `ontology_audit_finance_v1::orderQty_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**Budget.** Add owl:Class `:Budget` (a spending budget) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::Budget_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**budgetLimit.** Add owl:DatatypeProperty `:budgetLimit` (Budget -> xsd:decimal) to `crates/eg-core/ontology/finance-v1.ttl`. SHACL: minCount 1, in `finance-v1.shapes.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::budgetLimit_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**LedgerTransaction.** Add owl:Class `:LedgerTransaction` (a personal-ledger transaction (not position-bound, unlike :Activity)) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::LedgerTransaction_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**chargedToBudget.** Add owl:ObjectProperty `:chargedToBudget` (LedgerTransaction -> Budget) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::chargedToBudget_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**transactionAmount.** Add owl:DatatypeProperty `:transactionAmount` (LedgerTransaction -> xsd:decimal) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::transactionAmount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**personal-v1.ttl additions rollup.** 9 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R076.1` to `EG-CQ-CONN-R076.9`. | Children landed.

**birthPlace.** Add owl:ObjectProperty `:birthPlace` (core:Person -> core:Place) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: gramps. | `ontology_audit_personal_v1::birthPlace_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**birthYear.** Add owl:DatatypeProperty `:birthYear` (core:Person -> xsd:gYear) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: gramps. | `ontology_audit_personal_v1::birthYear_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**documentType.** Add owl:DatatypeProperty `:documentType` (core:Document -> xsd:string) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: paperless-ngx. | `ontology_audit_personal_v1::documentType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**dueDate.** Add owl:DatatypeProperty `:dueDate` (core:Document -> xsd:date) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: paperless-ngx. | `ontology_audit_personal_v1::dueDate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**totalAmount.** Add owl:DatatypeProperty `:totalAmount` (core:Document -> xsd:decimal) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: paperless-ngx. | `ontology_audit_personal_v1::totalAmount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**FileShare.** Add owl:Class `:FileShare` (a Nextcloud share of a file or folder) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::FileShare_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**sharesFile.** Add owl:ObjectProperty `:sharesFile` (FileShare -> core:Document) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::sharesFile_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**isPublicLink.** Add owl:DatatypeProperty `:isPublicLink` (FileShare -> xsd:boolean) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::isPublicLink_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**shareExpiresAt.** Add owl:DatatypeProperty `:shareExpiresAt` (FileShare -> xsd:date) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::shareExpiresAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**virtual_graph-v1.ttl additions rollup.** 3 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R077.1`, `EG-CQ-CONN-R077.2`, `EG-CQ-CONN-R077.3`. | Children landed.

**NamedGraph.** Add owl:Class `:NamedGraph` (subClassOf core:Dataset; a graph in a triple store) to `crates/eg-core/ontology/virtual_graph-v1.ttl`. Needed by: jena. | `ontology_audit_virtual_graph_v1::NamedGraph_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**tripleCount.** Add owl:DatatypeProperty `:tripleCount` (NamedGraph -> xsd:integer) to `crates/eg-core/ontology/virtual_graph-v1.ttl`. Needed by: jena. | `ontology_audit_virtual_graph_v1::tripleCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**lastModifiedAt.** Add owl:DatatypeProperty `:lastModifiedAt` (NamedGraph -> xsd:dateTime) to `crates/eg-core/ontology/virtual_graph-v1.ttl`. Needed by: jena. | `ontology_audit_virtual_graph_v1::lastModifiedAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**identity-v1.ttl additions rollup.** 5 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R078.1`, `EG-CQ-CONN-R078.2`, `EG-CQ-CONN-R078.3`, `EG-CQ-CONN-R078.4`, `EG-CQ-CONN-R078.5`. | Children landed.

**shapes companion for identity-v1.** Create `crates/eg-core/ontology/identity-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `identity` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_identity_v1::shapes_module_loads`.

