A

Delivery structure

24 specs, 4276 requirements, 2 with no code mapped
Knuckles-Team/medullaSpec delivery
Specs (24)
  • EG-BRANCH-MERGE7
  • EG-CQ-CONN430
  • EG-CQ-XSRC62
  • EG-DATAPLAT-VOCAB49
  • EG-DECISION-ENGINE938
  • EG-SDLC42
  • EG-DURABLE-KERNEL414
  • EG-IDENTITY52
  • EG-ENGINE-PARITY80
  • EG-FEDERATED-QUERY443
  • EG-FINANCE-PRIMITIVES181
  • EG-INGEST-WORKER136
  • EG-MEDIA-VOCAB123
  • EG-OBJECT-STORAGE-BACKEND5
  • 10 more specs. Panel D shows all specs.
Records not done
  • Requirementsall slices in all specs4276
  • Requirements not donenot VERIFIED3646
  • Specs not donewhole specs only24

Each spec shows its requirement count. Panel J lists every record.

B

Delivery states

count of total

Requirements (4276)

SPECIFIED (specified)3548 of 4276 requirements
LANDED (landed)98 of 4276 requirements
VERIFIED (verified)630 of 4276 requirements

Specs (24)

SPECIFIED (specified)24 of 24 specs

Each bar shows one state against all records of the same kind.

Percentages count current rows. Done means VERIFIED.

C

State definitions

delivery_state
StateDefinition
SPECIFIEDThe requirement is written. No code for it is on the default branch.
LANDEDA commit that carries its ID in a Spec trailer is on the default branch.
VERIFIEDIt is LANDED and a test bound to its ID exists.

A spec state is the lowest state of its rows. Done means VERIFIED.

Invalid state: 0

D

Specifications

specs/*/status.json
Spec / titleReq.LandedDoneSpec stateCode references
EG-BRANCH-MERGEEG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict Resolution70/70SPECIFIEDplan.md documentation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
status.json implementation: file exists; coverage not verified
tasks.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-CQ-CONNEG-CQ-CONN — Connector competency questions4300/4300SPECIFIEDcrates/eg-core/src/graph/schema_sources.rs implementation: file exists; coverage not verified
spec.md documentation: file exists; coverage not verified
src/server/handlers/decide/stat_decide.rs:50 implementation: file exists; coverage not verified
src/server/handlers/rdf/sparql.rs:30 implementation: file exists; coverage not verified
tasks.md documentation: file exists; coverage not verified
design.md documentation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-CQ-XSRCEG-CQ-XSRC — Cross-source competency: supply chain to services620/620SPECIFIED`ARBORA-OPS-R018` documentation: external declaration; not verified
spec.md documentation: file exists; coverage not verified
EG-DATAPLAT-VOCABEG-DATAPLAT-VOCAB — Data-platform vocabulary490/490SPECIFIEDcrates/eg-plan/src/virtual_graph_mapping.rs implementation: file exists; coverage not verified
spec.md documentation: file exists; coverage not verified
plan.md documentation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
EG-DECISION-ENGINEEG-DECISION-ENGINE — Decision engine938179/938179SPECIFIEDAU-CONTEXT-R004 documentation: external declaration; not verified
Capacity.tokens, context_knapsack.py:98 implementation: external declaration; not verified
fit_to_budget:422 implementation: external declaration; not verified
knapsack_model:161 implementation: external declaration; not verified
solve/mod.rs:1 implementation: external declaration; not verified
stat_decide.rs:134 implementation: external declaration; not verified
../durable-graph-kernel/plan.md documentation: file exists; coverage not verified
contract/schemas/method.request.json implementation: file exists; coverage not verified
crates/eg-capabilities/src/scopes/tests.rs implementation: file exists; coverage not verified
crates/eg-compute/src/assemble/conclude.rs implementation: file exists; coverage not verified
crates/eg-compute/src/assemble/conclude.rs:93 implementation: file exists; coverage not verified
crates/eg-compute/src/assemble/conclude.rs:99 implementation: file exists; coverage not verified
crates/eg-compute/src/assemble/eliminate.rs:138 implementation: file exists; coverage not verified
crates/eg-compute/src/assemble/eliminate.rs:97 implementation: file exists; coverage not verified
crates/eg-compute/src/assemble/model.rs:96 implementation: file exists; coverage not verified
crates/eg-compute/src/assemble/topology.rs:54 implementation: file exists; coverage not verified
crates/eg-compute/src/solve/verify/mod.rs:23 implementation: file exists; coverage not verified
crates/eg-core/ontology/orchestration-v1.ttl:250 implementation: file exists; coverage not verified
crates/eg-core/src/rbac_persist.rs implementation: file exists; coverage not verified
crates/eg-durable/src/project.rs:68 implementation: file exists; coverage not verified
crates/eg-epistemic/src/query.rs:661 implementation: file exists; coverage not verified
crates/eg-epistemic/src/ranking.rs implementation: file exists; coverage not verified
crates/eg-epistemic/src/ranking.rs:116 implementation: file exists; coverage not verified
crates/eg-epistemic/src/tms.rs implementation: file exists; coverage not verified
crates/eg-modality/src/provenance.rs:22 implementation: file exists; coverage not verified
crates/eg-numeric/benches/decision_resident_scorer.rs implementation: file exists; coverage not verified
crates/eg-numeric/src/py/method_body.rs implementation: file exists; coverage not verified
crates/eg-numeric/src/risk/reputation.rs implementation: file exists; coverage not verified
crates/eg-plan/src/exec/reliability.rs implementation: file exists; coverage not verified
crates/eg-storage/src/owner/registry.rs implementation: file exists; coverage not verified
crates/eg-tsdb/src/derive/mod.rs:152 implementation: file exists; coverage not verified
crates/eg-types/src/decision/derivation.rs:310 implementation: file exists; coverage not verified
crates/eg-types/src/decision/guardrail.rs implementation: file exists; coverage not verified
crates/eg-types/src/decision/guardrail.rs:62 implementation: file exists; coverage not verified
crates/eg-types/src/decision/ingestion_ladder.rs:46 implementation: file exists; coverage not verified
crates/eg-types/src/decision/record/premise.rs:17 implementation: file exists; coverage not verified
crates/eg-types/src/decision/statistical.rs:58 implementation: file exists; coverage not verified
crates/eg-types/src/decision/statistical/harness_config.rs:81 implementation: file exists; coverage not verified
crates/eg-types/src/decision/statistical/tool_subset.rs:58 implementation: file exists; coverage not verified
crates/eg-types/src/decision/task_plan.rs implementation: file exists; coverage not verified
crates/eg-types/src/decision/topology.rs:110 implementation: file exists; coverage not verified
crates/eg-types/src/decision/topology.rs:75 implementation: file exists; coverage not verified
crates/eg-types/src/identity/model.rs implementation: file exists; coverage not verified
crates/eg-types/src/outcome_bundle.rs:56 implementation: file exists; coverage not verified
epistemic_graph/connector_pack.py implementation: file exists; coverage not verified
epistemic_graph/decision_client.py implementation: file exists; coverage not verified
scripts/build_method_codec_wasm.py implementation: file exists; coverage not verified
src/redb_store/work_item/commit.rs:211 implementation: file exists; coverage not verified
src/redb_store/work_item_capability.rs implementation: file exists; coverage not verified
src/server/dispatch/graph_pipeline/web_ingest.rs implementation: file exists; coverage not verified
src/server/dispatch/identity_store.rs implementation: file exists; coverage not verified
src/server/dispatch/policy_evolution/gate.rs implementation: file exists; coverage not verified
src/server/dispatch/router/decision_plane.rs:95 implementation: file exists; coverage not verified
src/server/handlers/admin/connector_pack/reproject.rs:72 implementation: file exists; coverage not verified
src/server/handlers/decide/candidates.rs:415 implementation: file exists; coverage not verified
src/server/handlers/decide/commit.rs implementation: file exists; coverage not verified
src/server/handlers/decide/stat_decide.rs:137 implementation: file exists; coverage not verified
src/server/handlers/decide/stat_decide.rs:48 implementation: file exists; coverage not verified
src/server/handlers/decide/stat_tool_subset.rs:33 implementation: file exists; coverage not verified
src/server/handlers/decide/stat_walk_forward.rs implementation: file exists; coverage not verified
src/server/handlers/decide/statistical.rs:11 implementation: file exists; coverage not verified
src/server/handlers/graph_ops/gateway_graph_routes.rs implementation: file exists; coverage not verified
src/server/handlers/jobs/submit.rs implementation: file exists; coverage not verified
src/server/handlers/jobs/submit.rs:419 implementation: file exists; coverage not verified
src/server/handlers/txn/consensus.rs implementation: file exists; coverage not verified
src/server/mutation_batch/commit/program.rs implementation: file exists; coverage not verified
src/server/mutation_batch/commit/program.rs:64 implementation: file exists; coverage not verified
src/server/mutation_batch/terminal_outcome.rs:22 implementation: file exists; coverage not verified
src/server/persistence/agent_library.rs implementation: file exists; coverage not verified
src/server/persistence/decision_record.rs implementation: file exists; coverage not verified
tests/test_decision_static_contracts.py test: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
EG-SDLCEG-SDLC — Graph-driven development lifecycle420/420SPECIFIED../../crates/eg-compute/src/parser/tree_sitter.rs implementation: file exists; coverage not verified
../../src/server/dispatch/router/source_ingest.rs implementation: file exists; coverage not verified
crates/eg-compute/src/parser/tree_sitter.rs:249 implementation: file exists; coverage not verified
crates/eg-core/ontology/sdd-v1.ttl implementation: file exists; coverage not verified
spec.md documentation: file exists; coverage not verified
src/server/dispatch/router/source_ingest.rs:24 implementation: file exists; coverage not verified
plan.md documentation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-DURABLE-KERNELEG-DURABLE-KERNEL — Durable graph kernel414120/414111SPECIFIED.github/workflows/ci.yml implementation: file exists; coverage not verified
ReadThrough and ReadThroughFactory implementation: file exists; coverage not verified
budget.rs:264 implementation: file exists; coverage not verified
core_node_mutation.rs:60 implementation: file exists; coverage not verified
core_readthrough.rs:11 implementation: file exists; coverage not verified
crates/eg-capabilities/src/domains/graph.rs implementation: file exists; coverage not verified
crates/eg-core/src/rbac_persist/durable_write.rs:105 implementation: file exists; coverage not verified
crates/eg-jobs/src/store.rs implementation: file exists; coverage not verified
crates/eg-jobs/src/store.rs:2537 implementation: file exists; coverage not verified
crates/eg-plan/src/mirror_target.rs implementation: file exists; coverage not verified
crates/eg-tsdb/src/store.rs implementation: file exists; coverage not verified
crates/eg-types/src/mirror_sink.rs implementation: file exists; coverage not verified
crates/eg-types/src/pre_merge_test_module.rs implementation: file exists; coverage not verified
crates/eg-types/src/work_item_command_log.rs implementation: file exists; coverage not verified
engine reference documentation: file exists; coverage not verified
epistemic_graph/kvcache/connector.py implementation: file exists; coverage not verified
gateway_graph.rs:111 implementation: file exists; coverage not verified
graph.rs implementation: file exists; coverage not verified
main.rs:1547 implementation: file exists; coverage not verified
nodes.rs:85 implementation: file exists; coverage not verified
persist.rs:78 implementation: file exists; coverage not verified
read_through.rs implementation: file exists; coverage not verified
redb_backend.rs implementation: file exists; coverage not verified
registry.rs:553 implementation: file exists; coverage not verified
scripts/validate-raft-cluster.sh implementation: file exists; coverage not verified
src/main.rs implementation: file exists; coverage not verified
src/raft/flake_budget.rs implementation: file exists; coverage not verified
src/raft/harness/trace_capture.rs implementation: file exists; coverage not verified
src/raft/tests.rs implementation: file exists; coverage not verified
src/server/blob/store/holders.rs implementation: file exists; coverage not verified
src/server/dispatch/change_envelope/multi_graph.rs:19 implementation: file exists; coverage not verified
src/server/dispatch/router/data_plane.rs:770 implementation: file exists; coverage not verified
src/server/handlers/graph_ops/memory.rs implementation: file exists; coverage not verified
src/server/mutation_batch.rs implementation: file exists; coverage not verified
src/server_startup.rs:155 implementation: file exists; coverage not verified
store_read.rs:336 implementation: file exists; coverage not verified
store_read.rs:356 implementation: file exists; coverage not verified
trait_graph.rs:94 implementation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
EG-IDENTITYEG-IDENTITY — Engine identity, mode and scope authority528/528SPECIFIEDcrates/eg-core/src/isolation.rs:157 implementation: file exists; coverage not verified
crates/eg-types/src/identity.rs:1 implementation: file exists; coverage not verified
crates/eg-types/src/identity/model.rs:41 implementation: file exists; coverage not verified
crates/eg-types/src/rbac_elevation/ledger.rs:268 implementation: file exists; coverage not verified
src/main.rs implementation: file exists; coverage not verified
src/server/access.rs:702 implementation: file exists; coverage not verified
src/server/auth.rs:901 implementation: file exists; coverage not verified
src/server/dispatch/router/identity_access.rs:47 implementation: file exists; coverage not verified
src/server/graph_schema/compose.rs implementation: file exists; coverage not verified
src/server/handlers/graph_ops/gateway.rs:72 implementation: file exists; coverage not verified
src/server/handlers/graph_ops/gateway_graph.rs:151 implementation: file exists; coverage not verified
src/server/handlers/graph_ops/nodes.rs:85 implementation: file exists; coverage not verified
src/server/handlers/rdf/validation.rs:21 implementation: file exists; coverage not verified
src/server/mutation_batch/compile.rs:126 implementation: file exists; coverage not verified
tasks.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
tests/test_native_no_auth_served.py test: file exists; coverage not verified
architecture.md documentation: file exists; coverage not verified
crates/eg-capabilities/src/domains/security.rs implementation: file exists; coverage not verified
crates/eg-core/src/isolation/identity_admin.rs implementation: file exists; coverage not verified
crates/eg-core/src/rbac_persist.rs implementation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
src/audit.rs implementation: file exists; coverage not verified
src/server/auth.rs implementation: file exists; coverage not verified
src/server/dispatch/router/identity_access.rs implementation: file exists; coverage not verified
src/server/oidc.rs implementation: file exists; coverage not verified
EG-ENGINE-PARITYEG-ENGINE-PARITY — Relational engine parity inside one library800/800SPECIFIED../../src/server/pgwire/auth.rs implementation: file exists; coverage not verified
../../src/server/pgwire/mod.rs implementation: file exists; coverage not verified
../../src/server/sql_wire_auth.rs implementation: file exists; coverage not verified
spec.md documentation: file exists; coverage not verified
.config/spec-aliases.toml implementation: file exists; coverage not verified
plan.md documentation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
status.json implementation: file exists; coverage not verified
tasks.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-FEDERATED-QUERYEG-FEDERATED-QUERY — Federated query, search, and reasoning44373/44344SPECIFIEDColumn rendering implementation: external declaration; not verified
Control-lease contract implementation: external declaration; not verified
Dispatch attachment implementation: external declaration; not verified
Existing result fetch implementation: external declaration; not verified
Foreign-query handler implementation: external declaration; not verified
SDK-SOURCE-INGEST-R004.1–.6 documentation: external declaration; not verified
SQL validation implementation: external declaration; not verified
Compact tests test: file exists; coverage not verified
EG-TYPED-PACKS-R043 and R048 documentation: file exists; coverage not verified
Method::ShexValidate implementation: file exists; coverage not verified
Schema::from_shexj implementation: file exists; coverage not verified
ShexReport::from_results implementation: file exists; coverage not verified
ShexValidationReport implementation: file exists; coverage not verified
architecture documentation: file exists; coverage not verified
capability row implementation: file exists; coverage not verified
compact.rs implementation: file exists; coverage not verified
core tests test: file exists; coverage not verified
crates/eg-compute/src/assemble/conclude.rs:69 implementation: file exists; coverage not verified
crates/eg-compute/src/finance/market/confidence.rs:113 implementation: file exists; coverage not verified
crates/eg-compute/src/mining/causal_impact.rs implementation: file exists; coverage not verified
crates/eg-compute/src/mining/cluster.rs implementation: file exists; coverage not verified
crates/eg-core/src/isolation.rs:157 implementation: file exists; coverage not verified
crates/eg-core/src/projection_catalog.rs:75 implementation: file exists; coverage not verified
crates/eg-graphql/src/crossmodal.rs:429 implementation: file exists; coverage not verified
crates/eg-lake/src/catalog.rs:27 implementation: file exists; coverage not verified
crates/eg-lake/src/iceberg_avro.rs:371 implementation: file exists; coverage not verified
crates/eg-lake/src/lib.rs:299 implementation: file exists; coverage not verified
crates/eg-modality/src/rowset.rs implementation: file exists; coverage not verified
crates/eg-plan/src/algebra.rs:21 implementation: file exists; coverage not verified
crates/eg-plan/src/exec.rs implementation: file exists; coverage not verified
crates/eg-plan/src/exec.rs:1436 implementation: file exists; coverage not verified
crates/eg-plan/src/exec.rs:278 implementation: file exists; coverage not verified
crates/eg-plan/src/exec.rs:536 implementation: file exists; coverage not verified
crates/eg-plan/src/exec.rs:84 implementation: file exists; coverage not verified
crates/eg-plan/src/exec.rs:848 implementation: file exists; coverage not verified
crates/eg-plan/src/exec/vector_rank.rs:65 implementation: file exists; coverage not verified
crates/eg-plan/src/exec/vector_rank.rs:97 implementation: file exists; coverage not verified
crates/eg-plan/src/federation.rs implementation: file exists; coverage not verified
crates/eg-plan/src/federation.rs:933 implementation: file exists; coverage not verified
crates/eg-plan/src/federation_ssrf.rs implementation: file exists; coverage not verified
crates/eg-plan/src/knowledge.rs implementation: file exists; coverage not verified
crates/eg-plan/src/leanrag.rs:125 implementation: file exists; coverage not verified
crates/eg-plan/src/leanrag.rs:66 implementation: file exists; coverage not verified
crates/eg-plan/src/rowset.rs implementation: file exists; coverage not verified
crates/eg-plan/src/runtime.rs:61 implementation: file exists; coverage not verified
crates/eg-plan/src/uql/serve/annotate.rs implementation: file exists; coverage not verified
crates/eg-query/src/sql/ann.rs implementation: file exists; coverage not verified
crates/eg-query/src/sql/ann.rs:116 implementation: file exists; coverage not verified
crates/eg-query/src/tables/embedding_binding.rs:398 implementation: file exists; coverage not verified
crates/eg-types/src/embedding.rs:47 implementation: file exists; coverage not verified
crates/eg-types/src/lake_catalog.rs implementation: file exists; coverage not verified
crates/eg-types/src/wire_query_core.rs implementation: file exists; coverage not verified
crates/eg-types/src/wire_query_core.rs:27 implementation: file exists; coverage not verified
eg_shex::validate implementation: file exists; coverage not verified
epistemic_graph/generated/query.py implementation: file exists; coverage not verified
feature declaration implementation: file exists; coverage not verified
handle_shex_validate implementation: file exists; coverage not verified
src/redb_store/work_item/control_lease.rs:58 implementation: file exists; coverage not verified
src/server/handlers/graph_ops/semantic.rs:88 implementation: file exists; coverage not verified
src/server/handlers/graphlearn.rs implementation: file exists; coverage not verified
src/server/handlers/jobs/executor_claim.rs:82 implementation: file exists; coverage not verified
src/server/handlers/query/dispatch.rs:133 implementation: file exists; coverage not verified
src/server/handlers/query/dispatch.rs:66 implementation: file exists; coverage not verified
src/server/handlers/query/nl.rs:48 implementation: file exists; coverage not verified
src/server/handlers/query/planning.rs:11 implementation: file exists; coverage not verified
src/server/handlers/query/planning.rs:411 implementation: file exists; coverage not verified
src/server/handlers/query/planning.rs:424 implementation: file exists; coverage not verified
src/server/handlers/query/planning.rs:611 implementation: file exists; coverage not verified
src/server/handlers/query/planning.rs:854 implementation: file exists; coverage not verified
src/server/handlers/query/sql_read.rs:100 implementation: file exists; coverage not verified
src/server/handlers/query/sql_read.rs:305 implementation: file exists; coverage not verified
src/server/handlers/query/sql_read.rs:379 implementation: file exists; coverage not verified
src/server/handlers/query/uql_statement.rs:17 implementation: file exists; coverage not verified
src/server/handlers/semantic_index/dispatch.rs:14 implementation: file exists; coverage not verified
src/server/handlers/semantic_index/worker.rs:175 implementation: file exists; coverage not verified
src/server/lake/catalog_ops.rs:104 implementation: file exists; coverage not verified
src/server/lake/mod.rs:602 implementation: file exists; coverage not verified
src/server/lake/rest/catalog.rs:318 implementation: file exists; coverage not verified
src/server/lake/rest/mod.rs implementation: file exists; coverage not verified
src/server/semantic_index.rs:145 implementation: file exists; coverage not verified
tasks documentation: file exists; coverage not verified
try_handle implementation: file exists; coverage not verified
validate.rs implementation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-FINANCE-PRIMITIVESEG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidence18125/18125SPECIFIEDcrates/eg-compute/src/finance/lot_accounting.rs implementation: file exists; coverage not verified
crates/eg-compute/src/finance/market/backtest_run.rs implementation: file exists; coverage not verified
crates/eg-compute/src/finance/quant/validation.rs implementation: file exists; coverage not verified
crates/eg-compute/src/finance/regime.rs implementation: file exists; coverage not verified
crates/eg-compute/src/finance/statespace.rs:167 implementation: file exists; coverage not verified
crates/eg-compute/src/finance/statespace.rs:56 implementation: file exists; coverage not verified
crates/eg-compute/src/finance/statespace.rs:94 implementation: file exists; coverage not verified
crates/eg-core/ontology/finance-v1.ttl implementation: file exists; coverage not verified
crates/eg-numeric/src/evaluation/skill.rs:16 implementation: file exists; coverage not verified
crates/eg-numeric/src/series/kalman.rs:52 implementation: file exists; coverage not verified
crates/eg-plan/src/exec/derive.rs:21 implementation: file exists; coverage not verified
crates/eg-plan/src/exec/dispatch.rs:461 implementation: file exists; coverage not verified
crates/eg-tsdb/src/derive/mod.rs:1 implementation: file exists; coverage not verified
crates/eg-types/src/finance_event_envelope.rs implementation: file exists; coverage not verified
crates/eg-types/src/wire_finance.rs implementation: file exists; coverage not verified
src/server/handlers/finance/route_families.rs:211 implementation: file exists; coverage not verified
src/server/handlers/finance/route_families.rs:576 implementation: file exists; coverage not verified
src/server/handlers/query/sql_read.rs:305 implementation: file exists; coverage not verified
src/server/handlers/timeseries.rs:367 implementation: file exists; coverage not verified
src/server/handlers/timeseries/derived.rs:222 implementation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
EG-INGEST-WORKEREG-INGEST-WORKER — Durable ingest worker1360/1360SPECIFIEDcrates/eg-document/src/contract.rs:141 implementation: file exists; coverage not verified
crates/eg-document/src/document.rs:225 implementation: file exists; coverage not verified
crates/eg-document/src/runtime.rs:79 implementation: file exists; coverage not verified
crates/eg-types/src/source_ingestion.rs:265 implementation: file exists; coverage not verified
spec.md documentation: file exists; coverage not verified
src/redb_store/store_state.rs implementation: file exists; coverage not verified
src/server/dispatch/graph_pipeline/native_routes.rs:408 implementation: file exists; coverage not verified
src/server/dispatch/graph_pipeline/native_routes.rs:428 implementation: file exists; coverage not verified
src/server/handlers/modality/ingest.rs:151 implementation: file exists; coverage not verified
src/server/handlers/source_ingestion.rs implementation: file exists; coverage not verified
src/server/handlers/source_ingestion.rs:155 implementation: file exists; coverage not verified
src/server/handlers/source_ingestion.rs:1683 implementation: file exists; coverage not verified
src/server/handlers/source_ingestion.rs:1791 implementation: file exists; coverage not verified
src/server/handlers/source_ingestion.rs:2187 implementation: file exists; coverage not verified
src/server/handlers/source_ingestion.rs:385 implementation: file exists; coverage not verified
EG-MEDIA-VOCABEG-MEDIA-VOCAB — Media and personal-content vocabulary1230/1230SPECIFIEDspec.md documentation: file exists; coverage not verified
EG-OBJECT-STORAGE-BACKENDEG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost Gate50/50SPECIFIEDplan.md documentation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
status.json implementation: file exists; coverage not verified
tasks.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-CQ-ORCHEG-CQ-ORCH — Orchestration competency questions910/910SPECIFIEDcrates/eg-compute/src/parser/resolve.rs:63 implementation: file exists; coverage not verified
design.md documentation: file exists; coverage not verified
src/server/handlers/mining/impact.rs:264 implementation: file exists; coverage not verified
EG-ORCH-VOCABEG-ORCH-VOCAB — Orchestration vocabulary15227/15227SPECIFIEDcrates/eg-core/ontology/orchestration-v1.shapes.ttl implementation: file exists; coverage not verified
crates/eg-core/ontology/sdd-v1.ttl implementation: file exists; coverage not verified
crates/eg-query/src/cypher/exec.rs:4574 implementation: file exists; coverage not verified
crates/eg-rdf/tests/orchestration_vocabulary.rs test: file exists; coverage not verified
crates/eg-types/src/agent_ontology.rs implementation: file exists; coverage not verified
crates/eg-types/src/agent_template.rs implementation: file exists; coverage not verified
crates/eg-types/src/authority/replay.rs:191 implementation: file exists; coverage not verified
crates/eg-types/src/change_envelope.rs:248 implementation: file exists; coverage not verified
crates/eg-types/src/graph_schema.rs:79 implementation: file exists; coverage not verified
crates/eg-types/src/ingestion_wire.rs:36 implementation: file exists; coverage not verified
crates/eg-types/src/outcome_bundle.rs:130 implementation: file exists; coverage not verified
crates/eg-types/src/outcome_bundle.rs:668 implementation: file exists; coverage not verified
crates/eg-types/src/protocol/method/method_00.rs:6 implementation: file exists; coverage not verified
crates/eg-types/src/protocol/method/method_03.rs:317 implementation: file exists; coverage not verified
design.md documentation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
src/server/connector_pack_projection.rs implementation: file exists; coverage not verified
src/server/dispatch/change_envelope.rs:36 implementation: file exists; coverage not verified
src/server/dispatch/router/source_ingest.rs:24 implementation: file exists; coverage not verified
src/server/handlers/decide/assemble.rs implementation: file exists; coverage not verified
src/server/handlers/graph_ops/gateway_graph.rs implementation: file exists; coverage not verified
src/server/handlers/graph_ops/gateway_graph.rs:62 implementation: file exists; coverage not verified
src/server/mutation/coalescer.rs implementation: file exists; coverage not verified
src/server/persistence/provenance_anchor.rs:55 implementation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-PLACEMENTEG-PLACEMENT — Placement, worker policy and analytics bound7110/7110SPECIFIEDcrates/eg-compute/src/mining/association.rs:402 implementation: file exists; coverage not verified
crates/eg-jobs/src/store.rs:736 implementation: file exists; coverage not verified
crates/eg-quantum-jobs/src/job.rs:275 implementation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
spec.md documentation: file exists; coverage not verified
specs/decision-engine/requirements.md:163 documentation: file exists; coverage not verified
src/server/dispatch/router/decision_plane.rs:64 implementation: file exists; coverage not verified
src/server/handlers/decide/assemble.rs:57 implementation: file exists; coverage not verified
src/server/handlers/jobs/submit.rs:289 implementation: file exists; coverage not verified
EG-CONTRACTEG-CONTRACT — Public engine contract and reproducible clients8761/8753SPECIFIED.github/workflows/release.yml implementation: file exists; coverage not verified
Cargo.toml implementation: file exists; coverage not verified
EG-DECISION-ENGINE documentation: file exists; coverage not verified
EG-DURABLE-KERNEL documentation: file exists; coverage not verified
EG-FEDERATED-QUERY documentation: file exists; coverage not verified
EG-FINANCE-PRIMITIVES documentation: file exists; coverage not verified
EG-IDENTITY documentation: file exists; coverage not verified
EG-UNIFIED-DATA-PLANE-R001 documentation: file exists; coverage not verified
The component registry implementation: file exists; coverage not verified
The engine diagram documentation: file exists; coverage not verified
The scanner configuration implementation: file exists; coverage not verified
build_backend.py implementation: file exists; coverage not verified
clients/go/go.mod implementation: file exists; coverage not verified
clients/js/package-lock.json implementation: file exists; coverage not verified
crates/eg-core/src/read_through.rs implementation: file exists; coverage not verified
engine.md documentation: file exists; coverage not verified
folded-wheel/action.yml implementation: file exists; coverage not verified
modality_serving.md documentation: file exists; coverage not verified
native-program-optimization.md documentation: file exists; coverage not verified
pyproject.toml implementation: file exists; coverage not verified
scripts/build_method_codec_wasm.py implementation: file exists; coverage not verified
scripts/check_wheel_completeness.py implementation: file exists; coverage not verified
scripts/check_wheel_privacy.py implementation: file exists; coverage not verified
scripts/ci_parity.sh implementation: file exists; coverage not verified
src/server/handlers/query/planning.rs:424 implementation: file exists; coverage not verified
src/server/mutation.rs:136 implementation: file exists; coverage not verified
clients/go/codec.go implementation: file exists; coverage not verified
clients/js/codec.mjs implementation: file exists; coverage not verified
contract/errors.json implementation: file exists; coverage not verified
contract/fixtures/method_body_vectors.json implementation: file exists; coverage not verified
contract/methods.json implementation: file exists; coverage not verified
crates/eg-capabilities/src/bin/gen_contract.rs implementation: file exists; coverage not verified
epistemic_graph/generated/models.py implementation: file exists; coverage not verified
plan.md documentation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
scripts/generated_artifacts.py implementation: file exists; coverage not verified
tasks.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-REPO-INGESTEG-REPO-INGEST — Repository index and native ingestion10123/1016SPECIFIED.config/pre-commit.yaml implementation: file exists; coverage not verified
architecture.md documentation: file exists; coverage not verified
crates/eg-compute/src/parser/branch_index.rs implementation: file exists; coverage not verified
crates/eg-compute/src/parser/branch_index_tests.rs implementation: file exists; coverage not verified
crates/eg-types/src/ingestion_wire.rs implementation: file exists; coverage not verified
crates/eg-types/src/source_ingestion.rs implementation: file exists; coverage not verified
crates/eg-types/src/source_ingestion/tests.rs implementation: file exists; coverage not verified
docs/architecture/source_ingestion.md documentation: file exists; coverage not verified
epistemic_graph/generated/index_repository.py implementation: file exists; coverage not verified
spec.md documentation: file exists; coverage not verified
src/server/dispatch/graph_pipeline/repository_index.rs implementation: file exists; coverage not verified
src/server/handlers/repository_index.rs implementation: file exists; coverage not verified
src/server/handlers/repository_index_tests.rs implementation: file exists; coverage not verified
src/server/handlers/source_ingestion.rs implementation: file exists; coverage not verified
src/server/repository_enrichment_worker.rs implementation: file exists; coverage not verified
tests/repository_index_durable.rs test: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-SRC-AUTHEG-SRC-AUTH — Source authority: the ontology says which connected source answers a concept730/730SPECIFIEDcrates/eg-core/src/graph/schema_sources.rs implementation: file exists; coverage not verified
crates/eg-core/src/isolation.rs:1058 implementation: file exists; coverage not verified
crates/eg-plan/src/federation.rs implementation: file exists; coverage not verified
crates/eg-rdf/src/source_selection.rs implementation: file exists; coverage not verified
crates/eg-rdf/src/source_selection.rs:172 implementation: file exists; coverage not verified
crates/eg-rdf/src/source_selection.rs:26 implementation: file exists; coverage not verified
crates/eg-types/src/governed_change.rs implementation: file exists; coverage not verified
crates/eg-types/src/protocol/method/method_00.rs:6 implementation: file exists; coverage not verified
crates/eg-types/src/wire_query_modalities.rs implementation: file exists; coverage not verified
specs/cross-source-competency/plan.md documentation: file exists; coverage not verified
specs/orchestration-competency/requirements.md documentation: file exists; coverage not verified
src/server/graph_schema/approved.rs implementation: file exists; coverage not verified
src/server/graph_schema/virtual_graph_tests.rs:35 implementation: file exists; coverage not verified
src/server/handlers/graph_ops/gateway_graph.rs:62 implementation: file exists; coverage not verified
crates/eg-core/ontology/virtual_graph-v1.ttl implementation: file exists; coverage not verified
EG-SCMEG-SCM — Source changesets as the source of truth210/210SPECIFIEDsrc/server/blob/store.rs implementation: file exists; coverage not verified
src/server/blob/stream.rs implementation: file exists; coverage not verified
plan.md documentation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
status.json implementation: file exists; coverage not verified
tasks.md documentation: file exists; coverage not verified
test-spec.md documentation: file exists; coverage not verified
EG-SUPPLY-VOCABEG-SUPPLY-VOCAB — Supply-chain and service-impact vocabulary691/691SPECIFIEDcrates/eg-types/src/entity_link_proposal.rs implementation: file exists; coverage not verified
spec.md documentation: file exists; coverage not verified
specs/cross-source-competency/plan.md documentation: file exists; coverage not verified
src/server/handlers/mining/impact.rs:264 implementation: file exists; coverage not verified
plan.md documentation: file exists; coverage not verified
EG-TYPED-PACKSEG-TYPED-PACKS — Typed packs and catalog authority359112/35982SPECIFIEDbenches/schema_drift_classify.rs implementation: file exists; coverage not verified
crates/eg-core/ontology/swarm_topology-v1.ttl:80 implementation: file exists; coverage not verified
crates/eg-core/src/ontology_codegen.rs:45 implementation: file exists; coverage not verified
crates/eg-types/src/agent_component.rs:130 implementation: file exists; coverage not verified
crates/eg-types/src/agent_component/facts.rs:169 implementation: file exists; coverage not verified
crates/eg-types/src/agent_component/facts.rs:198 implementation: file exists; coverage not verified
crates/eg-types/src/agent_component/facts.rs:395 implementation: file exists; coverage not verified
crates/eg-types/src/connector_pack/annotations.rs:46 implementation: file exists; coverage not verified
crates/eg-types/src/decision/statistical/tool_subset.rs:58 implementation: file exists; coverage not verified
crates/eg-types/src/domain_pack.rs implementation: file exists; coverage not verified
crates/eg-types/src/fleet_catalog/row.rs:103 implementation: file exists; coverage not verified
crates/eg-types/src/graph_schema/drift.rs implementation: file exists; coverage not verified
crates/eg-types/src/lib.rs implementation: file exists; coverage not verified
evidence/gr1080-r048-5-20261011/client-parity.json implementation: file exists; coverage not verified
evidence/gr1080-r048-5-20261011/results.json implementation: file exists; coverage not verified
src/server/blob/engine_bodies.rs implementation: file exists; coverage not verified
src/server/blob/engine_bodies.rs:202 implementation: file exists; coverage not verified
src/server/connector_pack_projection.rs implementation: file exists; coverage not verified
src/server/connector_pack_projection.rs:220 implementation: file exists; coverage not verified
src/server/dispatch/consensus/fleet_catalog/project.rs:271 implementation: file exists; coverage not verified
src/server/graph_schema.rs:191 implementation: file exists; coverage not verified
src/server/graph_schema/attach_pack.rs implementation: file exists; coverage not verified
src/server/handlers/admin/agent.rs:142 implementation: file exists; coverage not verified
src/server/handlers/admin/component_content.rs implementation: file exists; coverage not verified
src/server/handlers/admin/component_content.rs:55 implementation: file exists; coverage not verified
src/server/handlers/admin/connector_pack/import/annotations.rs implementation: file exists; coverage not verified
src/server/handlers/admin/connector_pack/import/annotations.rs:34 implementation: file exists; coverage not verified
src/server/handlers/admin/connector_pack/import/facts.rs:21 implementation: file exists; coverage not verified
src/server/handlers/admin/connector_pack/reproject.rs:227 implementation: file exists; coverage not verified
src/server/handlers/decide/stat_decide.rs:137 implementation: file exists; coverage not verified
src/server/handlers/decide/stat_tool_subset.rs:99 implementation: file exists; coverage not verified
src/server/handlers/graph_ops/gateway_graph_routes.rs:656 implementation: file exists; coverage not verified
src/server/handlers/rdf/dispatch.rs implementation: file exists; coverage not verified
src/server/handlers/rdf/sparql.rs:30 implementation: file exists; coverage not verified
src/server/persistence/agent_component/write.rs:39 implementation: file exists; coverage not verified
src/server/persistence/connector_pack.rs implementation: file exists; coverage not verified
src/server/persistence/connector_pack/declaration.rs implementation: file exists; coverage not verified
tests/packs/test_schema_drift_served.py test: file exists; coverage not verified
architecture.md documentation: file exists; coverage not verified
contract/fixtures/connector_pack_digest_vectors.json implementation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
tasks.md documentation: file exists; coverage not verified
EG-UNIFIED-DATA-PLANEEG-UNIFIED-DATA-PLANE — Unified data plane29089/29084SPECIFIEDRequirements documentation: file exists; coverage not verified
crates/eg-ann/src/recall.rs:28 implementation: file exists; coverage not verified
crates/eg-ann/src/version.rs:129 implementation: file exists; coverage not verified
crates/eg-ann/src/version.rs:32 implementation: file exists; coverage not verified
crates/eg-lake/src/catalog.rs implementation: file exists; coverage not verified
crates/eg-modality/src/lib.rs implementation: file exists; coverage not verified
crates/eg-plan/src/federation_opt/run.rs:26 implementation: file exists; coverage not verified
crates/eg-query/src/tables/embedding_binding.rs:526 implementation: file exists; coverage not verified
crates/eg-rdf/src/obda.rs implementation: file exists; coverage not verified
cross-repository contracts documentation: file exists; coverage not verified
src/server/cdc.rs implementation: file exists; coverage not verified
src/server/dispatch/graph_pipeline/web_ingest.rs implementation: file exists; coverage not verified
src/server/foreign_catalog.rs implementation: file exists; coverage not verified
src/server/handlers/rdf/obda.rs implementation: file exists; coverage not verified
requirements.md documentation: file exists; coverage not verified
status.json implementation: file exists; coverage not verified
tasks documentation: file exists; coverage not verified
test specification documentation: file exists; coverage not verified

