Epistemic Graph -- Generated Capability Ledger¶

This file is GENERATED and is the AUTHORITATIVE machine-checked capability truth (CONCEPT:EG-P0-1) -- regenerate with cargo run -p eg-capabilities --features contract --bin gen_contract. It is derived directly from the eleven current domain ROWS declarations under crates/eg-capabilities/src/domains/. Inventory gates keep them exact for every Method variant. docs/capabilities.md describes surface-level feature parity; this generated table is authoritative for per-method policy.

mutates marked ~true means the value is a conservative UPPER BOUND: the real runtime answer is conditional (an operation, a writeback flag, or a parsed query) -- see the note column. VolatileControl is explicit non-durable process/session state; None is reserved for methods with no state transition.

Method	Mutates	Durability	Authz action	Idempotent	Audited	Emits CDC	Txn participation	Note
`CreateGraph`	true	GraphRedb	`graph:admin`	true	false	false	Atomic	native lifecycle MutationBatch before registry publication
`DeleteGraph`	true	GraphRedb	`graph:admin`	true	false	false	Atomic	native lifecycle MutationBatch before registry eviction
`ListGraphs`	false	None	`graph:read`	true	false	false	Snapshot
`Reshard`	true	ControlRedb	`admin:cluster`	true	false	false	Saga	prepared/committed admin MutationBatch saga
`CatalogAssign`	true	ControlRedb	`admin:cluster`	true	false	false	Saga	prepared/committed admin MutationBatch saga
`CatalogReassign`	true	ControlRedb	`admin:cluster`	true	false	false	Saga	prepared/committed admin MutationBatch saga
`CatalogRemove`	true	ControlRedb	`admin:cluster`	true	false	false	Saga	prepared/committed admin MutationBatch saga
`CatalogList`	false	None	`admin:cluster-read`	true	false	false	Snapshot
`RebalancePlan`	false	None	`admin:cluster-read`	true	false	false	Snapshot
`RebalanceExecute`	true	ControlRedb	`admin:cluster`	true	false	false	Saga	prepared/committed admin MutationBatch saga
`PlacementRoute`	false	None	`cluster:placement-read`	true	false	false	Snapshot	engine-authoritative complete route; single-node returns authoritative unplaced group 0/epoch 0, while clustered routing requires a live MultiRaft control leader; GOC-15/BUG-030 narrowed off admin:cluster-read (2026-08-17) -- ordinary kg:read/kg:write routes their OWN tenant, handlers::placement::handle_route requires kg:admin for any other tenant's route
`RaftAddLearner`	true	ControlRedb	`admin:cluster`	true	false	false	Saga	leader-only openraft add_learner; attaches a non-voting replica without changing the voter set
`RaftChangeMembership`	true	ControlRedb	`admin:cluster`	true	false	false	Saga	leader-only openraft change_membership; sets the group's exact voter set (the usual way to promote a learner added via RaftAddLearner)
`ClusterMembers`	false	None	`cluster:topology-read`	true	false	false	Snapshot	ADR-1/W1.1 engine-authoritative client topology; deliberately NOT admin:cluster-read -- ordinary service roles need it to re-resolve after a failover; answered from any node, not just the leader
`RegisterServer`	true	GraphRedb	`registry:write`	true	true	true	Atomic	W2.5 fleet server push-registration/heartbeat: self-translates into Method::AddNode against commons (dispatch.rs), writing a REAL :Server graph node, unlike the internal non-graph topology rows
`ListRegisteredServers`	false	None	`registry:read`	true	false	false	Snapshot	typed, RLS-projected live :Server snapshot forced to commons; revision+digest-fenced keyset pages; authoritative on the single-node/full route (no cluster read barrier is claimed)
`FleetCatalog`	~true	GraphRedb	`registry:write`	true	true	true	Atomic	EH-345 fleet catalog, runtime-conditional: list/lookup are tenant- and principal-projected snapshot reads forced to commons that join discovery records and operator overrides with connector-pack AgentComponents; record_discovery/set_override/clear_override self-translate into CreateNodeIfAbsent/CompareAndSetNodeFields against commons (overrides need admin:fleet-catalog)
`PlacementAdmin`	true	ControlRedb	`admin:cluster`	false	false	false	Saga	raft-replicated placement-catalog admin op (Assign/Move/AbortMove, the placement DECISION + PLAN->EXECUTE->CATALOG-UPDATE legs): MultiRaft::placement_assign / TenantManager::move_partition / abort_move commit through the DEFAULT group's own client_write / commit_placement, not this gateway's per-graph MutationBatch
`Ping`	false	None	`service:control`	true	false	false	None
`Health`	false	None	`service:control`	true	false	false	None
`Shutdown`	true	VolatileControl	`service:admin`	true	false	false	None	explicitly ephemeral process control; never acknowledges a user-data commit
`CancelRequest`	false	None	`service:control`	true	false	false	None
`RegisterForeignSource`	true	ControlRedb	`federation:admin`	true	false	false	Saga	opaque prepared/committed control receipt; endpoint configuration is not duplicated in the ledger
`RegisterUdf`	true	ControlRedb	`udf:admin`	true	false	false	Saga	opaque prepared/committed control receipt; module bytes are not duplicated in the ledger
`CreateMatView`	true	ControlRedb	`matview:admin`	true	false	false	Saga	prepared/committed control-plane MutationBatch saga
`GetMatView`	false	None	`matview:read`	true	false	false	Snapshot
`RefreshMatView`	true	ControlRedb	`matview:admin`	true	false	false	Saga	prepared/committed control-plane MutationBatch saga
`PlanMatViewDefine`	true	ControlRedb	`matview:admin`	true	false	false	Saga	prepared/committed control-plane MutationBatch saga
`PlanMatViewGet`	false	None	`matview:read`	true	false	false	Snapshot
`PlanMatViewRefresh`	true	ControlRedb	`matview:admin`	true	false	false	Saga	prepared/committed control-plane MutationBatch saga
`PlanMatViewDrop`	true	ControlRedb	`matview:admin`	true	false	false	Saga	prepared/committed control-plane MutationBatch saga
`TopologicalSort`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`FindCycle`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`GetShortestPath`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`GetBlastRadius`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`DegreeCentrality`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`DegreeCentralityAll`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`BetweennessCentrality`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`PageRank`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`PersonalizedPageRank`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`ConnectedComponents`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`StronglyConnectedComponents`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`MinimumSpanningTree`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`CommunityDetection`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`CommunityDetectEphemeral`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`GraphColoring`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`ComputeSimilarityEdges`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`ResolveCandidates`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`ClusterHierarchyRefresh`	false	None	`compute:graph-algo`	true	false	false	Snapshot	VIZ-1 hierarchical Leiden clustering for million-node graph visualization: (re)computes and durably caches the cluster hierarchy in its own non-authoritative store (server::persistence::cluster_hierarchy_store), never as graph nodes/edges -- see ClusterHierarchyClusters/ClusterHierarchyExpand
`ClusterHierarchyClusters`	false	None	`compute:graph-algo`	true	false	false	Snapshot	VIZ-1: GET clusters(graph, level, parent_cluster_id?) from the cached hierarchy
`ClusterHierarchyExpand`	false	None	`compute:graph-algo`	true	false	false	Snapshot	VIZ-1: GET expand(graph, cluster_id) -- a level-1 cluster's member nodes/edges read live off the graph
`Vf2SubgraphMatch`	false	None	`compute:graph-algo`	true	false	false	Snapshot
`MatchOntologyTerms`	false	None	`compute:semantic`	true	false	false	Snapshot
`BatchL2Normalize`	false	None	`compute:semantic`	true	false	false	Snapshot
`FinanceOptimizePortfolio`	false	None	`compute:finance`	true	false	false	None