**Application.** Add owl:Class `:Application` (declare the class already used as range of :assignedApp) to `crates/eg-core/ontology/identity-v1.ttl`. Needed by: keycloak, okta. | `ontology_audit_identity_v1::Application_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**OidcClient.** Add owl:Class `:OidcClient` (subClassOf :Application) to `crates/eg-core/ontology/identity-v1.ttl`. Needed by: keycloak. | `ontology_audit_identity_v1::OidcClient_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**roleGrantsAccessTo.** Add owl:ObjectProperty `:roleGrantsAccessTo` (IdentityRole -> Application) to `crates/eg-core/ontology/identity-v1.ttl`. Needed by: keycloak. | `ontology_audit_identity_v1::roleGrantsAccessTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**accountStatus.** Add owl:DatatypeProperty `:accountStatus` (IdentityUser -> xsd:string) to `crates/eg-core/ontology/identity-v1.ttl`. SHACL: sh:in (ACTIVE|SUSPENDED|DEACTIVATED), in `identity-v1.shapes.ttl`. Needed by: okta. | `ontology_audit_identity_v1::accountStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**orchestration-v1.ttl additions rollup.** 5 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R079.1`, `EG-CQ-CONN-R079.2`, `EG-CQ-CONN-R079.3`, `EG-CQ-CONN-R079.4`, `EG-CQ-CONN-R079.5`. | Children landed.

**shapes companion for orchestration-v1.** Create `crates/eg-core/ontology/orchestration-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `orchestration` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_orchestration_v1::shapes_module_loads`.

**promptVersion.** Add owl:DatatypeProperty `:promptVersion` (Prompt -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::promptVersion_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**tokenCost.** Add owl:DatatypeProperty `:tokenCost` (RunTrace -> xsd:decimal) to `crates/eg-core/ontology/orchestration-v1.ttl`. SHACL: minInclusive 0, in `orchestration-v1.shapes.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::tokenCost_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**tracePrompt.** Add owl:ObjectProperty `:tracePrompt` (RunTrace -> Prompt) to `crates/eg-core/ontology/orchestration-v1.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::tracePrompt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**evaluationScore.** Add owl:DatatypeProperty `:evaluationScore` (RunTrace|Prompt -> xsd:decimal) to `crates/eg-core/ontology/orchestration-v1.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::evaluationScore_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**enterprise-v1.ttl additions rollup.** 4 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R080.1`, `EG-CQ-CONN-R080.2`, `EG-CQ-CONN-R080.3`, `EG-CQ-CONN-R080.4`. | Children landed.

**shapes companion for enterprise-v1.** Create `crates/eg-core/ontology/enterprise-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `enterprise` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_enterprise_v1::shapes_module_loads`.

**factSheetType.** Add owl:DatatypeProperty `:factSheetType` (EAFactSheet -> xsd:string) to `crates/eg-core/ontology/enterprise-v1.ttl`. Needed by: leanix. | `ontology_audit_enterprise_v1::factSheetType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**lifecyclePhase.** Add owl:DatatypeProperty `:lifecyclePhase` (EAFactSheet -> xsd:string (plan|active|phaseOut|endOfLife)) to `crates/eg-core/ontology/enterprise-v1.ttl`. SHACL: sh:in, in `enterprise-v1.shapes.ttl`. Needed by: leanix. | `ontology_audit_enterprise_v1::lifecyclePhase_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.

**activeUserCount.** Add owl:DatatypeProperty `:activeUserCount` (EAFactSheet -> xsd:integer) to `crates/eg-core/ontology/enterprise-v1.ttl`. Needed by: leanix. | `ontology_audit_enterprise_v1::activeUserCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**nutrition-v1.ttl additions rollup.** 8 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R081.1` to `EG-CQ-CONN-R081.8`. | Children landed.

**Recipe.** Add owl:Class `:Recipe` (a recipe) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::Recipe_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**usesIngredient.** Add owl:ObjectProperty `:usesIngredient` (Recipe -> :Food) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::usesIngredient_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**ShoppingListItem.** Add owl:Class `:ShoppingListItem` (item on a shopping list, refers to a Food) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::ShoppingListItem_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**MealPlanEntry.** Add owl:Class `:MealPlanEntry` (a planned meal on a date for a Recipe) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::MealPlanEntry_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**WorkoutRoutine.** Add owl:Class `:WorkoutRoutine` (a planned set of exercises) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::WorkoutRoutine_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**Exercise.** Add owl:Class `:Exercise` (an exercise) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::Exercise_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**includesExercise.** Add owl:ObjectProperty `:includesExercise` (WorkoutRoutine -> Exercise) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::includesExercise_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**WorkoutSession.** Add owl:Class `:WorkoutSession` (a performed instance of a routine with completedAt) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::WorkoutSession_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**action-v1.ttl additions rollup.** 1 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R082.1`. | Children landed.