Landed counts LANDED and VERIFIED requirements. Done counts VERIFIED requirements only.

The spec state comes from the spec status file only.

U

Spec architecture

repository / component packages

Packages group specs by repository and declared component. Unassigned means no component was declared. Code links do not prove coverage. Mermaid source.

Knuckles-Team/medulla / Connector packs (1)
Knuckles-Team/medulla / Connector packs (1)EG-TYPED-PACKS
EG-TYPED-PACKS: source plan diagrams (Mermaid)
flowchart LR
  SDK[SDK builds canonical pack] --> UP[Blob upload]
  SDK --> IM[ConnectorPack.Import]
  UP --> IM
  IM --> V[Bounded validation G1–G21]
  V --> B[Engine body store]
  B --> TX[Agent Library owner transaction]
  TX --> H[Head, members, holders, receipt]
  TX --> O[Import outbox]
  O --> P[Projection worker]
  P --> GS[GraphSchema.Attach pack source]
  GS --> VIS[Visible record + outbox ack]
  VIS --> READ[Typed catalog and component reads]
Knuckles-Team/medulla / Development lifecycle (1)
Knuckles-Team/medulla / Development lifecycle (1)EG-SDLC
EG-SDLC: source plan diagrams (Mermaid)
flowchart LR
  REQ[Requirement] -- verifiedBy --> TEST[TestCase]
  SYM[CodeSymbol] -- implements --> REQ
  CS[Changeset] -- changes --> SYM
  CS -- citesRequirement --> REQ
  TEST -- exercises --> SYM
  GV[GateVerdict] -- judges --> CS
  CS -- producedBy --> RT[RunTrace]
  DEF[Defect] -- affects --> SYM
  DEF -- introducedBy --> CS
  DEF -- fixedBy --> CS
  REL[Release] -- contains --> CS
  DEP[Deployment] -- deploys --> REL
  INC[Incident] -- observedIn --> DEP
  INC -- raises --> DEF
Knuckles-Team/medulla / Storage (1)
Knuckles-Team/medulla / Storage (1)EG-ENGINE-PARITY
EG-ENGINE-PARITY: source plan diagrams (Mermaid)
flowchart TB
  subgraph Clients
    N[Native and generated clients]
    W[Outside SQL and BI tools]
  end
  W -- PostgreSQL wire protocol --> PW[Wire front end R006-R009]
  N --> RB[Request boundary]
  PW --> RB
  RB --> AD[Admission, principal, row security]
  AD --> PL[SQL / UQL planner over the columnar engine]
  PL --> TX[Transaction: snapshot reads, read and write sets R002]
  TX --> GC[Group committer per store file R001]
  GC --> P1[(Store file: tenant A)]
  GC --> P2[(Store file: tenant B)]
  GC --> LOG[Committed log]
  LOG --> CDC[Change stream R015]
  LOG --> ARC[Log archive and snapshots R016]
  LOG --> REP[Read replicas R017]
  LOG --> COL[Columnar copies of hot classes R018]
  PL --> COL
  PL --> EXT[Attached outside databases, read and federate only R019]
Knuckles-Team/medulla / Unassigned (21)
Knuckles-Team/medulla / Unassigned (21)EG-UNIFIED-DATA-PLANE

EG-BRANCH-MERGE: no plan diagram declared.

EG-CONTRACT: no plan diagram declared.

EG-CQ-CONN: no plan diagram declared.

EG-CQ-ORCH: no plan diagram declared.

EG-CQ-XSRC: no plan diagram declared.

EG-DATAPLAT-VOCAB: no plan diagram declared.

EG-DECISION-ENGINE: no plan diagram declared.

EG-DURABLE-KERNEL: source plan diagrams (Mermaid)
flowchart LR
  W[Native / RESP / SQL / client wire] --> A[Verified identity and policy]
  A --> C[Request classifier and MutationBatch compiler]
  C --> O[Owner manifest and transaction admission]
  O --> L[redb commit and Raft log]
  L --> P[Graph / table / KV / TSDB projections]
  L --> E[Outbox / CDC / audit receipts]
  E --> M[Mirror and subscriber cursors]

EG-FEDERATED-QUERY: no plan diagram declared.

EG-FINANCE-PRIMITIVES: no plan diagram declared.

EG-IDENTITY: no plan diagram declared.

EG-INGEST-WORKER: no plan diagram declared.

EG-MEDIA-VOCAB: no plan diagram declared.

EG-OBJECT-STORAGE-BACKEND: no plan diagram declared.

EG-ORCH-VOCAB: no plan diagram declared.

EG-PLACEMENT: no plan diagram declared.

EG-REPO-INGEST: source plan diagrams (Mermaid)
flowchart LR
  P[Provider snapshot adapter] --> S[Generated IndexRepository client]
  S --> A[Authenticated EG request boundary]
  A --> I[Branch index parser and resolver]
  I --> C[CAS source admission]
  C --> E[Canonical ChangeEnvelope compiler]
  E --> D[Durable graph and outbox commit]
  D --> Q[Graph and semantic queries]
  D --> W[Budgeted enrichment worker]
  W --> D

EG-SCM: no plan diagram declared.

EG-SRC-AUTH: no plan diagram declared.

EG-SUPPLY-VOCAB: no plan diagram declared.

EG-UNIFIED-DATA-PLANE: no plan diagram declared.

R

Spec relationships

declared dependencies and references

Depends on means a declared prerequisite. Extends and references do not imply prerequisite order. Shared code never creates dependencies. External targets are source declarations, not verified delivery.

Knuckles-Team/medulla / Connector packs
SpecRelationshipTargetEvidence
EG-TYPED-PACKSreferencesARBORA-FLEET-R036Knuckles-Team/graph-os: external declaration; not verified; source: specs/typed-packs-and-catalog/plan.md
EG-TYPED-PACKSreferencesSDK-CONNECTOR-CONTROL-R068Knuckles-Team/agent-connector-sdk: external declaration; not verified; source: specs/typed-packs-and-catalog/plan.md
EG-TYPED-PACKSreferencesEG-TYPED-PACKS-R101Knuckles-Team/medulla: local spec declaration; source: specs/typed-packs-and-catalog/plan.md
EG-TYPED-PACKSreferencesEG-TYPED-PACKS-R103Knuckles-Team/medulla: local spec declaration; source: specs/typed-packs-and-catalog/plan.md
Knuckles-Team/medulla / Development lifecycle
SpecRelationshipTargetEvidence
EG-SDLCreferencesEG-ORCH-VOCABKnuckles-Team/medulla: file exists; coverage not verified; source: specs/development-lifecycle/spec.md
EG-SDLCreferencesEG-REPO-INGESTKnuckles-Team/medulla: file exists; coverage not verified; source: specs/development-lifecycle/spec.md
EG-SDLCreferencesEG-SCMKnuckles-Team/medulla: file exists; coverage not verified; source: specs/development-lifecycle/spec.md
EG-SDLCreferencesEG-UNIFIED-DATA-PLANEKnuckles-Team/medulla: file exists; coverage not verified; source: specs/development-lifecycle/spec.md
EG-SDLCdepends onEG-ORCH-VOCAB-R012Knuckles-Team/medulla: local spec declaration; source: specs/development-lifecycle/spec.md
EG-SDLCdepends onEG-SCM-R002Knuckles-Team/medulla: local spec declaration; source: specs/development-lifecycle/spec.md
EG-SDLCdepends onEG-SCM-R008Knuckles-Team/medulla: local spec declaration; source: specs/development-lifecycle/spec.md
Knuckles-Team/medulla / Storage
SpecRelationshipTargetEvidence
EG-ENGINE-PARITYreferencesEG-DURABLE-KERNELKnuckles-Team/medulla: file exists; coverage not verified; source: specs/engine-parity/spec.md
EG-ENGINE-PARITYreferencesEG-FEDERATED-QUERYKnuckles-Team/medulla: file exists; coverage not verified; source: specs/engine-parity/spec.md
EG-ENGINE-PARITYreferencesEG-SCMKnuckles-Team/medulla: file exists; coverage not verified; source: specs/engine-parity/spec.md
EG-ENGINE-PARITYreferencesEG-UNIFIED-DATA-PLANEKnuckles-Team/medulla: file exists; coverage not verified; source: specs/engine-parity/spec.md
Knuckles-Team/medulla / Unassigned
SpecRelationshipTargetEvidence
EG-BRANCH-MERGENo relationships declared; dependencies unknown
EG-CONTRACTreferencesEG-DURABLE-KERNELKnuckles-Team/medulla: file exists; coverage not verified; source: specs/public-engine-contract-and-release/plan.md
EG-CONTRACTreferencesEG-FEDERATED-QUERYKnuckles-Team/medulla: file exists; coverage not verified; source: specs/public-engine-contract-and-release/plan.md
EG-CONTRACTreferencesEG-IDENTITYKnuckles-Team/medulla: file exists; coverage not verified; source: specs/public-engine-contract-and-release/plan.md
EG-CONTRACTreferencesFQR-03/04/06Knuckles-Team/medulla: file exists; coverage not verified; source: specs/public-engine-contract-and-release/plan.md
EG-CQ-CONNreferencesfederated query contractKnuckles-Team/medulla: file exists; coverage not verified; source: specs/connector-competency/plan.md
EG-CQ-CONNreferencesunified data planeKnuckles-Team/medulla: file exists; coverage not verified; source: specs/connector-competency/plan.md
EG-CQ-ORCHNo relationships declared; dependencies unknown
EG-CQ-XSRCNo relationships declared; dependencies unknown
EG-DATAPLAT-VOCABNo relationships declared; dependencies unknown
EG-DECISION-ENGINENo relationships declared; dependencies unknown
EG-DURABLE-KERNELreferences`unified-data-plane`Knuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md
EG-DURABLE-KERNELreferencesfederated query and reasoningKnuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md
EG-DURABLE-KERNELreferencespublic engine contract and release specKnuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md
EG-DURABLE-KERNELreferencestyped packs and catalogKnuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md
EG-DURABLE-KERNELreferencesunified data planeKnuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md
EG-FEDERATED-QUERYreferencesunified-data-planeKnuckles-Team/medulla: file exists; coverage not verified; source: specs/federated-query-and-reasoning/spec.md
EG-FINANCE-PRIMITIVESNo relationships declared; dependencies unknown
EG-IDENTITYNo relationships declared; dependencies unknown
EG-INGEST-WORKERNo relationships declared; dependencies unknown
EG-MEDIA-VOCABNo relationships declared; dependencies unknown
EG-OBJECT-STORAGE-BACKENDNo relationships declared; dependencies unknown
EG-ORCH-VOCABNo relationships declared; dependencies unknown
EG-PLACEMENTNo relationships declared; dependencies unknown
EG-REPO-INGESTNo relationships declared; dependencies unknown
EG-SCMNo relationships declared; dependencies unknown
EG-SRC-AUTHNo relationships declared; dependencies unknown
EG-SUPPLY-VOCABNo relationships declared; dependencies unknown
EG-UNIFIED-DATA-PLANENo relationships declared; dependencies unknown
G

Open issues and pull requests

open at capture
J

Record inventory

4300 records

Each status file gives one spec row. Each requirement gives one more row. A record without a valid state shows INVALID. Expand a Definition to read the canonical requirement and verification text.