`FinanceRiskParity`	false	None	`compute:finance`	true	false	false	None
`FinanceBlackLitterman`	false	None	`compute:finance`	true	false	false	None
`FinanceEfficientFrontier`	false	None	`compute:finance`	true	false	false	None
`DsLinearRegression`	false	None	`compute:datascience`	true	false	false	None
`DsKMeans`	false	None	`compute:datascience`	true	false	false	None
`DsPca`	false	None	`compute:datascience`	true	false	false	None
`DsComputeStats`	false	None	`compute:datascience`	true	false	false	None
`DsTrainTestSplit`	false	None	`compute:datascience`	true	false	false	None
`DsFitEstimator`	false	None	`compute:datascience`	true	false	false	None
`DsPredictEstimator`	false	None	`compute:datascience`	true	false	false	None
`DsSoftmax`	false	None	`compute:datascience`	true	false	false	None
`DsLogSoftmax`	false	None	`compute:datascience`	true	false	false	None
`DsCrossEntropy`	false	None	`compute:datascience`	true	false	false	None
`DsDpoLoss`	false	None	`compute:datascience`	true	false	false	None
`DsGrpoSurrogate`	false	None	`compute:datascience`	true	false	false	None
`DsKlDivergence`	false	None	`compute:datascience`	true	false	false	None
`DsAdamStep`	false	None	`compute:datascience`	true	false	false	None
`DsSgdStep`	false	None	`compute:datascience`	true	false	false	None
`FinanceVar`	false	None	`compute:finance`	true	false	false	None
`FinanceCvar`	false	None	`compute:finance`	true	false	false	None
`FinanceMaxDrawdown`	false	None	`compute:finance`	true	false	false	None
`FinanceDrawdownSeries`	false	None	`compute:finance`	true	false	false	None
`FinanceDownsideDeviation`	false	None	`compute:finance`	true	false	false	None
`FinanceRiskMetrics`	false	None	`compute:finance`	true	false	false	None
`FinanceMonteCarloVar`	false	None	`compute:finance`	true	false	false	None
`FinanceStressTest`	false	None	`compute:finance`	true	false	false	None
`FinanceDetectRegimes`	false	None	`compute:finance`	true	false	false	None
`FinanceSignalDecay`	false	None	`compute:finance`	true	false	false	None
`FinanceCombineAlphas`	false	None	`compute:finance`	true	false	false	None
`FinanceCrossSectionalRank`	false	None	`compute:finance`	true	false	false	None
`FinanceMomentum`	false	None	`compute:finance`	true	false	false	None
`FinanceMeanReversion`	false	None	`compute:finance`	true	false	false	None
`FinanceInformationCoefficient`	false	None	`compute:finance`	true	false	false	None
`FinanceTwap`	false	None	`compute:finance`	true	false	false	None
`FinanceVwap`	false	None	`compute:finance`	true	false	false	None
`FinanceMarketImpact`	false	None	`compute:finance`	true	false	false	None
`FinancePairsTrading`	false	None	`compute:finance`	true	false	false	None
`FinanceMatchOrders`	false	None	`compute:finance`	true	false	false	None
`FinanceAvellanedaStoikov`	false	None	`compute:finance`	true	false	false	None
`FinanceGltQuotes`	false	None	`compute:finance`	true	false	false	None
`FinanceLogitQuotes`	false	None	`compute:finance`	true	false	false	None
`FinanceGlostenMilgromSpread`	false	None	`compute:finance`	true	false	false	None
`FinanceExpectedPnlRate`	false	None	`compute:finance`	true	false	false	None
`FinanceBreakevenAlpha`	false	None	`compute:finance`	true	false	false	None
`FinanceOfiSeries`	false	None	`compute:finance`	true	false	false	None
`FinanceMicropriceSeries`	false	None	`compute:finance`	true	false	false	None
`FinanceVpinPm`	false	None	`compute:finance`	true	false	false	None
`FinanceHawkesMle`	false	None	`compute:finance`	true	false	false	None
`FinanceHardimanBouchaud`	false	None	`compute:finance`	true	false	false	None
`FinanceKyleLambda`	false	None	`compute:finance`	true	false	false	None
`FinanceSurveillanceRisk`	false	None	`compute:finance`	true	false	false	None
`FinanceKellyFraction`	false	None	`compute:finance`	true	false	false	None
`FinanceBayesianKelly`	false	None	`compute:finance`	true	false	false	None
`FinancePosteriorCredibleInterval`	false	None	`compute:finance`	true	false	false	None
`FinancePurgedCpcv`	false	None	`compute:finance`	true	false	false	None
`FinanceDeflatedSharpe`	false	None	`compute:finance`	true	false	false	None
`FinanceProbabilityBacktestOverfit`	false	None	`compute:finance`	true	false	false	None
`FinanceDieboldMariano`	false	None	`compute:finance`	true	false	false	None
`FinanceForensicReport`	false	None	`compute:finance`	true	false	false	None
`FinanceMarket`	false	None	`compute:finance`	true	false	false	None	EH-413..EH-418 market bars and trend signals: bar codec/resolve/rollup over the time-series layout, integer indicators, signal replay/advance/scan, calibrated flip confidence and the backtest-run record. Pure compute over the request; informational only, never an order authority
`FinanceSignalModels`	false	None	`compute:finance`	true	false	false	None	EH-423 / AUD-30 signal fusion and the strategic-insider model moved from agent-utilities: sequential Bayesian fusion of directional calls weighted by measured priors, and the Kyle insider equilibrium under dynamic legal risk with its schedule and penalty verdict. Pure compute over the request; informational only, never an order authority
`FinanceKalmanFilter1d`	false	None	`compute:finance`	true	false	false	None
`FinanceKalmanBeta`	false	None	`compute:finance`	true	false	false	None
`FinanceKalmanVolatility`	false	None	`compute:finance`	true	false	false	None
`FinanceAdfTest`	false	None	`compute:finance`	true	false	false	None
`FinanceOuCalibrate`	false	None	`compute:finance`	true	false	false	None
`FinanceOuOptimalThresholds`	false	None	`compute:finance`	true	false	false	None
`FinanceMarkovTransitionMatrix`	false	None	`compute:finance`	true	false	false	None
`FinanceOrderBookImbalance`	false	None	`compute:finance`	true	false	false	None
`FinanceQueueImbalance`	false	None	`compute:finance`	true	false	false	None
`FinanceRealizedVolTick`	false	None	`compute:finance`	true	false	false	None
`FinanceSpreadReversion`	false	None	`compute:finance`	true	false	false	None
`FinanceInformationRatio`	false	None	`compute:finance`	true	false	false	None
`FinanceEffectiveIndependentN`	false	None	`compute:finance`	true	false	false	None
`FinanceAlphaCombinationEngine`	false	None	`compute:finance`	true	false	false	None
`FinanceBrierScore`	false	None	`compute:finance`	true	false	false	None
`FinanceConvergenceGate`	false	None	`compute:finance`	true	false	false	None
`FinanceEmpiricalKelly`	false	None	`compute:finance`	true	false	false	None
`FinanceSabrImpliedVol`	false	None	`compute:finance`	true	false	false	None
`FinanceSabrSmile`	false	None	`compute:finance`	true	false	false	None
`FinanceSabrCalibrate`	false	None	`compute:finance`	true	false	false	None
`RunUdf`	false	None	`udf:exec`	false	false	false	Snapshot	executes a registered sandboxed function; treated as read/compute unless the UDF itself writes back (not modeled -- the wire protocol has no writeback flag here)
`DistributedCompute`	false	None	`distcompute:read`	true	false	false	Snapshot	read-only Pregel/GAS computation; materialization uses the distinct Create/Refresh methods
`MineAssociate`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineCluster`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineAnomaly`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineClassifyFit`	false	None	`mining:read`	true	false	false	Snapshot	the one Mine* family member that is unconditionally read-only (produces a model blob, never writes back)
`MineClassifyPredict`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineReduce`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`GraphLearnFit`	~true	GraphRedb	`graphlearn:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`GraphLearnPredict`	~true	GraphRedb	`graphlearn:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MiningPipelineTrain`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field (persists a versioned :Model artifact)
`MiningPipelineServe`	true	GraphRedb	`mining:write`	false	true	false	Atomic	always writes the :ServedModel pointer to deploy a version
`MiningPipelinePredict`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field (materializes :Prediction nodes)