**failureReason.** Add owl:DatatypeProperty `:failureReason` (ActionInvocation -> xsd:string) to `crates/eg-core/ontology/action-v1.ttl`. Needed by: stirlingpdf. | `ontology_audit_action_v1::failureReason_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).

**erpnext, salesforce and twenty vocabulary (rollup, single row).** Commercial term and representation requirements are owned by `EG-SUPPLY-VOCAB` in `crates/eg-core/ontology/commercial-v1.ttl`. Rows `EG-SUPPLY-VOCAB-R003.7` through `EG-SUPPLY-VOCAB-R003.12` reuse Organization and Person rather than adding Party or Contact classes. They declare PurchaseOrder, PurchaseInvoice, Opportunity, contactOf and lastActivityAt. No `commerce-v1.ttl` is created. Needed by: erpnext, salesforce, twenty. Also depends on EG-SUPPLY-VOCAB-R003.13 through EG-SUPPLY-VOCAB-R003.17. Vocabulary reassignment text is not implementation evidence. | `commercial_connector_prerequisites` parses all three Coverage rows and both Vocabulary cells per connector. Resolve every required producer IRI through registered modules. Reject a missing producer, an unrelated-row-only edit, or duplicate incompatible declarations. Live unavailable fields cause typed abstention.

**Concept-to-source authority is declared in the ontology (rollup).** The ontology itself states which attached source is authoritative for which ontology class, so source choice is data, not query text. Children add the vocabulary, its SHACL shapes and a precedence rule. Rollup: LANDED only once every child is. | Every child is LANDED and the decisive swap test (R007.4) passes.

**Add `vg:SourceAuthority`, `vg:authoritativeSource`, `vg:authorityFor` and `vg:authorityRank` to the virtual-graph vocabulary.** `crates/eg-core/ontology/virtual_graph-v1.ttl` gains class `vg:SourceAuthority` and properties `vg:authoritativeSource` (to `vg:SourceConnection`), `vg:authorityFor` (to an ontology class) and `vg:authorityRank` (integer, lower wins). Net-new: no authority term exists in any shipped .ttl (grep for authoritative/systemOfRecord found only unrelated DNS and ADR text). | The ontology parses and the new terms are present with domain and range. A unit test loads the file and lists them.

**SHACL shape: a `vg:SourceAuthority` names exactly one connected source, one class and one rank.** `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl` adds `vg:SourceAuthorityShape`. It refuses an authority with no source, no class or no rank, an authority whose source is not a `vg:SourceConnection`, and two authorities of equal rank for one class. Depends on `EG-CQ-XSRC-R001.1`. | Shape fixtures accept a valid authority and refuse each of the four faults, including the equal-rank tie.

**Authority applies through subclass entailment.** An authority declared on a superclass (for example `:ApplicationEvent`) serves its subclasses (for example `:Incident`) unless a subclass declares its own. Reuses the subclass entailment of `EG-FEDERATED-QUERY-R072`; adds only the precedence rule. Depends on `EG-CQ-XSRC-R001.1`. | A fixture shows the superclass authority inherited and a subclass authority overriding it.

**Authority records the approval of its mapping.** An authority is effective only while the `vg:VirtualMapping` it points at is approved (`vg:approved true`, `EG-UNIFIED-DATA-PLANE-R037`). An unapproved or retracted mapping makes the authority inactive, and the class is reported uncovered rather than served by a fallback source. | A fixture with an unapproved mapping returns the class as uncovered with the reason named.

**Supply-chain concepts and the sources that are authoritative for them (rollup).** Add the supply-chain concepts missing from the ontology and declare their authoritative sources. `:Vendor` and `:TechnologyProduct` (`trm-v1.ttl`) exist and are reused. Sources named here are a judgement from the connector list: erpnext-mcp (suppliers, purchase orders, items), salesforce-mcp and twenty-mcp (customer and partner accounts), ciso-assistant-mcp and onetrust-mcp (third-party risk and vendor assessments), leanix-mcp (provider fact sheets); software supply chain: dockerhub-mcp (image publisher and tags), github-mcp and gitlab-mcp (source repositories, dependencies, advisories), repository-manager-mcp (workspace repositories). Rollup: LANDED only once every child is. | Every child is LANDED.