All documented records (4300 rows)
ID / sourceKindParentStateCommit / test evidence
EG-BRANCH-MERGE
EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict Resolution
specNoneSPECIFIEDNo recorded commit/test evidence
EG-BRANCH-MERGE-R001
Typed branch model and create
Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source
**Typed branch model and create.** Model: a branch is a registry entry. It binds tenant, graph, name, base engine version, and creator. A branch is a view over the commit chain. It is not a data copy. Behavior: CreateBranch registers the name at its base version. It returns the branch identity. Branch reads use the off-lock graph snapshot. Tenant RLS applies as usual. Wiring: add a branch module to `crates/eg-types`. Serve it through the request boundary. Persist registrations in the owner-store lineage registry (EG-DURABLE-KERNEL-R003). Refusal: the registry refuses empty or duplicate names. It refuses reserved-namespace names. It refuses foreign-tenant creation. It refuses an unresolvable base version. Every refusal is a typed error before state change. Evidence: the identity round-trips. Every refusal leaves no registry entry. | `tests/test_branch_create.py::test_branch_create_and_refusals` creates a branch. It reads the branch back. Each refusal returns a typed error with no registry entry.
requirementEG-BRANCH-MERGESPECIFIEDNo recorded commit/test evidence
EG-BRANCH-MERGE-R002
Branch-scoped mutations
Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source
**Branch-scoped mutations.** Model: a mutation names its target branch. A commit appends to that branch's append-only chain. The commit carries a parent pointer to the branch's prior head. It commits commit-before-ack. Behavior: branch writes show on that branch only. They stay invisible to main and sibling branches until merge. Branch writes are idempotent under a tenant-scoped branch idempotency key. Wiring: extend the mutation path in `src/server/handlers` with branch targeting. Reuse the existing commit and raft paths. Reuse the tenant-scoped idempotency pattern of EG-DURABLE-KERNEL-R019. Refusal: the engine refuses a mutation that names an unknown branch. It refuses a deleted branch. It refuses a foreign-tenant branch. The refusal happens before any graph mutation. A replayed branch write returns the original receipt. Evidence: a branch write is invisible on main until merge. The replay returns an identical receipt. | `tests/test_branch_scoped_mutation.py::test_branch_write_invisible_until_merge` writes on a branch. It asserts main is unchanged. It asserts the replay receipt is identical.
requirementEG-BRANCH-MERGESPECIFIEDNo recorded commit/test evidence
EG-BRANCH-MERGE-R003
Merge base and fast-forward
Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source
**Merge base and fast-forward.** Model: merge outcomes form the closed set `up_to_date` / `fast_forward` / `merged` / `conflict`. The engine computes them over the two branch commit chains. Behavior: when the target has no writes since the merge base, the merge fast-forwards. When the source head is a descendant of the target head, the merge fast-forwards. The fast-forward moves the target to the source head without an entity scan. When the source is already contained, the outcome is up-to-date. Nothing publishes. Wiring: add merge-base computation to the branch module. Reuse the commit-chain walk of the owner store. Refusal: the engine refuses a merge whose branches share no ancestor. The refusal is typed. It never invents an implicit base. Evidence: up-to-date publishes nothing. Fast-forward advances the target with a single-parent receipt. The receipt names the source head as merged parent. | `tests/test_branch_merge_base.py::test_merge_outcomes_up_to_date_and_fast_forward` drives four fixture topologies. It asserts the closed outcome set.
requirementEG-BRANCH-MERGESPECIFIEDNo recorded commit/test evidence
EG-BRANCH-MERGE-R004
Entity-level three-way merge
Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source
**Entity-level three-way merge.** Model: the merge resolves per entity. Node identity is `(tenant, type, key)`. Edge identity is the existing `(source, target, relation_type)` triple (EG-REPO-INGEST-R009.1). Behavior: both-sides-unchanged entities stay on the target without row copy. One-sided entities are adopted. Adoption passes schema, constraint, and ABox validation. The validation uses the existing typed authorities. Both-sides entities become typed conflicts. They are never silent overwrites. Wiring: add the entity-level merge pass to the branch module. Reuse the constraint and ABox check authorities of schema repair (EG-DECISION-ENGINE-R102.1). Refusal: an adopted entity that fails validation refuses the whole merge. The merge refuses atomically with a named reason. No partial merge publishes. Evidence: disjoint, one-sided, and both-sides fixtures each produce the declared outcome. The atomic-refusal case publishes nothing. | `tests/test_branch_three_way_merge.py::test_entity_level_outcomes` drives the three fixtures. It asserts the published target state matches the expected entities exactly.
requirementEG-BRANCH-MERGESPECIFIEDNo recorded commit/test evidence
EG-BRANCH-MERGE-R005
Epistemic conflict resolution
Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source
**Epistemic conflict resolution.** Model: a conflicted entity produces a typed conflict record. The record carries both candidate values. Each candidate keeps its bitemporal windows (`valid_from`/`valid_until`, `tx_from`/`tx_until`). Each keeps its provenance (source reliability, confidence, evidence refs). Behavior: an owner-pinned epistemic policy selects the winner. Or it leaves the conflict open. The open conflict is a typed queryable state. Resolution is never a silent last-write-wins. A resolved row keeps the contradiction link. It keeps both evidence refs in its epistemic neighbourhood. Wiring: extend the conflict path of R004. Reuse the epistemic neighbourhood fields served by `WITH KNOWLEDGE`. Reuse the source-reliability authority. Refusal: the engine refuses resolution with a missing epistemic policy. It refuses stale evidence refs. It refuses nonfinite confidence. A conflict with no policy leaves the entity unmerged. The engine never guesses. Evidence: the two-candidate fixture resolves per the pinned policy. The no-policy conflict stays open with both candidates queryable. In contrast to an entity-level last-write-wins merge with constraint checks, this row is evidence-weighted and validity-aware. | `tests/test_branch_epistemic_conflict.py::test_evidence_weighted_resolution_and_open_conflict` resolves under a pinned policy. It re-runs without a policy. It reads back the open conflict with both candidates.
requirementEG-BRANCH-MERGESPECIFIEDNo recorded commit/test evidence
EG-BRANCH-MERGE-R006
Branch diff and time-travel reads
Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source
**Branch diff and time-travel reads.** Model: a branch or commit diff is a typed change feed. It names a baseline (entity, operation, image ref). It uses the engine's change-envelope vocabulary. A branch reads at any engine version on its chain. Behavior: an as-of-version read serves the off-lock snapshot. The snapshot pins to that version. It stays RLS-filtered. The diff between two versions lists added, updated, and deleted entities. Wiring: add as-of snapshot reads to the branch module. Reuse the existing snapshot and off-lock read paths. Reuse the tenant-scoping filter (EG-DURABLE-KERNEL-R029). Refusal: the engine refuses a version not on the branch's chain. It refuses a cross-tenant diff. Both refusals are typed. Evidence: a read at version N equals the write set at N. The diff between N and M equals the commits in between. The foreign-tenant and unknown-version cases refuse. | `tests/test_branch_time_travel.py::test_as_of_reads_and_diff` walks a branch chain of three versions. It reads each as-of. It asserts the diff matches the intervening commits.
requirementEG-BRANCH-MERGESPECIFIEDNo recorded commit/test evidence
EG-BRANCH-MERGE-R007
Atomic merge publication
Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source
**Atomic merge publication.** Model: a merge publishes the target change atomically. The publication spans every affected type and modality. It uses the existing cross-modal transaction and raft path. The receipt is a typed two-parent commit. The receipt carries commit id, manifest digest, parents, actor, and creation timestamp. Behavior: replay against the same `(source_head, target_head, merge_base)` returns the original receipt. A merge that cannot complete publishes nothing. It never claims a rollback. Wiring: extend the commit publication path. Reuse raft command sealing (EG-DURABLE-KERNEL-R009). Reuse the cross-modal transaction. Refusal: the engine refuses a target that advanced past its recorded head. The refusal names the state as stale. It never silently rebases. It refuses an unknown actor. Evidence: the two-parent receipt reads back byte-identically. The replay returns the same receipt. The stale-target case publishes nothing. | `tests/test_branch_merge_publish.py::test_atomic_two_parent_publication_and_replay` publishes a two-parent merge. It reads it back. It replays it. It asserts the stale-target refusal leaves the target unchanged.
requirementEG-BRANCH-MERGESPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN
EG-CQ-CONN — Connector competency questions
specNoneSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R001
ansible-tower competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ansible-tower competency rollup.** The ontology answers one single-source and one cross-source question over the `ansible-tower` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R001.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R001.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R001.1
ansible-tower single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ansible-tower single-source question.** "Which job templates failed in their last run, and against which inventory hosts?" Answered from the ansible-tower connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over ansible-tower data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R001.2
ansible-tower cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ansible-tower cross-source question.** "Which hosts that failed their last Tower run also have an open ServiceNow change or incident?" Requires linking ansible-tower to servicenow and systems-manager through the ontology concept: managed host (configuration item). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R001.3
ansible-tower acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ansible-tower acceptance test.** Both questions (EG-CQ-CONN-R001.1 and EG-CQ-CONN-R001.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R001.1 and EG-CQ-CONN-R001.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R002
archimate competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**archimate competency rollup.** The ontology answers one single-source and one cross-source question over the `archimate` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R002.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R002.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R002.1
archimate single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**archimate single-source question.** "Which application components serve a given business process, and through which relationships?" Answered from the archimate connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A fixture query over archimate data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R002.2
archimate cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**archimate cross-source question.** "Which ArchiMate application components have no matching LeanIX fact sheet or ServiceNow CI?" Requires linking archimate to leanix and servicenow through the ontology concept: application / configuration item. Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R002.3
archimate acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**archimate acceptance test.** Both questions (EG-CQ-CONN-R002.1 and EG-CQ-CONN-R002.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R002.1 and EG-CQ-CONN-R002.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R003
archivebox competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**archivebox competency rollup.** The ontology answers one single-source and one cross-source question over the `archivebox` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R003.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R003.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R003.1
archivebox single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**archivebox single-source question.** "Which archived snapshots of a given domain failed one or more extractors, and when?" Answered from the archivebox connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/documentation-v1.ttl`. | A fixture query over archivebox data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R003.2
archivebox cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**archivebox cross-source question.** "Which archived pages were first seen as FreshRSS articles but never captured by ArchiveBox?" Requires linking archivebox to freshrss and searxng through the ontology concept: URL / web resource. Vocabulary: `crates/eg-core/ontology/documentation-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R003.3
archivebox acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**archivebox acceptance test.** Both questions (EG-CQ-CONN-R003.1 and EG-CQ-CONN-R003.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R003.1 and EG-CQ-CONN-R003.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R004
aris competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**aris competency rollup.** The ontology answers one single-source and one cross-source question over the `aris` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R004.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R004.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R004.1
aris single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**aris single-source question.** "Which EPC functions in a process model have no outgoing control-flow connection?" Answered from the aris connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A fixture query over aris data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R004.2
aris cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**aris cross-source question.** "Which ARIS-modelled processes have a deployed Camunda definition, and which do not?" Requires linking aris to camunda and archimate through the ontology concept: business process. Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R004.3
aris acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**aris acceptance test.** Both questions (EG-CQ-CONN-R004.1 and EG-CQ-CONN-R004.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R004.1 and EG-CQ-CONN-R004.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R005
arr competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**arr competency rollup.** The ontology answers one single-source and one cross-source question over the `arr` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R005.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R005.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R005.1
arr single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**arr single-source question.** "Which monitored movies and episodes are wanted but have no file, and which indexer last searched them?" Answered from the arr connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over arr data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R005.2
arr cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**arr cross-source question.** "Which wanted Radarr titles are currently downloading in qBittorrent and not yet visible in Jellyfin?" Requires linking arr to qbittorrent and jellyfin through the ontology concept: media item (title). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R005.3
arr acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**arr acceptance test.** Both questions (EG-CQ-CONN-R005.1 and EG-CQ-CONN-R005.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R005.1 and EG-CQ-CONN-R005.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R006
atlassian competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**atlassian competency rollup.** The ontology answers one single-source and one cross-source question over the `atlassian` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R006.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R006.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R006.1
atlassian single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**atlassian single-source question.** "Which Jira issues in a project are blocked and unassigned, and by which linked issue?" Answered from the atlassian connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over atlassian data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R006.2
atlassian cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**atlassian cross-source question.** "Which open Jira issues reference a GitHub pull request that is already merged?" Requires linking atlassian to github and plane through the ontology concept: work item / pull request. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R006.3
atlassian acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**atlassian acceptance test.** Both questions (EG-CQ-CONN-R006.1 and EG-CQ-CONN-R006.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R006.1 and EG-CQ-CONN-R006.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R007
audiobookshelf competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**audiobookshelf competency rollup.** The ontology answers one single-source and one cross-source question over the `audiobookshelf` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R007.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R007.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R007.1
audiobookshelf single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**audiobookshelf single-source question.** "Which audiobook series have a book with listening progress stopped partway, and for which user?" Answered from the audiobookshelf connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over audiobookshelf data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R007.2
audiobookshelf cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**audiobookshelf cross-source question.** "Which audiobooks exist both in Audiobookshelf and as a downloaded file from media-downloader, and which are only one side?" Requires linking audiobookshelf to jellyfin and media-downloader through the ontology concept: media item (title). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R007.3
audiobookshelf acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**audiobookshelf acceptance test.** Both questions (EG-CQ-CONN-R007.1 and EG-CQ-CONN-R007.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R007.1 and EG-CQ-CONN-R007.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R008
audio-transcriber competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**audio-transcriber competency rollup.** The ontology answers one single-source and one cross-source question over the `audio-transcriber` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R008.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R008.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R008.1
audio-transcriber single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**audio-transcriber single-source question.** "Which recordings were transcribed with a low-confidence segment, and what text was affected?" Answered from the audio-transcriber connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over audio-transcriber data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R008.2
audio-transcriber cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**audio-transcriber cross-source question.** "Which transcribed recordings mention a topic that also appears in PulseLink social or video transcripts?" Requires linking audio-transcriber to pulselink and paperless-ngx through the ontology concept: document / transcript. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R008.3
audio-transcriber acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**audio-transcriber acceptance test.** Both questions (EG-CQ-CONN-R008.1 and EG-CQ-CONN-R008.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R008.1 and EG-CQ-CONN-R008.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R009
caddy competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**caddy competency rollup.** The ontology answers one single-source and one cross-source question over the `caddy` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R009.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R009.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R009.1
caddy single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**caddy single-source question.** "Which routes proxy to a given upstream, and which hostnames are served by each site block?" Answered from the caddy connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over caddy data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R009.2
caddy cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**caddy cross-source question.** "Which Caddy hostnames have no DNS record in Technitium or no Uptime Kuma monitor?" Requires linking caddy to technitium-dns and uptime through the ontology concept: hostname. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R009.3
caddy acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**caddy acceptance test.** Both questions (EG-CQ-CONN-R009.1 and EG-CQ-CONN-R009.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R009.1 and EG-CQ-CONN-R009.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R010
camunda competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**camunda competency rollup.** The ontology answers one single-source and one cross-source question over the `camunda` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R010.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R010.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R010.1
camunda single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**camunda single-source question.** "Which process instances have an open incident, and at which activity did they stop?" Answered from the camunda connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A fixture query over camunda data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R010.2
camunda cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**camunda cross-source question.** "Which running Camunda process definitions have an open ServiceNow incident raised against their service?" Requires linking camunda to aris and servicenow through the ontology concept: business process. Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R010.3
camunda acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**camunda acceptance test.** Both questions (EG-CQ-CONN-R010.1 and EG-CQ-CONN-R010.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R010.1 and EG-CQ-CONN-R010.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R011
ciso-assistant competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ciso-assistant competency rollup.** The ontology answers one single-source and one cross-source question over the `ciso-assistant` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R011.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R011.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R011.1
ciso-assistant single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ciso-assistant single-source question.** "Which controls in an applied framework are non-compliant and which risk scenarios do they mitigate?" Answered from the ciso-assistant connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A fixture query over ciso-assistant data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R011.2
ciso-assistant cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ciso-assistant cross-source question.** "Which CISO Assistant risks map to a ServiceNow CMDB service with an open incident?" Requires linking ciso-assistant to onetrust and servicenow through the ontology concept: control / risk. Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R011.3
ciso-assistant acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ciso-assistant acceptance test.** Both questions (EG-CQ-CONN-R011.1 and EG-CQ-CONN-R011.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R011.1 and EG-CQ-CONN-R011.2. Mapping acceptance depends on these producer rows: `RiskScenario`: `EG-CQ-CONN-R073.2` (`government-v1.ttl`); `mitigatesRisk`: `EG-CQ-CONN-R073.3` (`government-v1.ttl`); `inFramework`: `EG-CQ-CONN-R073.4` (`government-v1.ttl`); `riskAffectsService`: `EG-CQ-CONN-R073.5` (`government-v1.ttl`). The acceptance test must preserve `government-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::ciso_assistant` must parse the exact `ciso-assistant` Coverage row and `EG-CQ-CONN-R011.1` / `EG-CQ-CONN-R011.2` Vocabulary cells. It must assert `government-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R012
clarity competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**clarity competency rollup.** The ontology answers one single-source and one cross-source question over the `clarity` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R012.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R012.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R012.1
clarity single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**clarity single-source question.** "Which pages have the highest rage-click or dead-click rate over the last week?" Answered from the clarity connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over clarity data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R012.2
clarity cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**clarity cross-source question.** "Which pages with a spike in rage clicks were changed by a pull request merged in the previous week?" Requires linking clarity to plane and github through the ontology concept: web page / release. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R012.3
clarity acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**clarity acceptance test.** Both questions (EG-CQ-CONN-R012.1 and EG-CQ-CONN-R012.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R012.1 and EG-CQ-CONN-R012.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R013
container-manager competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**container-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `container-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R013.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R013.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R013.1
container-manager single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**container-manager single-source question.** "Which containers or pods are restarting repeatedly, and from which image?" Answered from the container-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over container-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R013.2
container-manager cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**container-manager cross-source question.** "Which running images have a newer tag on Docker Hub than the one deployed?" Requires linking container-manager to dockerhub and portainer through the ontology concept: container image. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R013.3
container-manager acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**container-manager acceptance test.** Both questions (EG-CQ-CONN-R013.1 and EG-CQ-CONN-R013.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R013.1 and EG-CQ-CONN-R013.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R014
data-science competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**data-science competency rollup.** The ontology answers one single-source and one cross-source question over the `data-science` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R014.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R014.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R014.1
data-science single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**data-science single-source question.** "Which trained models have validation metrics below their baseline run, and on which dataset?" Answered from the data-science connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over data-science data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R014.2
data-science cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**data-science cross-source question.** The question is "Which fine-tuned models have no evaluation trace and no stored artifact?" The trace store holds evaluation traces. The object store holds artifacts. The answer links data-science to langfuse and objectstore through the ontology concept model / dataset. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R014.3
data-science acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**data-science acceptance test.** Both questions (EG-CQ-CONN-R014.1 and EG-CQ-CONN-R014.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R014.1 and EG-CQ-CONN-R014.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R015
dockerhub competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**dockerhub competency rollup.** The ontology answers one single-source and one cross-source question over the `dockerhub` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R015.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R015.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R015.1
dockerhub single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**dockerhub single-source question.** "Which repositories in an organization have not been pushed to in a year, and what are their pull counts?" Answered from the dockerhub connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over dockerhub data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R015.2
dockerhub cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**dockerhub cross-source question.** "Which Docker Hub repositories correspond to a GitHub repository with recent commits but no recent image push?" Requires linking dockerhub to container-manager and github through the ontology concept: container image / repository. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R015.3
dockerhub acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**dockerhub acceptance test.** Both questions (EG-CQ-CONN-R015.1 and EG-CQ-CONN-R015.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R015.1 and EG-CQ-CONN-R015.2. Mapping acceptance depends on these producer rows: `lastPushedAt`: `EG-CQ-CONN-R068.13` (`infrastructure-v1.ttl`); `pullCount`: `EG-CQ-CONN-R068.14` (`infrastructure-v1.ttl`); `Repository`: `EG-CQ-CONN-R069.2` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `infrastructure-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::dockerhub` must parse the exact `dockerhub` Coverage row and `EG-CQ-CONN-R015.1` / `EG-CQ-CONN-R015.2` Vocabulary cells. It must assert `infrastructure-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R016
documentdb competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**documentdb competency rollup.** The ontology answers one single-source and one cross-source question over the `documentdb` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R016.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R016.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R016.1
documentdb single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**documentdb single-source question.** "Which collections have the most documents and which fields are missing in more than half of them?" Answered from the documentdb connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over documentdb data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R016.2
documentdb cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**documentdb cross-source question.** "Which documentdb collections duplicate a table in the SQL database, and which side is newer?" Requires linking documentdb to sql and objectstore through the ontology concept: dataset / collection. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R016.3
documentdb acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**documentdb acceptance test.** Both questions (EG-CQ-CONN-R016.1 and EG-CQ-CONN-R016.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R016.1 and EG-CQ-CONN-R016.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R017
egeria competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**egeria competency rollup.** The ontology answers one single-source and one cross-source question over the `egeria` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R017.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R017.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R017.1
egeria single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**egeria single-source question.** "Which glossary terms are linked to a data asset with a confidential classification?" Answered from the egeria connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A fixture query over egeria data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R017.2
egeria cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**egeria cross-source question.** "Which Egeria-cataloged assets correspond to a live SQL table, and which are cataloged but missing?" Requires linking egeria to sql and jena through the ontology concept: data asset. Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R017.3
egeria acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**egeria acceptance test.** Both questions (EG-CQ-CONN-R017.1 and EG-CQ-CONN-R017.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R017.1 and EG-CQ-CONN-R017.2. Mapping acceptance depends on these producer rows: `GlossaryTerm`: `EG-CQ-CONN-R074.2` (`core-foundation-v1.ttl`); `termAssignedTo`: `EG-CQ-CONN-R074.3` (`core-foundation-v1.ttl`). The acceptance test must preserve `core-foundation-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::egeria` must parse the exact `egeria` Coverage row and `EG-CQ-CONN-R017.1` / `EG-CQ-CONN-R017.2` Vocabulary cells. It must assert `core-foundation-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R018
emerald-exchange competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**emerald-exchange competency rollup.** The ontology answers one single-source and one cross-source question over the `emerald-exchange` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R018.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R018.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R018.1
emerald-exchange single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**emerald-exchange single-source question.** "Which open orders on an exchange are partially filled and what is their remaining quantity?" Answered from the emerald-exchange connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A fixture query over emerald-exchange data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R018.2
emerald-exchange cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**emerald-exchange cross-source question.** "Which exchange fills correspond to a deposit or withdrawal recorded in the Firefly III ledger?" Requires linking emerald-exchange to firefly-iii and home-assistant through the ontology concept: account / currency. Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R018.3
emerald-exchange acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**emerald-exchange acceptance test.** Both questions (EG-CQ-CONN-R018.1 and EG-CQ-CONN-R018.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R018.1 and EG-CQ-CONN-R018.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R019
erpnext competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**erpnext competency rollup.** The ontology answers one single-source and one cross-source question over the `erpnext` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R019.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R019.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R019.1
erpnext single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**erpnext single-source question.** "Which open purchase orders are late, and from which supplier?" Answered from the erpnext connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A fixture query over erpnext data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R019.2
erpnext cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**erpnext cross-source question.** "Which ERPNext suppliers with late orders are also marked as active accounts in the Twenty CRM or paid in Firefly III?" Requires linking erpnext to twenty and firefly-iii through the ontology concept: party (supplier / customer). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R019.3
erpnext acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**erpnext acceptance test.** Both questions (EG-CQ-CONN-R019.1 and EG-CQ-CONN-R019.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R019.1 and EG-CQ-CONN-R019.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R020
fan-manager competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**fan-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `fan-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R020.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R020.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R020.1
fan-manager single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**fan-manager single-source question.** "Which fans ran above 80 percent duty while the host temperature stayed above its threshold?" Answered from the fan-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over fan-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R020.2
fan-manager cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**fan-manager cross-source question.** "Which hosts had fan duty at maximum during a window in which Grafana alerted on temperature?" Requires linking fan-manager to systems-manager and lgtm through the ontology concept: host. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R020.3
fan-manager acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**fan-manager acceptance test.** Both questions (EG-CQ-CONN-R020.1 and EG-CQ-CONN-R020.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R020.1 and EG-CQ-CONN-R020.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R021
firefly-iii competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**firefly-iii competency rollup.** The ontology answers one single-source and one cross-source question over the `firefly-iii` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R021.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R021.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R021.1
firefly-iii single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**firefly-iii single-source question.** "Which budgets were exceeded this month, and by which transactions?" Answered from the firefly-iii connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A fixture query over firefly-iii data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R021.2
firefly-iii cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**firefly-iii cross-source question.** "Which Firefly III expenses match an ERPNext purchase invoice by amount and date?" Requires linking firefly-iii to erpnext and emerald-exchange through the ontology concept: account / transaction. Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R021.3
firefly-iii acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**firefly-iii acceptance test.** Both questions (EG-CQ-CONN-R021.1 and EG-CQ-CONN-R021.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R021.1 and EG-CQ-CONN-R021.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R022
freshrss competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**freshrss competency rollup.** The ontology answers one single-source and one cross-source question over the `freshrss` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R022.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R022.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R022.1
freshrss single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**freshrss single-source question.** "Which unread articles from a given feed were published in the last 48 hours?" Answered from the freshrss connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over freshrss data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R022.2
freshrss cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**freshrss cross-source question.** "Which FreshRSS articles also appear in SearXNG results for the same query, and which are new?" Requires linking freshrss to archivebox and searxng through the ontology concept: URL / article. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R022.3
freshrss acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**freshrss acceptance test.** Both questions (EG-CQ-CONN-R022.1 and EG-CQ-CONN-R022.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R022.1 and EG-CQ-CONN-R022.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R023
github competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**github competency rollup.** The ontology answers one single-source and one cross-source question over the `github` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R023.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R023.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R023.1
github single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**github single-source question.** "Which open pull requests have failing checks and no reviewer assigned?" Answered from the github connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over github data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R023.2
github cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**github cross-source question.** "Which GitHub pull requests close a Jira issue that is still in an open state?" Requires linking github to gitlab and atlassian through the ontology concept: repository / change request. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R023.3
github acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**github acceptance test.** Both questions (EG-CQ-CONN-R023.1 and EG-CQ-CONN-R023.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R023.1 and EG-CQ-CONN-R023.2. Mapping acceptance depends on these producer rows: `requestedReviewer`: `EG-CQ-CONN-R069.12` (`sdlc_lifecycle-v1.ttl`); `closesTicket`: `EG-CQ-CONN-R069.10` (`sdlc_lifecycle-v1.ttl`); `proposalState`: `EG-CQ-CONN-R069.11` (`sdlc_lifecycle-v1.ttl`); `Repository`: `EG-CQ-CONN-R069.2` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `sdlc_lifecycle-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::github` must parse the exact `github` Coverage row and `EG-CQ-CONN-R023.1` / `EG-CQ-CONN-R023.2` Vocabulary cells. It must assert `sdlc_lifecycle-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R024
gitlab competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**gitlab competency rollup.** The ontology answers one single-source and one cross-source question over the `gitlab` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R024.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R024.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R024.1
gitlab single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**gitlab single-source question.** "Which pipelines on the default branch failed in the last day, and at which job?" Answered from the gitlab connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over gitlab data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R024.2
gitlab cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**gitlab cross-source question.** "Which repositories exist in GitLab and GitHub with diverging default-branch heads?" Requires linking gitlab to github and repository-manager through the ontology concept: repository / pipeline. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R024.3
gitlab acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**gitlab acceptance test.** Both questions (EG-CQ-CONN-R024.1 and EG-CQ-CONN-R024.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R024.1 and EG-CQ-CONN-R024.2. Mapping acceptance depends on these producer rows: `PipelineJob`: `EG-CQ-CONN-R069.13` (`sdlc_lifecycle-v1.ttl`); `pipelineJobOf`: `EG-CQ-CONN-R069.14` (`sdlc_lifecycle-v1.ttl`); `Branch`: `EG-CQ-CONN-R069.3` (`sdlc_lifecycle-v1.ttl`); `branchOf`: `EG-CQ-CONN-R069.4` (`sdlc_lifecycle-v1.ttl`); `headCommit`: `EG-CQ-CONN-R069.5` (`sdlc_lifecycle-v1.ttl`); `isDefaultBranch`: `EG-CQ-CONN-R069.6` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `sdlc_lifecycle-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::gitlab` must parse the exact `gitlab` Coverage row and `EG-CQ-CONN-R024.1` / `EG-CQ-CONN-R024.2` Vocabulary cells. It must assert `sdlc_lifecycle-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R025
gramps competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**gramps competency rollup.** The ontology answers one single-source and one cross-source question over the `gramps` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R025.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R025.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R025.1
gramps single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**gramps single-source question.** "Which people in the tree were born in a given place before a given year, and who are their parents?" Answered from the gramps connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A fixture query over gramps data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R025.2
gramps cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**gramps cross-source question.** "Which Gramps people have a photo or document reference that exists as a file in Nextcloud?" Requires linking gramps to nextcloud through the ontology concept: person / media. Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R025.3
gramps acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**gramps acceptance test.** Both questions (EG-CQ-CONN-R025.1 and EG-CQ-CONN-R025.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R025.1 and EG-CQ-CONN-R025.2. Mapping acceptance depends on these producer rows: `birthPlace`: `EG-CQ-CONN-R076.1` (`personal-v1.ttl`); `birthYear`: `EG-CQ-CONN-R076.2` (`personal-v1.ttl`). The acceptance test must preserve `personal-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::gramps` must parse the exact `gramps` Coverage row and `EG-CQ-CONN-R025.1` / `EG-CQ-CONN-R025.2` Vocabulary cells. It must assert `personal-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R026
home-assistant competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**home-assistant competency rollup.** The ontology answers one single-source and one cross-source question over the `home-assistant` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R026.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R026.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R026.1
home-assistant single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**home-assistant single-source question.** "Which sensors reported a value outside their normal range in the last 24 hours?" Answered from the home-assistant connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over home-assistant data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R026.2