`MiningPipelineEvaluate`	false	None	`mining:read`	true	false	false	Snapshot	read-only: scores a stored versioned model against a labeled set
`MiningPipelineCompare`	false	None	`mining:read`	true	false	false	Snapshot	read-only: diffs two model versions' held-out metrics
`MineSequence`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound; writeback=true enters the canonical durable mutation path
`MineForecast`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound; writeback=true enters the canonical durable mutation path
`MineText`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound; writeback=true for lda/nmf enters the canonical durable mutation path
`MineSubgraph`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound; writeback=true for gspan enters the canonical durable mutation path
`MineEntityResolve`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineCausalImpact`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineProcess`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineRootCause`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineRiskPropagation`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineOntologyGap`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineRetrievalQuality`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`MineCommunity`	~true	GraphRedb	`mining:write`	false	true	false	Atomic	mutates is a conservative upper bound: the REAL access::requires_write(m) returns the runtime `writeback` field
`Solve`	false	None	`compute:solve`	true	false	false	None	pure compute: a bounded 0-1 integer programme with an independently verifiable certificate. Reads no store, no clock and no float, so it participates in no transaction
`ClaimNext`	true	GraphRedb	`node:write`	false	true	false	Atomic
`ClaimWorkItem`	true	GraphRedb	`work:claim`	false	true	false	Atomic	engine-native tenant/fair WorkItem lease claim
`AcquireCapacity`	true	GraphRedb	`capacity:lease`	true	true	false	Atomic	atomic multi-dimensional capacity admission with epoch/fence ownership
`RenewCapacity`	true	GraphRedb	`capacity:lease`	true	true	false	Atomic	bounded all-or-nothing lease renewal
`ReleaseCapacity`	true	GraphRedb	`capacity:lease`	true	true	false	Atomic	bounded all-or-nothing lease release
`ReclaimExpiredCapacity`	true	GraphRedb	`capacity:lease`	true	true	false	Atomic	bounded expiry reclaim with native aggregate accounting
`ReconcileCapacity`	false	None	`capacity:read`	true	false	false	Snapshot	bounded native cells/leases reconciliation page
`CapacityStatus`	false	None	`capacity:read`	true	false	false	Snapshot	exact tenant-scoped native capacity status
`UpdateCapacityCell`	true	GraphRedb	`capacity:admin`	true	true	false	Atomic	controller epoch CAS for resource dimension/capacity policy
`ThrottleCapacityCell`	true	GraphRedb	`capacity:throttle`	false	true	false	Atomic	EH-406 error-budget AIMD step on one cell: narrows the throttle ceiling on an error burst, gives it back only on recovery evidence and never above the declared capacity; each window counts once; the policy and capacity stay capacity:admin (UpdateCapacityCell)
`KgDelegate`	true	GraphRedb	`work:delegate`	true	true	false	Atomic	authenticated Agent Library pinned delegation lowered to native WorkItem admission
`SubmitWorkItem`	true	GraphRedb	`work:submit`	true	true	false	Atomic	native tenant-scoped WorkItem command-log admission and outbox commit
`SubmitWorkItems`	true	GraphRedb	`work:submit`	true	true	false	Atomic	bounded all-or-nothing WorkItem admission batch
`MintWorkItemClaimCapability`	true	GraphRedb	`work:claim-capability`	true	false	false	Atomic	opaque native capability is retained in a private ledger and never projected
`VerifyWorkItemClaimCapability`	false	GraphRedb	`work:claim-capability`	true	false	false	Snapshot	linearizable live-lease check precedes private capability lookup
`RenewWorkItemLease`	true	GraphRedb	`work:write`	true	true	false	Atomic	lease epoch and fencing token are validated atomically
`CommitWorkItemResult`	true	GraphRedb	`work:write`	true	true	false	Atomic	terminal result references and outbox commit atomically
`CancelWorkItem`	true	GraphRedb	`work:write`	true	true	false	Atomic	pending cancellation never steals an active lease
`DeferWorkItem`	true	GraphRedb	`work:write`	true	true	false	Atomic	fenced lease release schedules retry without consuming an attempt
`CasWorkItemMetadata`	true	GraphRedb	`work:write`	true	true	false	Atomic	BUG-111: atomic single-field CAS on non-authority scheduling metadata (checkpoint_id/metadata/prio_bucket); status/lease/tenant are fenced but never written
`PublishCurrentPlan`	true	GraphRedb	`work:write`	true	true	false	Atomic	immutable owner and live fence bind revisioned current-plan publication
`GetCurrentPlan`	false	None	`work:read`	true	false	false	Snapshot	authoritative owner-bound current plan and live lease snapshot
`GetRunWorkItem`	false	None	`work:read`	true	false	false	Snapshot	owner-bound immutable run admission and current caller-safe WorkItem snapshot
`GetWorkItem`	false	None	`work:read`	true	false	false	Snapshot	tenant-bound native WorkItem row view; lease owner/epoch/fencing token never projected
`ListWorkItems`	false	None	`work:read`	true	false	false	Snapshot	bounded tenant-bound WorkItem page; limit/scan/byte bounds each resume through an opaque tenant-bound cursor
`GetWorkItemOutcome`	false	None	`work:read`	true	false	false	Snapshot	tenant-bound terminal WorkItem plus the provenance its native commit bound; the OutcomeEvaluation receipt is digest-verified
`IssueControlLease`	true	GraphRedb	`lease:write`	true	true	false	Atomic	tenant-bound immutable grant record in the WorkItem MutationBatch; an existing id is a collision, never an overwrite
`TransitionControlLease`	true	GraphRedb	`lease:write`	true	true	false	Atomic	one-way active to revoked/expired, CAS on the read revision
`ListControlLeases`	false	None	`lease:read`	true	false	false	Snapshot	bounded tenant-bound control-lease page filtered by kind/status/grant pairs
`GetControlLease`	false	None	`lease:read`	true	false	false	Snapshot	tenant-bound native control-lease view
`GapUpsert`	true	GraphRedb	`gap:write`	true	true	false	Atomic	one tenant-bound canonical Gap and its native WorkItem commit together or not at all; only unseen evidence changes or reopens it
`GapTransition`	true	GraphRedb	`gap:write`	true	true	false	Atomic	legal-edge Gap lifecycle move, CAS on the read revision
`GapSettle`	true	GraphRedb	`gap:write`	true	true	false	Atomic	engine-read terminal WorkItem outcome recorded as Gap evidence in the same transaction
`WorkOfferPut`	true	GraphRedb	`work:offer-write`	true	true	false	Atomic	versioned derived offer on a live Gap's WorkItem citing only held evidence; engine-computed fixed-point utility rate
`GapGet`	false	None	`gap:read`	true	false	false	Snapshot	tenant-bound canonical Gap view
`GapList`	false	None	`gap:read`	true	false	false	Snapshot	bounded tenant-bound Gap page in row-key order; a listing, never a ranking
`RetireSealedRecord`	true	GraphRedb	`record:retire`	true	true	false	Atomic	digest-checked replacement of a sealed record by its audited tombstone in the WorkItem MutationBatch; generic writes may not change or remove a sealed row
`ReserveWorkItemResources`	true	GraphRedb	`resource:reserve`	true	true	false	Atomic	controller-only atomic host admission and WorkItem fence validation
`ReleaseWorkItemResources`	true	GraphRedb	`resource:reserve`	true	true	false	Atomic	controller-only lifecycle release with retained tombstone
`ReclaimWorkItemResources`	true	GraphRedb	`resource:reserve`	true	true	false	Atomic	controller-only expiry/supersession reclaim with retained tombstone
`QueryWorkItemReservation`	false	None	`resource:read`	true	false	false	Snapshot	linearizable exact native authority read
`ResourceReservationStatus`	false	None	`resource:read`	true	false	false	Snapshot	bounded linearizable reconciliation read
`UpdateResourceHost`	true	GraphRedb	`resource:host`	true	true	false	Atomic	controller-only monotonic host telemetry update
`ReserveDevelopmentLane`	true	GraphRedb	`lane:reserve`	true	true	false	Atomic	controller-only atomic branch/worktree uniqueness and multi-scope quota hold; now_ms is authority-normalized