**Add `:Supplier` as a subclass of `:Vendor`, and `:SupplyChainItem` with `:suppliedBy`.** A new `crates/eg-core/ontology/supply_chain-v1.ttl` declares `:Supplier rdfs:subClassOf :Vendor` (reusing `trm-v1.ttl`), `:SupplyChainItem` and `:suppliedBy` (item to supplier). MISSING today: no supplier, procurement or supply-chain-item term exists outside `energy_geopolitics-v1.ttl` `:SupplyRoute`. | The file parses, `:Supplier` entails `:Vendor` in the reasoner, and a unit test lists the terms.

**Add `:SoftwareComponent`, `:ComponentVersion` and `:publishedBy`.** `supply_chain-v1.ttl` adds the software supply-chain terms: a component, a version of it, and the publisher (a `:Supplier`). A `:ContainerImage` (`infrastructure-v1.ttl`) is declared a `:SoftwareComponent`. Depends on `EG-CQ-XSRC-R002.1`. | The file parses and `:ContainerImage` entails `:SoftwareComponent`.

**Add `:Vulnerability` and `:affectsComponent`.** `supply_chain-v1.ttl` adds `:Vulnerability` (identifier, severity, fixed-in version) and `:affectsComponent` (to a `:ComponentVersion`). MISSING today: the only vulnerability term is the count `:vulnerabilityCount` in `trm-v1.ttl`. Depends on `EG-CQ-XSRC-R002.2`. | The file parses and a unit test lists the terms; `:vulnerabilityCount` is left unchanged.

**SHACL shape for supplier and component.** `crates/eg-core/ontology/supply_chain-v1.shapes.ttl` requires a `:Supplier` to carry a name and a `:ComponentVersion` to name its component and a version string. Depends on `EG-CQ-XSRC-R002.2`. | Shape fixtures accept valid items and refuse a nameless supplier and a versionless component.

**Source-authority mapping: suppliers and purchase items.** Declare `vg:SourceAuthority` rows: `:Supplier` and `:SupplyChainItem` to erpnext-mcp (rank 1) with leanix-mcp `Provider` fact sheets (rank 2); third-party risk to ciso-assistant-mcp. Judgement: ERPNext is the transactional procurement system; LeanIX is the architecture catalogue. A seed `.ttl` fixture under `crates/eg-core/tests/fixtures/` holds the rows. Depends on `EG-CQ-XSRC-R001.1`, `EG-CQ-XSRC-R002.1`. | The seed loads, passes `vg:SourceAuthorityShape`, and `select_sources` returns erpnext for `:Supplier`.

**Source-authority mapping: software components and vulnerabilities.** Declare `vg:SourceAuthority` rows: `:ContainerImage` to dockerhub-mcp (publisher, tags) with gitlab-mcp and github-mcp for source repositories. `:Vulnerability` to gitlab-mcp (vulnerability findings) with github-mcp advisories at rank 2. Judgement: the registry is authoritative for what an image is, the code host for what is wrong with it. Depends on `EG-CQ-XSRC-R002.3`. | The seed loads and `select_sources` returns the registry for an image and the code host for a vulnerability.

**Virtual mapping fixture: erpnext supplier table to `:Supplier`.** One approved `vg:VirtualMapping` (`vg:mapsOntologyClass :Supplier`, key field, predicate-field pairs for name and status) over a recorded erpnext-mcp operation contract, using the operation-bound kinds of `EG-FEDERATED-QUERY-R073`. Cross-repo prerequisite: the erpnext connector operation contract (owning repo: agent-packages connector). | The mapping passes the `EG-UNIFIED-DATA-PLANE-R037` shapes and reads equal rows from a recorded response.

**Service concepts and the sources that are authoritative for them (rollup).** Declare which sources are authoritative for services, their hosts and their health. Found: `:Service` (a monitored network service, `infrastructure-v1.ttl`), `:Host`, `:Node`, `:Rack`, `:ContainerImage`, `:Incident`, `:BusinessCapability` (`archimate-v1.ttl`). Sources named are a judgement: uptime-mcp and lgtm-mcp for live service health, container-manager-mcp and portainer-mcp for deployed workloads and images, servicenow-mcp (CMDB) and leanix-mcp for the service catalogue and business capabilities, archimate-mcp for the architecture model, caddy-mcp and technitium-dns-mcp for ingress and name records, systems-manager-mcp for host facts. Rollup: LANDED only once every child is. | Every child is LANDED.