home-assistant cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**home-assistant cross-source question.** "Which Home Assistant devices went unavailable at the same time as an Uptime Kuma monitor failure?" Requires linking home-assistant to fan-manager and uptime through the ontology concept: device / host. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R026.3
home-assistant acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**home-assistant acceptance test.** Both questions (EG-CQ-CONN-R026.1 and EG-CQ-CONN-R026.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R026.1 and EG-CQ-CONN-R026.2. Mapping acceptance depends on these producer rows: `entityState`: `EG-CQ-CONN-R068.15` (`infrastructure-v1.ttl`); `unavailableSince`: `EG-CQ-CONN-R068.16` (`infrastructure-v1.ttl`). The acceptance test must preserve `infrastructure-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::home_assistant` must parse the exact `home-assistant` Coverage row and `EG-CQ-CONN-R026.1` / `EG-CQ-CONN-R026.2` Vocabulary cells. It must assert `infrastructure-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R027
jellyfin competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**jellyfin competency rollup.** The ontology answers one single-source and one cross-source question over the `jellyfin` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R027.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R027.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R027.1
jellyfin single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**jellyfin single-source question.** "Which movies in a library have never been played and were added more than a year ago?" Answered from the jellyfin connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over jellyfin data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R027.2
jellyfin cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**jellyfin cross-source question.** "Which Jellyfin items have no matching Radarr or Sonarr entry, and so cannot be re-fetched?" Requires linking jellyfin to arr and qbittorrent through the ontology concept: media item (title). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R027.3
jellyfin acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**jellyfin acceptance test.** Both questions (EG-CQ-CONN-R027.1 and EG-CQ-CONN-R027.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R027.1 and EG-CQ-CONN-R027.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R028
jena competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**jena competency rollup.** The ontology answers one single-source and one cross-source question over the `jena` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R028.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R028.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R028.1
jena single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**jena single-source question.** "Which named graphs contain the most triples and which have no recent update?" Answered from the jena connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/virtual_graph-v1.ttl`. | A fixture query over jena data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R028.2
jena cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**jena cross-source question.** "Which Jena named graphs describe the same entities as an Egeria-cataloged asset?" Requires linking jena to egeria and sql through the ontology concept: graph / dataset. Vocabulary: `crates/eg-core/ontology/virtual_graph-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R028.3
jena acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**jena acceptance test.** Both questions (EG-CQ-CONN-R028.1 and EG-CQ-CONN-R028.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R028.1 and EG-CQ-CONN-R028.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R029
kafka competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**kafka competency rollup.** The ontology answers one single-source and one cross-source question over the `kafka` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R029.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R029.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R029.1
kafka single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**kafka single-source question.** "Which consumer groups lag by more than a threshold on which topic partitions?" Answered from the kafka connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over kafka data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R029.2
kafka cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**kafka cross-source question.** "Which Kafka consumer groups with sustained lag belong to a service that Grafana is alerting on?" Requires linking kafka to langfuse and lgtm through the ontology concept: topic / service. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R029.3
kafka acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**kafka acceptance test.** Both questions (EG-CQ-CONN-R029.1 and EG-CQ-CONN-R029.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R029.1 and EG-CQ-CONN-R029.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R030
keycloak competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**keycloak competency rollup.** The ontology answers one single-source and one cross-source question over the `keycloak` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R030.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R030.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R030.1
keycloak single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**keycloak single-source question.** "Which clients can a given user sign in to, and through which role?" Answered from the keycloak connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A fixture query over keycloak data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R030.2
keycloak cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**keycloak cross-source question.** "Which people have access to a service that has an open security incident?" Requires linking keycloak to okta and servicenow through the ontology concept: person / service. Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R030.3
keycloak acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**keycloak acceptance test.** Both questions (EG-CQ-CONN-R030.1 and EG-CQ-CONN-R030.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R030.1 and EG-CQ-CONN-R030.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R031
langfuse competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**langfuse competency rollup.** The ontology answers one single-source and one cross-source question over the `langfuse` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R031.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R031.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R031.1
langfuse single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**langfuse single-source question.** "Which traces had the highest token cost and which prompt version produced them?" Answered from the langfuse connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/orchestration-v1.ttl`. | A fixture query over langfuse data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R031.2
langfuse cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**langfuse cross-source question.** "Which prompt versions with falling evaluation scores were last changed by a merged GitHub pull request?" Requires linking langfuse to data-science and github through the ontology concept: prompt / model. Vocabulary: `crates/eg-core/ontology/orchestration-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R031.3
langfuse acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**langfuse acceptance test.** Both questions (EG-CQ-CONN-R031.1 and EG-CQ-CONN-R031.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R031.1 and EG-CQ-CONN-R031.2. Mapping acceptance depends on these producer rows: `promptVersion`: `EG-CQ-CONN-R079.2` (`orchestration-v1.ttl`); `tokenCost`: `EG-CQ-CONN-R079.3` (`orchestration-v1.ttl`); `tracePrompt`: `EG-CQ-CONN-R079.4` (`orchestration-v1.ttl`); `evaluationScore`: `EG-CQ-CONN-R079.5` (`orchestration-v1.ttl`). The acceptance test must preserve `orchestration-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::langfuse` must parse the exact `langfuse` Coverage row and `EG-CQ-CONN-R031.1` / `EG-CQ-CONN-R031.2` Vocabulary cells. It must assert `orchestration-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R032
leanix competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**leanix competency rollup.** The ontology answers one single-source and one cross-source question over the `leanix` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R032.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R032.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R032.1
leanix single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**leanix single-source question.** "Which fact sheets of type application have lifecycle phase end-of-life but still have active users?" Answered from the leanix connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/enterprise-v1.ttl`. | A fixture query over leanix data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R032.2
leanix cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**leanix cross-source question.** "Which end-of-life LeanIX applications still have an active ServiceNow CI and open incidents?" Requires linking leanix to archimate and servicenow through the ontology concept: application. Vocabulary: `crates/eg-core/ontology/enterprise-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R032.3
leanix acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**leanix acceptance test.** Both questions (EG-CQ-CONN-R032.1 and EG-CQ-CONN-R032.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R032.1 and EG-CQ-CONN-R032.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R033
legal-peripherals competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**legal-peripherals competency rollup.** The ontology answers one single-source and one cross-source question over the `legal-peripherals` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R033.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R033.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R033.1
legal-peripherals single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**legal-peripherals single-source question.** "Which contracts expire within 90 days and have no renewal action recorded?" Answered from the legal-peripherals connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A fixture query over legal-peripherals data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R033.2
legal-peripherals cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**legal-peripherals cross-source question.** "Which expiring contracts have a scanned copy in Paperless-ngx and a matching OneTrust vendor assessment?" Requires linking legal-peripherals to paperless-ngx and onetrust through the ontology concept: contract / document. Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R033.3
legal-peripherals acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**legal-peripherals acceptance test.** Both questions (EG-CQ-CONN-R033.1 and EG-CQ-CONN-R033.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R033.1 and EG-CQ-CONN-R033.2. Mapping acceptance depends on these producer rows: `counterparty`: `EG-CQ-CONN-R074.4` (`core-foundation-v1.ttl`); `agreementExpiresAt`: `EG-CQ-CONN-R074.5` (`core-foundation-v1.ttl`); `hasRenewalAction`: `EG-CQ-CONN-R074.6` (`core-foundation-v1.ttl`). The acceptance test must preserve `core-foundation-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::legal_peripherals` must parse the exact `legal-peripherals` Coverage row and `EG-CQ-CONN-R033.1` / `EG-CQ-CONN-R033.2` Vocabulary cells. It must assert `core-foundation-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R034
lgtm competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**lgtm competency rollup.** The ontology answers one single-source and one cross-source question over the `lgtm` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R034.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R034.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R034.1
lgtm single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**lgtm single-source question.** "Which alerts are firing right now, with what severity and for how long?" Answered from the lgtm connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over lgtm data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R034.2
lgtm cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**lgtm cross-source question.** "Which firing Grafana alerts have no open ServiceNow incident, and which incidents have no alert?" Requires linking lgtm to uptime and servicenow through the ontology concept: service / alert. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R034.3
lgtm acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**lgtm acceptance test.** Both questions (EG-CQ-CONN-R034.1 and EG-CQ-CONN-R034.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R034.1 and EG-CQ-CONN-R034.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R035
listmonk competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**listmonk competency rollup.** The ontology answers one single-source and one cross-source question over the `listmonk` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R035.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R035.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R035.1
listmonk single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**listmonk single-source question.** "Which campaigns had an open rate below the list average, and to which lists were they sent?" Answered from the listmonk connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over listmonk data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R035.2
listmonk cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**listmonk cross-source question.** "Which subscribers on a Listmonk list have no matching Twenty contact, and which contacts are unsubscribed?" Requires linking listmonk to twenty and postiz through the ontology concept: contact / audience. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R035.3
listmonk acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**listmonk acceptance test.** Both questions (EG-CQ-CONN-R035.1 and EG-CQ-CONN-R035.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R035.1 and EG-CQ-CONN-R035.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R036
mattermost competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**mattermost competency rollup.** The ontology answers one single-source and one cross-source question over the `mattermost` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R036.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R036.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R036.1
mattermost single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**mattermost single-source question.** "Which channels have had no posts in 90 days but still have more than ten members?" Answered from the mattermost connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over mattermost data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R036.2
mattermost cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**mattermost cross-source question.** "Which Mattermost members have no active identity-provider account, and which people lack a Mattermost account?" Requires linking mattermost to keycloak and okta through the ontology concept: person. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R036.3
mattermost acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**mattermost acceptance test.** Both questions (EG-CQ-CONN-R036.1 and EG-CQ-CONN-R036.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R036.1 and EG-CQ-CONN-R036.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R037
mealie competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**mealie competency rollup.** The ontology answers one single-source and one cross-source question over the `mealie` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R037.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R037.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R037.1
mealie single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**mealie single-source question.** "Which recipes use an ingredient that is also on the current shopping list?" Answered from the mealie connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A fixture query over mealie data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R037.2
mealie cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**mealie cross-source question.** "Which planned Mealie meals exceed the daily calorie target set in wger, and what did the groceries cost in Firefly III?" Requires linking mealie to wger and firefly-iii through the ontology concept: food / ingredient. Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R037.3
mealie acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**mealie acceptance test.** Both questions (EG-CQ-CONN-R037.1 and EG-CQ-CONN-R037.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R037.1 and EG-CQ-CONN-R037.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R038
media-downloader competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**media-downloader competency rollup.** The ontology answers one single-source and one cross-source question over the `media-downloader` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R038.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R038.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R038.1
media-downloader single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**media-downloader single-source question.** "Which download jobs failed in the last week, with what error, for which source URL?" Answered from the media-downloader connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over media-downloader data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R038.2
media-downloader cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**media-downloader cross-source question.** "Which completed downloads were never added to Jellyfin or Audiobookshelf?" Requires linking media-downloader to audiobookshelf and jellyfin through the ontology concept: media item / URL. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R038.3
media-downloader acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**media-downloader acceptance test.** Both questions (EG-CQ-CONN-R038.1 and EG-CQ-CONN-R038.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R038.1 and EG-CQ-CONN-R038.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R039
microsoft competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**microsoft competency rollup.** The ontology answers one single-source and one cross-source question over the `microsoft` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R039.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R039.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R039.1
microsoft single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**microsoft single-source question.** "Which meetings tomorrow overlap, and which attendees are double-booked?" Answered from the microsoft connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/calendar-v1.ttl`. | A fixture query over microsoft data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R039.2
microsoft cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**microsoft cross-source question.** "Which attendees of an upcoming meeting have no identity-provider account or Mattermost presence?" Requires linking microsoft to okta and mattermost through the ontology concept: person. Vocabulary: `crates/eg-core/ontology/calendar-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R039.3
microsoft acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**microsoft acceptance test.** Both questions (EG-CQ-CONN-R039.1 and EG-CQ-CONN-R039.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R039.1 and EG-CQ-CONN-R039.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R040
nextcloud competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**nextcloud competency rollup.** The ontology answers one single-source and one cross-source question over the `nextcloud` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R040.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R040.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R040.1
nextcloud single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**nextcloud single-source question.** "Which shared folders are accessible by external links and when do those shares expire?" Answered from the nextcloud connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A fixture query over nextcloud data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R040.2
nextcloud cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**nextcloud cross-source question.** "Which publicly shared Nextcloud files also exist as Paperless-ngx documents tagged confidential?" Requires linking nextcloud to keycloak and paperless-ngx through the ontology concept: file / person. Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R040.3
nextcloud acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**nextcloud acceptance test.** Both questions (EG-CQ-CONN-R040.1 and EG-CQ-CONN-R040.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R040.1 and EG-CQ-CONN-R040.2. Mapping acceptance depends on these producer rows: `FileShare`: `EG-CQ-CONN-R076.6` (`personal-v1.ttl`); `sharesFile`: `EG-CQ-CONN-R076.7` (`personal-v1.ttl`); `isPublicLink`: `EG-CQ-CONN-R076.8` (`personal-v1.ttl`); `shareExpiresAt`: `EG-CQ-CONN-R076.9` (`personal-v1.ttl`). The acceptance test must preserve `personal-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::nextcloud` must parse the exact `nextcloud` Coverage row and `EG-CQ-CONN-R040.1` / `EG-CQ-CONN-R040.2` Vocabulary cells. It must assert `personal-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R041
objectstore competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**objectstore competency rollup.** The ontology answers one single-source and one cross-source question over the `objectstore` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R041.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R041.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R041.1
objectstore single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**objectstore single-source question.** "Which buckets hold the most data and which objects have not been read in a year?" Answered from the objectstore connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over objectstore data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R041.2
objectstore cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**objectstore cross-source question.** "Which object-store artifacts are not referenced by any model or dataset in the data-science connector?" Requires linking objectstore to data-science and documentdb through the ontology concept: dataset / artifact. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R041.3
objectstore acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**objectstore acceptance test.** Both questions (EG-CQ-CONN-R041.1 and EG-CQ-CONN-R041.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R041.1 and EG-CQ-CONN-R041.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R042
okta competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**okta competency rollup.** The ontology answers one single-source and one cross-source question over the `okta` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R042.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R042.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R042.1
okta single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**okta single-source question.** "Which users hold a given application assignment through which group?" Answered from the okta connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A fixture query over okta data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R042.2
okta cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**okta cross-source question.** "Which Okta users were deactivated but still hold a Keycloak role or an open ServiceNow assignment?" Requires linking okta to keycloak and servicenow through the ontology concept: person / role. Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R042.3
okta acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**okta acceptance test.** Both questions (EG-CQ-CONN-R042.1 and EG-CQ-CONN-R042.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R042.1 and EG-CQ-CONN-R042.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R043
onetrust competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**onetrust competency rollup.** The ontology answers one single-source and one cross-source question over the `onetrust` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R043.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R043.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R043.1
onetrust single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**onetrust single-source question.** "Which privacy assessments are overdue and which processing activities do they cover?" Answered from the onetrust connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A fixture query over onetrust data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R043.2
onetrust cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**onetrust cross-source question.** "Which vendors with an overdue OneTrust assessment have open ERPNext purchase orders?" Requires linking onetrust to ciso-assistant and erpnext through the ontology concept: processing activity / vendor. Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R043.3
onetrust acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**onetrust acceptance test.** Both questions (EG-CQ-CONN-R043.1 and EG-CQ-CONN-R043.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R043.1 and EG-CQ-CONN-R043.2. Mapping acceptance depends on these producer rows: `PrivacyAssessment`: `EG-CQ-CONN-R073.6` (`government-v1.ttl`); `ProcessingActivity`: `EG-CQ-CONN-R073.7` (`government-v1.ttl`); `assessmentCovers`: `EG-CQ-CONN-R073.8` (`government-v1.ttl`); `assessmentDueDate`: `EG-CQ-CONN-R073.9` (`government-v1.ttl`); `assessedVendor`: `EG-CQ-CONN-R073.10` (`government-v1.ttl`); `assessmentStatus`: `EG-CQ-CONN-R073.11` (`government-v1.ttl`). The acceptance test must preserve `government-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::onetrust` must parse the exact `onetrust` Coverage row and `EG-CQ-CONN-R043.1` / `EG-CQ-CONN-R043.2` Vocabulary cells. It must assert `government-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R044
openbao competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**openbao competency rollup.** The ontology answers one single-source and one cross-source question over the `openbao` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R044.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R044.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R044.1
openbao single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**openbao single-source question.** "Which secret paths have not been rotated in 180 days, and which policies grant read on them?" Answered from the openbao connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over openbao data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R044.2
openbao cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**openbao cross-source question.** "Which services running in container-manager read a secret path that has no recent rotation?" Requires linking openbao to keycloak and container-manager through the ontology concept: secret / service. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R044.3
openbao acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**openbao acceptance test.** Both questions (EG-CQ-CONN-R044.1 and EG-CQ-CONN-R044.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R044.1 and EG-CQ-CONN-R044.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R045
owncast competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**owncast competency rollup.** The ontology answers one single-source and one cross-source question over the `owncast` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R045.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R045.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R045.1
owncast single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**owncast single-source question.** "Which streams had the highest peak viewer count and how long did they run?" Answered from the owncast connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over owncast data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R045.2
owncast cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**owncast cross-source question.** "Which Owncast broadcasts were announced through a Postiz post, and what was the audience versus the post reach?" Requires linking owncast to postiz and mattermost through the ontology concept: broadcast / audience. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R045.3
owncast acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**owncast acceptance test.** Both questions (EG-CQ-CONN-R045.1 and EG-CQ-CONN-R045.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R045.1 and EG-CQ-CONN-R045.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R046
paperless-ngx competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**paperless-ngx competency rollup.** The ontology answers one single-source and one cross-source question over the `paperless-ngx` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R046.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R046.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R046.1
paperless-ngx single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**paperless-ngx single-source question.** "Which documents tagged as invoice have no correspondent or no due date?" Answered from the paperless-ngx connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A fixture query over paperless-ngx data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R046.2
paperless-ngx cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**paperless-ngx cross-source question.** "Which Paperless-ngx invoices have no matching ERPNext purchase invoice or Firefly III expense?" Requires linking paperless-ngx to erpnext and firefly-iii through the ontology concept: document / invoice. Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R046.3
paperless-ngx acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**paperless-ngx acceptance test.** Both questions (EG-CQ-CONN-R046.1 and EG-CQ-CONN-R046.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R046.1 and EG-CQ-CONN-R046.2. Mapping acceptance depends on these producer rows: `documentType`: `EG-CQ-CONN-R076.3` (`personal-v1.ttl`); `dueDate`: `EG-CQ-CONN-R076.4` (`personal-v1.ttl`); `totalAmount`: `EG-CQ-CONN-R076.5` (`personal-v1.ttl`). The acceptance test must preserve `personal-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::paperless_ngx` must parse the exact `paperless-ngx` Coverage row and `EG-CQ-CONN-R046.1` / `EG-CQ-CONN-R046.2` Vocabulary cells. It must assert `personal-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R047
plane competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**plane competency rollup.** The ontology answers one single-source and one cross-source question over the `plane` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R047.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R047.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R047.1
plane single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**plane single-source question.** "Which work items in the active cycle are overdue and which module do they belong to?" Answered from the plane connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over plane data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R047.2
plane cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**plane cross-source question.** "Which Plane work items link to a GitHub pull request that has merged but are not marked done?" Requires linking plane to github and atlassian through the ontology concept: work item. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R047.3
plane acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**plane acceptance test.** Both questions (EG-CQ-CONN-R047.1 and EG-CQ-CONN-R047.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R047.1 and EG-CQ-CONN-R047.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R048
portainer competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**portainer competency rollup.** The ontology answers one single-source and one cross-source question over the `portainer` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R048.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R048.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R048.1
portainer single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**portainer single-source question.** "Which stacks have services with fewer running replicas than desired, and on which endpoint?" Answered from the portainer connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over portainer data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R048.2
portainer cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**portainer cross-source question.** "Which Portainer stacks deploy from a Git repository whose latest GitLab pipeline failed?" Requires linking portainer to container-manager and gitlab through the ontology concept: stack / repository. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R048.3
portainer acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**portainer acceptance test.** Both questions (EG-CQ-CONN-R048.1 and EG-CQ-CONN-R048.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R048.1 and EG-CQ-CONN-R048.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R049
postiz competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**postiz competency rollup.** The ontology answers one single-source and one cross-source question over the `postiz` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R049.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R049.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R049.1
postiz single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**postiz single-source question.** "Which scheduled posts failed to publish and on which channel?" Answered from the postiz connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over postiz data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R049.2
postiz cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**postiz cross-source question.** "Which Postiz posts promote a campaign that Listmonk also sent, and which got the better engagement?" Requires linking postiz to owncast and listmonk through the ontology concept: campaign / channel. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R049.3
postiz acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**postiz acceptance test.** Both questions (EG-CQ-CONN-R049.1 and EG-CQ-CONN-R049.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R049.1 and EG-CQ-CONN-R049.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R050
pulselink competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**pulselink competency rollup.** The ontology answers one single-source and one cross-source question over the `pulselink` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R050.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R050.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R050.1
pulselink single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**pulselink single-source question.** "Which videos on a topic had transcripts mentioning a given term this week?" Answered from the pulselink connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over pulselink data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R050.2
pulselink cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**pulselink cross-source question.** "Which topics appear in PulseLink video transcripts and SearXNG news but not in any archived page?" Requires linking pulselink to searxng and audio-transcriber through the ontology concept: topic / transcript. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R050.3
pulselink acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**pulselink acceptance test.** Both questions (EG-CQ-CONN-R050.1 and EG-CQ-CONN-R050.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R050.1 and EG-CQ-CONN-R050.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R051
qbittorrent competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**qbittorrent competency rollup.** The ontology answers one single-source and one cross-source question over the `qbittorrent` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R051.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R051.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R051.1
qbittorrent single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**qbittorrent single-source question.** "Which torrents are stalled, with what ratio and how long since last activity?" Answered from the qbittorrent connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over qbittorrent data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R051.2
qbittorrent cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**qbittorrent cross-source question.** "Which stalled torrents belong to a wanted Radarr or Sonarr title, and so block it from import?" Requires linking qbittorrent to arr and jellyfin through the ontology concept: media item (torrent). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R051.3
qbittorrent acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**qbittorrent acceptance test.** Both questions (EG-CQ-CONN-R051.1 and EG-CQ-CONN-R051.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R051.1 and EG-CQ-CONN-R051.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R052
repository-manager competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**repository-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `repository-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R052.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R052.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R052.1
repository-manager single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**repository-manager single-source question.** "Which worktrees are stale or dangling relative to their base branch?" Answered from the repository-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over repository-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R052.2
repository-manager cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**repository-manager cross-source question.** "Which local worktrees track a branch whose pull request has already been merged on GitHub or GitLab?" Requires linking repository-manager to github and gitlab through the ontology concept: repository / branch. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R052.3
repository-manager acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**repository-manager acceptance test.** Both questions (EG-CQ-CONN-R052.1 and EG-CQ-CONN-R052.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R052.1 and EG-CQ-CONN-R052.2. Mapping acceptance depends on these producer rows: `Worktree`: `EG-CQ-CONN-R069.20` (`sdlc_lifecycle-v1.ttl`); `worktreeState`: `EG-CQ-CONN-R069.21` (`sdlc_lifecycle-v1.ttl`); `tracksBranch`: `EG-CQ-CONN-R069.22` (`sdlc_lifecycle-v1.ttl`); `proposalBranch`: `EG-CQ-CONN-R069.23` (`sdlc_lifecycle-v1.ttl`); `Repository`: `EG-CQ-CONN-R069.2` (`sdlc_lifecycle-v1.ttl`); `Branch`: `EG-CQ-CONN-R069.3` (`sdlc_lifecycle-v1.ttl`); `proposalState`: `EG-CQ-CONN-R069.11` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `sdlc_lifecycle-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::repository_manager` must parse the exact `repository-manager` Coverage row and `EG-CQ-CONN-R052.1` / `EG-CQ-CONN-R052.2` Vocabulary cells. It must assert `sdlc_lifecycle-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R053
rom-manager competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**rom-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `rom-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R053.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R053.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R053.1
rom-manager single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**rom-manager single-source question.** "Which ROMs in a platform collection fail a checksum match against the reference set?" Answered from the rom-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over rom-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R053.2
rom-manager cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**rom-manager cross-source question.** "Which ROMs were obtained by a media-downloader job and which are still unconverted?" Requires linking rom-manager to media-downloader and jellyfin through the ontology concept: game / file. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R053.3
rom-manager acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**rom-manager acceptance test.** Both questions (EG-CQ-CONN-R053.1 and EG-CQ-CONN-R053.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R053.1 and EG-CQ-CONN-R053.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R054
salesforce competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**salesforce competency rollup.** The ontology answers one single-source and one cross-source question over the `salesforce` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R054.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R054.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R054.1
salesforce single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**salesforce single-source question.** "Which open opportunities close this quarter, with what amount and owner?" Answered from the salesforce connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A fixture query over salesforce data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R054.2
salesforce cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**salesforce cross-source question.** "Which Salesforce accounts have an open ServiceNow incident and an opportunity closing this quarter?" Requires linking salesforce to twenty and servicenow through the ontology concept: account / customer. Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R054.3
salesforce acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**salesforce acceptance test.** Both questions (EG-CQ-CONN-R054.1 and EG-CQ-CONN-R054.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R054.1 and EG-CQ-CONN-R054.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R055
scholarx competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**scholarx competency rollup.** The ontology answers one single-source and one cross-source question over the `scholarx` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R055.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R055.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R055.1
scholarx single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**scholarx single-source question.** "Which papers cite a given paper and were published in the last two years?" Answered from the scholarx connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over scholarx data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R055.2
scholarx cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**scholarx cross-source question.** "Which papers on a topic are in ScholarX but were never surfaced by a SearXNG query for that topic?" Requires linking scholarx to searxng and langfuse through the ontology concept: paper / topic. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R055.3
scholarx acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**scholarx acceptance test.** Both questions (EG-CQ-CONN-R055.1 and EG-CQ-CONN-R055.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R055.1 and EG-CQ-CONN-R055.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R056
searxng competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**searxng competency rollup.** The ontology answers one single-source and one cross-source question over the `searxng` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R056.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R056.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R056.1
searxng single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**searxng single-source question.** "Which engines returned no results for a given query, and which returned the most?" Answered from the searxng connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over searxng data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R056.2
searxng cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**searxng cross-source question.** "Which URLs from a SearXNG query are not yet archived in ArchiveBox?" Requires linking searxng to freshrss and archivebox through the ontology concept: URL / query. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R056.3
searxng acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**searxng acceptance test.** Both questions (EG-CQ-CONN-R056.1 and EG-CQ-CONN-R056.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R056.1 and EG-CQ-CONN-R056.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R057
servicenow competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**servicenow competency rollup.** The ontology answers one single-source and one cross-source question over the `servicenow` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R057.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R057.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R057.1
servicenow single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**servicenow single-source question.** "Which incidents are open on a given configuration item and who is assigned?" Answered from the servicenow connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A fixture query over servicenow data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R057.2
servicenow cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**servicenow cross-source question.** "Which open incidents on a CI also show a Grafana alert and a failing Uptime Kuma monitor?" Requires linking servicenow to okta and lgtm through the ontology concept: configuration item / service. Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R057.3
servicenow acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**servicenow acceptance test.** Both questions (EG-CQ-CONN-R057.1 and EG-CQ-CONN-R057.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R057.1 and EG-CQ-CONN-R057.2. Mapping acceptance depends on these producer rows: `ConfigurationItem`: `EG-CQ-CONN-R070.5` (`archimate-v1.ttl`); `affectsConfigurationItem`: `EG-CQ-CONN-R070.6` (`archimate-v1.ttl`); `incidentState`: `EG-CQ-CONN-R070.7` (`archimate-v1.ttl`); `incidentAssignee`: `EG-CQ-CONN-R070.8` (`archimate-v1.ttl`). The acceptance test must preserve `archimate-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::servicenow` must parse the exact `servicenow` Coverage row and `EG-CQ-CONN-R057.1` / `EG-CQ-CONN-R057.2` Vocabulary cells. It must assert `archimate-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R058
sql competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**sql competency rollup.** The ontology answers one single-source and one cross-source question over the `sql` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R058.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R058.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R058.1