`RenewDevelopmentLane`	true	GraphRedb	`lane:reserve`	true	true	false	Atomic	in-place O(1) hold renewal bound to the current WorkItem lease; now_ms is authority-normalized
`ObserveDevelopmentLane`	true	GraphRedb	`lane:reserve`	true	true	false	Atomic	monotonic retained-footprint observation replaces the prior native charge; now_ms is authority-normalized
`FinishDevelopmentLane`	true	GraphRedb	`lane:reserve`	true	true	false	Atomic	terminal lifecycle releases active count but retains cleanup charges and identity; now_ms is authority-normalized
`CleanupDevelopmentLane`	true	GraphRedb	`lane:cleanup`	true	true	false	Atomic	distinct cleanup WorkItem fence releases retained disk and exclusivity; now_ms is authority-normalized
`QueryDevelopmentLane`	false	None	`lane:read`	true	false	false	Snapshot	linearizable exact lane hold/tombstone read
`DevelopmentLaneStatus`	false	None	`lane:read`	true	false	false	Snapshot	bounded tenant-scoped status with maintained counters
`UpdateDevelopmentLaneQuota`	true	GraphRedb	`lane:quota`	true	true	false	Atomic	controller/admin-only monotonic server-owned quota policy with numeric expected_policy_revision CAS; now_ms is authority-normalized
`ResourceStatsPage`	false	None	`service:control`	true	false	false	None	bounded ACL-filtered keyset page; summary suppresses detail arrays
`AnalyticsJob`	~true	JobsRedb	`jobs:write`	false	false	false	Atomic	runtime-conditional: Status is a read; Submit/Cancel/Resume commit through the native jobs.redb MutationBatch gateway
`DecisionFit`	~true	ControlRedb	`admin:decision-fit`	true	false	false	Atomic	RF-ADR-010 DL-6, runtime-conditional: status is an authenticated tenant-bound read; submit runs one bounded deterministic fit to its terminal state and commits the job row and the draft head body in one agent_library.redb control-owner transaction. Local-only authority, refused in clustered mode
`DecisionEval`	~true	ControlRedb	`admin:decision-eval`	true	false	false	Atomic	RF-ADR-010 DL-6, runtime-conditional: status is an authenticated tenant-bound read; submit evaluates a draft or published head on admitted labels and commits the job row and its receipt in one agent_library.redb control-owner transaction; a DecisionHead publish requires a passed receipt. Local-only authority, refused in clustered mode
`DecisionLog`	~true	ControlRedb	`agent:decision-write`	true	false	false	Atomic	RF-ADR-010 DL-5/DL-5b, runtime-conditional: commit re-derives an acted-on statistical record from its stored inputs, reveals its exploration seed and stores it; evaluate joins one independent outcome evaluation; get/aggregate are authenticated reads filtered by record visibility (graph-sourced records are visible to their committing principal only). All in the agent_library.redb control owner; local-only authority, refused in clustered mode
`Statechart`	~true	StatechartRedb	`statechart:write`	false	false	false	Atomic	runtime-conditional: GetState/List are reads; Define/Instantiate/SendEvent commit to the native statecharts.redb store (CONCEPT:INT-P2-2)
`AddNode`	true	GraphRedb	`node:write`	false	true	true	Atomic
`CreateNodeIfAbsent`	true	GraphRedb	`node:write`	false	true	true	Atomic	atomic create returns true only to the inserting writer, so its result is not cross-request cacheable
`RemoveNode`	true	GraphRedb	`node:write`	true	true	true	Atomic
`HasNode`	false	None	`node:read`	true	false	false	Snapshot
`GetNodes`	false	None	`node:read`	true	false	false	Snapshot
`GetNodesByLabel`	false	None	`node:read`	true	false	false	Snapshot
`GetNodeProperties`	false	None	`node:read`	true	false	false	Snapshot
`CompareAndSetNodeFields`	true	GraphRedb	`node:write`	true	true	true	Atomic
`CreateSummaryNode`	true	GraphRedb	`memory:write`	false	true	false	Atomic
`Consolidate`	true	GraphRedb	`memory:write`	false	true	false	Atomic
`Reinforce`	true	GraphRedb	`memory:write`	false	true	false	Atomic
`DecayNode`	true	GraphRedb	`memory:write`	false	true	false	Atomic
`DecayMemories`	true	GraphRedb	`memory:write`	false	true	false	Atomic
`EvictBelow`	true	GraphRedb	`memory:write`	false	true	false	Atomic
`Maintain`	true	GraphRedb	`memory:write`	false	true	false	Atomic
`SummaryChildren`	false	None	`memory:read`	true	false	false	Snapshot
`SummariesAtLevel`	false	None	`memory:read`	true	false	false	Snapshot
`AddSceneObject`	true	GraphRedb	`scene:write`	false	true	false	Atomic
`SetPose`	true	GraphRedb	`scene:write`	true	true	false	Atomic
`Reparent`	true	GraphRedb	`scene:write`	true	true	false	Atomic
`WorldTransform`	false	None	`scene:read`	true	false	false	Snapshot
`SceneChildren`	false	None	`scene:read`	true	false	false	Snapshot
`PolicyEvolution`	~true	GraphRedb	`policy:capture-write`	true	true	true	Atomic	EH-346/EH-347 capture-first policy evolution, runtime-conditional: get is a snapshot read (policy:read); put_capability / commit_capture / register_model_policy_version / commit_training_run / commit_policy_evaluation each self-translate into ONE CreateNodeIfAbsent of an immutable content-addressed record in the request graph. The row names the capture leg; PolicyEvolutionOp::authz_action is the authority for each operation (the other writes are admin: gated)
`PolicyEvolutionStore`	true	GraphRedb	`admin:policy-evolution-store`	true	true	false	Atomic	EH-346 engine-internal: the durable WorkItem-kernel write that stores one record PolicyEvolution already admitted (content-addressed, create-only, tenant bound to the verified carrier); refused from the wire. Generic graph writes to policy-evolution rows are refused by the row guard, so this is their only writer
`StartTrajectory`	true	GraphRedb	`memory:write`	false	true	false	Atomic
`AppendStep`	true	GraphRedb	`memory:write`	false	true	false	Atomic
`DiscountedReturn`	false	None	`memory:read`	true	false	false	Snapshot
`BestTrajectory`	false	None	`memory:read`	true	false	false	Snapshot
`GetNodePropertiesBatch`	false	None	`node:read`	true	false	false	Snapshot
`HasNodesBatch`	false	None	`node:read`	true	false	false	Snapshot
`NodeCount`	false	None	`node:read`	true	false	false	Snapshot
`NodeIds`	false	None	`node:read`	true	false	false	Snapshot
`AddEdge`	true	GraphRedb	`edge:write`	false	true	true	Atomic
`RemoveEdge`	true	GraphRedb	`edge:write`	true	true	true	Atomic
`InvalidateEdge`	true	GraphRedb	`edge:write`	true	true	false	Atomic
`SupersedeEdge`	true	GraphRedb	`edge:write`	true	true	false	Atomic
`HasEdge`	false	None	`edge:read`	true	false	false	Snapshot
`GetEdges`	false	None	`edge:read`	true	false	false	Snapshot
`GetEdgesPage`	false	None	`edge:read`	true	false	false	Snapshot
`ClearGraph`	true	GraphRedb	`graph:admin`	true	true	true	Atomic
`GetEdgeProperties`	false	None	`edge:read`	true	false	false	Snapshot
`GetEdgePropertiesBatch`	false	None	`edge:read`	true	false	false	Snapshot
`EdgeCount`	false	None	`edge:read`	true	false	false	Snapshot
`InDegree`	false	None	`edge:read`	true	false	false	Snapshot
`OutDegree`	false	None	`edge:read`	true	false	false	Snapshot
`GetPredecessors`	false	None	`edge:read`	true	false	false	Snapshot
`GetSuccessors`	false	None	`edge:read`	true	false	false	Snapshot
`GetNeighbors`	false	None	`edge:read`	true	false	false	Snapshot
`GetNeighborsBatch`	false	None	`edge:read`	true	false	false	Snapshot
`UnionGetNodeProperties`	false	None	`node:read`	true	false	false	Snapshot
`UnionGetNodesByLabel`	false	None	`node:read`	true	false	false	Snapshot
`UnionGetNeighbors`	false	None	`node:read`	true	false	false	Snapshot
`PruneByLifecycle`	true	GraphRedb	`node:admin`	false	false	false	Atomic	state-backed MutationBatch commits the resulting authoritative image
`Metrics`	false	None	`service:control`	true	false	false	None
`EvictLRU`	true	GraphRedb	`node:admin`	false	false	false	Atomic	state-backed MutationBatch commits the resulting authoritative image
`DecaySweep`	true	GraphRedb	`node:admin`	false	false	false	Atomic	state-backed MutationBatch commits the resulting authoritative image
`TouchNodes`	true	GraphRedb	`node:admin`	false	false	false	Atomic	state-backed MutationBatch commits the resulting authoritative image