**Source-authority mapping: `:Service` health.** Declare `:Service` to uptime-mcp (rank 1) and lgtm-mcp (rank 2) for health, and to servicenow-mcp CMDB (rank 1) for the catalogue identity. Where two sources hold different facets, the authority row carries a `vg:authorityFor` property list rather than the whole class. Depends on `EG-CQ-XSRC-R001.1`. | The seed passes the shape and `select_sources` names uptime for health and CMDB for identity.

**Source-authority mapping: deployed workloads and images.** Declare `:ContainerImage` deployment facts and `:Host` placement to container-manager-mcp (rank 1) and portainer-mcp (rank 2); `:Host` hardware facts to systems-manager-mcp. Depends on `EG-CQ-XSRC-R001.1`. | The seed passes the shape and `select_sources` names container-manager for deployed images.

**Source-authority mapping: business capabilities.** Declare `:BusinessCapability` to leanix-mcp (rank 1) and archimate-mcp (rank 2). Judgement: LeanIX is the maintained catalogue, ArchiMate the modelled view. Depends on `EG-CQ-XSRC-R001.1`. | The seed passes the shape and `select_sources` names leanix, with archimate as the second.

**Virtual mapping fixture: uptime monitor to `:Service`.** One approved `vg:VirtualMapping` from a recorded uptime-mcp operation contract to `:Service`, with name, status and last-check fields. Cross-repo prerequisite: the uptime connector operation contract (owning repo: agent-packages connector). | The mapping passes the `EG-UNIFIED-DATA-PLANE-R037` shapes and reads equal rows from a recorded response.

**Virtual mapping fixture: container-manager workload to `:Service` and `:ContainerImage`.** One approved `vg:VirtualMapping` from a recorded container-manager-mcp contract to `:Service` with its image reference. Cross-repo prerequisite: the container-manager operation contract (owning repo: agent-packages connector). | The mapping passes the shapes and reads equal rows from a recorded response.

**Linking relation between a supply-chain entity and a service, with entity resolution across sources (rollup).** The relation that joins the two sides, and the resolution that makes one real-world thing in two sources one node. Found: `:dependsOn` (service to service, `infrastructure-v1.ttl`), `:runsOn`, `:hostedBy`, `:buildsImageFor`, `:affectsEntity`, `:alignedWith`, `owl:sameAs` proposals (`EG-UNIFIED-DATA-PLANE-R030`). Rollup: LANDED only once every child is. | Every child is LANDED.

**Add `:usesComponent` (service to component version) and `:suppliesService`.** `supply_chain-v1.ttl` adds `:usesComponent` (domain `:Service`, range `:ComponentVersion`) and `:suppliesService` as its property chain with `:publishedBy` (supplier to service). The service-to-image step reuses the existing `:buildsImageFor`/`:runsOn` terms; it is not redefined. MISSING: no supplier-to-service relation exists. Depends on `EG-CQ-XSRC-R002.2`. | The file parses and a reasoner fixture entails `:suppliesService` from a service, its image and the image publisher.

**SHACL shape: `:usesComponent` domain and range.** `supply_chain-v1.shapes.ttl` refuses `:usesComponent` from a non-service or to a non-component. Depends on `EG-CQ-XSRC-R004.1`. | Shape fixtures accept a valid link and refuse both faults.

**Resolve a vendor in erpnext, leanix and dockerhub to one `:Supplier`.** Adapt the entity-resolution model of `EG-UNIFIED-DATA-PLANE-R030` (it covers Gramps, Immich, Twenty and Firefly today) to supplier records: blocking on normalized name and domain, a proposed `owl:sameAs` that is active only once approved. Adds `Erpnext`, `Leanix` and `Dockerhub` to `AttachedApplication` in `crates/eg-types/src/entity_link_proposal.rs`. Depends on `EG-UNIFIED-DATA-PLANE-R030.1`. | A fixture with a true match, a false match and an ambiguous pair proves no link is asserted before approval, mirroring R030.