sql single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**sql single-source question.** "Which tables have no primary key, and which columns reference tables that do not exist?" Answered from the sql connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over sql data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R058.2
sql cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**sql cross-source question.** "Which SQL tables are not cataloged in Egeria, and which cataloged tables no longer exist?" Requires linking sql to egeria and documentdb through the ontology concept: table / data asset. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R058.3
sql acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**sql acceptance test.** Both questions (EG-CQ-CONN-R058.1 and EG-CQ-CONN-R058.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R058.1 and EG-CQ-CONN-R058.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R059
stirlingpdf competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**stirlingpdf competency rollup.** The ontology answers one single-source and one cross-source question over the `stirlingpdf` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R059.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R059.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R059.1
stirlingpdf single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**stirlingpdf single-source question.** "Which operations failed on which PDFs and with what error?" Answered from the stirlingpdf connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/action-v1.ttl`. | A fixture query over stirlingpdf data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R059.2
stirlingpdf cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**stirlingpdf cross-source question.** "Which PDFs processed by Stirling-PDF were stored in Paperless-ngx or Nextcloud, and which were not?" Requires linking stirlingpdf to paperless-ngx and nextcloud through the ontology concept: document. Vocabulary: `crates/eg-core/ontology/action-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R059.3
stirlingpdf acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**stirlingpdf acceptance test.** Both questions (EG-CQ-CONN-R059.1 and EG-CQ-CONN-R059.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R059.1 and EG-CQ-CONN-R059.2. Mapping acceptance depends on these producer rows: `failureReason`: `EG-CQ-CONN-R082.1` (`action-v1.ttl`). The acceptance test must preserve `action-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::stirlingpdf` must parse the exact `stirlingpdf` Coverage row and `EG-CQ-CONN-R059.1` / `EG-CQ-CONN-R059.2` Vocabulary cells. It must assert `action-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R060
systems-manager competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**systems-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `systems-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R060.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R060.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R060.1
systems-manager single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**systems-manager single-source question.** "Which hosts have pending OS updates and what is their uptime?" Answered from the systems-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over systems-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R060.2
systems-manager cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**systems-manager cross-source question.** "Which hosts with pending updates have no Ansible Tower patch job scheduled and no ServiceNow change?" Requires linking systems-manager to ansible-tower and servicenow through the ontology concept: host (configuration item). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R060.3
systems-manager acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**systems-manager acceptance test.** Both questions (EG-CQ-CONN-R060.1 and EG-CQ-CONN-R060.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R060.1 and EG-CQ-CONN-R060.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R061
technitium-dns competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**technitium-dns competency rollup.** The ontology answers one single-source and one cross-source question over the `technitium-dns` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R061.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R061.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R061.1
technitium-dns single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**technitium-dns single-source question.** "Which zones contain records pointing to an address that no host answers on?" Answered from the technitium-dns connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over technitium-dns data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R061.2
technitium-dns cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**technitium-dns cross-source question.** "Which DNS A records have no Caddy route and no Uptime Kuma monitor?" Requires linking technitium-dns to caddy and uptime through the ontology concept: hostname. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R061.3
technitium-dns acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**technitium-dns acceptance test.** Both questions (EG-CQ-CONN-R061.1 and EG-CQ-CONN-R061.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R061.1 and EG-CQ-CONN-R061.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R062
tunnel-manager competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**tunnel-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `tunnel-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R062.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R062.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R062.1
tunnel-manager single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**tunnel-manager single-source question.** "Which SSH hosts in the inventory failed their last connection, and with what error?" Answered from the tunnel-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over tunnel-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R062.2
tunnel-manager cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**tunnel-manager cross-source question.** "Which hosts that tunnel-manager cannot reach are still listed as managed in Ansible Tower?" Requires linking tunnel-manager to ansible-tower and systems-manager through the ontology concept: host. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R062.3
tunnel-manager acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**tunnel-manager acceptance test.** Both questions (EG-CQ-CONN-R062.1 and EG-CQ-CONN-R062.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R062.1 and EG-CQ-CONN-R062.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R063
twenty competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**twenty competency rollup.** The ontology answers one single-source and one cross-source question over the `twenty` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R063.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R063.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R063.1
twenty single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**twenty single-source question.** "Which people at a company have no logged activity in the last 60 days while a deal is open?" Answered from the twenty connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A fixture query over twenty data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R063.2
twenty cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**twenty cross-source question.** "Which Twenty contacts also exist as Salesforce contacts with different email addresses?" Requires linking twenty to salesforce and listmonk through the ontology concept: person / company. Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R063.3
twenty acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**twenty acceptance test.** Both questions (EG-CQ-CONN-R063.1 and EG-CQ-CONN-R063.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R063.1 and EG-CQ-CONN-R063.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R064
uptime competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**uptime competency rollup.** The ontology answers one single-source and one cross-source question over the `uptime` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R064.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R064.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R064.1
uptime single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**uptime single-source question.** "Which monitored services were down in the last 24 hours and for how long?" Answered from the uptime connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over uptime data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R064.2
uptime cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**uptime cross-source question.** "Which services Uptime Kuma saw down had a Grafana alert or a Caddy route error at the same time?" Requires linking uptime to lgtm and caddy through the ontology concept: service / hostname. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R064.3
uptime acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**uptime acceptance test.** Both questions (EG-CQ-CONN-R064.1 and EG-CQ-CONN-R064.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R064.1 and EG-CQ-CONN-R064.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R065
vector competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**vector competency rollup.** The ontology answers one single-source and one cross-source question over the `vector` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R065.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R065.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R065.1
vector single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**vector single-source question.** "Which collections have the most vectors and which have an embedding dimension that mismatches the model?" Answered from the vector connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over vector data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R065.2
vector cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**vector cross-source question.** "Which Paperless-ngx documents have no embedding stored in the vector database?" Requires linking vector to data-science and paperless-ngx through the ontology concept: embedding / document. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R065.3
vector acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**vector acceptance test.** Both questions (EG-CQ-CONN-R065.1 and EG-CQ-CONN-R065.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R065.1 and EG-CQ-CONN-R065.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R066
wger competency rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**wger competency rollup.** The ontology answers one single-source and one cross-source question over the `wger` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R066.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R066.1 to .3 are LANDED.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R066.1
wger single-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**wger single-source question.** "Which workout routines were not completed in the last two weeks and which exercises were skipped?" Answered from the wger connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A fixture query over wger data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R066.2
wger cross-source question
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**wger cross-source question.** "Which weeks of low workout completion coincide with a Mealie meal plan above the calorie target?" Requires linking wger to mealie and home-assistant through the ontology concept: person / nutrition plan. Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R066.3
wger acceptance test
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**wger acceptance test.** Both questions (EG-CQ-CONN-R066.1 and EG-CQ-CONN-R066.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R066.1 and EG-CQ-CONN-R066.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R067
Contract kinds rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Contract kinds rollup.** For each access-contract kind the ontology can declare a source of that kind and the engine answers a question by fetching through the contract at query time, with no copy of the source in the engine; delivered as children `EG-CQ-CONN-R067.1` to `EG-CQ-CONN-R067.6`. Mechanism: `specs/federated-query-and-reasoning` and `specs/unified-data-plane`; no new functionality outside them. | All children verified.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R067.1
MCP contract answers at query time
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**MCP contract answers at query time.** One acceptance test declares a connector that exposes MCP tools and resources in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R067.2
A2A contract answers at query time
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**A2A contract answers at query time.** One acceptance test declares an external agent reached over the A2A protocol in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R067.3
API (REST) contract answers at query time
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**API (REST) contract answers at query time.** One acceptance test declares a connector that calls an HTTP API described by an operation contract in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R067.4
GraphQL contract answers at query time
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**GraphQL contract answers at query time.** One acceptance test declares a connector whose source speaks GraphQL in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R067.5
virtual graph over a relational or document store contract answers at query time
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**virtual graph over a relational or document store contract answers at query time.** One acceptance test declares a SQL or document source mapped by a virtual-graph mapping in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R067.6
Materialisation is declared, never implicit
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Materialisation is declared, never implicit.** A source may be copied into the engine only when its ontology declaration states a materialisation policy with a reason; a source with no such statement is always fetched at query time. | One test asserts a source without a materialisation statement stores no rows after a query, and one with the statement does.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068
infrastructure-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**infrastructure-v1.ttl additions rollup.** 26 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R068.1` to `EG-CQ-CONN-R068.26`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.1
shapes companion for infrastructure-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for infrastructure-v1.** Create `crates/eg-core/ontology/infrastructure-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `infrastructure` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_infrastructure_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.2
AutomationJob
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**AutomationJob.** Add owl:Class `:AutomationJob` (subClassOf :Workload-adjacent bfo process; one Tower job run) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: AutomationJob: jobStatus minCount 1, in `infrastructure-v1.shapes.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::AutomationJob_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.3
AutomationJobTemplate
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**AutomationJobTemplate.** Add owl:Class `:AutomationJobTemplate` (template a job instantiates) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::AutomationJobTemplate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.4
jobStatus
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**jobStatus.** Add owl:DatatypeProperty `:jobStatus` (AutomationJob -> xsd:string (successful|failed|running|canceled)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: sh:in on jobStatus, in `infrastructure-v1.shapes.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::jobStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.5
ranAgainstHost
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ranAgainstHost.** Add owl:ObjectProperty `:ranAgainstHost` (AutomationJob -> :Host) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::ranAgainstHost_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.6
routeHostname
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**routeHostname.** Add owl:DatatypeProperty `:routeHostname` (ProxyRoute -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: routeHostname minCount 1 on ProxyRoute, in `infrastructure-v1.shapes.ttl`. Needed by: caddy. | `ontology_audit_infrastructure_v1::routeHostname_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.7
upstreamAddress
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**upstreamAddress.** Add owl:DatatypeProperty `:upstreamAddress` (ProxyRoute -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: caddy. | `ontology_audit_infrastructure_v1::upstreamAddress_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.8
Alert
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Alert.** Add owl:Class `:Alert` (a firing or resolved alert rule instance on a :Service) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: Alert: alertSeverity, alertState minCount 1, in `infrastructure-v1.shapes.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::Alert_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.9
alertSeverity
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**alertSeverity.** Add owl:DatatypeProperty `:alertSeverity` (Alert -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::alertSeverity_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.10
alertState
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**alertState.** Add owl:DatatypeProperty `:alertState` (Alert -> xsd:string (firing|resolved|pending)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::alertState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.11
firingSince
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**firingSince.** Add owl:DatatypeProperty `:firingSince` (Alert -> xsd:dateTime) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::firingSince_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.12
alertsOn
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**alertsOn.** Add owl:ObjectProperty `:alertsOn` (Alert -> :Service) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::alertsOn_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.13
lastPushedAt
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**lastPushedAt.** Add owl:DatatypeProperty `:lastPushedAt` (ContainerImage -> xsd:dateTime) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: dockerhub. | `ontology_audit_infrastructure_v1::lastPushedAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.14
pullCount
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**pullCount.** Add owl:DatatypeProperty `:pullCount` (ContainerImage -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: pullCount minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: dockerhub. | `ontology_audit_infrastructure_v1::pullCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.15
entityState
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**entityState.** Add owl:DatatypeProperty `:entityState` (ha :Entity -> xsd:string (value or unavailable)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: home-assistant. | `ontology_audit_infrastructure_v1::entityState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.16
unavailableSince
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**unavailableSince.** Add owl:DatatypeProperty `:unavailableSince` (ha :Entity -> xsd:dateTime) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: home-assistant. | `ontology_audit_infrastructure_v1::unavailableSince_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.17
desiredReplicas
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**desiredReplicas.** Add owl:DatatypeProperty `:desiredReplicas` (ContainerStack -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::desiredReplicas_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.18
runningReplicas
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**runningReplicas.** Add owl:DatatypeProperty `:runningReplicas` (ContainerStack -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::runningReplicas_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.19
stackSourceRepository
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**stackSourceRepository.** Add owl:ObjectProperty `:stackSourceRepository` (ContainerStack -> :Repository) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::stackSourceRepository_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.20
ManagementEnvironment
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ManagementEnvironment.** Add owl:Class `:ManagementEnvironment` (a Portainer environment (named so it does not collide with the probed :Endpoint)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::ManagementEnvironment_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.21
pendingUpdateCount
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**pendingUpdateCount.** Add owl:DatatypeProperty `:pendingUpdateCount` (OperatingSystem -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: systems-manager. | `ontology_audit_infrastructure_v1::pendingUpdateCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.22
uptimeSeconds
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**uptimeSeconds.** Add owl:DatatypeProperty `:uptimeSeconds` (OperatingSystem -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: systems-manager. | `ontology_audit_infrastructure_v1::uptimeSeconds_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.23
recordType
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**recordType.** Add owl:DatatypeProperty `:recordType` (DnsRecord -> xsd:string (the existing :dnsType is typed on :DNSService, not the record)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: technitium-dns. | `ontology_audit_infrastructure_v1::recordType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.24
recordValue
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**recordValue.** Add owl:DatatypeProperty `:recordValue` (DnsRecord -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: technitium-dns. | `ontology_audit_infrastructure_v1::recordValue_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.25
lastConnectionStatus
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**lastConnectionStatus.** Add owl:DatatypeProperty `:lastConnectionStatus` (Host -> xsd:string (ok|failed)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: tunnel-manager. | `ontology_audit_infrastructure_v1::lastConnectionStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R068.26
lastConnectionError
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**lastConnectionError.** Add owl:DatatypeProperty `:lastConnectionError` (Host -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: tunnel-manager. | `ontology_audit_infrastructure_v1::lastConnectionError_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069
sdlc_lifecycle-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**sdlc_lifecycle-v1.ttl additions rollup.** 23 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R069.1` to `EG-CQ-CONN-R069.23`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.1
shapes companion for sdlc_lifecycle-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for sdlc_lifecycle-v1.** Create `crates/eg-core/ontology/sdlc_lifecycle-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `sdlc_lifecycle` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_sdlc_lifecycle_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.2
Repository
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Repository.** Add owl:Class `:Repository` (source repository (class used by infra:ContainerImage/aliasOf but never declared)) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: dockerhub, github, repository-manager. | `ontology_audit_sdlc_lifecycle_v1::Repository_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.3
Branch
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Branch.** Add owl:Class `:Branch` (a ref in a Repository) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab, repository-manager. | `ontology_audit_sdlc_lifecycle_v1::Branch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.4
branchOf
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**branchOf.** Add owl:ObjectProperty `:branchOf` (Branch -> Repository) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::branchOf_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.5
headCommit
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**headCommit.** Add owl:ObjectProperty `:headCommit` (Branch -> software:Commit) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::headCommit_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.6
isDefaultBranch
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**isDefaultBranch.** Add owl:DatatypeProperty `:isDefaultBranch` (Branch -> xsd:boolean) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::isDefaultBranch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.7
blockedBy
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**blockedBy.** Add owl:ObjectProperty `:blockedBy` (Ticket -> Ticket) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian. | `ontology_audit_sdlc_lifecycle_v1::blockedBy_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.8
assignedTo
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**assignedTo.** Add owl:ObjectProperty `:assignedTo` (Ticket -> :Person) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian. | `ontology_audit_sdlc_lifecycle_v1::assignedTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.9
ticketStatus
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ticketStatus.** Add owl:DatatypeProperty `:ticketStatus` (Ticket -> xsd:string) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian, plane. | `ontology_audit_sdlc_lifecycle_v1::ticketStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.10
closesTicket
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**closesTicket.** Add owl:ObjectProperty `:closesTicket` (CodeChangeProposal -> Ticket) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian, github. | `ontology_audit_sdlc_lifecycle_v1::closesTicket_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.11
proposalState
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**proposalState.** Add owl:DatatypeProperty `:proposalState` (CodeChangeProposal -> xsd:string (open|merged|closed)) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. SHACL: sh:in, in `sdlc_lifecycle-v1.shapes.ttl`. Needed by: atlassian, github, repository-manager. | `ontology_audit_sdlc_lifecycle_v1::proposalState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.12
requestedReviewer
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**requestedReviewer.** Add owl:ObjectProperty `:requestedReviewer` (CodeChangeProposal -> :Person) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: github. | `ontology_audit_sdlc_lifecycle_v1::requestedReviewer_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.13
PipelineJob
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**PipelineJob.** Add owl:Class `:PipelineJob` (one job inside a PipelineRun) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::PipelineJob_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.14
pipelineJobOf
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**pipelineJobOf.** Add owl:ObjectProperty `:pipelineJobOf` (PipelineJob -> PipelineRun) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::pipelineJobOf_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.15
IterationCycle
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**IterationCycle.** Add owl:Class `:IterationCycle` (Plane cycle / sprint) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::IterationCycle_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.16
inCycle
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**inCycle.** Add owl:ObjectProperty `:inCycle` (Ticket -> IterationCycle) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::inCycle_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.17
WorkModule
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**WorkModule.** Add owl:Class `:WorkModule` (Plane module grouping tickets) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::WorkModule_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.18
inModule
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**inModule.** Add owl:ObjectProperty `:inModule` (Ticket -> WorkModule) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::inModule_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.19
ticketDueDate
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ticketDueDate.** Add owl:DatatypeProperty `:ticketDueDate` (Ticket -> xsd:date) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::ticketDueDate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.20
Worktree
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Worktree.** Add owl:Class `:Worktree` (a linked git worktree of a Repository) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::Worktree_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.21
worktreeState
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**worktreeState.** Add owl:DatatypeProperty `:worktreeState` (Worktree -> xsd:string (active|stale|dangling|merged)) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. SHACL: sh:in, in `sdlc_lifecycle-v1.shapes.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::worktreeState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.22
tracksBranch
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**tracksBranch.** Add owl:ObjectProperty `:tracksBranch` (Worktree -> Branch) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::tracksBranch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R069.23
proposalBranch
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**proposalBranch.** Add owl:ObjectProperty `:proposalBranch` (CodeChangeProposal -> Branch) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::proposalBranch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R070
archimate-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**archimate-v1.ttl additions rollup.** 8 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R070.1` to `EG-CQ-CONN-R070.8`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R070.1
shapes companion for archimate-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for archimate-v1.** Create `crates/eg-core/ontology/archimate-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `archimate` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_archimate_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R070.2
ApplicationComponent
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ApplicationComponent.** Add owl:Class `:ApplicationComponent` (subClassOf :ApplicationLayer; anchor for LeanIX/Backstage components) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: archimate. | `ontology_audit_archimate_v1::ApplicationComponent_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R070.3
ArchimateRelationship
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ArchimateRelationship.** Add owl:Class `:ArchimateRelationship` (reified relationship) to `crates/eg-core/ontology/archimate-v1.ttl`. SHACL: ArchimateRelationship: relationshipType, relSource, relTarget minCount 1, in `archimate-v1.shapes.ttl`. Needed by: archimate. | `ontology_audit_archimate_v1::ArchimateRelationship_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R070.4
relationshipType
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**relationshipType.** Add owl:DatatypeProperty `:relationshipType` (ArchimateRelationship -> xsd:string (Serving|Realization|Assignment|...)) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: archimate. | `ontology_audit_archimate_v1::relationshipType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R070.5
ConfigurationItem
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ConfigurationItem.** Add owl:Class `:ConfigurationItem` (subClassOf :ApplicationLayer; crosswalk anchor for a ServiceNow CI) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::ConfigurationItem_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R070.6
affectsConfigurationItem
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**affectsConfigurationItem.** Add owl:ObjectProperty `:affectsConfigurationItem` (Incident|Change -> ConfigurationItem) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::affectsConfigurationItem_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R070.7
incidentState
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**incidentState.** Add owl:DatatypeProperty `:incidentState` (Incident -> xsd:string (new|in_progress|resolved|closed)) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::incidentState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R070.8
incidentAssignee
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**incidentAssignee.** Add owl:ObjectProperty `:incidentAssignee` (Incident -> :Person) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::incidentAssignee_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R071
documentation-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**documentation-v1.ttl additions rollup.** 6 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R071.1`, `EG-CQ-CONN-R071.2`, `EG-CQ-CONN-R071.3`, `EG-CQ-CONN-R071.4`, `EG-CQ-CONN-R071.5`, `EG-CQ-CONN-R071.6`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R071.1
shapes companion for documentation-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for documentation-v1.** Create `crates/eg-core/ontology/documentation-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `documentation` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_documentation_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R071.2
WebSnapshot
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**WebSnapshot.** Add owl:Class `:WebSnapshot` (subClassOf :Document; a captured URL snapshot) to `crates/eg-core/ontology/documentation-v1.ttl`. SHACL: WebSnapshot: sourceRef minCount 1 (the URL), in `documentation-v1.shapes.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::WebSnapshot_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R071.3
ArchiveResult
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ArchiveResult.** Add owl:Class `:ArchiveResult` (one extractor outcome for a snapshot) to `crates/eg-core/ontology/documentation-v1.ttl`. SHACL: ArchiveResult: extractorName, resultStatus minCount 1, in `documentation-v1.shapes.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::ArchiveResult_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R071.4
hasArchiveResult
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**hasArchiveResult.** Add owl:ObjectProperty `:hasArchiveResult` (WebSnapshot -> ArchiveResult) to `crates/eg-core/ontology/documentation-v1.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::hasArchiveResult_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R071.5
extractorName
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**extractorName.** Add owl:DatatypeProperty `:extractorName` (ArchiveResult -> xsd:string) to `crates/eg-core/ontology/documentation-v1.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::extractorName_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R071.6
resultStatus
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**resultStatus.** Add owl:DatatypeProperty `:resultStatus` (ArchiveResult -> xsd:string (succeeded|failed|skipped)) to `crates/eg-core/ontology/documentation-v1.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::resultStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R072
process_intelligence-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**process_intelligence-v1.ttl additions rollup.** 7 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R072.1`, `EG-CQ-CONN-R072.2`, `EG-CQ-CONN-R072.3`, `EG-CQ-CONN-R072.4`, `EG-CQ-CONN-R072.5`, `EG-CQ-CONN-R072.6`, `EG-CQ-CONN-R072.7`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R072.1
EpcFunction
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**EpcFunction.** Add owl:Class `:EpcFunction` (subClassOf :ProcessEventType; ARIS EPC function) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: aris. | `ontology_audit_process_intelligence_v1::EpcFunction_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R072.2
EpcRuleOperator
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**EpcRuleOperator.** Add owl:Class `:EpcRuleOperator` (ARIS split/join (AND|OR|XOR) between EPC nodes) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: aris. | `ontology_audit_process_intelligence_v1::EpcRuleOperator_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R072.3
flowsTo
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**flowsTo.** Add owl:ObjectProperty `:flowsTo` (model-level control-flow edge: EPC node -> EPC node (distinct from instance-level :directlyFollows)) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: aris. | `ontology_audit_process_intelligence_v1::flowsTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R072.4
ProcessInstance
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ProcessInstance.** Add owl:Class `:ProcessInstance` (one running or finished execution of a ProcessModelVersion) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::ProcessInstance_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R072.5
instanceOfProcessModel
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**instanceOfProcessModel.** Add owl:ObjectProperty `:instanceOfProcessModel` (ProcessInstance -> :ProcessModelVersion) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::instanceOfProcessModel_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R072.6
stoppedAtActivity
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**stoppedAtActivity.** Add owl:ObjectProperty `:stoppedAtActivity` (ProcessInstance -> :ProcessEventType) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::stoppedAtActivity_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R072.7
raisedIncident
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**raisedIncident.** Add owl:ObjectProperty `:raisedIncident` (ProcessInstance -> :ApplicationEvent (archimate crosswalk)) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::raisedIncident_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073
government-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**government-v1.ttl additions rollup.** 11 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R073.1` to `EG-CQ-CONN-R073.11`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.1
shapes companion for government-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for government-v1.** Create `crates/eg-core/ontology/government-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `government` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_government_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.2
RiskScenario
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**RiskScenario.** Add owl:Class `:RiskScenario` (a risk scenario in a risk assessment) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::RiskScenario_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.3
mitigatesRisk
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**mitigatesRisk.** Add owl:ObjectProperty `:mitigatesRisk` (SecurityControl -> RiskScenario) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::mitigatesRisk_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.4
inFramework
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**inFramework.** Add owl:ObjectProperty `:inFramework` (SecurityControl -> core:Framework) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::inFramework_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.5
riskAffectsService
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**riskAffectsService.** Add owl:ObjectProperty `:riskAffectsService` (RiskScenario -> infra:Service) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::riskAffectsService_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.6
PrivacyAssessment
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**PrivacyAssessment.** Add owl:Class `:PrivacyAssessment` (DPIA/PIA instance) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::PrivacyAssessment_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.7
ProcessingActivity
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ProcessingActivity.** Add owl:Class `:ProcessingActivity` (a records-of-processing entry) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::ProcessingActivity_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.8
assessmentCovers
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**assessmentCovers.** Add owl:ObjectProperty `:assessmentCovers` (PrivacyAssessment -> ProcessingActivity) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessmentCovers_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.9
assessmentDueDate
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**assessmentDueDate.** Add owl:DatatypeProperty `:assessmentDueDate` (PrivacyAssessment -> xsd:date) to `crates/eg-core/ontology/government-v1.ttl`. SHACL: assessmentDueDate minCount 1, in `government-v1.shapes.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessmentDueDate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.10
assessedVendor
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**assessedVendor.** Add owl:ObjectProperty `:assessedVendor` (PrivacyAssessment -> trm:Vendor) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessedVendor_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R073.11
assessmentStatus
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**assessmentStatus.** Add owl:DatatypeProperty `:assessmentStatus` (PrivacyAssessment -> xsd:string (draft|in_review|approved); overdue is derived from as-of and assessmentDueDate) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessmentStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R074
core-foundation-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**core-foundation-v1.ttl additions rollup.** 6 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R074.1`, `EG-CQ-CONN-R074.2`, `EG-CQ-CONN-R074.3`, `EG-CQ-CONN-R074.4`, `EG-CQ-CONN-R074.5`, `EG-CQ-CONN-R074.6`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R074.1
shapes companion for core-foundation-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for core-foundation-v1.** Create `crates/eg-core/ontology/core-foundation-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `core-foundation` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_core_foundation_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R074.2
GlossaryTerm
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**GlossaryTerm.** Add owl:Class `:GlossaryTerm` (subClassOf :Concept; a governed business term) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: egeria. | `ontology_audit_core_foundation_v1::GlossaryTerm_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R074.3
termAssignedTo
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**termAssignedTo.** Add owl:ObjectProperty `:termAssignedTo` (GlossaryTerm -> :Dataset) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: egeria. | `ontology_audit_core_foundation_v1::termAssignedTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R074.4
counterparty
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**counterparty.** Add owl:ObjectProperty `:counterparty` (Agreement -> :LegalEntity) to `crates/eg-core/ontology/core-foundation-v1.ttl`. SHACL: counterparty minCount 1, in `core-foundation-v1.shapes.ttl`. Needed by: legal-peripherals. | `ontology_audit_core_foundation_v1::counterparty_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R074.5
agreementExpiresAt
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**agreementExpiresAt.** Add owl:DatatypeProperty `:agreementExpiresAt` (Agreement -> xsd:date) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: legal-peripherals. | `ontology_audit_core_foundation_v1::agreementExpiresAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R074.6
hasRenewalAction
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**hasRenewalAction.** Add owl:ObjectProperty `:hasRenewalAction` (Agreement -> :Action) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: legal-peripherals. | `ontology_audit_core_foundation_v1::hasRenewalAction_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R075
finance-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**finance-v1.ttl additions rollup.** 7 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R075.1`, `EG-CQ-CONN-R075.2`, `EG-CQ-CONN-R075.3`, `EG-CQ-CONN-R075.4`, `EG-CQ-CONN-R075.5`, `EG-CQ-CONN-R075.6`, `EG-CQ-CONN-R075.7`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R075.1
shapes companion for finance-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for finance-v1.** Create `crates/eg-core/ontology/finance-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `finance` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_finance_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R075.2
orderQty
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**orderQty.** Add owl:DatatypeProperty `:orderQty` (VersionedOrder -> xsd:float) to `crates/eg-core/ontology/finance-v1.ttl`. SHACL: filledQty sh:lessThanOrEquals orderQty, in `finance-v1.shapes.ttl`. Needed by: emerald-exchange. | `ontology_audit_finance_v1::orderQty_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R075.3
Budget
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Budget.** Add owl:Class `:Budget` (a spending budget) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::Budget_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R075.4
budgetLimit
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**budgetLimit.** Add owl:DatatypeProperty `:budgetLimit` (Budget -> xsd:decimal) to `crates/eg-core/ontology/finance-v1.ttl`. SHACL: minCount 1, in `finance-v1.shapes.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::budgetLimit_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R075.5
LedgerTransaction
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**LedgerTransaction.** Add owl:Class `:LedgerTransaction` (a personal-ledger transaction (not position-bound, unlike :Activity)) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::LedgerTransaction_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R075.6
chargedToBudget
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**chargedToBudget.** Add owl:ObjectProperty `:chargedToBudget` (LedgerTransaction -> Budget) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::chargedToBudget_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R075.7
transactionAmount
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**transactionAmount.** Add owl:DatatypeProperty `:transactionAmount` (LedgerTransaction -> xsd:decimal) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::transactionAmount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076
personal-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**personal-v1.ttl additions rollup.** 9 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R076.1` to `EG-CQ-CONN-R076.9`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076.1