`GetSubgraph`	false	None	`node:read`	true	false	false	Snapshot
`Fork`	false	None	`graph:read`	true	false	false	Snapshot	returns the forked snapshot to the caller; never registers/persists it server-side
`DiffAgainst`	false	None	`graph:read`	true	false	false	Snapshot
`CompactNodesByType`	true	GraphRedb	`node:admin`	false	true	true	Atomic	state-backed MutationBatch
`Reconcile`	true	GraphRedb	`graph:write`	false	true	true	Saga	state-backed MutationBatch commits the merged image
`ApplyMutation`	true	GraphRedb	`graph:write`	false	true	true	Atomic	state-backed MutationBatch
`AddTriples`	true	GraphRedb	`rdf:write`	false	true	false	Atomic
`RemoveTriples`	true	GraphRedb	`rdf:write`	true	true	false	Atomic
`DropNamedGraph`	true	GraphRedb	`rdf:write`	true	true	false	Atomic
`SourceIngest`	true	GraphRedb	`source:ingest`	true	true	true	Saga	RF-ADR-009 native ingestion authority: tenant-bound typed Connector Manifest mapping resolution and idempotent raw-CAS admission precede one atomic ChangeEnvelope commit for mapped graph material, provenance, cursor and receipt; unknown mapping, tenant or authority fails closed; exact MCP catalog generation and digest binding makes the generated consumer contract replay-safe
`SourceIngestStatus`	false	None	`source:ingest`	true	false	false	Snapshot	read-only authoritative source-partition checkpoint and receipt identity for restart/failover CAS recovery; callers must not substitute local checkpoint authority
`EnrichDocument`	true	GraphRedb	`source:ingest`	true	true	true	Saga	EG-UNIFIED-DATA-PLANE-R651.7: chunks one RLS-visible held Document and embeds the chunks. Chunk nodes, chunkOf edges, vectors and one enrichment record commit as one ChangeEnvelope. An enriched digest replays; a new digest supersedes the earlier chunks
`TelemetryDerive`	true	GraphRedb	`telemetry:derive`	true	true	true	Atomic	EH-408/EH-409: reads the caller's tenant-scoped stored logs/metrics/spans over one window, binds them to the request graph's declared individuals (RLS-filtered reads), derives BehaviourObservation/HealthAnomaly/Incident/ConformanceViolation facts, and self-translates into ONE BatchUpdate (upsert, deterministic fact ids) against the request graph through dispatch_graph_op; a re-derivation is an idempotent upsert
`ServedModality`	~true	GraphRedb	`modality:write`	false	true	true	Atomic	runtime-conditional: authority/query/events/capabilities are verified read snapshots; ingest/delete/cold/restore commit an encrypted state-backed MutationBatch
`ParseFile`	false	None	`compute:parse`	true	false	false	None
`ParseFiles`	false	None	`compute:parse`	true	false	false	None
`IndexRepository`	~true	GraphRedb	`source:ingest`	true	true	true	Saga	EH-280 runtime-conditional: without `scope` a stateless parse+resolve of the submitted files; with `scope` each unique blob is parsed once and the :Blob/:FileVersion/:Branch projection (tombstones remove membership) commits as one content-addressed ChangeEnvelope through ApplyChangeEnvelope, replaying an unchanged batch
`ObserveScreen`	false	None	`compute:vision`	false	false	false	None
`AddEmbedding`	true	GraphRedb	`node:write`	false	true	false	Atomic
`SemanticIndex`	true	SemanticIndexRedb	`semantic:binding-write`	true	false	false	Atomic	RF-019's S1-S6 tiered ingestion queue. Runtime-conditional like the four agent layers, but over SIX authz actions rather than two: binding lifecycle is semantic:binding-write, S1 admission semantic:source-admit, subscribe/claim/release semantic:stage-claim, stage completion semantic:stage-complete, and the reads semantic:binding-read / semantic:stage-read. The row names the binding-write leg; SemanticIndexOp::authz_action is the authority for each operation
`SemanticSearch`	false	None	`compute:semantic`	true	false	false	Snapshot
`Discover`	false	None	`compute:semantic`	true	false	false	Snapshot
`Quantum`	false	None	`quantum:run`	true	false	false	None	self-routes before dispatch_graph_op like AnalyticsJob/Statechart, never reaches the graph tamper-evident audit chain; R5 override audit instead rides the response's PlannerDecision.audit trail into the agent-utilities :ToolCall/:QuantumJob provenance
`Asr`	false	None	`asr:transcribe`	false	false	false	None	self-routes before dispatch_graph_op like Quantum/Viz; direct non-durable whisper-rs transcription, commits no asr.result.v1 (that governed commit is future worker/AU-orchestration work, W03/W06)
`Viz`	false	None	`viz:render`	true	false	false	None	pure compute: resolves a fresh per-request ColumnStore and returns rendered bytes, no durable write (D-VZ-1 lanes V4/V6)
`DeclareExchange`	true	Outbox	`broker:admin`	true	true	false	Atomic
`DeleteExchange`	true	Outbox	`broker:admin`	true	true	false	Atomic
`BindQueue`	true	Outbox	`broker:admin`	true	true	false	Atomic
`UnbindQueue`	true	Outbox	`broker:admin`	true	true	false	Atomic
`Publish`	true	Outbox	`broker:publish`	false	true	false	Atomic	PublishIdempotent is the one exception (producer-id/seq dedup makes replays idempotent by construction)
`DeclareQueue`	true	Outbox	`broker:admin`	true	true	false	Atomic
`PublishEx`	true	Outbox	`broker:publish`	false	true	false	Atomic	PublishIdempotent is the one exception (producer-id/seq dedup makes replays idempotent by construction)
`BrokerConsume`	true	Outbox	`broker:consume`	false	true	false	Atomic
`BrokerAck`	true	Outbox	`broker:ack`	true	true	false	Atomic
`BrokerReject`	true	Outbox	`broker:ack`	true	true	false	Atomic
`SweepExpired`	true	Outbox	`broker:admin`	true	true	false	Atomic
`StreamDeclare`	true	Outbox	`stream:admin`	true	true	false	Atomic
`StreamPublish`	true	Outbox	`stream:write`	false	true	false	Atomic
`StreamRead`	false	None	`stream:read`	true	false	false	Snapshot
`StreamTrim`	true	Outbox	`stream:admin`	true	true	false	Atomic
`StreamCommitOffset`	true	Outbox	`stream:admin`	true	true	false	Atomic
`StreamCommittedOffset`	false	None	`stream:read`	true	false	false	Snapshot
`PublishConfirmed`	true	Outbox	`broker:publish`	false	true	false	Atomic	PublishIdempotent is the one exception (producer-id/seq dedup makes replays idempotent by construction)
`PublishIdempotent`	true	Outbox	`broker:publish`	true	true	false	Atomic	PublishIdempotent is the one exception (producer-id/seq dedup makes replays idempotent by construction)
`BrokerAckTag`	true	Outbox	`broker:ack`	false	true	false	Atomic	current-generation result must not be replay-cached across requests
`BrokerNackTag`	true	Outbox	`broker:ack`	false	true	false	Atomic	current-generation result must not be replay-cached across requests
`BrokerRenewTag`	true	Outbox	`broker:ack`	false	true	false	Atomic	current-generation result must not be replay-cached across requests
`CreateChannel`	true	ControlRedb	`channel:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch; message/member payloads stay out of the ledger
`JoinChannel`	true	ControlRedb	`channel:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch
`LeaveChannel`	true	ControlRedb	`channel:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch
`CloseChannel`	true	ControlRedb	`channel:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch
`SendMessage`	true	ControlRedb	`channel:write`	true	false	false	Saga	request-scoped opaque session-control receipt prevents acknowledgement-lost duplicate sends
`GetChannelMessages`	false	None	`channel:read`	true	false	false	Snapshot
`ListChannels`	false	None	`channel:read`	true	false	false	Snapshot
`GetChannelMembers`	false	None	`channel:read`	true	false	false	Snapshot
`CdcRead`	false	None	`cdc:read`	true	false	false	Snapshot
`RegisterContinuousQuery`	true	ControlRedb	`cdc:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch
`ReadContinuousQuery`	false	None	`cdc:read`	true	false	false	Snapshot
`DropContinuousQuery`	true	ControlRedb	`cdc:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch
`Watch`	false	None	`cdc:read`	false	false	false	None	opens a push subscription; not a snapshot read nor a mutation
`RegisterTrigger`	true	ControlRedb	`cdc:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch
`DropTrigger`	true	ControlRedb	`cdc:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch
`ListTriggers`	false	None	`cdc:read`	true	false	false	Snapshot
`FreshnessFeed`	false	None	`cdc:read`	true	false	false	Snapshot
`FiredTriggers`	false	None	`cdc:read`	true	false	false	Snapshot
`CepSubscribe`	true	ControlRedb	`cep:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch
`CepPoll`	false	None	`cep:read`	true	false	false	Snapshot
`CepUnsubscribe`	true	ControlRedb	`cep:admin`	true	false	false	Saga	opaque prepared/committed session-control MutationBatch
`GetContextView`	false	None	`node:read`	true	false	false	Snapshot
`GetChangeEnvelope`	false	None	`ingest:read`	true	false	false	Snapshot	Verified tenant-scoped reconciliation read
`GetContentVersion`	false	None	`ingest:read`	true	false	false	Snapshot	Typed content versions are never compared lexically
`GetChangeCursor`	false	None	`ingest:read`	true	false	false	Snapshot	Typed source cursors are tenant/graph/partition scoped
`Sql`	~true	GraphRedb	`query:sql`	false	true	false	Atomic	runtime-conditional; graph DML uses staged graph state while table/catalog writes atomically commit SQL rows plus MutationBatch status/fence/idempotency/outbox
`CypherQuery`	~true	GraphRedb	`query:cypher`	false	true	false	Atomic	runtime-conditional; writes execute against a staged graph and publish only after durable MutationBatch commit
`GraphQl`	~true	GraphRedb	`query:graphql`	false	true	false	Atomic	runtime-conditional; ordinary writes stage through MutationBatch and cross-modal commit atomically includes universal status/fence/idempotency/outbox
`KnowledgeStream`	false	None	`query:stream`	true	false	false	Snapshot	one RequestContext/RLS/placement-bound stream with the sole native Arrow IPC projection for all seven query families
`UnifiedQuery`	false	None	`query:unified`	true	false	false	Snapshot
`QueryForeignColumns`	false	None	`federation:read`	true	false	false	Snapshot	Verified owner-scoped mapped-column read with bounded source fetch and local predicate residual
`Uql`	false	None	`query:unified`	true	false	false	Snapshot	UQL statement: typed params, EXPLAIN/PROFILE, LET programs, RETURN channels; read-only
`ExplainPlan`	false	None	`explain:read`	true	false	false	Snapshot
`ExplainProvenance`	false	None	`explain:read`	true	false	false	Snapshot
`ExplainProvenanceByIds`	false	None	`explain:read`	true	false	false	Snapshot	CONCEPT:EG-KB-CURRENCY — ID-seeded sibling of ExplainProvenance, same policy profile
`ExplainPolicy`	false	None	`explain:read`	true	false	false	Snapshot
`ExplainBelief`	false	None	`explain:read`	true	false	false	Snapshot
`EpistemicStatus`	false	None	`explain:read`	true	false	false	Snapshot	L53 (EPI-P3-5) acceptance capstone; handler additionally gated `epistemic-tms`
`WhatChanged`	false	None	`explain:read`	true	false	false	Snapshot	L53 (EPI-P3-5) bitemporal diff; handler additionally gated `epistemic-tms`
`RecomputeMaterialization`	true	ReasoningProjection	`reasoning:write`	false	false	false	Atomic	fenced recompute/writeback resolves provenance from the authoritative graph and fsyncs the per-graph projection
`MaterializationStatus`	false	None	`explain:read`	true	false	false	Snapshot	read-only status from the durable per-graph incremental reasoning authority
`StaleMaterializations`	false	None	`explain:read`	true	false	false	Snapshot	bulk opaque stale references from the durable per-graph incremental reasoning authority
`ResolveConflict`	false	None	`explain:read`	true	false	false	Snapshot	EPI-P3-7 (gap-fill) standalone Dung argumentation (grounded/preferred/stable) conflict resolution over a BeliefGraph snapshot; handler additionally gated `epistemic-tms`
`ExplainEvidence`	false	None	`explain:read`	true	false	false	Snapshot	CONCEPT:EG-X1 multimodal-citation resolver; handler additionally gated `evidence-graph`
`CausalEstimate`	false	None	`explain:read`	true	false	false	Snapshot	EPI-P3-3/P3-6 do-calculus intervention OR observational conditioning (selected by `mode`) over a request-carried SCM; handler additionally gated `epistemic-causal`
`CausalCounterfactual`	false	None	`explain:read`	true	false	false	Snapshot	EPI-P3-6 Pearl point-counterfactual over a request-carried SCM + a fully-observed unit; handler additionally gated `epistemic-causal`
`RankByProvenance`	false	None	`explain:read`	true	false	false	Snapshot	EPI-P3-3 provenance-aware retrieval ranking; handler additionally gated `epistemic-causal`
`NlQuery`	false	None	`query:nl`	false	false	false	Snapshot
`NlQueryExplain`	false	None	`query:nl`	false	false	false	Snapshot	EG-FEDERATED-QUERY-R058.2.2.1: NlQuery plus the executed UQL text. It shares the planner, budget, authority and refusals of NlQuery
`TxnUnifiedQuery`	false	None	`txn:read`	true	false	false	Saga
`TxnUql`	false	None	`txn:read`	true	false	false	Saga
`EdgeIndex`	~true	GraphRedb	`semantic:binding-write`	true	false	false	Atomic	EH-351/EH-352, runtime-conditional: status reads; create, refresh and drop write the verified tenant's SQL catalog (registration and generations) and the request graph's IndexManager. Drop is fenced: a build in flight never activates after it
`EdgeSearch`	false	None	`semantic:binding-read`	true	false	false	Snapshot	EH-351: edge-native vector or BM25 search of the request graph; the caller's row-level security, the edge type and the property filters are applied inside the index walk, and edges come back as edges (endpoints and parallel-edge ordinal)
`SelectWebPages`	false	None	`query:decide`	true	false	false	Snapshot	EG-DECISION-ENGINE-R802: deterministic web page selection over search candidates. It dedupes by canonical URL and digest against held Documents and enforces a budget. It commits nothing and runs no model
`Decide`	false	None	`query:decide`	true	false	false	Snapshot	RF-ADR-010 DL-4. Evaluate-only: scores the tenant-visible library candidates under a pinned feature schema, head and policy and answers a batch of sealed statistical records; it commits none of them. Graph-sourced candidates are refused until graph-sourced records land
`RunDatalogReasoning`	true	GraphRedb	`reasoning:write`	true	true	true	Atomic	state-backed MutationBatch commits inferred facts; operation-identity replay prevents duplicate materialization/audit/CDC
`GetRdf`	false	None	`rdf:read`	true	false	false	Snapshot
`Sparql`	false	None	`sparql:read`	true	false	false	Snapshot
`SparqlVirtual`	false	None	`sparql:read`	true	false	false	Snapshot
`OwlReason`	false	None	`owl:read`	true	false	false	Snapshot
`OwlReasonDistributed`	false	None	`owl:read`	true	false	false	Snapshot
`OwlExplain`	false	None	`owl:read`	true	false	false	Snapshot
`RunRules`	false	None	`reasoning:read`	true	false	false	Snapshot	READ-ONLY (EG-P0-2/L11 handler audit): handle_run_rules reasons over an off-lock analysis_snapshot and returns inferred triples, no writeback -- unlike its sibling RunDatalogReasoning which materialises in-place. Corrected from a prior mutates=true semantic guess; now agrees with access.rs (never a write there)
`ShaclValidate`	false	None	`validation:read`	true	false	false	Snapshot
`OntologyInspect`	false	None	`validation:read`	true	false	false	Snapshot	the vocabulary, SHACL targets and canonical digest of inline documents or the composed GraphSchema sources, so orchestration callers need no RDF parser; reads schema, never graph rows
`IcvConfigure`	true	GraphRedb	`security:admin`	true	true	true	Atomic	state-backed MutationBatch
`GraphSchema`	true	GraphRedb	`security:admin`	true	true	true	Atomic	X9. Gateway-routed exactly like IcvConfigure: every op attaches, replaces or detaches one keyed schema source through the graph commit kernel, so it is audited, emits CDC, and is recorded in the native Raft GraphState catalog
`GraphSchemaList`	false	None	`security:admin`	true	false	false	Snapshot	X9. Reads the request graph's schema-source set and its composed digest; a separate method rather than an op because a read op inside a gateway-routed method would need a runtime-conditional gateway plan
`GraphSchemaClasses`	false	None	`owl:read`	true	false	false	Snapshot	EH-389. One page of the classes and properties the request graph's composed schema declares, with the declaring source; the schema's own vocabulary, not graph rows and not the source documents, so an ordinary ontology read (owl:read) rather than GraphSchemaList's security:admin