**Resolve a service in uptime, container-manager and the CMDB to one `:Service`.** The same resolution applied to service records: blocking on name, host and port, an inactive proposal until approved. Reuses the `R030` model; adds only the application kinds and the blocking keys. Depends on `EG-CQ-XSRC-R004.3`. | A fixture proves the three records resolve to one node after approval and stay three before it.

**Query-time link: a join may only cross an approved `owl:sameAs`.** The federated query joins records from different sources only through an approved link. A candidate link that is unapproved contributes nothing and is reported as an unresolved candidate in the answer. Mechanism: `EG-FEDERATED-QUERY-R072` path plus the approval state of R030. | A fixture shows the join empty before approval, non-empty after, and the candidate listed while unapproved.

**The federated query is planned from the ontology's source declarations (rollup).** Source selection reads `vg:SourceAuthority`. The question names only ontology classes; the planner picks the sources. Mechanism: `EG-FEDERATED-QUERY-R072` (source selection with premises), `EG-FEDERATED-QUERY-R046` and `R069` (pushdown), `EG-FEDERATED-QUERY-R073` (operation-bound sources), `EG-UNIFIED-DATA-PLANE-R005`/`R006` (R2RML virtual graphs). Rollup: LANDED only once every child is. | Every child is LANDED.

**`select_sources` orders candidate mappings by `vg:authorityRank`.** Extend `eg-rdf::source_selection` so a covered class names the authoritative source by rank and lists the lower-ranked ones as alternates, each with a `Premise` citing the authority row. Depends on `EG-FEDERATED-QUERY-R072.1`, `EG-CQ-XSRC-R001.1`. | A two-source fixture shows the rank-1 source chosen, the alternate listed, and the authority row in the premises.

**Query fixture: the supply-chain impact query over classes only.** A SPARQL fixture in `crates/eg-rdf/tests/fixtures/` asks for `:Service`, the `:SoftwareComponent` and `:Supplier` behind it, and `:Vulnerability` on it. It names no source, endpoint or connector. A test fails if the text contains a connector name. Depends on `EG-CQ-XSRC-R004.1`. | The fixture parses, and the no-connector-name check passes.

**The plan is derived, not authored: planned sources equal the declared authorities.** Plan the fixture of R005.2 and assert the set of sources in the plan equals the set derived from the authority rows. Depends on `EG-CQ-XSRC-R005.1`, `EG-CQ-XSRC-R005.2`. | The test compares the planned set to the authority-derived set for the seed.

**An unconnected authoritative source yields a typed abstention, not a silent fallback.** When the rank-1 source for a class is not connected, the plan names it as `Unconnected { source, class }`. A lower-ranked alternate is used only if the authority row permits fallback (`vg:allowFallback`), and the report then says so. Depends on `EG-CQ-XSRC-R005.1`. | A fixture with erpnext unconnected returns the typed abstention naming erpnext and `:Supplier`.

**`EXPLAIN` shows the authority premise for each planned source.** Served `EXPLAIN` lists, per fragment, the authority row, rank, mapping generation and whether it was pushed. Mechanism: the redacted trace of `EG-FEDERATED-QUERY-R044`; no URL or credential in the output. Depends on `EG-CQ-XSRC-R005.3`. | A test reads the `EXPLAIN` output and finds the authority premises and no endpoint URL.

**The unified report shape (rollup).** One typed report: impact per service, the supply-chain items behind each, the sources used and why, freshness per source, and typed abstention. Rollup: LANDED only once every child is. | Every child is LANDED.

**Add the typed `SupplyChainImpactReport` model.** `crates/eg-types/src/supply_chain_report.rs` defines the report: a list of `ServiceImpact` (service IRI, items with supplier, component version, vulnerability and impact kind), `sources_used` (source, class served, authority premise), and `abstentions`. It refuses a `ServiceImpact` item with no source. Depends on `EG-CQ-XSRC-R005.1`. | Unit tests construct a valid report, refuse an item with no source, and round-trip the wire encoding.

**Report carries freshness per source.** Each `sources_used` entry carries the watermark and age of its data (live read, or accelerated copy with its watermark, per `EG-UNIFIED-DATA-PLANE-R038.1`). A source with no watermark is reported `live`. Depends on `EG-CQ-XSRC-R006.1`. | Unit tests cover a copy with a watermark, a live read, and the refusal of a copy with no watermark.