birthPlace
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**birthPlace.** Add owl:ObjectProperty `:birthPlace` (core:Person -> core:Place) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: gramps. | `ontology_audit_personal_v1::birthPlace_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076.2
birthYear
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**birthYear.** Add owl:DatatypeProperty `:birthYear` (core:Person -> xsd:gYear) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: gramps. | `ontology_audit_personal_v1::birthYear_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076.3
documentType
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**documentType.** Add owl:DatatypeProperty `:documentType` (core:Document -> xsd:string) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: paperless-ngx. | `ontology_audit_personal_v1::documentType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076.4
dueDate
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**dueDate.** Add owl:DatatypeProperty `:dueDate` (core:Document -> xsd:date) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: paperless-ngx. | `ontology_audit_personal_v1::dueDate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076.5
totalAmount
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**totalAmount.** Add owl:DatatypeProperty `:totalAmount` (core:Document -> xsd:decimal) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: paperless-ngx. | `ontology_audit_personal_v1::totalAmount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076.6
FileShare
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**FileShare.** Add owl:Class `:FileShare` (a Nextcloud share of a file or folder) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::FileShare_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076.7
sharesFile
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**sharesFile.** Add owl:ObjectProperty `:sharesFile` (FileShare -> core:Document) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::sharesFile_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076.8
isPublicLink
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**isPublicLink.** Add owl:DatatypeProperty `:isPublicLink` (FileShare -> xsd:boolean) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::isPublicLink_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R076.9
shareExpiresAt
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shareExpiresAt.** Add owl:DatatypeProperty `:shareExpiresAt` (FileShare -> xsd:date) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::shareExpiresAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R077
virtual_graph-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**virtual_graph-v1.ttl additions rollup.** 3 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R077.1`, `EG-CQ-CONN-R077.2`, `EG-CQ-CONN-R077.3`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R077.1
NamedGraph
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**NamedGraph.** Add owl:Class `:NamedGraph` (subClassOf core:Dataset; a graph in a triple store) to `crates/eg-core/ontology/virtual_graph-v1.ttl`. Needed by: jena. | `ontology_audit_virtual_graph_v1::NamedGraph_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R077.2
tripleCount
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**tripleCount.** Add owl:DatatypeProperty `:tripleCount` (NamedGraph -> xsd:integer) to `crates/eg-core/ontology/virtual_graph-v1.ttl`. Needed by: jena. | `ontology_audit_virtual_graph_v1::tripleCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R077.3
lastModifiedAt
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**lastModifiedAt.** Add owl:DatatypeProperty `:lastModifiedAt` (NamedGraph -> xsd:dateTime) to `crates/eg-core/ontology/virtual_graph-v1.ttl`. Needed by: jena. | `ontology_audit_virtual_graph_v1::lastModifiedAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R078
identity-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**identity-v1.ttl additions rollup.** 5 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R078.1`, `EG-CQ-CONN-R078.2`, `EG-CQ-CONN-R078.3`, `EG-CQ-CONN-R078.4`, `EG-CQ-CONN-R078.5`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R078.1
shapes companion for identity-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for identity-v1.** Create `crates/eg-core/ontology/identity-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `identity` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_identity_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R078.2
Application
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Application.** Add owl:Class `:Application` (declare the class already used as range of :assignedApp) to `crates/eg-core/ontology/identity-v1.ttl`. Needed by: keycloak, okta. | `ontology_audit_identity_v1::Application_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R078.3
OidcClient
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**OidcClient.** Add owl:Class `:OidcClient` (subClassOf :Application) to `crates/eg-core/ontology/identity-v1.ttl`. Needed by: keycloak. | `ontology_audit_identity_v1::OidcClient_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R078.4
roleGrantsAccessTo
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**roleGrantsAccessTo.** Add owl:ObjectProperty `:roleGrantsAccessTo` (IdentityRole -> Application) to `crates/eg-core/ontology/identity-v1.ttl`. Needed by: keycloak. | `ontology_audit_identity_v1::roleGrantsAccessTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R078.5
accountStatus
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**accountStatus.** Add owl:DatatypeProperty `:accountStatus` (IdentityUser -> xsd:string) to `crates/eg-core/ontology/identity-v1.ttl`. SHACL: sh:in (ACTIVE|SUSPENDED|DEACTIVATED), in `identity-v1.shapes.ttl`. Needed by: okta. | `ontology_audit_identity_v1::accountStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R079
orchestration-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**orchestration-v1.ttl additions rollup.** 5 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R079.1`, `EG-CQ-CONN-R079.2`, `EG-CQ-CONN-R079.3`, `EG-CQ-CONN-R079.4`, `EG-CQ-CONN-R079.5`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R079.1
shapes companion for orchestration-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for orchestration-v1.** Create `crates/eg-core/ontology/orchestration-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `orchestration` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_orchestration_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R079.2
promptVersion
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**promptVersion.** Add owl:DatatypeProperty `:promptVersion` (Prompt -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::promptVersion_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R079.3
tokenCost
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**tokenCost.** Add owl:DatatypeProperty `:tokenCost` (RunTrace -> xsd:decimal) to `crates/eg-core/ontology/orchestration-v1.ttl`. SHACL: minInclusive 0, in `orchestration-v1.shapes.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::tokenCost_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R079.4
tracePrompt
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**tracePrompt.** Add owl:ObjectProperty `:tracePrompt` (RunTrace -> Prompt) to `crates/eg-core/ontology/orchestration-v1.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::tracePrompt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R079.5
evaluationScore
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**evaluationScore.** Add owl:DatatypeProperty `:evaluationScore` (RunTrace|Prompt -> xsd:decimal) to `crates/eg-core/ontology/orchestration-v1.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::evaluationScore_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R080
enterprise-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**enterprise-v1.ttl additions rollup.** 4 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R080.1`, `EG-CQ-CONN-R080.2`, `EG-CQ-CONN-R080.3`, `EG-CQ-CONN-R080.4`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R080.1
shapes companion for enterprise-v1
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**shapes companion for enterprise-v1.** Create `crates/eg-core/ontology/enterprise-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `enterprise` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_enterprise_v1::shapes_module_loads`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R080.2
factSheetType
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**factSheetType.** Add owl:DatatypeProperty `:factSheetType` (EAFactSheet -> xsd:string) to `crates/eg-core/ontology/enterprise-v1.ttl`. Needed by: leanix. | `ontology_audit_enterprise_v1::factSheetType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R080.3
lifecyclePhase
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**lifecyclePhase.** Add owl:DatatypeProperty `:lifecyclePhase` (EAFactSheet -> xsd:string (plan|active|phaseOut|endOfLife)) to `crates/eg-core/ontology/enterprise-v1.ttl`. SHACL: sh:in, in `enterprise-v1.shapes.ttl`. Needed by: leanix. | `ontology_audit_enterprise_v1::lifecyclePhase_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R080.4
activeUserCount
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**activeUserCount.** Add owl:DatatypeProperty `:activeUserCount` (EAFactSheet -> xsd:integer) to `crates/eg-core/ontology/enterprise-v1.ttl`. Needed by: leanix. | `ontology_audit_enterprise_v1::activeUserCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R081
nutrition-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**nutrition-v1.ttl additions rollup.** 8 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R081.1` to `EG-CQ-CONN-R081.8`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R081.1
Recipe
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Recipe.** Add owl:Class `:Recipe` (a recipe) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::Recipe_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R081.2
usesIngredient
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**usesIngredient.** Add owl:ObjectProperty `:usesIngredient` (Recipe -> :Food) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::usesIngredient_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R081.3
ShoppingListItem
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**ShoppingListItem.** Add owl:Class `:ShoppingListItem` (item on a shopping list, refers to a Food) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::ShoppingListItem_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R081.4
MealPlanEntry
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**MealPlanEntry.** Add owl:Class `:MealPlanEntry` (a planned meal on a date for a Recipe) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::MealPlanEntry_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R081.5
WorkoutRoutine
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**WorkoutRoutine.** Add owl:Class `:WorkoutRoutine` (a planned set of exercises) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::WorkoutRoutine_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R081.6
Exercise
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Exercise.** Add owl:Class `:Exercise` (an exercise) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::Exercise_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R081.7
includesExercise
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**includesExercise.** Add owl:ObjectProperty `:includesExercise` (WorkoutRoutine -> Exercise) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::includesExercise_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R081.8
WorkoutSession
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**WorkoutSession.** Add owl:Class `:WorkoutSession` (a performed instance of a routine with completedAt) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::WorkoutSession_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R082
action-v1.ttl additions rollup
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**action-v1.ttl additions rollup.** 1 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R082.1`. | Children landed.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R082.1
failureReason
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**failureReason.** Add owl:DatatypeProperty `:failureReason` (ActionInvocation -> xsd:string) to `crates/eg-core/ontology/action-v1.ttl`. Needed by: stirlingpdf. | `ontology_audit_action_v1::failureReason_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain).
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R083
erpnext, salesforce and twenty vocabulary (rollup, single row)
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**erpnext, salesforce and twenty vocabulary (rollup, single row).** Commercial term and representation requirements are owned by `EG-SUPPLY-VOCAB` in `crates/eg-core/ontology/commercial-v1.ttl`. Rows `EG-SUPPLY-VOCAB-R003.7` through `EG-SUPPLY-VOCAB-R003.12` reuse Organization and Person rather than adding Party or Contact classes. They declare PurchaseOrder, PurchaseInvoice, Opportunity, contactOf and lastActivityAt. No `commerce-v1.ttl` is created. Needed by: erpnext, salesforce, twenty. Also depends on EG-SUPPLY-VOCAB-R003.13 through EG-SUPPLY-VOCAB-R003.17. Vocabulary reassignment text is not implementation evidence. | `commercial_connector_prerequisites` parses all three Coverage rows and both Vocabulary cells per connector. Resolve every required producer IRI through registered modules. Reject a missing producer, an unrelated-row-only edit, or duplicate incompatible declarations. Live unavailable fields cause typed abstention.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R084
Connector-pack competency questions (rollup)
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Connector-pack competency questions (rollup).** The ontology answers selection and governance questions by SPARQL over imported connector packs. Each pack carries a domain ontology, an ingest contract and its surface. Children `.1` to `.6` state the questions, their answer shapes and the proof. | Rollup closes when every child `.1` to `.6` passes its proving test.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R084.1
Which finance algorithms apply to analysis type X for instrument or position type Y, and which connector tool performs each?
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Which finance algorithms apply to analysis type X for instrument or position type Y, and which connector tool performs each?** Answer shape: rows of algorithm class, analysis type, instrument or position class, tool component id, connector and pack digest. Depends on `:FinanceAlgorithm`, `:AnalysisType`, `:appliesToAnalysis` and `:appliesToInstrumentType` (`.5`). It also depends on `cp:Tool` and `cp:executes` (`EG-TYPED-PACKS-R102.1`). | `crates/eg-core/tests/connector_pack_competency.rs::finance_algorithm_selection_answers`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R084.2
What are my trades and positions, and which risk analyses apply to them?
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**What are my trades and positions, and which risk analyses apply to them?** Answer shape: rows of position or order IRI, instrument, quantity, as-of time, analysis type and algorithm class. Depends on `:Position`, `:PortfolioPosition`, `:VersionedOrder`, `:FinancialInstrument` and `:RiskSnapshot` in `finance-v1.ttl`. It also depends on `.5` and `cp:governedBy` (`EG-TYPED-PACKS-R101.1`). | `crates/eg-core/tests/connector_pack_competency.rs::positions_and_applicable_risk_analyses_answer`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R084.3
Which connector features, tools, prompts and skills can satisfy capability C, and under which ingest contract?
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Which connector features, tools, prompts and skills can satisfy capability C, and under which ingest contract?** Answer shape: rows of connector, feature, component kind, component id and contract IRI. Depends on `cp:Connector`, `cp:Feature`, `cp:realizedBy`, `cp:providesCapability` and `cp:hasContract` (`EG-TYPED-PACKS-R102.1`). | `crates/eg-core/tests/connector_pack_competency.rs::capability_to_surface_and_contract_answers`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R084.4
Which connector ingest contracts govern record R, with their mappings, access policy and provenance requirements?
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Which connector ingest contracts govern record R, with their mappings, access policy and provenance requirements?** Answer shape: rows of contract IRI, connector, contract revision, mapping IRI, default ACL, privacy class per field and required provenance fields. Depends on `cp:governedBy`, `cp:FieldMapping`, `cp:AccessPolicy`, `cp:privacyClass` and `cp:ProvenanceRequirement` (`EG-TYPED-PACKS-R101.1`). | `crates/eg-core/tests/connector_pack_competency.rs::record_governance_answers`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R084.5
Finance method vocabulary
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Finance method vocabulary.** Add `:FinanceAlgorithm`, `:AnalysisType`, `:appliesToAnalysis`, `:appliesToInstrumentType` and `:requiresInput` to `crates/eg-core/ontology/finance-v1.ttl`. Add a shape to `finance-v1.shapes.ttl`: each algorithm names at least one analysis type and one instrument or position class. | `crates/eg-core/tests/connector_pack_competency.rs::finance_method_terms_and_shape`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R084.6
Hot-path proof
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method. The test imports a finance connector pack and a document connector pack, then ingests fixture records through `SourceIngest`. It runs `.1` to `.4` through the served SPARQL method and `.1` through `Decide` (`EG-DECISION-ENGINE-R172.12`). Each answer must be non-empty and carry source, record id and as-of. Without the finance pack, `.1` must abstain and name the missing pack. | `tests/typed_packs/test_connector_pack_competency_served.py::test_pack_questions_end_to_end`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R085
Competency check: a question spans a connector's live data and the ontology (rollup)
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Competency check: a question spans a connector's live data and the ontology (rollup).** Arbora onboards one connector alone (`ARBORA-FLEET-R041`). One question then needs its live data and a parent-ontology concept. The answer comes through the virtual graph and carries provenance. It extends `EG-CQ-CONN-R067` and `EG-CQ-XSRC-R005`. It proves `EG-TYPED-PACKS-R105`, `EG-TYPED-PACKS-R106`, `EG-TYPED-PACKS-R107` and `EG-FEDERATED-QUERY-R722` together. The answer resolves through the active pack contract. The catalog lists the connector assets with owner and lineage. Children `.1` to `.6` deliver it. | See each child.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R085.1
Model
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Model.** Add the fixture `crates/eg-core/tests/fixtures/connector_auto_onboard/` with one connector pack. The pack holds an ontology that extends a parent class. It also holds one system prompt, one skill and one tool. One data resource has a mock operation. Record the expected answer as rows of parent class, connector class, instance and source. | `crates/eg-core/tests/connector_auto_onboard.rs::fixture_parses_and_is_linked_to_the_parent`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R085.2
Behavior
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Behavior.** The question names only parent-ontology terms. It asks which instances of parent class C exist, with their live status. The engine answers from the connector subclass through the virtual source. The answer includes native rows of the same class. It names the connector, contract and fetch time per row. With the connector absent, the question returns only native rows and names the missing connector. | `crates/eg-core/tests/connector_auto_onboard.rs::parent_term_question_returns_native_and_live_connector_rows`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R085.3
Wiring
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Wiring.** The check enters through the served `ConnectorPack.Import` method and the served `Uql` and `NlQuery` methods. It uses the same `project` path (`src/server/connector_pack_projection.rs:228`) and `foreign_scan` (`crates/eg-plan/src/federation_opt/run.rs:26`) as production. | `tests/typed_packs/test_connector_auto_onboard_served.py::test_check_uses_production_import_and_scan`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R085.4
Refusal
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Refusal.** With the ontology orphaned, the import refuses with `ONTOLOGY_ORPHAN` and the question abstains. With the mapping held, the answer abstains on the live part and names `SOURCE_HELD`. A wrong answer is a failure, not an abstention. | `crates/eg-core/tests/connector_auto_onboard.rs::orphan_and_held_variants_abstain_by_name`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R085.5
Evidence
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Evidence.** The answer cites the pack digest, the graph revision and the fetch time. The same test lists the system prompt, skill and tool of the connector. They appear in the load set for a job on that class (`EG-CQ-ORCH-R011.1`). | `tests/typed_packs/test_connector_auto_onboard_served.py::test_answer_cites_digest_revision_fetch_time_and_load_set`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-CONN-R085.6
Hot-path proof
Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source
**Hot-path proof.** The entry point is a real fixture connector process over MCP. Arbora onboards it with no manual step. A served NL question through arbora returns the combined answer. The test then drops the connector and sees the live part leave the answer. | `tests/typed_packs/test_connector_auto_onboard_served.py::test_onboarded_connector_answers_a_cross_ontology_live_question`.
requirementEG-CQ-CONNSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC
EG-CQ-XSRC — Cross-source competency: supply chain to services
specNoneSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R001
Concept-to-source authority is declared in the ontology (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Concept-to-source authority is declared in the ontology (rollup).** The ontology itself states which attached source is authoritative for which ontology class, so source choice is data, not query text. Children add the vocabulary, its SHACL shapes and a precedence rule. Rollup: LANDED only once every child is. | Every child is LANDED and the decisive swap test (R007.4) passes.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R001.1
Add `vg:SourceAuthority`, `vg:authoritativeSource`, `vg:authorityFor` and `vg:authorityRank` to the virtual-graph vocabulary
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Add `vg:SourceAuthority`, `vg:authoritativeSource`, `vg:authorityFor` and `vg:authorityRank` to the virtual-graph vocabulary.** `crates/eg-core/ontology/virtual_graph-v1.ttl` gains class `vg:SourceAuthority` and properties `vg:authoritativeSource` (to `vg:SourceConnection`), `vg:authorityFor` (to an ontology class) and `vg:authorityRank` (integer, lower wins). Net-new: no authority term exists in any shipped .ttl (grep for authoritative/systemOfRecord found only unrelated DNS and ADR text). | The ontology parses and the new terms are present with domain and range. A unit test loads the file and lists them.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R001.2
SHACL shape: a `vg:SourceAuthority` names exactly one connected source, one class and one rank
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**SHACL shape: a `vg:SourceAuthority` names exactly one connected source, one class and one rank.** `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl` adds `vg:SourceAuthorityShape`. It refuses an authority with no source, no class or no rank, an authority whose source is not a `vg:SourceConnection`, and two authorities of equal rank for one class. Depends on `EG-CQ-XSRC-R001.1`. | Shape fixtures accept a valid authority and refuse each of the four faults, including the equal-rank tie.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R001.3
Authority applies through subclass entailment
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Authority applies through subclass entailment.** An authority declared on a superclass (for example `:ApplicationEvent`) serves its subclasses (for example `:Incident`) unless a subclass declares its own. Reuses the subclass entailment of `EG-FEDERATED-QUERY-R072`; adds only the precedence rule. Depends on `EG-CQ-XSRC-R001.1`. | A fixture shows the superclass authority inherited and a subclass authority overriding it.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R001.4
Authority records the approval of its mapping
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Authority records the approval of its mapping.** An authority is effective only while the `vg:VirtualMapping` it points at is approved (`vg:approved true`, `EG-UNIFIED-DATA-PLANE-R037`). An unapproved or retracted mapping makes the authority inactive, and the class is reported uncovered rather than served by a fallback source. | A fixture with an unapproved mapping returns the class as uncovered with the reason named.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R002
Supply-chain concepts and the sources that are authoritative for them (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Supply-chain concepts and the sources that are authoritative for them (rollup).** Add the supply-chain concepts missing from the ontology and declare their authoritative sources. `:Vendor` and `:TechnologyProduct` (`trm-v1.ttl`) exist and are reused. Sources named here are a judgement from the connector list: erpnext-mcp (suppliers, purchase orders, items), salesforce-mcp and twenty-mcp (customer and partner accounts), ciso-assistant-mcp and onetrust-mcp (third-party risk and vendor assessments), leanix-mcp (provider fact sheets); software supply chain: dockerhub-mcp (image publisher and tags), github-mcp and gitlab-mcp (source repositories, dependencies, advisories), repository-manager-mcp (workspace repositories). Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R002.1
Add `:Supplier` as a subclass of `:Vendor`, and `:SupplyChainItem` with `:suppliedBy`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Add `:Supplier` as a subclass of `:Vendor`, and `:SupplyChainItem` with `:suppliedBy`.** A new `crates/eg-core/ontology/supply_chain-v1.ttl` declares `:Supplier rdfs:subClassOf :Vendor` (reusing `trm-v1.ttl`), `:SupplyChainItem` and `:suppliedBy` (item to supplier). MISSING today: no supplier, procurement or supply-chain-item term exists outside `energy_geopolitics-v1.ttl` `:SupplyRoute`. | The file parses, `:Supplier` entails `:Vendor` in the reasoner, and a unit test lists the terms.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R002.2
Add `:SoftwareComponent`, `:ComponentVersion` and `:publishedBy`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Add `:SoftwareComponent`, `:ComponentVersion` and `:publishedBy`.** `supply_chain-v1.ttl` adds the software supply-chain terms: a component, a version of it, and the publisher (a `:Supplier`). A `:ContainerImage` (`infrastructure-v1.ttl`) is declared a `:SoftwareComponent`. Depends on `EG-CQ-XSRC-R002.1`. | The file parses and `:ContainerImage` entails `:SoftwareComponent`.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R002.3
Add `:Vulnerability` and `:affectsComponent`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Add `:Vulnerability` and `:affectsComponent`.** `supply_chain-v1.ttl` adds `:Vulnerability` (identifier, severity, fixed-in version) and `:affectsComponent` (to a `:ComponentVersion`). MISSING today: the only vulnerability term is the count `:vulnerabilityCount` in `trm-v1.ttl`. Depends on `EG-CQ-XSRC-R002.2`. | The file parses and a unit test lists the terms; `:vulnerabilityCount` is left unchanged.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R002.4
SHACL shape for supplier and component
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**SHACL shape for supplier and component.** `crates/eg-core/ontology/supply_chain-v1.shapes.ttl` requires a `:Supplier` to carry a name and a `:ComponentVersion` to name its component and a version string. Depends on `EG-CQ-XSRC-R002.2`. | Shape fixtures accept valid items and refuse a nameless supplier and a versionless component.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R002.5
Source-authority mapping: suppliers and purchase items
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Source-authority mapping: suppliers and purchase items.** Declare `vg:SourceAuthority` rows: `:Supplier` and `:SupplyChainItem` to erpnext-mcp (rank 1) with leanix-mcp `Provider` fact sheets (rank 2); third-party risk to ciso-assistant-mcp. Judgement: ERPNext is the transactional procurement system; LeanIX is the architecture catalogue. A seed `.ttl` fixture under `crates/eg-core/tests/fixtures/` holds the rows. Depends on `EG-CQ-XSRC-R001.1`, `EG-CQ-XSRC-R002.1`. | The seed loads, passes `vg:SourceAuthorityShape`, and `select_sources` returns erpnext for `:Supplier`.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R002.6
Source-authority mapping: software components and vulnerabilities
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Source-authority mapping: software components and vulnerabilities.** Declare `vg:SourceAuthority` rows: `:ContainerImage` to dockerhub-mcp (publisher, tags) with gitlab-mcp and github-mcp for source repositories. `:Vulnerability` to gitlab-mcp (vulnerability findings) with github-mcp advisories at rank 2. Judgement: the registry is authoritative for what an image is, the code host for what is wrong with it. Depends on `EG-CQ-XSRC-R002.3`. | The seed loads and `select_sources` returns the registry for an image and the code host for a vulnerability.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R002.7
Virtual mapping fixture: erpnext supplier table to `:Supplier`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Virtual mapping fixture: erpnext supplier table to `:Supplier`.** One approved `vg:VirtualMapping` (`vg:mapsOntologyClass :Supplier`, key field, predicate-field pairs for name and status) over a recorded erpnext-mcp operation contract, using the operation-bound kinds of `EG-FEDERATED-QUERY-R073`. Cross-repo prerequisite: the erpnext connector operation contract (owning repo: agent-packages connector). | The mapping passes the `EG-UNIFIED-DATA-PLANE-R037` shapes and reads equal rows from a recorded response.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R003
Service concepts and the sources that are authoritative for them (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Service concepts and the sources that are authoritative for them (rollup).** Declare which sources are authoritative for services, their hosts and their health. Found: `:Service` (a monitored network service, `infrastructure-v1.ttl`), `:Host`, `:Node`, `:Rack`, `:ContainerImage`, `:Incident`, `:BusinessCapability` (`archimate-v1.ttl`). Sources named are a judgement: uptime-mcp and lgtm-mcp for live service health, container-manager-mcp and portainer-mcp for deployed workloads and images, servicenow-mcp (CMDB) and leanix-mcp for the service catalogue and business capabilities, archimate-mcp for the architecture model, caddy-mcp and technitium-dns-mcp for ingress and name records, systems-manager-mcp for host facts. Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R003.1
Source-authority mapping: `:Service` health
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Source-authority mapping: `:Service` health.** Declare `:Service` to uptime-mcp (rank 1) and lgtm-mcp (rank 2) for health, and to servicenow-mcp CMDB (rank 1) for the catalogue identity. Where two sources hold different facets, the authority row carries a `vg:authorityFor` property list rather than the whole class. Depends on `EG-CQ-XSRC-R001.1`. | The seed passes the shape and `select_sources` names uptime for health and CMDB for identity.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R003.2
Source-authority mapping: deployed workloads and images
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Source-authority mapping: deployed workloads and images.** Declare `:ContainerImage` deployment facts and `:Host` placement to container-manager-mcp (rank 1) and portainer-mcp (rank 2); `:Host` hardware facts to systems-manager-mcp. Depends on `EG-CQ-XSRC-R001.1`. | The seed passes the shape and `select_sources` names container-manager for deployed images.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R003.3
Source-authority mapping: business capabilities
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Source-authority mapping: business capabilities.** Declare `:BusinessCapability` to leanix-mcp (rank 1) and archimate-mcp (rank 2). Judgement: LeanIX is the maintained catalogue, ArchiMate the modelled view. Depends on `EG-CQ-XSRC-R001.1`. | The seed passes the shape and `select_sources` names leanix, with archimate as the second.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R003.4
Virtual mapping fixture: uptime monitor to `:Service`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Virtual mapping fixture: uptime monitor to `:Service`.** One approved `vg:VirtualMapping` from a recorded uptime-mcp operation contract to `:Service`, with name, status and last-check fields. Cross-repo prerequisite: the uptime connector operation contract (owning repo: agent-packages connector). | The mapping passes the `EG-UNIFIED-DATA-PLANE-R037` shapes and reads equal rows from a recorded response.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R003.5
Virtual mapping fixture: container-manager workload to `:Service` and `:ContainerImage`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Virtual mapping fixture: container-manager workload to `:Service` and `:ContainerImage`.** One approved `vg:VirtualMapping` from a recorded container-manager-mcp contract to `:Service` with its image reference. Cross-repo prerequisite: the container-manager operation contract (owning repo: agent-packages connector). | The mapping passes the shapes and reads equal rows from a recorded response.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R004
Linking relation between a supply-chain entity and a service, with entity resolution across sources (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Linking relation between a supply-chain entity and a service, with entity resolution across sources (rollup).** The relation that joins the two sides, and the resolution that makes one real-world thing in two sources one node. Found: `:dependsOn` (service to service, `infrastructure-v1.ttl`), `:runsOn`, `:hostedBy`, `:buildsImageFor`, `:affectsEntity`, `:alignedWith`, `owl:sameAs` proposals (`EG-UNIFIED-DATA-PLANE-R030`). Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R004.1
Add `:usesComponent` (service to component version) and `:suppliesService`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Add `:usesComponent` (service to component version) and `:suppliesService`.** `supply_chain-v1.ttl` adds `:usesComponent` (domain `:Service`, range `:ComponentVersion`) and `:suppliesService` as its property chain with `:publishedBy` (supplier to service). The service-to-image step reuses the existing `:buildsImageFor`/`:runsOn` terms; it is not redefined. MISSING: no supplier-to-service relation exists. Depends on `EG-CQ-XSRC-R002.2`. | The file parses and a reasoner fixture entails `:suppliesService` from a service, its image and the image publisher.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R004.2
SHACL shape: `:usesComponent` domain and range
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**SHACL shape: `:usesComponent` domain and range.** `supply_chain-v1.shapes.ttl` refuses `:usesComponent` from a non-service or to a non-component. Depends on `EG-CQ-XSRC-R004.1`. | Shape fixtures accept a valid link and refuse both faults.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R004.3
Resolve a vendor in erpnext, leanix and dockerhub to one `:Supplier`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Resolve a vendor in erpnext, leanix and dockerhub to one `:Supplier`.** Adapt the entity-resolution model of `EG-UNIFIED-DATA-PLANE-R030` (it covers Gramps, Immich, Twenty and Firefly today) to supplier records: blocking on normalized name and domain, a proposed `owl:sameAs` that is active only once approved. Adds `Erpnext`, `Leanix` and `Dockerhub` to `AttachedApplication` in `crates/eg-types/src/entity_link_proposal.rs`. Depends on `EG-UNIFIED-DATA-PLANE-R030.1`. | A fixture with a true match, a false match and an ambiguous pair proves no link is asserted before approval, mirroring R030.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R004.4
Resolve a service in uptime, container-manager and the CMDB to one `:Service`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Resolve a service in uptime, container-manager and the CMDB to one `:Service`.** The same resolution applied to service records: blocking on name, host and port, an inactive proposal until approved. Reuses the `R030` model; adds only the application kinds and the blocking keys. Depends on `EG-CQ-XSRC-R004.3`. | A fixture proves the three records resolve to one node after approval and stay three before it.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R004.5
Query-time link: a join may only cross an approved `owl:sameAs`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Query-time link: a join may only cross an approved `owl:sameAs`.** The federated query joins records from different sources only through an approved link. A candidate link that is unapproved contributes nothing and is reported as an unresolved candidate in the answer. Mechanism: `EG-FEDERATED-QUERY-R072` path plus the approval state of R030. | A fixture shows the join empty before approval, non-empty after, and the candidate listed while unapproved.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R005
The federated query is planned from the ontology's source declarations (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**The federated query is planned from the ontology's source declarations (rollup).** Source selection reads `vg:SourceAuthority`. The question names only ontology classes; the planner picks the sources. Mechanism: `EG-FEDERATED-QUERY-R072` (source selection with premises), `EG-FEDERATED-QUERY-R046` and `R069` (pushdown), `EG-FEDERATED-QUERY-R073` (operation-bound sources), `EG-UNIFIED-DATA-PLANE-R005`/`R006` (R2RML virtual graphs). Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R005.1
`select_sources` orders candidate mappings by `vg:authorityRank`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**`select_sources` orders candidate mappings by `vg:authorityRank`.** Extend `eg-rdf::source_selection` so a covered class names the authoritative source by rank and lists the lower-ranked ones as alternates, each with a `Premise` citing the authority row. Depends on `EG-FEDERATED-QUERY-R072.1`, `EG-CQ-XSRC-R001.1`. | A two-source fixture shows the rank-1 source chosen, the alternate listed, and the authority row in the premises.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R005.2
Query fixture: the supply-chain impact query over classes only
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Query fixture: the supply-chain impact query over classes only.** A SPARQL fixture in `crates/eg-rdf/tests/fixtures/` asks for `:Service`, the `:SoftwareComponent` and `:Supplier` behind it, and `:Vulnerability` on it. It names no source, endpoint or connector. A test fails if the text contains a connector name. Depends on `EG-CQ-XSRC-R004.1`. | The fixture parses, and the no-connector-name check passes.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R005.3
The plan is derived, not authored: planned sources equal the declared authorities
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**The plan is derived, not authored: planned sources equal the declared authorities.** Plan the fixture of R005.2 and assert the set of sources in the plan equals the set derived from the authority rows. Depends on `EG-CQ-XSRC-R005.1`, `EG-CQ-XSRC-R005.2`. | The test compares the planned set to the authority-derived set for the seed.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R005.4
An unconnected authoritative source yields a typed abstention, not a silent fallback
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**An unconnected authoritative source yields a typed abstention, not a silent fallback.** When the rank-1 source for a class is not connected, the plan names it as `Unconnected { source, class }`. A lower-ranked alternate is used only if the authority row permits fallback (`vg:allowFallback`), and the report then says so. Depends on `EG-CQ-XSRC-R005.1`. | A fixture with erpnext unconnected returns the typed abstention naming erpnext and `:Supplier`.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R005.5
`EXPLAIN` shows the authority premise for each planned source
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**`EXPLAIN` shows the authority premise for each planned source.** Served `EXPLAIN` lists, per fragment, the authority row, rank, mapping generation and whether it was pushed. Mechanism: the redacted trace of `EG-FEDERATED-QUERY-R044`; no URL or credential in the output. Depends on `EG-CQ-XSRC-R005.3`. | A test reads the `EXPLAIN` output and finds the authority premises and no endpoint URL.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R006
The unified report shape (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**The unified report shape (rollup).** One typed report: impact per service, the supply-chain items behind each, the sources used and why, freshness per source, and typed abstention. Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R006.1
Add the typed `SupplyChainImpactReport` model
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Add the typed `SupplyChainImpactReport` model.** `crates/eg-types/src/supply_chain_report.rs` defines the report: a list of `ServiceImpact` (service IRI, items with supplier, component version, vulnerability and impact kind), `sources_used` (source, class served, authority premise), and `abstentions`. It refuses a `ServiceImpact` item with no source. Depends on `EG-CQ-XSRC-R005.1`. | Unit tests construct a valid report, refuse an item with no source, and round-trip the wire encoding.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R006.2
Report carries freshness per source
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Report carries freshness per source.** Each `sources_used` entry carries the watermark and age of its data (live read, or accelerated copy with its watermark, per `EG-UNIFIED-DATA-PLANE-R038.1`). A source with no watermark is reported `live`. Depends on `EG-CQ-XSRC-R006.1`. | Unit tests cover a copy with a watermark, a live read, and the refusal of a copy with no watermark.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R006.3
Report abstention variants
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Report abstention variants.** `abstentions` holds `Unconnected`, `Uncovered`, `Disconnected` and `UnapprovedMapping` entries, mapping the `CoverageResult` of `EG-FEDERATED-QUERY-R072.1` plus the unconnected case. A report with an abstention is still returned, never an error. Depends on `EG-CQ-XSRC-R006.1`. | Unit tests build one report per abstention kind and confirm the other services still report.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R006.4
Assemble the report from the federated rows
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Assemble the report from the federated rows.** A pure function from the planned query's rows and premises to `SupplyChainImpactReport`. Depends on `EG-CQ-XSRC-R006.1`, `EG-CQ-XSRC-R005.3`. | A fixture over recorded rows produces the expected report, byte for byte.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R006.5
Serve the report through graph-os
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Serve the report through graph-os.** Cross-repo prerequisite (owning repo: graph-os): expose one intent tool that takes the question and returns `SupplyChainImpactReport`. Per the registry rule, graph-os serves the tool; EG supplies the method. Depends on `EG-CQ-XSRC-R006.4`. | A served call returns a report whose shape matches the typed model.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R007
End-to-end acceptance from real connected data (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**End-to-end acceptance from real connected data (rollup).** "How does the supply chain affect our services?" answered through the served surface, with sources chosen only from the ontology. Rollup: LANDED only once every child is. | Every child is LANDED, including the swap test.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R007.1
Acceptance on recorded connector responses
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Acceptance on recorded connector responses.** Run the question over recorded erpnext-mcp, dockerhub-mcp, gitlab-mcp, container-manager-mcp and uptime-mcp responses. Assert at least one `ServiceImpact` with a supplier, a component version and a source per item, and that every source named in the report appears in an authority row. Depends on `EG-CQ-XSRC-R006.4`. | The test is non-empty and provenance-carrying, run in CI without network.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R007.2
Acceptance against the live connected sources
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Acceptance against the live connected sources.** The same question through graph-os against the connected sources that exist on the day. It reports each unconnected authoritative source as an abstention. Cross-repo prerequisite (owning repo: graph-os): the connected-source list. Depends on `EG-CQ-XSRC-R006.5`. | A run records the report, the sources used and the abstentions. A non-empty answer is required for at least the software supply chain and services sides.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R007.3
Acceptance with the procurement source not connected
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Acceptance with the procurement source not connected.** Run R007.1 with erpnext-mcp absent. Assert the report still gives the software supply-chain impact and carries `Unconnected{erpnext, :Supplier}`. Depends on `EG-CQ-XSRC-R005.4`. | The test asserts the abstention and the unchanged software-side rows.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R007.4
Decisive test: changing only the ontology's authority declaration changes the sources used
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Decisive test: changing only the ontology's authority declaration changes the sources used.** Run the question twice over the same query text. Between runs change one `vg:SourceAuthority` row (for example `:Vulnerability` from gitlab-mcp to github-mcp). Assert the plan and report name the new source and that the query text is byte-identical. This is the exit gate. Depends on `EG-CQ-XSRC-R007.1`. | The test compares query text (equal) and sources used (different) across the two runs.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008