`ShexValidate`	false	None	`validation:read`	true	false	false	Snapshot
`GetLedger`	false	None	`ledger:read`	true	false	false	Snapshot
`AuditVerify`	false	None	`security:audit`	true	false	false	Snapshot
`AuditAppend`	true	GraphRedb	`security:audit-write`	true	false	false	Atomic	tenant-bound operation audit: a reservation and its linked outcome with request-id/op idempotency and no raw params; requires a declared audit class and a durable writer (AUDIT_CLASS_REQUIRED, AUDIT_CLASS_UNKNOWN, AUDIT_WRITER_UNAVAILABLE); writes its own audit-chain entry directly (see src/redb_store/operation_audit.rs::operation_audit_append), not through the generic per-mutation audit_line() dispatch, like EdgeIndex above
`AuditReadEvent`	false	None	`security:audit`	true	false	false	Snapshot	read one privacy-safe operation event with a full-chain verification result
`AuditProveInclusion`	false	None	`security:audit`	true	false	false	Snapshot	provenance anchoring: Merkle inclusion proof for one node against a prior PROVENANCE_ANCHOR audit-chain entry
`RegisterIdentity`	true	ControlRedb	`security:admin`	true	true	false	Atomic	RBAC/identity snapshot and MutationBatch metadata share one rbac.redb WTX; each registration also appends a hash-chained entry to the identity store's own audit trail in that same WTX, and a principal owned by the identity store is refused
`RbacAdmin`	~true	ControlRedb	`security:admin`	true	true	false	Atomic	runtime-conditional: List is a read; role and grant updates share one rbac.redb WTX with MutationBatch metadata; each write also appends a hash-chained entry to the identity store's own audit trail in that WTX, and the identity store's idm: namespace is refused
`RbacElevation`	~true	ControlRedb	`rbac:elevation`	false	true	false	Atomic	EH-404 just-in-time elevation, runtime-conditional: list is a read (rbac:elevation-read); request/revoke need rbac:elevation, approve needs the EXACT rbac:approve-elevation scope from a direct (undelegated) principal sharing no identity with the requester; every transition is hash-chain audited in the elevation ledger that shares the rbac.redb policy WTX
`Identity`	~true	ControlRedb	`identity:admin`	false	true	false	Atomic	the engine-owned identity store (users, credentials, sessions, tokens, MFA, API keys, roles, groups, identity providers), runtime-conditional: reads are identity:read/identity:authenticate; writes need the op's EXACT identity:* scope (never implied by kg:admin or *) from the boundary-stamped actor; every secret is hashed, verified or sealed at the request boundary and cleared before replication; the store and its full RBAC projection share one rbac.redb WTX with a hash-chained identity audit trail
`GovernedChange`	~true	ControlRedb	`governance:propose`	false	true	false	Atomic	EH-560 governed changes, runtime-conditional: get/list are reads (governance:read); propose needs the kind's EXACT proposer scope, approve the kind's EXACT approver scope from a direct principal sharing no identity with the proposer, bound to the exact candidate digest; consumption is engine-internal and single-use; every transition is hash-chain audited in the ledger that shares the rbac.redb policy WTX; generic IssueControlLease refuses the governed. prefix
`GetIdentity`	false	None	`security:admin`	true	false	false	Snapshot	identity read-back closing the RegisterIdentity blind-upsert gap: None means unregistered/unknown, Some(identity) with empty roles means registered-and-confirmed-empty -- gated security:admin like RegisterIdentity/RbacAdmin so it grants no caller new privilege
`CheckAccess`	false	None	`security:check`	true	false	false	Snapshot	confused-deputy-safe executor re-check: would this principal's own request of read/write on the request graph be admitted now (the engine's isolation/RBAC decision). Answers only allowed yes/no for one principal on one graph the caller can itself read; never the identity or the policy
`ToMsgpack`	false	None	`graph:read`	true	false	false	Snapshot
`FromMsgpack`	true	GraphRedb	`graph:admin`	false	true	true	Atomic	state-backed MutationBatch commits the imported authoritative image
`ClearLedger`	true	GraphRedb	`ledger:admin`	true	true	true	Atomic	state-backed MutationBatch
`ApplyLedger`	true	GraphRedb	`ledger:write`	false	true	true	Atomic	state-backed MutationBatch
`Backup`	false	None	`admin:backup`	true	false	false	Snapshot	reads a consistent snapshot out to a bundle; does not mutate the live graph
`Restore`	true	ControlRedb	`admin:backup`	true	false	false	Saga	prepared/committed admin MutationBatch saga
`AgentLibrary`	~true	ControlRedb	`agent:library-write`	true	false	false	Atomic	runtime-conditional: Current/History/Status are authenticated tenant-bound read snapshots; Publish/Retire atomically commit native revisions, action provenance, replay receipts, and outbox through ControlRedb
`AgentGraph`	true	ControlRedb	`agent:graph-write`	true	false	false	Atomic	RF-ADR-008. Runtime-conditional exactly like AgentLibrary: Current/History/Status are authenticated tenant-bound read snapshots; Publish/Retire atomically commit native graph revisions, action provenance, replay receipts, and outbox through ControlRedb into the SAME agent_library.redb owner
`AgentComponent`	true	ControlRedb	`agent:component-write`	true	false	false	Atomic	RF-ADR-008 layer 1. Runtime-conditional like AgentLibrary/AgentGraph: Current/History/Status/Search are authenticated tenant-bound read snapshots; Publish/Retire atomically commit native component revisions, action provenance, replay receipts and outbox through ControlRedb into the SAME agent_library.redb owner
`AgentTemplate`	true	ControlRedb	`agent:template-write`	true	false	false	Atomic	RF-ADR-008 item C. Runtime-conditional like the three layers beside it: Current/History/Status/Instantiate are authenticated tenant-bound read snapshots (Instantiate binds parameters and returns a draft, committing nothing); Publish/Retire atomically commit native template revisions, action provenance, replay receipts and outbox through ControlRedb into the SAME agent_library.redb owner. Its own authz action because publishing a parameterized FAMILY of agents is a distinct privilege from publishing one
`AgentAssemble`	false	None	`agent:assemble-read`	true	false	false	Snapshot	RF-ADR-010 A1. Reads ONE tenant-bound agent_library.redb snapshot and proves an agent graph against it; commits nothing. The record it answers with is durable only if the caller then sends DecisionCommit
`CapabilityCoverage`	false	None	`agent:assemble-read`	true	false	false	Snapshot	EG-DECISION-ENGINE-R126.2.1. Reads ONE tenant-bound agent_library.redb snapshot and answers which visible components and A2A cards cover each capability of a task closure; ranks nothing, commits nothing
`GuardrailEntailment`	false	None	`agent:assemble-read`	true	false	false	Snapshot	EG-DECISION-ENGINE-R127.2.2. Reads ONE tenant-bound agent_library.redb snapshot of published rule heads and returns advisory ontology entailment paths and source generations; commits nothing and does not authorize execution
`DecisionCommit`	true	ControlRedb	`agent:decision-write`	true	false	false	Atomic	native MutationBatch in agent_library.redb: one DecisionRecord component revision, its receipt and outbox in one WTX after re-derivation and a catalog compare-and-set; local-only authority, refused in clustered mode
`ConnectorPack`	~true	ControlRedb	`agent:pack-control`	true	false	false	Atomic	RF-ADR-009 A2 plus RF-021 durable catalog reconciliation; runtime-conditional: status is an authenticated tenant-bound read snapshot exposing the exact MCP catalog generation/digest binding; import atomically commits resources/templates, component revisions, CAS body holders, provenance, receipt and outbox. Bind/unbind/retire/reproject/reconcile_bodies and a mass-withdrawal import need admin:connector-pack; local-only authority, refused in clustered mode