**Report abstention variants.** `abstentions` holds `Unconnected`, `Uncovered`, `Disconnected` and `UnapprovedMapping` entries, mapping the `CoverageResult` of `EG-FEDERATED-QUERY-R072.1` plus the unconnected case. A report with an abstention is still returned, never an error. Depends on `EG-CQ-XSRC-R006.1`. | Unit tests build one report per abstention kind and confirm the other services still report.

**Assemble the report from the federated rows.** A pure function from the planned query's rows and premises to `SupplyChainImpactReport`. Depends on `EG-CQ-XSRC-R006.1`, `EG-CQ-XSRC-R005.3`. | A fixture over recorded rows produces the expected report, byte for byte.

**Serve the report through graph-os.** Cross-repo prerequisite (owning repo: graph-os): expose one intent tool that takes the question and returns `SupplyChainImpactReport`. Per the registry rule, graph-os serves the tool; EG supplies the method. Depends on `EG-CQ-XSRC-R006.4`. | A served call returns a report whose shape matches the typed model.

**End-to-end acceptance from real connected data (rollup).** "How does the supply chain affect our services?" answered through the served surface, with sources chosen only from the ontology. Rollup: LANDED only once every child is. | Every child is LANDED, including the swap test.

**Acceptance on recorded connector responses.** Run the question over recorded erpnext-mcp, dockerhub-mcp, gitlab-mcp, container-manager-mcp and uptime-mcp responses. Assert at least one `ServiceImpact` with a supplier, a component version and a source per item, and that every source named in the report appears in an authority row. Depends on `EG-CQ-XSRC-R006.4`. | The test is non-empty and provenance-carrying, run in CI without network.

**Acceptance against the live connected sources.** The same question through graph-os against the connected sources that exist on the day. It reports each unconnected authoritative source as an abstention. Cross-repo prerequisite (owning repo: graph-os): the connected-source list. Depends on `EG-CQ-XSRC-R006.5`. | A run records the report, the sources used and the abstentions. A non-empty answer is required for at least the software supply chain and services sides.

**Acceptance with the procurement source not connected.** Run R007.1 with erpnext-mcp absent. Assert the report still gives the software supply-chain impact and carries `Unconnected{erpnext, :Supplier}`. Depends on `EG-CQ-XSRC-R005.4`. | The test asserts the abstention and the unchanged software-side rows.

**Decisive test: changing only the ontology's authority declaration changes the sources used.** Run the question twice over the same query text. Between runs change one `vg:SourceAuthority` row (for example `:Vulnerability` from gitlab-mcp to github-mcp). Assert the plan and report name the new source and that the query text is byte-identical. This is the exit gate. Depends on `EG-CQ-XSRC-R007.1`. | The test compares query text (equal) and sources used (different) across the two runs.

**Generalization: three more cross-source questions of the same shape (rollup).** Three questions that reuse the authority declaration, source selection and report model. Each child adds only its missing classes, authority rows and a test. Rollup: LANDED only once every child is. | Every child is LANDED.

**Which services are exposed by a vulnerability in an image we deploy? (rollup)** Sources: dockerhub-mcp (image, tags), gitlab-mcp and github-mcp (vulnerability findings, advisories), container-manager-mcp and portainer-mcp (what is deployed), uptime-mcp (service). Uses `:ContainerImage`, `:Vulnerability`, `:affectsComponent`, `:usesComponent`. Mostly covered by R002 to R005; the child adds the deployed-image filter. Rollup: LANDED only once every child is. | Both children are LANDED.

**Query fixture and authority rows: vulnerable deployed image to exposed service.** Add the SPARQL fixture over classes only, and any authority row not already seeded by `EG-CQ-XSRC-R002.6`/`R003.2`. Depends on `EG-CQ-XSRC-R005.3`. | The fixture plans to exactly the sources named above and names no connector.

**Acceptance: exposed services listed with image, vulnerability and sources.** Recorded-response test asserting a non-empty list of services with the vulnerable image, the vulnerability identifier, and per-item source. And the typed abstention with the code host disconnected. Depends on `EG-CQ-XSRC-R008.1.1`. | Non-empty, provenance-carrying. Abstention case passes.