Generalization: three more cross-source questions of the same shape (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Generalization: three more cross-source questions of the same shape (rollup).** Three questions that reuse the authority declaration, source selection and report model. Each child adds only its missing classes, authority rows and a test. Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.1
Which services are exposed by a vulnerability in an image we deploy? (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Which services are exposed by a vulnerability in an image we deploy? (rollup)** Sources: dockerhub-mcp (image, tags), gitlab-mcp and github-mcp (vulnerability findings, advisories), container-manager-mcp and portainer-mcp (what is deployed), uptime-mcp (service). Uses `:ContainerImage`, `:Vulnerability`, `:affectsComponent`, `:usesComponent`. Mostly covered by R002 to R005; the child adds the deployed-image filter. Rollup: LANDED only once every child is. | Both children are LANDED.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.1.1
Query fixture and authority rows: vulnerable deployed image to exposed service
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Query fixture and authority rows: vulnerable deployed image to exposed service.** Add the SPARQL fixture over classes only, and any authority row not already seeded by `EG-CQ-XSRC-R002.6`/`R003.2`. Depends on `EG-CQ-XSRC-R005.3`. | The fixture plans to exactly the sources named above and names no connector.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.1.2
Acceptance: exposed services listed with image, vulnerability and sources
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Acceptance: exposed services listed with image, vulnerability and sources.** Recorded-response test asserting a non-empty list of services with the vulnerable image, the vulnerability identifier, and per-item source. And the typed abstention with the code host disconnected. Depends on `EG-CQ-XSRC-R008.1.1`. | Non-empty, provenance-carrying. Abstention case passes.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.2
Which business capabilities depend on a host that is over its temperature or capacity limit? (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Which business capabilities depend on a host that is over its temperature or capacity limit? (rollup)** Sources: systems-manager-mcp (host capacity), the fan and temperature telemetry via lgtm-mcp (metrics), container-manager-mcp (placement), leanix-mcp and archimate-mcp (capabilities), servicenow-mcp CMDB (service to capability). Uses `:BusinessCapability`, `:Service`, `:runsOn`, `:Host`, `:Rack`, `:CoolingUnit`. MISSING: a temperature observation and a capacity limit on `:Host`; `:supports` (`core-foundation-v1.ttl`) is the candidate link from service to capability, to be confirmed. Rollup: LANDED only once every child is. | All children are LANDED.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.2.1
Add a host limit-breach term to the ontology
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Add a host limit-breach term to the ontology.** `infrastructure-v1.ttl` gains `:temperatureCelsius`, `:temperatureLimitCelsius` and `:capacityUtilization` on `:Host`, with the limit stated as data. MISSING today. No threshold is hard-coded in the query. | The file parses and a unit test lists the terms.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.2.2
SHACL shape: a limit-bearing host carries both reading and limit
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**SHACL shape: a limit-bearing host carries both reading and limit.** `crates/eg-core/ontology/infrastructure-v1.shapes.ttl` (new) refuses a reading with no limit. Depends on `EG-CQ-XSRC-R008.2.1`. | Shape fixtures accept a pair and refuse a reading with no limit.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.2.3
Authority rows and query fixture: capability to service to host over a limit
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Authority rows and query fixture: capability to service to host over a limit.** Authority rows for host readings (lgtm-mcp rank 1, systems-manager-mcp rank 2) and the class-only SPARQL fixture. Confirms whether `:supports` or an `archimate` relationship carries service to capability; records the choice in `plan.md`. Depends on `EG-CQ-XSRC-R008.2.1`. | The fixture plans to the sources named above and names no connector.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.2.4
Acceptance: capabilities at risk listed with the host, reading and limit
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Acceptance: capabilities at risk listed with the host, reading and limit.** Recorded-response test asserting a non-empty list with capability, service, host, reading, limit and per-item source. Abstention when the metrics source is not connected. Depends on `EG-CQ-XSRC-R008.2.3`. | Non-empty, provenance-carrying. Abstention case passes.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.3
Which open incidents or changes touch a service a customer contract depends on? (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Which open incidents or changes touch a service a customer contract depends on? (rollup)** Sources: servicenow-mcp (incidents, changes, CMDB), salesforce-mcp and twenty-mcp (customer accounts and contracts), erpnext-mcp (contracts and issues as `:ErpNextIssue`), uptime-mcp (service). Uses `:Incident`, `:ApplicationEvent`, `:affectsEntity`, `:Service`, `:Organization`. MISSING: `:Customer` as a class (archimate-v1.ttl only mentions it in a comment), `:CustomerContract`, `:ChangeRequest`, and the contract-to-service relation. Rollup: LANDED only once every child is. | All children are LANDED.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.3.1
Add `:CustomerContract`, `:ChangeRequest` and `:coversService`
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Add `:CustomerContract`, `:ChangeRequest` and `:coversService`.** `supply_chain-v1.ttl` or a new `commercial-v1.ttl` adds `:CustomerContract` (to `:Organization` customer), `:ChangeRequest` (subclass of `:ApplicationEvent`) and `:coversService` (contract to service). MISSING today. | The file parses and `:ChangeRequest` entails `:ApplicationEvent`.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.3.2
SHACL shape: a contract names a customer and at least one service
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**SHACL shape: a contract names a customer and at least one service.** The shapes file refuses a `:CustomerContract` with no customer or no `:coversService`. Depends on `EG-CQ-XSRC-R008.3.1`. | Shape fixtures accept a valid contract and refuse both faults.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.3.3
Authority rows and query fixture: open incident or change to service to contract
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Authority rows and query fixture: open incident or change to service to contract.** Authority rows for `:Incident` and `:ChangeRequest` (servicenow-mcp rank 1, erpnext-mcp for `:ErpNextIssue` rank 2) and `:CustomerContract` (salesforce-mcp rank 1, twenty-mcp rank 2), plus the class-only SPARQL fixture. Depends on `EG-CQ-XSRC-R008.3.1`. | The fixture plans to the sources named above and names no connector.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R008.3.4
Acceptance: open incidents and changes listed with the service and contract
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Acceptance: open incidents and changes listed with the service and contract.** Recorded-response test asserting a non-empty list with incident or change, service, contract, customer and per-item source. Abstention when the CRM source is not connected. Depends on `EG-CQ-XSRC-R008.3.3`. | Non-empty, provenance-carrying. Abstention case passes.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R009
Acceptance: high-confidence agent claims against a new external report (rollup)
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Acceptance: high-confidence agent claims against a new external report (rollup).** The question has three parts. First, find each high-confidence claim of my agent from the last 30 days that touches a new external report. Second, cluster the supporting evidence by embedding similarity. Third, run a temporal decay analysis on the contradictions. One UQL program must answer it as one plan, served by arbora through `ARBORA-OPS-R018`. Children `.1` to `.5` deliver it. | Each child requirement has its own verification.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R009.1
Query fixture: claims that touch the report
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Query fixture: claims that touch the report.** `tests/fixtures/cq/xsrc_r009.uql` must hold the program. It must select claims by the agent with confidence at least 0.8 and valid time in the last 30 days. A claim touches the report through a graph edge or a vector similarity of at least 0.75 to a report chunk. | A parser test compiles the fixture to one plan DAG.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R009.2
Evidence clustering
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Evidence clustering.** The program must gather the supporting evidence with `EVIDENCE FOR`. It must group the evidence with the `CLUSTER BY EMBEDDING` stage of `EG-FEDERATED-QUERY-R720.3`. | The served acceptance test of `.4` checks the cluster ids of the fixture evidence.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R009.3
Contradiction decay analysis
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Contradiction decay analysis.** The program must read the contradictions of the selected claims with `CONTRADICTS` of `EG-DECISION-ENGINE-R700.7`. It must weight each contradiction with the `DECAY` stage of `EG-FEDERATED-QUERY-R720.2`. It must return the decayed weight of each contradiction. | The served acceptance test of `.4` checks the decayed weights against fixed values.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R009.4
Served acceptance through arbora
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Served acceptance through arbora.** The test must ingest a report fixture and agent claims through arbora. It must run the program through `ARBORA-OPS-R018`. `EXPLAIN` must report one plan id. The result must hold the expected claims, clusters and decayed weights. | `tests/test_cq_xsrc_r009.py::test_agent_claims_against_report_one_plan` passes against a served engine.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-CQ-XSRC-R009.5
Refusal
Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source
**Refusal.** A report id with no ingested record must refuse with `CQ_REPORT_NOT_FOUND`. An empty claim window must return an empty typed result and no error. | `tests/test_cq_xsrc_r009.py::test_unknown_report_refuses` asserts the code and the empty-window result.
requirementEG-CQ-XSRCSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB
EG-DATAPLAT-VOCAB — Data-platform vocabulary
specNoneSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R001
Shared terms and mapping properties (rollup)
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Shared terms and mapping properties (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R001.1 to .4 are LANDED.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R001.1
Add `dp:DataStore`, `dp:storeFamily`, `dp:inStore`, `dp:viaConnection`, `dp:asOf` to the new vocabulary file. Touches `crates/eg-core/ontology/data_platform-v1.ttl`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:DataStore`, `dp:storeFamily`, `dp:inStore`, `dp:viaConnection`, `dp:asOf` to the new vocabulary file. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. | `crates/eg-core/tests/data_platform_vocab.rs::shared_terms_present` loads the file and asserts the five IRIs.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R001.2
Add `dp:StoreMapping` (subclass of `vg:VirtualMapping`) with `dp:contractKind`, `dp:viaOperation`, `dp:accelerationMode`, `dp:materialisationReason`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:StoreMapping` (subclass of `vg:VirtualMapping`) with `dp:contractKind`, `dp:viaOperation`, `dp:accelerationMode`, `dp:materialisationReason`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::store_mapping_subclass_of_virtual_mapping`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R001.3
Add `document` to the `vg:sourceKind` list comment and `sh:in` of the source-connection shape. Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `document` to the `vg:sourceKind` list comment and `sh:in` of the source-connection shape. Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | `crates/eg-core/tests/data_platform_vocab.rs::document_source_kind_accepted` validates a `document` connection and still rejects `ftp`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R001.4
Register `core:data-platform@1` as a core schema source next to `core:virtual-graph@1`. Touches `crates/eg-core/src/graph/schema_sources.rs`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Register `core:data-platform@1` as a core schema source next to `core:virtual-graph@1`. Touches `crates/eg-core/src/graph/schema_sources.rs`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::core_source_registered` resolves the source by name and version.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R002
Relational and document store terms (rollup)
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Relational and document store terms (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R002.1 to .4 are LANDED.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R002.1
Add `dp:Database`, `dp:Schema`, `dp:Table`, `dp:View`, `dp:Column`, `dp:ForeignKey`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:Database`, `dp:Schema`, `dp:Table`, `dp:View`, `dp:Column`, `dp:ForeignKey`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::relational_classes_present`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R002.2
Add `dp:inSchema`, `dp:hasColumn`, `dp:referencesTable`, `dp:isPrimaryKey`, `dp:sqlDialect` with domain/range. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:inSchema`, `dp:hasColumn`, `dp:referencesTable`, `dp:isPrimaryKey`, `dp:sqlDialect` with domain/range. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.1`. | `crates/eg-core/tests/data_platform_vocab.rs::relational_properties_domain_range`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R002.3
Add `dp:Collection`, `dp:DocumentField`, `dp:fieldPath`, `dp:fieldType`, `dp:presenceRatio`, `dp:documentCount`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:Collection`, `dp:DocumentField`, `dp:fieldPath`, `dp:fieldType`, `dp:presenceRatio`, `dp:documentCount`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::document_terms_present`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R002.4
Add a shape: `dp:fieldType` is in the `DocumentFieldType` list (incl. `Mixed`); `dp:presenceRatio` in [0,1]. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.3`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add a shape: `dp:fieldType` is in the `DocumentFieldType` list (incl. `Mixed`); `dp:presenceRatio` in [0,1]. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.3`. | `crates/eg-core/tests/data_platform_vocab.rs::document_field_shape_rejects_ratio_2`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R003
Object and vector store terms (rollup)
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Object and vector store terms (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R003.1 to .3 are LANDED.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R003.1
Add `dp:Bucket`, `dp:StoredObject`, `dp:objectKey`, `dp:byteSize`, `dp:lastModified`; no content property. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:Bucket`, `dp:StoredObject`, `dp:objectKey`, `dp:byteSize`, `dp:lastModified`; no content property. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::object_terms_present_without_content_property`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R003.2
Add `dp:VectorCollection`, `dp:EmbeddingSpace`, `dp:embeddingModel`, `dp:dimensions`, `dp:distanceMetric`, `dp:usesEmbeddingSpace`, `dp:vectorCount`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:VectorCollection`, `dp:EmbeddingSpace`, `dp:embeddingModel`, `dp:dimensions`, `dp:distanceMetric`, `dp:usesEmbeddingSpace`, `dp:vectorCount`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::vector_terms_present`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R003.3
Add a shape: `dp:dimensions` positive integer; exactly one embedding space per vector collection. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R003.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add a shape: `dp:dimensions` positive integer; exactly one embedding space per vector collection. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R003.2`. | `crates/eg-core/tests/data_platform_vocab.rs::vector_dimension_zero_rejected`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R004
Stream, analytics and ML terms (rollup)
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Stream, analytics and ML terms (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R004.1 to .4 are LANDED.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R004.1
Add `dp:Topic`, `dp:Partition`, `dp:ConsumerGroup`, `dp:PartitionLag`, `dp:partitionOf`, `dp:subscribesTo`, `dp:lag`, `dp:groupState`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:Topic`, `dp:Partition`, `dp:ConsumerGroup`, `dp:PartitionLag`, `dp:partitionOf`, `dp:subscribesTo`, `dp:lag`, `dp:groupState`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::stream_terms_present`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R004.2
Add a shape: `dp:lag` integer >= 0 and `dp:asOf` required on `dp:PartitionLag`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R004.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add a shape: `dp:lag` integer >= 0 and `dp:asOf` required on `dp:PartitionLag`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R004.1`. | `crates/eg-core/tests/data_platform_vocab.rs::negative_lag_rejected`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R004.3
Add `dp:AnalyticsSite`, `dp:BehaviorMetric`, `dp:metricName`, `dp:metricValue`, `dp:windowDays`, `dp:dimensionName`, `dp:dimensionValue`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:AnalyticsSite`, `dp:BehaviorMetric`, `dp:metricName`, `dp:metricValue`, `dp:windowDays`, `dp:dimensionName`, `dp:dimensionValue`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::analytics_terms_present`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R004.4
Add `dp:Dataset` as a subclass of the existing core `:Dataset`, `dp:Model` as a general trained-model class (not equivalent to the narrower LLM/embedding `:Model`), `dp:TrainingRun`, `dp:EvaluationResult`, `dp:trainedOn`, `dp:producedModel`, `dp:evaluatedOn`, `dp:baselineRun`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:Dataset` as a subclass of the existing core `:Dataset`, `dp:Model` as a general trained-model class (not equivalent to the narrower LLM/embedding `:Model`), `dp:TrainingRun`, `dp:EvaluationResult`, `dp:trainedOn`, `dp:producedModel`, `dp:evaluatedOn`, `dp:baselineRun`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::ml_terms_present`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R005
Secret metadata only (openbao) (rollup)
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Secret metadata only (openbao) (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R005.1 to .5 are LANDED.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R005.1
Add `dp:SecretEngine`, `dp:SecretPath`, `dp:AccessPolicy`, `dp:RotationState`, `dp:hasRotationState`, `dp:lastRotatedAt`, `dp:currentVersion`, `dp:pathName`, `dp:PolicyPathGrant`, `dp:grantPolicy`, `dp:grantPath`, `dp:grantsCapability`, `dp:leaseExpiresAt`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add `dp:SecretEngine`, `dp:SecretPath`, `dp:AccessPolicy`, `dp:RotationState`, `dp:hasRotationState`, `dp:lastRotatedAt`, `dp:currentVersion`, `dp:pathName`, `dp:PolicyPathGrant`, `dp:grantPolicy`, `dp:grantPath`, `dp:grantsCapability`, `dp:leaseExpiresAt`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::secret_metadata_terms_present`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R005.2
Add closed shapes (`sh:closed true`) for the five secret-metadata classes, including `dp:PolicyPathGrant`. Allow only their applicable metadata properties, including shared store/provenance links, and reject every other property. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R005.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add closed shapes (`sh:closed true`) for the five secret-metadata classes, including `dp:PolicyPathGrant`. Allow only their applicable metadata properties, including shared store/provenance links, and reject every other property. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R005.1`. | `crates/eg-core/tests/data_platform_vocab.rs::secret_path_with_extra_property_rejected`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R005.3
Refusal test row: a `dp:SecretPath` carrying a `value` (and one carrying `token`) triple fails validation, and the vocabulary file contains no property named value, secret, token, password, ciphertext or rules. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R005.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Refusal test row: a `dp:SecretPath` carrying a `value` (and one carrying `token`) triple fails validation, and the vocabulary file contains no property named value, secret, token, password, ciphertext or rules. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R005.2`. | `crates/eg-core/tests/data_platform_vocab.rs::secret_value_refused_and_no_value_property`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R005.4
Add a mapping-validator rule that refuses a `dp:StoreMapping` whose `dp:viaOperation` is `openbao_mcp_kv:kv2_get`, `kv1_get`, `openbao_mcp_logical:read` or `unwrap`. Touches `crates/eg-plan/src/virtual_graph_mapping.rs`. Depends on `EG-DATAPLAT-VOCAB-R005.3`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add a mapping-validator rule that refuses a `dp:StoreMapping` whose `dp:viaOperation` is `openbao_mcp_kv:kv2_get`, `kv1_get`, `openbao_mcp_logical:read` or `unwrap`. Touches `crates/eg-plan/src/virtual_graph_mapping.rs`. Depends on `EG-DATAPLAT-VOCAB-R005.3`. | `crates/eg-core/tests/data_platform_vocab.rs::openbao_value_operation_mapping_refused`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R005.5
Add a shape: each `dp:PolicyPathGrant` has exactly one `dp:grantPolicy` (`dp:AccessPolicy`), exactly one `dp:grantPath` (`dp:SecretPath`), and at least one `dp:grantsCapability` string in `read list create update delete sudo deny`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R005.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add a shape: each `dp:PolicyPathGrant` has exactly one `dp:grantPolicy` (`dp:AccessPolicy`), exactly one `dp:grantPath` (`dp:SecretPath`), and at least one `dp:grantsCapability` string in `read list create update delete sudo deny`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R005.1`. | `crates/eg-core/tests/data_platform_vocab.rs::grants_capability_closed_list` rejects an invalid permission and proves one policy can grant read on path A and deny on path B without mixing the permissions.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R006
Per-connector mapping fixtures (rollup)
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Per-connector mapping fixtures (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R006.1 to .8 are LANDED.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R006.1
Add the `sql` `dp:StoreMapping` fixture for `sql_schema:tables`, `columns`, `foreign_keys`, `constraints` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/sql.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the `sql` `dp:StoreMapping` fixture for `sql_schema:tables`, `columns`, `foreign_keys`, `constraints` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/sql.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_sql_validates`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R006.2
Add the `documentdb` `dp:StoreMapping` fixture for `documentdb_collections:list_collections`, `documentdb_analysis:aggregate` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/documentdb.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the `documentdb` `dp:StoreMapping` fixture for `documentdb_collections:list_collections`, `documentdb_analysis:aggregate` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/documentdb.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_documentdb_validates`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R006.3
Add the `objectstore` `dp:StoreMapping` fixture for `buckets:list`, `objects:list`, `objects:head` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/objectstore.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the `objectstore` `dp:StoreMapping` fixture for `buckets:list`, `objects:list`, `objects:head` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/objectstore.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_objectstore_validates`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R006.4
Add the `vector` `dp:StoreMapping` fixture for `vector_collection_management:list_collections` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/vector.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the `vector` `dp:StoreMapping` fixture for `vector_collection_management:list_collections` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/vector.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_vector_validates`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R006.5
Add the `kafka` `dp:StoreMapping` fixture for `kafka_groups:lags`, `kafka_partitions:list`, `kafka_topics:list` with `dp:accelerationMode` V; M for sustained lag (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/kafka.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the `kafka` `dp:StoreMapping` fixture for `kafka_groups:lags`, `kafka_partitions:list`, `kafka_topics:list` with `dp:accelerationMode` V; M for sustained lag (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/kafka.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_kafka_validates`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R006.6
Add the `openbao` `dp:StoreMapping` fixture for `openbao_mcp_sys:get_mounts`, `openbao_mcp_logical:list` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/openbao.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the `openbao` `dp:StoreMapping` fixture for `openbao_mcp_sys:get_mounts`, `openbao_mcp_logical:list` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/openbao.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_openbao_validates`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R006.7
Add the `clarity` `dp:StoreMapping` fixture for `clarity_insights:get_data_export` with `dp:accelerationMode` V up to 3 days; M beyond (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/clarity.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the `clarity` `dp:StoreMapping` fixture for `clarity_insights:get_data_export` with `dp:accelerationMode` V up to 3 days; M beyond (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/clarity.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_clarity_validates`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R006.8
Add the `data-science` `dp:StoreMapping` fixture for `load_dataset`, `dataset_lineage`, `rank_models`, `evaluate_model` with `dp:accelerationMode` V; M for run history (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/data-science.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the `data-science` `dp:StoreMapping` fixture for `load_dataset`, `dataset_lineage`, `rank_models`, `evaluate_model` with `dp:accelerationMode` V; M for run history (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/data-science.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_data_science_validates`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R007
Mode and discovery guards (rollup)
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Mode and discovery guards (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R007.1 to .4 are LANDED.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R007.1
Add a shape rule: `materialised` without `dp:materialisationReason` is a violation; `virtual` needs none. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add a shape rule: `materialised` without `dp:materialisationReason` is a violation; `virtual` needs none. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::materialised_without_reason_rejected`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R007.2
Add a shape rule: `contractKind = mcp-operation` requires `dp:viaOperation`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add a shape rule: `contractKind = mcp-operation` requires `dp:viaOperation`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mcp_operation_requires_via_operation`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R007.3
Add a test that no `dp:` term or mapping fixture declares a discovery operation: relational/document entries come from `vg:MetadataContract` only. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R006.1`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add a test that no `dp:` term or mapping fixture declares a discovery operation: relational/document entries come from `vg:MetadataContract` only. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R006.1`. | `crates/eg-core/tests/data_platform_vocab.rs::no_second_discovery_path`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R007.4
Add a test that every fixture mapping not marked `materialised` has no `AccelerationPolicy` and every `materialised` one cites R038. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R006.8`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add a test that every fixture mapping not marked `materialised` has no `AccelerationPolicy` and every `materialised` one cites R038. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R006.8`. | `crates/eg-core/tests/data_platform_vocab.rs::virtual_default_for_all_eight`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R008
Alignment with package-local ontologies (rollup)
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Alignment with package-local ontologies (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R008.1 to .3 are LANDED.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R008.1
Add an alignment table (package term -> `dp:` term, `rdfs:subClassOf` / `owl:equivalentProperty`) for sql and documentdb. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_relational.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add an alignment table (package term -> `dp:` term, `rdfs:subClassOf` / `owl:equivalentProperty`) for sql and documentdb. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_relational.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.2`. | `crates/eg-core/tests/data_platform_vocab.rs::alignment_relational_resolves`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R008.2
Add the alignment table for objectstore and vector. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_object_vector.ttl`. Depends on `EG-DATAPLAT-VOCAB-R003.2`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the alignment table for objectstore and vector. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_object_vector.ttl`. Depends on `EG-DATAPLAT-VOCAB-R003.2`. | `crates/eg-core/tests/data_platform_vocab.rs::alignment_object_vector_resolves`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R008.3
Add the alignment table for kafka, openbao, clarity, data-science. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_ops_ml.ttl`. Depends on `EG-DATAPLAT-VOCAB-R004.4`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
Add the alignment table for kafka, openbao, clarity, data-science. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_ops_ml.ttl`. Depends on `EG-DATAPLAT-VOCAB-R004.4`. | `crates/eg-core/tests/data_platform_vocab.rs::alignment_ops_ml_resolves`.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R009
Connector operations this vocabulary needs (cross-repo rollup)
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Connector operations this vocabulary needs (cross-repo rollup).** Each child is owned by the named repository and is BLOCKED for the dependent competency question until it lands. | Children EG-DATAPLAT-VOCAB-R009.1 to .5 are LANDED.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R009.1
Cross-repo, owner `objectstore-mcp`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Cross-repo, owner `objectstore-mcp`.** Add a last-access (or access-log derived last-read) operation to `objects`. Touches `agent-packages/agents/objectstore-mcp/objectstore_mcp/mcp/mcp_objectstore.py`. | a `head`/`list` result carries `last_accessed` or the operation returns a typed `unsupported` for backends without it.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R009.2
Cross-repo, owner `vector-mcp`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Cross-repo, owner `vector-mcp`.** Add collection stats action (count, dimension, embedding model, distance metric) and get-by-id to `vector_collection_management`. Touches `agent-packages/agents/vector-mcp/vector_mcp/mcp_server.py`. | stats action returns the four fields on a fixture collection.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R009.3
Cross-repo, owner `openbao-mcp`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Cross-repo, owner `openbao-mcp`.** Add a metadata-only operation: KV v2 metadata (path, current version, created/updated time) and policy-to-path capability matrix, no values and no HCL. Touches `agent-packages/agents/openbao-mcp/openbao_mcp/mcp/mcp_secrets.py`. | response schema test asserts no value/data/token key at any depth.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R009.4
Cross-repo, owner `clarity-api`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Cross-repo, owner `clarity-api`.** Name and surface rage-click and dead-click metrics by URL in `get_data_export` results. Touches `agent-packages/agents/clarity-api/clarity_api/mcp/mcp_insights.py`. | fixture export returns the two metrics for the URL dimension.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DATAPLAT-VOCAB-R009.5
Cross-repo, owner `data-science-mcp`
Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source
**Cross-repo, owner `data-science-mcp`.** Add a run-registry read operation returning training runs, their dataset, validation metrics and baseline run. Touches `agent-packages/agents/data-science-mcp/data_science_mcp/mcp_server.py`. | fixture runs list returns metrics and a baseline id.
requirementEG-DATAPLAT-VOCABSPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE
EG-DECISION-ENGINE — Decision engine
specNoneSPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R001
Typed decision ladder with explicit resolution kinds (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed decision ladder with explicit resolution kinds (rollup).** Every decision answer exposes a resolution_kind of constraint, entailment, optimization, statistical, or abstention, selected by applying policy and hard constraints first, then ontology entailment, then bounded exact solving, and falling back to fitted statistics only to rank remaining legal options or abstain. Split (2026-10-09): `.1` the three resolution kinds the production chokepoint actually emits, `.2` the missing Constraint/Entailment production paths. Child `.100` adds a GraphOS pre-surface physical/safety bound decision contract. It does not replace GraphOS's required served surfacing gate. | Unit and integration tests assert the resolution_kind returned for representative constraint, entailment, optimization, statistical, and abstention cases. `.100` requires served bound checks and an explicit GraphOS pre-surface consumer receipt.
requirementEG-DECISION-ENGINESPECIFIED52f333ca756e
a4804f87c971
d2386535ca97
EG-DECISION-ENGINE-R001.1
`ResolutionKind` is typed with all five variants; the production chokepoint emits Optimization, Statistical, and Abstention
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**`ResolutionKind` is typed with all five variants; the production chokepoint emits Optimization, Statistical, and Abstention.** `ResolutionKind` (crates/eg-types) defines Constraint, Entailment, Optimization, Statistical, and Abstention. The live `Decide`/assemble chokepoint (`crates/eg-compute/src/assemble/conclude.rs`) constructs `ResolutionKind::Optimization` and `ResolutionKind::Abstention`; `stat_decide` constructs `ResolutionKind::Statistical` and `::Abstention`. | `crates/eg-compute/src/assemble/tests/routing.rs` and `crates/eg-types/src/test_support/contract_wave/decision.rs` assert resolution_kind for Optimization/Statistical/Abstention cases.
requirementEG-DECISION-ENGINEVERIFIEDb23e8815f42c
crates/eg-compute/src/assemble/tests/routing.rs:146
EG-DECISION-ENGINE-R001.2
Remaining scope: production Constraint and Entailment resolution paths
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Remaining scope: production Constraint and Entailment resolution paths.** `conclude.rs` and `stat_decide` never construct `ResolutionKind::Constraint` or `::Entailment` — the only existing `Constraint` construction is `A2ARoutingResolution` (`crates/eg-types/src/decision/rapid_r044.rs`, EG-DECISION-ENGINE-R044.1), which is not wired into the general `Decide`/assemble chokepoint. Add: (a) a constraint-only short-circuit in `conclude.rs` that returns `ResolutionKind::Constraint` when hard constraints alone determine the answer, before solving/statistics run; (b) an ontology-entailment path that returns `ResolutionKind::Entailment` when the answer follows from entailment alone (reusing the existing is_a derivation machinery, EG-DECISION-ENGINE-R003). | Unit and integration tests assert `resolution_kind == Constraint` and `== Entailment` for representative cases through the production `Decide`/assemble chokepoint (not through `A2ARoutingResolution`).
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R002
Evidence class recorded on every decision record
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence class recorded on every decision record.** Each decision record stores an evidence_class: proof, observation or claim. The value comes from its weakest premise. Pack-provided capability annotations therefore appear as claims, not proof. | A negative test confirms a capability derived only from a pack annotation reports evidence_class claim, not proof.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
crates/eg-compute/src/assemble/tests/planted.rs:170
EG-DECISION-ENGINE-R003
Derivation records for entailed answers
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Derivation records for entailed answers.** An is_a derivation record backs an entailment-resolved answer. It names the source and premise class of each edge used. An invented or unsupported ontology edge bars the overall answer from claiming proof-level evidence. | A negative test confirms the engine refuses an answer that depends on a fabricated ontology edge. The engine does not accept it as a proof.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
31c7f9514f41
52f333ca756e
crates/eg-types/src/decision/derivation/tests.rs:191
EG-DECISION-ENGINE-R004
Independently verifiable 0-1 integer solver certificate
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Independently verifiable 0-1 integer solver certificate.** The solver in crates/eg-compute/src/solve produces a certificate naming feasibility, objective value, lower bound, optimality gap, solver version, and input digest for every solved assembly, and a separate verifier recomputes and checks that certificate independently of the solve path. | Determinism tests confirm repeated solves are byte-identical and match a committed golden certificate digest, and an exhaustive-search test confirms the solver's optimum matches brute-force search on small models.
requirementEG-DECISION-ENGINEVERIFIED31c7f9514f41
52f333ca756e
b43f33569dd4
crates/eg-compute/tests/solve/determinism.rs:49
crates/eg-compute/tests/solve/determinism.rs:78
crates/eg-compute/tests/solve/exhaustive.rs:40
EG-DECISION-ENGINE-R005
Conformal and risk-controlled statistical guarantees
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Conformal and risk-controlled statistical guarantees.** Statistical heads apply acceptability-set conformal prediction, selective risk control (Learn-then-Test), and adaptive conformal inference to bound miscoverage under drift, abstaining rather than returning an uncalibrated answer when these guarantees cannot be met. | Numeric unit tests fit and evaluate each guarantee and assert the resulting coverage and abstention behavior.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
31c7f9514f41
52f333ca756e
crates/eg-numeric/tests/stat_kernels/conformal.rs:210
crates/eg-numeric/tests/stat_kernels/conformal.rs:361
crates/eg-numeric/tests/stat_kernels/risk.rs:246
EG-DECISION-ENGINE-R006
Off-policy evaluation gated on effective sample size
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Off-policy evaluation gated on effective sample size.** Decision evaluation records exact propensities and computes off-policy estimates. It uses clipped or SWITCH importance sampling and doubly robust estimators. It reports effective sample size and refuses to promote a fitted head when that size falls below the configured minimum. | A unit test asserts that off-policy evaluation reports support and effective sample size. It also verifies that the engine blocks promotion below the minimum threshold.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
31c7f9514f41
52f333ca756e
crates/eg-numeric/tests/stat_kernels/ope.rs:159
crates/eg-numeric/tests/stat_kernels/ope.rs:204
EG-DECISION-ENGINE-R007
Deterministic cross-target replay of committed decision records
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Deterministic cross-target replay of committed decision records.** A committed decision record replays to byte-identical quantized fixed-point digests using a pinned software floating-point implementation. The same record verifies identically on every supported target platform. | A golden-vector replay test confirms identical digests on the supported targets. Release qualification exercises the full target matrix.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
e0587cbf4693
crates/eg-compute/src/assemble/tests/golden.rs:55
EG-DECISION-ENGINE-R008
Why-chosen and why-not explanations for solved assemblies
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Why-chosen and why-not explanations for solved assemblies.** Every solved assembly can explain why it chose an option. For each visible excluded option, it can explain why not. It uses a bounded re-solve for that option rather than an unbounded search. | Integration tests confirm why-not routing returns a correct, bounded explanation for excluded candidates.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
e0587cbf4693
crates/eg-compute/src/assemble/tests/template.rs:117
EG-DECISION-ENGINE-R009
Learned ranking stays monotone with respect to safety
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Learned ranking stays monotone with respect to safety.** A fitted statistical head may only narrow the set of legal options or cause abstention. It can never widen the legal set. It can never authorize an option that policy and hard constraints have not already permitted. | A negative test confirms that a learned head cannot override or widen the constraint-derived legal set. It also confirms that execution enforces this invariant independently of the head.
requirementEG-DECISION-ENGINEVERIFIED4952a2edced4
52f333ca756e
crates/eg-numeric/tests/decision/scorer.rs:140
EG-DECISION-ENGINE-R010
Typed abstention reason for unmet capability
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed abstention reason for unmet capability.** When no legal assembly satisfies the requested capabilities, the system returns a typed AbstainReason value naming the specific missing capability rather than a generic failure. | Unit tests assert that an unsatisfiable capability request returns an AbstainReason identifying the missing capability.
requirementEG-DECISION-ENGINEVERIFIED52f333ca756e
a4804f87c971
e0587cbf4693
crates/eg-compute/src/assemble/tests/routing.rs:147
EG-DECISION-ENGINE-R011
Work-budgeted search without an arbitrary result cap
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Work-budgeted search without an arbitrary result cap.** The solver in crates/eg-compute/src/solve/search bounds search by a deterministic node budget rather than an arbitrary cap on the number of candidate results, reporting an unresolved or certified-gap result when the budget is exhausted instead of silently truncating the option set. | Adversarial tests confirm that exhausting the budget above the accepted gap yields an unresolved result, that exhausting it within the accepted gap yields a certified gap, and that a parity case exhausts the budget without an incumbent.
requirementEG-DECISION-ENGINEVERIFIED52f333ca756e
b43f33569dd4
e0587cbf4693
crates/eg-compute/tests/solve/adversarial.rs:33
crates/eg-compute/tests/solve/adversarial.rs:57
crates/eg-compute/tests/solve/adversarial.rs:8
EG-DECISION-ENGINE-R012
Shared slate crediting across multiple questions
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Shared slate crediting across multiple questions.** When multiple questions are answered against the same assembly template, the system credits outcomes at the slot level across the shared template, with results aggregated consistently across the related questions. | Template-level unit tests assert slot-level crediting is applied correctly across a shared assembly template.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
81e90c5f3bde
d2386535ca97
src/server/handlers/decide/stat_tests/attribution_tests.rs:128
src/server/handlers/decide/stat_tests/attribution_tests.rs:129
EG-DECISION-ENGINE-R012.1
Slot-level crediting across questions sharing an assembly template
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Slot-level crediting across questions sharing an assembly template.** When multiple questions are answered against the same assembly template, outcomes must be credited at the slot level across the shared template; today only whole- or sub-slate crediting exists. | Test: `crates/eg-types/src/decision/rapid_r012.rs::tests::credits_outcomes_at_the_slot_level_across_a_shared_assembly_template`.
requirementEG-DECISION-ENGINEVERIFIED81e90c5f3bde
src/server/handlers/decide/stat_tests/attribution_tests.rs:129
EG-DECISION-ENGINE-R013
Tenant-visibility filtering before feature computation
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Tenant-visibility filtering before feature computation.** Decision candidates are filtered by tenant and row-level visibility before any feature is computed or counted, and no report or aggregate may expose a candidate, feature value, or statistic derived from a source outside the requesting tenant's visibility. | A negative test confirms that a candidate from another tenant is excluded from decision results and aggregates.
requirementEG-DECISION-ENGINEVERIFIED14743fbffa3d
2a0d6eae0918
52f333ca756e
src/server/persistence/agent_component.rs:1101
EG-DECISION-ENGINE-R014
Composition solved as bounded constraint optimization
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Composition solved as bounded constraint optimization.** Agent or component composition is resolved by lowering covering, implication, exactly-one, knapsack, feature-compatibility, and cardinality requirements into a bounded 0-1 integer program and solving it exactly, rather than by a single unverified model-generated choice. | Exhaustive-search and model-validation tests confirm the lowered constraint model produces correct, verifiable compositions across representative cases.