`WriteBack`	~true	ControlRedb	`connector:write-back`	true	true	false	Atomic	RF-ADR-009 D18, runtime-conditional: create/record operations append tenant-bound change-set and receipt rows through the existing Agent Library ControlRedb mutation kernel; get/receipts are authenticated snapshots. EG records authorization and source observations and never calls vendor APIs
`TsAppend`	true	SeriesRedb	`timeseries:write`	false	false	false	Atomic	graph ACL + placement policy precede the tenant/graph/series-scoped series.redb write
`TsRange`	false	None	`timeseries:read`	true	false	false	Snapshot
`TsAsofJoin`	false	None	`timeseries:read`	true	false	false	Snapshot
`TsWindow`	false	None	`timeseries:read`	true	false	false	Snapshot
`TsGapFill`	false	None	`timeseries:read`	true	false	false	Snapshot
`TsEvict`	true	SeriesRedb	`timeseries:write`	true	false	false	Atomic	content-idempotent unlike TsAppend: re-evicting an already-past cutoff is a safe no-op (see SeriesStore::evict_before)
`TsDeleteSeries`	true	SeriesRedb	`timeseries:write`	true	false	false	Atomic	content-idempotent unlike TsAppend: re-deleting an already-gone series is a safe no-op (see SeriesStore::delete_series)
`TsListSeries`	false	None	`timeseries:read`	true	false	false	Snapshot
`TsDefineSeries`	true	SeriesRedb	`timeseries:write`	true	false	false	Atomic	EH-524 materialised derived series: one native MutationBatch in series.redb commits the derived points and the definition/checkpoint in the series metadata; idempotent for the same definition (a re-definition only catches up)
`BlobBegin`	true	BlobRedb	`blob:write`	false	false	false	Saga	multi-call chunked-upload protocol (Begin ... ChunkPut* ... Commit); no single-call atomicity; durable via its own blob.redb (group-committed Immediate), self-routes before dispatch_graph_op
`BlobChunkPut`	true	BlobRedb	`blob:write`	false	false	false	Saga	durable via its own blob.redb (group-committed Immediate); self-routes before dispatch_graph_op
`BlobCommit`	true	BlobRedb	`blob:write`	false	false	false	Saga	multi-call chunked-upload protocol (Begin ... ChunkPut* ... Commit); no single-call atomicity; durable via its own blob.redb (group-committed Immediate), self-routes before dispatch_graph_op
`BlobFetchBegin`	false	None	`blob:read`	true	false	false	Snapshot
`BlobChunkGet`	false	None	`blob:read`	true	false	false	Snapshot
`BlobFetchEnd`	false	None	`blob:read`	true	false	false	Snapshot
`BlobRef`	true	BlobRedb	`blob:write`	true	false	false	Atomic	X6 (fix/eg-blob-cas-hardening-20260917): holder-scoped named reference (digest, owner scope), not a bare counter -- a retry or replay of the same reference is one holder row, never a second count (holders.rs's own module doc and handle_blob_ref_op's doc comment). Idempotent as of the 2.27.x blob CAS hardening; durable via blob.redb.
`BlobUnref`	true	BlobRedb	`blob:write`	true	false	false	Atomic	X6: releasing an already-released holder returns changed: false rather than erroring or underflowing (HolderOutcome's own doc comment). Idempotent as of the 2.27.x blob CAS hardening; durable via blob.redb.
`BlobGc`	true	BlobRedb	`blob:admin`	true	false	false	Atomic	durable via blob.redb
`KvGet`	false	None	`kv:read`	true	false	false	Snapshot	EG-DURABLE-KERNEL-R102. The key is scoped by verified tenant, principal (unless shared), request graph and namespace. It answers the value and its commit version
`KvPut`	true	KvRedb	`kv:write`	false	true	false	Atomic	Native MutationBatch in kv.redb, committed before the acknowledgment. Each write stamps a new namespace commit version. The batch ledger is the durable audit
`KvDelete`	true	KvRedb	`kv:write`	true	true	false	Atomic	Native MutationBatch in kv.redb. Re-deleting an absent key is a safe no-op that answers false
`KvScan`	false	None	`kv:read`	true	false	false	Snapshot	Bounded prefix scan over one snapshot. A page holds at most 1000 rows (default 100) and 4 MiB. An exclusive-start cursor resumes it
`KvCas`	true	KvRedb	`kv:write`	false	true	false	Atomic	Compare-and-swap on the row commit version inside one admitted kv.redb write; 0 means absent. A failed comparison is a terminal, replayable verdict
`SqlSourceBatch`	true	ControlRedb	`query:sql`	true	true	false	Atomic	native SQL-catalog MutationBatch: typed source rows, provider cursor, committed source epoch, terminal result, replay/idempotency and outbox in one WTX; self-routes before graph dispatch; local-only authority, refused in clustered mode
`ImportSqliteFile`	true	ControlRedb	`admin:sqlite-file`	true	true	false	Atomic	native SQL-catalog MutationBatch; logical transfer name is excluded from the durable receipt
`ExportSqliteFile`	false	None	`admin:sqlite-file`	true	true	false	Snapshot	operator-provisioned transfer root; logical filenames only
`BatchUpdate`	true	GraphRedb	`node:write`	false	true	false	Atomic
`MultiGraphBatchUpdate`	true	ControlRedb	`node:write`	true	false	false	Saga	durable parent coordinator with per-graph MutationBatch children
`ApplyChangeEnvelope`	true	GraphRedb	`ingest:write`	true	true	true	Atomic	Engine-native object/material/governance/version/cursor/outbox commit; verified context is mandatory
`ApplyChangeEnvelopeDraft`	true	GraphRedb	`ingest:write`	true	true	true	Atomic	Client path: the request boundary mints scope identity, version expectation and admission envelope from the verified context
`ApplyChangeEnvelopes`	true	GraphRedb	`ingest:write`	true	true	true	Atomic	Batch envelope coordinator: one coalesced graph transaction per shard-partition; same policy class as ApplyChangeEnvelope
`ApplyChangeEnvelopeDrafts`	true	GraphRedb	`ingest:write`	true	true	true	Atomic	Client batch path: drafts compiled into governed envelopes by the request boundary from the verified context
`ApplyMultisigMutation`	true	GraphRedb	`security:admin`	true	true	true	Saga	threshold validation translates into the graph MutationBatch gateway
`BeginTxn`	true	ControlRedb	`txn:control`	false	false	false	Saga	encrypted Raft-native transaction staging authority
`TxnAddNode`	true	ControlRedb	`txn:write`	false	false	false	Saga	encrypted Raft-native staging; Commit owns graph publication
`TxnRemoveNode`	true	ControlRedb	`txn:write`	true	false	false	Saga	encrypted Raft-native staging; Commit owns graph publication
`TxnAddEdge`	true	ControlRedb	`txn:write`	false	false	false	Saga	encrypted Raft-native staging; Commit owns graph publication
`TxnRemoveEdge`	true	ControlRedb	`txn:write`	true	false	false	Saga	encrypted Raft-native staging; Commit owns graph publication
`TxnCas`	true	ControlRedb	`txn:write`	true	false	false	Saga	encrypted Raft-native staging; Commit owns graph publication
`TxnAddEmbedding`	true	ControlRedb	`txn:write`	false	false	false	Saga	encrypted Raft-native cross-modal staging
`TxnBlobRef`	true	ControlRedb	`txn:write`	false	false	false	Saga	encrypted Raft-native cross-modal staging
`TxnAddMeasurement`	true	ControlRedb	`txn:write`	false	false	false	Saga	encrypted Raft-native cross-modal staging
`TxnAxiom`	true	ControlRedb	`txn:write`	false	false	false	Saga	encrypted Raft-native cross-modal staging
`TxnConstruct`	true	ControlRedb	`txn:write`	false	false	false	Saga	encrypted Raft-native cross-modal staging
`TxnPlanWriteback`	true	ControlRedb	`txn:write`	false	false	false	Saga	encrypted Raft-native cross-modal staging
`TxnMaterializeBelief`	true	ControlRedb	`txn:write`	false	false	false	Saga	encrypted Raft-native cross-modal staging
`Commit`	true	ControlRedb	`txn:control`	true	false	false	Saga	named parent receipt plus atomic graph/cross-modal child batches
`Rollback`	true	ControlRedb	`txn:control`	false	false	false	Saga	encrypted Raft-native transaction staging removal
`MutationOutbox`	~true	ControlRedb	`admin:outbox`	true	false	false	Saga	X10, runtime-conditional: status and dead_letters are reads; rewind resets one consumer's durable cursor through bounded eg-transaction transactions, so it is a saga rather than one atomic write. Targets a graph's outbox, or a native store of the verified tenant through a typed scope selector (tenant for Agent Library and jobs, binding for a semantic index, resource for the shared SQL catalog). Local-only authority, refused in clustered mode