**Which business capabilities depend on a host that is over its temperature or capacity limit? (rollup)** Sources: systems-manager-mcp (host capacity), the fan and temperature telemetry via lgtm-mcp (metrics), container-manager-mcp (placement), leanix-mcp and archimate-mcp (capabilities), servicenow-mcp CMDB (service to capability). Uses `:BusinessCapability`, `:Service`, `:runsOn`, `:Host`, `:Rack`, `:CoolingUnit`. MISSING: a temperature observation and a capacity limit on `:Host`; `:supports` (`core-foundation-v1.ttl`) is the candidate link from service to capability, to be confirmed. Rollup: LANDED only once every child is. | All children are LANDED.

**Add a host limit-breach term to the ontology.** `infrastructure-v1.ttl` gains `:temperatureCelsius`, `:temperatureLimitCelsius` and `:capacityUtilization` on `:Host`, with the limit stated as data. MISSING today. No threshold is hard-coded in the query. | The file parses and a unit test lists the terms.

**SHACL shape: a limit-bearing host carries both reading and limit.** `crates/eg-core/ontology/infrastructure-v1.shapes.ttl` (new) refuses a reading with no limit. Depends on `EG-CQ-XSRC-R008.2.1`. | Shape fixtures accept a pair and refuse a reading with no limit.

**Authority rows and query fixture: capability to service to host over a limit.** Authority rows for host readings (lgtm-mcp rank 1, systems-manager-mcp rank 2) and the class-only SPARQL fixture. Confirms whether `:supports` or an `archimate` relationship carries service to capability; records the choice in `plan.md`. Depends on `EG-CQ-XSRC-R008.2.1`. | The fixture plans to the sources named above and names no connector.

**Acceptance: capabilities at risk listed with the host, reading and limit.** Recorded-response test asserting a non-empty list with capability, service, host, reading, limit and per-item source. Abstention when the metrics source is not connected. Depends on `EG-CQ-XSRC-R008.2.3`. | Non-empty, provenance-carrying. Abstention case passes.

**Which open incidents or changes touch a service a customer contract depends on? (rollup)** Sources: servicenow-mcp (incidents, changes, CMDB), salesforce-mcp and twenty-mcp (customer accounts and contracts), erpnext-mcp (contracts and issues as `:ErpNextIssue`), uptime-mcp (service). Uses `:Incident`, `:ApplicationEvent`, `:affectsEntity`, `:Service`, `:Organization`. MISSING: `:Customer` as a class (archimate-v1.ttl only mentions it in a comment), `:CustomerContract`, `:ChangeRequest`, and the contract-to-service relation. Rollup: LANDED only once every child is. | All children are LANDED.

**Add `:CustomerContract`, `:ChangeRequest` and `:coversService`.** `supply_chain-v1.ttl` or a new `commercial-v1.ttl` adds `:CustomerContract` (to `:Organization` customer), `:ChangeRequest` (subclass of `:ApplicationEvent`) and `:coversService` (contract to service). MISSING today. | The file parses and `:ChangeRequest` entails `:ApplicationEvent`.

**SHACL shape: a contract names a customer and at least one service.** The shapes file refuses a `:CustomerContract` with no customer or no `:coversService`. Depends on `EG-CQ-XSRC-R008.3.1`. | Shape fixtures accept a valid contract and refuse both faults.

**Authority rows and query fixture: open incident or change to service to contract.** Authority rows for `:Incident` and `:ChangeRequest` (servicenow-mcp rank 1, erpnext-mcp for `:ErpNextIssue` rank 2) and `:CustomerContract` (salesforce-mcp rank 1, twenty-mcp rank 2), plus the class-only SPARQL fixture. Depends on `EG-CQ-XSRC-R008.3.1`. | The fixture plans to the sources named above and names no connector.

**Acceptance: open incidents and changes listed with the service and contract.** Recorded-response test asserting a non-empty list with incident or change, service, contract, customer and per-item source. Abstention when the CRM source is not connected. Depends on `EG-CQ-XSRC-R008.3.3`. | Non-empty, provenance-carrying. Abstention case passes.

**Shared terms and mapping properties (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R001.1 to .4 are LANDED.