requirementEG-DECISION-ENGINESPECIFIED14743fbffa3d
52f333ca756e
b43f33569dd4
crates/eg-compute/tests/solve/exhaustive.rs:41
crates/eg-compute/tests/solve/model_validation.rs:223
EG-DECISION-ENGINE-R015
No generative model weights inside the decision engine (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**No generative model weights inside the decision engine (rollup).** The decision engine contains no large language model weights and performs no free-text generation. Its statistical heads are small fitted models used only to rank legal options or abstain. Split into child requirements by code root. `.1` is a typed, closed StatisticalHeadKind refusing a non-fitted-head name. `.2` wires the ladder's head registry through the typed head-kind parse. | Architecture and dependency review confirms no generative model weights or text-generation calls are present in the decision engine's code paths.
requirementEG-DECISION-ENGINEVERIFIED0fac721690e2
2763396269d0
3c6b457009e4
40ea81e3e512
52f333ca756e
crates/eg-numeric/tests/decision/head_kinds.rs:75
crates/eg-types/src/decision/jobs.rs:615
crates/eg-types/src/decision/jobs.rs:635
crates/eg-types/src/decision/rapid_r015.rs:100
crates/eg-types/src/decision/rapid_r015.rs:117
EG-DECISION-ENGINE-R015.1
Typed, closed StatisticalHeadKind refusing a non-fitted-head name
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed, closed StatisticalHeadKind refusing a non-fitted-head name.** Add the typed, closed `StatisticalHeadKind::parse` (`crates/eg-types/src/decision/rapid_r015.rs`). It refuses any head-kind name outside the two fitted heads the ladder uses, including a generative-model label. | Test: `crates/eg-types/src/decision/rapid_r015.rs::tests::refuses_a_generative_model_name`.
requirementEG-DECISION-ENGINEVERIFIED0fac721690e2
crates/eg-types/src/decision/rapid_r015.rs:100
EG-DECISION-ENGINE-R015.2
Wire the ladder's head registry through the typed head-kind parse
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wire the ladder's head registry through the typed head-kind parse.** Remaining scope from the split (2026-10-09): wiring the ladder's head registry to construct heads only through this parse. Split into grandchild requirements (2026-10-09). `.1` a total, reversible mapping between the closed `StatisticalHeadKind` and the ladder's production `HeadKind` registry, `.2` routing `DecisionFitRequest` construction through that mapping at admission. | Architecture and dependency review confirms no generative model weights or text-generation calls are present in the decision engine's code paths.
requirementEG-DECISION-ENGINEVERIFIED2763396269d0
3c6b457009e4
crates/eg-types/src/decision/jobs.rs:615
crates/eg-types/src/decision/jobs.rs:635
crates/eg-types/src/decision/rapid_r015.rs:117
EG-DECISION-ENGINE-R015.2.1
Total, reversible mapping between StatisticalHeadKind and the production HeadKind registry
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Total, reversible mapping between StatisticalHeadKind and the production HeadKind registry.** Add `StatisticalHeadKind::to_head_kind` and `StatisticalHeadKind::from_head_kind` (`crates/eg-types/src/decision/rapid_r015.rs`), connecting the closed, parse-validated name set to the ladder's actual `HeadKind` enum, with the resident-scorer `OptionAttention` variant correctly outside the closed set rather than silently coerced into it. | Test: `crates/eg-types/src/decision/rapid_r015.rs::tests::wires_the_production_head_kind_through_the_closed_registry`.
requirementEG-DECISION-ENGINEVERIFIED3c6b457009e4
crates/eg-types/src/decision/rapid_r015.rs:117
EG-DECISION-ENGINE-R015.2.2
Route DecisionFitRequest construction through the typed mapping
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Route DecisionFitRequest construction through the typed mapping.** Remaining scope: validate `DecisionFitRequest.head_kind` through `StatisticalHeadKind::from_head_kind` at admission (`crates/eg-types/src/decision/jobs.rs`), deciding how an `OptionAttention` fit request is admitted given it is outside the `.1`/`.2.1` closed set. | Architecture and dependency review confirms no generative model weights or text-generation calls are present in the decision engine's code paths.
requirementEG-DECISION-ENGINEVERIFIED2763396269d0
crates/eg-types/src/decision/jobs.rs:615
crates/eg-types/src/decision/jobs.rs:635
EG-DECISION-ENGINE-R016
Training restricted to independently evaluated outcomes
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Training restricted to independently evaluated outcomes.** Calibration and training data include only outcomes recorded with exact propensities by approved commit principals; a self-reported or language-model-resolved outcome is excluded from the calibration or training set. | Unit tests confirm that the engine refuses every planted defective label by name. A language-model-resolved abstention never enters the calibration set.
requirementEG-DECISION-ENGINEVERIFIED14743fbffa3d
2a0d6eae0918
52f333ca756e
crates/eg-numeric/tests/decision/admission.rs:32
crates/eg-numeric/tests/decision/admission.rs:87
EG-DECISION-ENGINE-R017
Single write authority per durable decision state kind
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Single write authority per durable decision state kind.** Each durable decision-state kind has exactly one write authority responsible for committing it. Examples include an assembled agent graph, a graph mutation batch, or a published component with its receipt. No second code path may independently mutate that state. | Integration tests confirm only the designated path commits each state kind. They also confirm bypass attempts fail.
requirementEG-DECISION-ENGINEVERIFIED28a27439cec5
52f333ca756e
9079ca7b0ddd
crates/eg-types/src/agent_component.rs:2278
EG-DECISION-ENGINE-R018
Unknown facts never default to zero in the solver
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Unknown facts never default to zero in the solver.** When a cost, latency, or capability fact needed by the solver objective is unknown, the solver treats it as unknown rather than silently substituting zero or a true or false default, and surfaces the gap instead of producing a misleadingly optimal result. | A unit test confirms that an unknown required fact prevents a false-confidence solve rather than being silently defaulted.
requirementEG-DECISION-ENGINEVERIFIED52f333ca756e
c0edc96d1e10
crates/eg-compute/src/assemble/tests/planted.rs:43
crates/eg-compute/src/assemble/tests/topology.rs:143
EG-DECISION-ENGINE-R019
Decision commit re-derives and verifies before writing
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision commit re-derives and verifies before writing.** Committing a decision result re-derives the result, verifies its certificate, checks every pinned component revision, and compares the candidate-universe catalog digest with a compare-and-set, all within one transaction, so a stale catalog or fabricated input fails closed instead of being committed. | Integration tests confirm that a stale catalog or a fabricated input is rejected at commit time while a byte-identical retry commits idempotently.
requirementEG-DECISION-ENGINESPECIFIED14743fbffa3d
52f333ca756e
d6baf6dfc8c9
src/server/persistence/decision_record/tests.rs:167
src/server/persistence/decision_record/tests.rs:196
src/server/persistence/decision_record/tests.rs:222
EG-DECISION-ENGINE-R020
Bounded, keyed exploration excluded from sensitive questions
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Bounded, keyed exploration excluded from sensitive questions.** Exploratory ranking requires an explicit budget and an unpredictable HMAC-keyed seed, and is unavailable for security, policy, write-back, and irreversible-action questions regardless of the requested budget. | Unit tests verify the keyed seed against a published HMAC test vector and confirm that exploration on a security question is refused by the served path.
requirementEG-DECISION-ENGINESPECIFIED2a0d6eae0918
52f333ca756e
src/server/handlers/decide/stat_tests.rs:868
EG-DECISION-ENGINE-R021
Versioned feature schema for decision candidates
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Versioned feature schema for decision candidates.** Decision ranking computes a versioned feature set over caller-visible candidates, including vector similarity, candidate-local BM25, entailed coverage, provenance quality, belief confidence, cost and latency, freshness, and outcome statistics, so a feature schema change can be tracked and replayed. | Unit and client tests assert the versioned feature vector is computed correctly for representative candidates.
requirementEG-DECISION-ENGINEVERIFIED14743fbffa3d
2a0d6eae0918
52f333ca756e
crates/eg-numeric/tests/decision/features.rs:63
EG-DECISION-ENGINE-R022
Separation of full-label and bandit-label training regimes
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Separation of full-label and bandit-label training regimes.** Training data distinguishes gold-labelled questions, which provide a full label, from executed-option-only outcomes, which provide a bandit label, and each regime is admitted into fitting only through its own path. | Unit tests in the admission path confirm gold-labelled and bandit-labelled data are routed and validated separately.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
a4e9027b789e
crates/eg-numeric/tests/decision/admission.rs:33
crates/eg-numeric/tests/decision/admission.rs:88
EG-DECISION-ENGINE-R023
Hierarchical pooling of outcome statistics with a minimum-sample gate
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hierarchical pooling of outcome statistics with a minimum-sample gate.** Pool outcome statistics hierarchically by kind, capability class and option using a Beta-Binomial model. A pool below its configured sample minimum cannot support fitted-head promotion. | A unit test confirms insufficient pooled support for an option blocks promotion.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
a4e9027b789e
crates/eg-numeric/tests/decision/fit_eval.rs:204
EG-DECISION-ENGINE-R024
Multi-class and binary calibration utilities
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Multi-class and binary calibration utilities.** Decision confidence uses temperature, vector, or Dirichlet scaling for multi-class outputs. It uses isotonic calibration only for the binary entity-resolution case. The engine records the calibration method on the resulting receipt. | A unit test confirms pooled calibration output is recorded on the fit receipt.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
a4e9027b789e
crates/eg-numeric/tests/decision/fit_eval.rs:236
EG-DECISION-ENGINE-R025
Drift detection via out-of-distribution checks and adaptive conformal bounds
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Drift detection via out-of-distribution checks and adaptive conformal bounds.** The decision engine detects drift by checking incoming features for out-of-distribution values and by bounding miscoverage with adaptive conformal inference, abstaining rather than ranking when drift is detected. | A unit test confirms that an out-of-distribution feature causes the head to abstain.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
a4e9027b789e
crates/eg-numeric/tests/decision/ladder.rs:302
EG-DECISION-ENGINE-R026
Inverse-probability-weighted audit sampling of acted decisions
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Inverse-probability-weighted audit sampling of acted decisions.** A sample of acted decisions is selected for audit using inverse-probability weighting at a fixed five-percent rate, and every audited decision record carries an audit flag usable by downstream calibration. | Unit tests assert that evaluated records carry the audit flag and that calibration correctly applies the inverse-probability weighting.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
81ea985399b0
a4e9027b789e
crates/eg-numeric/src/decision/targets.rs:82
crates/eg-numeric/tests/decision/ladder.rs:326
EG-DECISION-ENGINE-R026.1
Calibration-weighting half of audit sampling is tested in-crate
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Calibration-weighting half of audit sampling is tested in-crate.** The audit-flag sampling half of inverse-probability-weighted audit sampling has a bound test, but the calibration-weighting half (`pub(crate) audit_weight`/targets) has no in-crate `#[cfg(test)]` test confirming calibration correctly applies the inverse-probability weight. | Test: `crates/eg-numeric/src/decision/audit.rs::tests::calibration_applies_the_pub_crate_inverse_probability_audit_weight`.
requirementEG-DECISION-ENGINEVERIFIED81ea985399b0
crates/eg-numeric/src/decision/targets.rs:82
EG-DECISION-ENGINE-R027
WeightedFeatures and ListwiseLogistic fitted decision heads
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**WeightedFeatures and ListwiseLogistic fitted decision heads.** The decision engine supports a WeightedFeatures head, which is advisory only and never calibrated, and a ListwiseLogistic head, which is a deterministic, bit-for-bit reproducible optimizer; a further Kolmogorov-Arnold listwise head is not yet included. | Unit tests confirm a fit is bit-for-bit reproducible and certifies an act threshold, and that the WeightedFeatures head remains advisory and is never calibrated.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
crates/eg-numeric/tests/decision/fit_eval.rs:53
crates/eg-numeric/tests/decision/fit_eval.rs:79
EG-DECISION-ENGINE-R028
Natural-language template routing without a generative model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Natural-language template routing without a generative model.** A natural-language decision request is routed to a matching NlTemplate using candidate-local BM25, embedding, or ontology-label similarity rather than a generative model call. | Unit tests cover natural-language template matching; end-to-end served routing is proven when the serving path is exercised.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
52f333ca756e
9ea2c1ac6a24
crates/eg-numeric/src/decision/bm25.rs:92
src/server/handlers/decide/stat_tests/nl_tests.rs:59
EG-DECISION-ENGINE-R029
Decision-based retrieval-plan selection
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision-based retrieval-plan selection.** The decision ladder selects among retrieval plans, such as LeanRAG, reciprocal-rank fusion, or direct SPARQL querying, for a given request using the same typed decision mechanism as other question families. | An integration test asserts the correct retrieval plan is selected for representative request shapes.
requirementEG-DECISION-ENGINESPECIFIED52f333ca756e
5951a4a6272e
9f300857d769
b2d01ed93bd8
crates/eg-types/src/decision/statistical/retrieval_plan.rs:132
EG-DECISION-ENGINE-R030
Decision-based ingestion path routing
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision-based ingestion path routing.** Ingestion requests are routed to a fast, medium, or slow processing path through the same typed decision mechanism used for other question families, rather than a hard-coded rule. | An integration test confirms ingestion routing selects the expected path for representative inputs.
requirementEG-DECISION-ENGINEVERIFIED15f6e8dff987
28ca65b7e45b
2b5963a7d670
52f333ca756e
5951a4a6272e
crates/eg-types/src/decision/statistical/ingestion_lane.rs:90
EG-DECISION-ENGINE-R031
Expected-value scheduling for enrichment work
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Expected-value scheduling for enrichment work.** Enrichment scheduling selects candidate work by comparing expected value against cost through the typed decision mechanism, rather than a fixed priority order. | An integration test confirms enrichment scheduling selects the higher expected-value option under representative cost scenarios.
requirementEG-DECISION-ENGINESPECIFIED7db76f6142e3
aa3e35c45f82
b2d01ed93bd8
b6eb6a62d9dc
fa780d3e101a
crates/eg-types/src/decision/statistical/enrichment_schedule.rs:126
EG-DECISION-ENGINE-R032
Entity-resolution candidates with conformal guarantees (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Entity-resolution candidates with conformal guarantees (rollup).** Entity-resolution (owl:sameAs) candidate decisions use the binary entity-matching head with isotonic calibration and report a conformal guarantee validated against a gold label set, abstaining when that guarantee cannot be met. Split (2026-10-09): `.1` the declared-but-unused QuestionKind, `.2` the full ResolveEntity decision path. | A unit test against a gold-labelled set confirms the reported conformal guarantee holds and that insufficient confidence results in abstention.
requirementEG-DECISION-ENGINESPECIFIEDa1bb9fb9503e
d2386535ca97
fa780d3e101a
EG-DECISION-ENGINE-R032.1
`QuestionKind::ResolveEntity` is declared
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**`QuestionKind::ResolveEntity` is declared.** `QuestionKind::ResolveEntity` is declared in `crates/eg-types/src/decision/statistical.rs`. No code constructs, matches, or tests it anywhere in the repo. There is no entity-matching head, isotonic calibration, or conformal-guarantee code for this kind. | Compiles as part of the `QuestionKind` enum. No test exists (none is claimed).
requirementEG-DECISION-ENGINEVERIFIEDb23e8815f42c
crates/eg-types/src/decision/statistical.rs:381
EG-DECISION-ENGINE-R032.2
Remaining scope: ResolveEntity decision path with conformal guarantee
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Remaining scope: ResolveEntity decision path with conformal guarantee.** Build the full path: a binary entity-matching head trained/scored over owl:sameAs candidate pairs, isotonic calibration of its score, a conformal guarantee computed against a gold-labelled set, and abstention when the guarantee cannot be met — dispatched through `Decide` on `QuestionKind::ResolveEntity`. | A unit test against a gold-labelled set confirms the reported conformal guarantee holds and that insufficient confidence results in abstention, exercised through `QuestionKind::ResolveEntity` end to end.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R033
Decision-based schema mapping for SQL sources (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision-based schema mapping for SQL sources (rollup).** Mapping a source column to an ontology property for SQL ingestion and pack content is resolved through the typed decision mechanism, producing a proposed mapping with its evidence class rather than an unverified direct assignment. Split (2026-10-09): `.1` the declared-but-unused QuestionKind, `.2` the full SchemaMapping decision path. | An integration test confirms a representative column set maps to the expected ontology properties with correct evidence classification.
requirementEG-DECISION-ENGINESPECIFIEDa1bb9fb9503e
d2386535ca97
fa780d3e101a
EG-DECISION-ENGINE-R033.1
`QuestionKind::SchemaMapping` is declared
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**`QuestionKind::SchemaMapping` is declared.** `QuestionKind::SchemaMapping` is declared in `crates/eg-types/src/decision/statistical.rs`. No code constructs, matches, or tests it anywhere in the repo; there is no SQL-column-to-ontology-property decision path. | Compiles as part of the `QuestionKind` enum; no test exists (none is claimed).
requirementEG-DECISION-ENGINEVERIFIEDb23e8815f42c
crates/eg-types/src/decision/statistical.rs:388
EG-DECISION-ENGINE-R033.2
Remaining scope: SchemaMapping decision path for SQL ingestion
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Remaining scope: SchemaMapping decision path for SQL ingestion.** Build the full path: given a SQL source column (name, type, sample content) and the ontology's candidate properties, resolve the mapping through `Decide` on `QuestionKind::SchemaMapping`, producing a proposed mapping and its evidence class (proof/observation/claim) rather than an unverified direct assignment, for both SQL ingestion and pack content. | An integration test maps representative columns to the expected ontology properties. It checks evidence classification through `QuestionKind::SchemaMapping` end to end.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R034
Proposal-only contradiction-handling suggestions
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Proposal-only contradiction-handling suggestions.** When the truth-maintenance system detects a contradiction, the decision engine may propose a resolution but never performs an automatic retraction. Any retraction requires a separate, explicit authorization step. | A negative test confirms that a detected contradiction produces a proposal only and that no automatic retraction occurs.
requirementEG-DECISION-ENGINEVERIFIED94da44835d59
9ea2c1ac6a24
fa780d3e101a
crates/eg-epistemic/src/query.rs:661
EG-DECISION-ENGINE-R035
Decision-based routing for execution configuration
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision-based routing for execution configuration.** This repository's graph.decide() method accepts requests to select among candidate models, prompts, skills, tools, harness modes, account modes, or sandbox configurations and returns a ranked or constrained choice with its evidence class; the consuming execution environment applies that choice. | A contract test confirms graph.decide() returns a valid typed choice and evidence class for each supported routing category.
requirementEG-DECISION-ENGINESPECIFIED7db76f6142e3
fa780d3e101a
src/server/handlers/decide/stat_tests/consumer_tests.rs:421
EG-DECISION-ENGINE-R036
graph.assemble() as the authority for agent composition
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**graph.assemble() as the authority for agent composition.** graph.assemble() is the sole method for composing an agent graph from typed tasks and capabilities, replacing a model-generated composition choice with a verifiable constraint-solved result. | An integration test confirms graph.assemble() produces a legal, certificate-backed agent graph for representative composition requests.
requirementEG-DECISION-ENGINESPECIFIED9ea2c1ac6a24
d6baf6dfc8c9
fa780d3e101a
crates/eg-compute/src/assemble/tests/golden.rs:56
EG-DECISION-ENGINE-R037
Escalated abstentions re-enter as claims
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Escalated abstentions re-enter as claims.** When a typed abstention is escalated to a language model or a human reviewer and a resolution is produced, that resolution re-enters the decision engine only as a claim-class input, never as a proof or observation. | A negative test confirms a resolution produced by escalation is recorded with evidence_class claim.
requirementEG-DECISION-ENGINEVERIFIED2ae20b268539
8475bc4d611a
fa780d3e101a
src/server/handlers/decide/stat_tests/consumer_tests.rs:225
EG-DECISION-ENGINE-R038
Advisory pre-tool risk scoring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Advisory pre-tool risk scoring.** Before a tool invocation, the decision engine can return an advisory risk score for the candidate action. The score informs but never itself authorizes or blocks execution. | A unit test confirms the risk score is returned as advisory and does not gate execution on its own.
requirementEG-DECISION-ENGINEVERIFIED1570bfef96aa
4034a361535b
81e90c5f3bde
fa780d3e101a
src/server/handlers/decide/stat_tests/pretool_risk_tests.rs:26
src/server/handlers/decide/stat_tests/pretool_risk_tests.rs:27
EG-DECISION-ENGINE-R038.1
Typed ToolInvocation / pre-tool risk concept exists
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed ToolInvocation / pre-tool risk concept exists.** No risk/pretool/ToolInvocation concept exists in the engine. Add the typed representation a caller can score before dispatching a tool invocation, advisory only. | Test: `crates/eg-types/src/decision/rapid_r038.rs::tests::returns_an_advisory_risk_score_for_a_candidate_tool_invocation_without_gating_execution`.
requirementEG-DECISION-ENGINEVERIFIED81e90c5f3bde
src/server/handlers/decide/stat_tests/pretool_risk_tests.rs:27
EG-DECISION-ENGINE-R039
Cost-aware routing using accounting data (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Cost-aware routing using accounting data (rollup).** Routing decisions use cost information from the usage and cost accounting subsystem. They prefer lower-cost legal options that satisfy the same constraints. Split (2026-10-09): `.1` the missing-data abstention path that landed, `.2` the missing cost-preference ranking. | An integration test confirms a routing decision prefers the lower-cost legal option when accounting data distinguishes candidates.
requirementEG-DECISION-ENGINESPECIFIED0cbda8f2af96
d2386535ca97
fa780d3e101a
EG-DECISION-ENGINE-R039.1
Routing abstains naming the fact when L5 accounting data is missing
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Routing abstains naming the fact when L5 accounting data is missing.** `cost_routing_without_l5_accounting_abstains_naming_the_fact` (EH-039, `src/server/handlers/decide/stat_tests/consumer_tests.rs`) confirms that when there is no L5 cost-accounting data for the candidates, the routing decision abstains and names the missing-data fact rather than guessing. | Test: `src/server/handlers/decide/stat_tests/consumer_tests.rs::cost_routing_without_l5_accounting_abstains_naming_the_fact`.
requirementEG-DECISION-ENGINEVERIFIEDa742d4439964
src/server/handlers/decide/stat_tests/consumer_tests.rs:288
EG-DECISION-ENGINE-R039.2
Remaining scope: cost-preference ranking when accounting data is present
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Remaining scope: cost-preference ranking when accounting data is present.** No production code path ranks or prefers options by a cost-like feature when L5 accounting data is present — this needs a published scoring head over observed/accounted cost (consuming `ObservedCost`, see AU-CONTROL-R006) feeding the deterministic ladder, since the exploration policy currently samples uniformly over legal options rather than preferring the cheaper one. | An integration test confirms a routing decision prefers the lower-cost legal option when accounting data distinguishes candidates (the original R039 acceptance test, now bound to this child).
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R040
Guarded promotion of fitted heads via publish receipt
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Guarded promotion of fitted heads via publish receipt.** A fitted decision head is promoted to active use only through the component-publish path gated on a matching DecisionEval receipt. A receipt that does not match the evaluated digest causes promotion to be refused. | Unit tests confirm a mismatched receipt is refused with an evaluation-receipt-mismatch error while a matching receipt allows publish.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
8475bc4d611a
fa780d3e101a
src/server/handlers/decide/stat_tests/scorer_tests.rs:80
EG-DECISION-ENGINE-R041
Connector event triage through Decide
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Connector event triage through Decide.** EG classifies inbound connector events by routing them through the decision ladder in evaluate-only mode, returning a proposal and its evidence class without taking any action on the connector's behalf. A sampled subset of these evaluations is logged for audit. | An integration test submits synthetic connector events, calls the evaluate-only triage path, and asserts no side effect occurs while a sampled fraction of evaluations is recorded.
requirementEG-DECISION-ENGINEVERIFIEDa742d4439964
d2386535ca97
f420578b85d2
fa780d3e101a
src/server/handlers/decide/stat_tests/connector_triage_tests.rs:24
src/server/handlers/decide/stat_tests/connector_triage_tests.rs:25
EG-DECISION-ENGINE-R041.1
Connector-event evaluate-only triage path with sampled audit logging
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Connector-event evaluate-only triage path with sampled audit logging.** No connector-event evaluate-only triage path or sampled-audit mechanism exists. Inbound connector events must be classified via the decision ladder in evaluate-only mode with a sampled fraction logged for audit. | Test: `src/server/handlers/decide/stat_tests/consumer_tests.rs::connector_event_triage_is_evaluate_only_and_logs_a_sampled_fraction_for_audit`.
requirementEG-DECISION-ENGINEVERIFIEDa742d4439964
src/server/handlers/decide/stat_tests/connector_triage_tests.rs:24
EG-DECISION-ENGINE-R042
Connector tool-choice advisory via Decide
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Connector tool-choice advisory via Decide.** Decide evaluates which internal tool a connector should use for a given task and returns a proposal with evidence only; the connector's own deterministic authorization path, not Decide, governs whether any resulting write-back actually occurs. | A test exercises tool-choice evaluation for a connector task and confirms the proposal alone cannot trigger a write-back without passing the separate deterministic authorization check.
requirementEG-DECISION-ENGINESPECIFIED67d04f5e9087
e8eaaf916a40
fa780d3e101a
src/server/handlers/decide/stat_tests/connector_toolchoice_tests.rs:24
EG-DECISION-ENGINE-R043
Write-back proposals routed through Decide
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Write-back proposals routed through Decide.** EG's decision ladder can produce a write-back proposal with supporting evidence for a connector action. The proposal never authorizes the write itself. Any exploration or statistical head that generates the proposal stays outside the authorization step. That deterministic step must separately approve the write. | A negative test asserts a Decide-sourced write-back proposal has no external effect. The effect occurs only after the connector's own deterministic authorization check passes.
requirementEG-DECISION-ENGINESPECIFIED21f73899e76c
e8eaaf916a40
fa780d3e101a
src/server/handlers/decide/stat_tests/connector_writeback_tests.rs:25
EG-DECISION-ENGINE-R044
A2A task routing through the decision ladder (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**A2A task routing through the decision ladder (rollup).** Inbound A2A tasks are routed to an existing or assembled agent graph. Routing applies the same typed decision ladder used for other question families. It returns a routing resolution with its resolution kind and evidence class rather than an unexplained match. Split into child requirements by code root. `.1` typed A2ARoutingResolution refusal over ResolutionKind/EvidenceClass, `.2` wire A2A task submission through the typed routing resolution. | An integration test submits inbound A2A tasks and asserts each is routed to a graph through a recorded decision with a resolution kind and evidence class.
requirementEG-DECISION-ENGINESPECIFIEDfa780d3e101a
EG-DECISION-ENGINE-R044.1
Typed A2ARoutingResolution refusal over ResolutionKind/EvidenceClass
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed A2ARoutingResolution refusal over ResolutionKind/EvidenceClass.** Add the typed `A2ARoutingResolution::new` refusal (`crates/eg-types/src/decision/rapid_r044.rs`) over the existing `ResolutionKind`/`EvidenceClass`, refusing an empty graph id and an abstention claiming proof-grade evidence. | Test: `crates/eg-types/src/decision/rapid_r044.rs::tests::refuses_an_abstention_claiming_proof_grade_evidence`.
requirementEG-DECISION-ENGINEVERIFIED0fac721690e2
crates/eg-types/src/decision/rapid_r044.rs:97
EG-DECISION-ENGINE-R044.2
Wire A2A task submission through the typed routing resolution
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wire A2A task submission through the typed routing resolution.** Remaining scope from the split (2026-10-09): the A2A task-submission entry point that constructs one of these per inbound task and an integration test over the served path. Split into grandchild requirements (2026-10-09): `.1` a typed registry-lookup routing function over known graph ids, `.2` the served A2A task-submission entry point calling it with an integration test. | An integration test submits inbound A2A tasks and asserts each is routed to a graph through a recorded decision with a resolution kind and evidence class.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R044.2.1
Typed registry-lookup routing function over known graph ids
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed registry-lookup routing function over known graph ids.** Add `A2ARoutingResolution::route` (`crates/eg-types/src/decision/rapid_r044.rs`): given the known graph-id registry and a requested id, resolves to the matching graph as a Constraint/Observation resolution or abstains as Claim-grade evidence, always through `::new`. | Test: `crates/eg-types/src/decision/rapid_r044.rs::tests::routes_to_a_known_graph_and_abstains_otherwise`.
requirementEG-DECISION-ENGINEVERIFIED3c6b457009e4
crates/eg-types/src/decision/rapid_r044.rs:111
EG-DECISION-ENGINE-R044.2.2
Served A2A task-submission entry point
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Served A2A task-submission entry point.** Remaining scope: the actual inbound A2A task-submission handler that builds the known-graph registry per request and calls `A2ARoutingResolution::route`, with an integration test over the served path. | An integration test submits inbound A2A tasks and asserts each is routed to a graph through a recorded decision with a resolution kind and evidence class.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R045
Smallest covering tool subset within a context budget
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Smallest covering tool subset within a context budget.** Decide selects the smallest tool subset that still covers every required capability within a caller-specified context budget, so a multiplexer can expose fewer tools to a caller without losing coverage. | A test constructs a capability requirement set with a token budget and asserts the returned subset is minimal, covers every required capability, and stays within budget.
requirementEG-DECISION-ENGINEVERIFIED0dfbaa95ea36
961b1785319c
e8eaaf916a40
fa780d3e101a
crates/eg-types/src/decision/statistical/tool_subset.rs:140
crates/eg-types/src/decision/statistical/tool_subset.rs:161
crates/eg-types/src/decision/statistical/tool_subset.rs:189
crates/eg-types/src/decision/statistical/tool_subset.rs:203
src/server/handlers/decide/stat_tests/tool_subset_tests.rs:58
EG-DECISION-ENGINE-R045.1
Typed tool-subset request and greedy covering-set selection
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed tool-subset request and greedy covering-set selection.** EG defines a typed tool-subset request body and a greedy set-cover selection over it, with no server or candidate-source dependency. | Unit tests assert the selection is minimal, covers every required capability, and refuses when coverage or budget cannot be met.
requirementEG-DECISION-ENGINEVERIFIED0dfbaa95ea36
961b1785319c
e8eaaf916a40
crates/eg-types/src/decision/statistical/tool_subset.rs:140
crates/eg-types/src/decision/statistical/tool_subset.rs:161
crates/eg-types/src/decision/statistical/tool_subset.rs:189
crates/eg-types/src/decision/statistical/tool_subset.rs:203
EG-DECISION-ENGINE-R045.2
Tool-subset selection wired into Decide
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Tool-subset selection wired into Decide.** EG wires the R045.1 selection into a dedicated Decide question kind, reading tool candidates from the agent library and returning the selected subset on the served decision record. | A served test submits a tool-subset question and asserts the returned record's selected subset is minimal, covers every required capability, and stays within the caller's budget.
requirementEG-DECISION-ENGINEVERIFIED0dfbaa95ea36
e8eaaf916a40
src/server/handlers/decide/stat_tests/tool_subset_tests.rs:58
EG-DECISION-ENGINE-R046
Swarm topology decisions via the decision ladder
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Swarm topology decisions via the decision ladder.** EG answers swarm-topology questions by applying its typed decision ladder to capacity and shape constraints, returning a proposed topology or a typed abstention together with its evidence; EG itself never acquires or leases capacity as part of answering the question. | A test exercises topology decision requests and asserts a constraint-checked proposal or abstention is returned with no capacity lease taken before separate acquisition.
requirementEG-DECISION-ENGINESPECIFIED2d087761c964
e8eaaf916a40
fa780d3e101a
crates/eg-compute/src/assemble/tests/topology.rs:115
crates/eg-compute/src/assemble/tests/topology.rs:95
EG-DECISION-ENGINE-R047
DecisionRecord v1 contract: types and methods
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**DecisionRecord v1 contract: types and methods.** EG defines versioned DecisionRecord v1 types, the AgentAssemble and DecisionCommit methods, a DecisionRecord component kind, and a decide feature flag, introduced through a single count-pinned schema change so generated contracts stay consistent across languages. | A contract-generation test confirms the Rust, Python, and wire descriptors for AgentAssemble and DecisionCommit are generated, fresh, and each has exactly one reachable handler.
requirementEG-DECISION-ENGINEVERIFIEDa4804f87c971
dc8d8d712d7f
fa780d3e101a
crates/eg-capabilities/tests/invariants.rs:257
EG-DECISION-ENGINE-R048
Entailment derivation with weakest-premise evidence class
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Entailment derivation with weakest-premise evidence class.** EG records is_a derivation entries for task-to-capability closure and assigns each derivation the weakest premise evidence class among its inputs, and an independent verifier re-checks claim-premised task mappings against those derivations. | Unit tests build derivation chains with mixed premise classes and assert the verifier recomputes the same weakest-premise conclusion.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
dc8d8d712d7f
fa780d3e101a
crates/eg-compute/src/assemble/tests/routing.rs:187
crates/eg-types/src/decision/derivation/tests.rs:219
EG-DECISION-ENGINE-R049
Exact 0-1 solver with certificate and verifier
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Exact 0-1 solver with certificate and verifier.** EG solves legal assemblies with a bounded 0-1 integer program. It preprocesses, finds a greedy incumbent, and uses branch-and-bound. It also uses a Lagrangian covering bound and work-node budget. EG emits a certificate for independent verification. The `verify_certificate` routine and brute-force oracle check it. The solver also supports template enumeration and no-good-cut re-solves. | Solver tests compare optima and certificates with exhaustive enumeration on small instances. They confirm `verify_certificate` rejects corrupted certificates.
requirementEG-DECISION-ENGINEVERIFIED4b11f62898df
dc8d8d712d7f
fa780d3e101a
crates/eg-compute/tests/solve/exhaustive.rs:42
crates/eg-compute/tests/solve/tamper_proof.rs:252
EG-DECISION-ENGINE-R050
Typed optional model and tool facts
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed optional model and tool facts.** EG represents model and tool facts such as modality, cost, latency, and schema digests as typed optional fields on the component schema, and the unread provides field is removed. | A schema test confirms provides no longer exists and a stored-component test round-trips the typed optional facts.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
dc8d8d712d7f
fa780d3e101a
crates/eg-types/src/agent_component.rs:1970
EG-DECISION-ENGINE-R051
AgentAssemble and DecisionCommit handlers with audit lines
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**AgentAssemble and DecisionCommit handlers with audit lines.** EG's AgentAssemble and DecisionCommit handlers enforce one agent graph per commit, refuse any pack-provided DecisionRecord component, and emit an audit line for each commit outcome. | Handler tests cover a successful commit, a rejected pack-sourced DecisionRecord, a fabricated record, a cross-tenant record, and retired, withdrawn, or denied commit attempts.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
dc8d8d712d7f
fa780d3e101a
src/server/persistence/decision_record/tests.rs:168
src/server/persistence/decision_record/tests.rs:223
src/server/persistence/decision_record/tests.rs:242
EG-DECISION-ENGINE-R052
Routing acceptance fixture with golden vectors
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Routing acceptance fixture with golden vectors.** EG ships a routing acceptance fixture. It covers acceptability sets, planted bad inputs, oracle comparison, golden result vectors and a latency report. It also tests a link from the committed record to its outcome. | The fixture suite runs oracle, planted-input and golden-vector cases. It also verifies the outcome link against the stored golden file.
requirementEG-DECISION-ENGINEVERIFIED2421a2a2e25e
2a0d6eae0918
fa780d3e101a
crates/eg-compute/src/assemble/tests/golden.rs:57
crates/eg-compute/src/assemble/tests/oracle.rs:123
crates/eg-compute/src/assemble/tests/oracle.rs:141
crates/eg-compute/src/assemble/tests/planted.rs:43
crates/eg-compute/src/assemble/tests/routing.rs:148
EG-DECISION-ENGINE-R053
Gold set of labelled requirement-to-assembly items
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Gold set of labelled requirement-to-assembly items.** EG maintains a labelled gold set mapping typed requirements to acceptable assemblies, sized to validate the decision ladder, with a documented path to grow coverage per evidence class before any statistical calibration claim is made. | A synthetic export test confirms the gold set loads, each item is labelled, and class coverage is reported.
requirementEG-DECISION-ENGINEVERIFIED2421a2a2e25e
2a0d6eae0918
fa780d3e101a
tests/synthetic/test_synthetic_decision_export.py:40
EG-DECISION-ENGINE-R054
Statistical contract: Decide, DecisionFit, DecisionEval
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Statistical contract: Decide, DecisionFit, DecisionEval.** EG defines the Decide, DecisionFit, and DecisionEval methods together with a DecisionRecord v2 schema, and generates the corresponding TTL and SHACL ontology artifacts from that contract. | A contract-surface test confirms all three methods are served and listed, and a generation check confirms the TTL and SHACL files match the contract.
requirementEG-DECISION-ENGINESPECIFIED2a0d6eae0918
8d4f409785b2
fa780d3e101a
crates/eg-capabilities/tests/invariants.rs:536
EG-DECISION-ENGINE-R054.1
TTL/SHACL generation artifact for the Decide/DecisionFit/DecisionEval contract exists
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**TTL/SHACL generation artifact for the Decide/DecisionFit/DecisionEval contract exists.** No TTL/SHACL generation artifact exists for the Decide, DecisionFit, and DecisionEval contract and DecisionRecord v2 schema. | Test: `contract/tests/decide_contract_generation.rs::ttl_and_shacl_artifacts_are_generated_and_match_the_decide_fit_eval_contract`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R055
Pinned deterministic numeric stack for calibration
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Pinned deterministic numeric stack for calibration.** EG's numeric layer pins its soft-float math library version and uses quantised fixed-point arithmetic so that calibration, conformal, risk-control, and off-policy-evaluation computations produce identical results across every supported target. | A cross-target golden-vector test replays the same inputs through the numeric kernels and asserts byte-identical digests on every supported target.
requirementEG-DECISION-ENGINEVERIFIED2421a2a2e25e
b43f33569dd4
fa780d3e101a
crates/eg-numeric/tests/decision/scorer.rs:109
crates/eg-numeric/tests/stat_kernels/kernels.rs:117
EG-DECISION-ENGINE-R056
Statistical-path release of the exact solver (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Statistical-path release of the exact solver (rollup).** The exact 0-1 solver and its certificate verification apply to the statistical decision path with the same deterministic guarantees as the core assembly solver. Split into child requirements by code root: `.1` typed StatisticalSolverCertificate refusal on a stale model digest, `.2` route the statistical path through the exact 0-1 solver and this certificate. | Solver tests on the statistical feature set confirm certificate verification and deterministic branching hold as they do for the core assembly path.
requirementEG-DECISION-ENGINESPECIFIED65afe57d3c4e
fa780d3e101a
EG-DECISION-ENGINE-R056.1
Typed StatisticalSolverCertificate refusal on a stale model digest
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed StatisticalSolverCertificate refusal on a stale model digest.** Add the typed `StatisticalSolverCertificate::verify` refusal on a stale model digest (`crates/eg-types/src/decision/rapid_r056.rs`), giving the statistical path the same certificate-verification shape as the core assembly solver. | Test: `crates/eg-types/src/decision/rapid_r056.rs::tests::refuses_a_stale_model_digest`.
requirementEG-DECISION-ENGINEVERIFIED0fac721690e2
crates/eg-types/src/decision/rapid_r056.rs:83
EG-DECISION-ENGINE-R056.2
Route the statistical path through the exact 0-1 solver and this certificate
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Route the statistical path through the exact 0-1 solver and this certificate.** Remaining scope from the split (2026-10-09): routing an actual statistical-path solve through the exact 0-1 solver and this certificate shape. Split into grandchild requirements (2026-10-09): `.1` a validating certificate constructor refusing a branch count over the solver's own node budget, `.2` an actual statistical-path call into `eg-compute`'s exact 0-1 solver producing this certificate. | Solver tests on the statistical feature set confirm certificate verification and deterministic branching hold as they do for the core assembly path.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R056.2.1
Validating certificate constructor bound to the solver's node budget
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Validating certificate constructor bound to the solver's node budget.** Add `StatisticalSolverCertificate::solved` (`crates/eg-types/src/decision/rapid_r056.rs`), refusing a reported branch count above the deterministic solver's own node budget -- the same node-budget guarantee `EG-DECISION-ENGINE-R011` gives the core assembly path. | Test: `crates/eg-types/src/decision/rapid_r056.rs::tests::refuses_a_certificate_exceeding_the_solver_node_budget`.
requirementEG-DECISION-ENGINEVERIFIED3c6b457009e4
crates/eg-types/src/decision/rapid_r056.rs:100
EG-DECISION-ENGINE-R056.2.2
Statistical-path call into the exact 0-1 solver
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Statistical-path call into the exact 0-1 solver.** Remaining scope: an actual statistical-path solve that calls `eg-compute`'s exact 0-1 solver (`crates/eg-compute/src/solve/search`) and reports its result through `StatisticalSolverCertificate::solved`. | Solver tests on the statistical feature set confirm certificate verification and deterministic branching hold as they do for the core assembly path.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R057
Decision executor with CandidateSource and DecideText
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision executor with CandidateSource and DecideText.** EG's dedicated decision executor accepts candidates from a CandidateSource spanning the component library and the graph, parses DecideText requests with typed parameters, and scores candidates with the WeightedFeatures head. | Executor tests run a fit-evaluate-publish-decide cycle end to end and a negative test confirms graph-sourced candidates from a foreign tenant are refused.
requirementEG-DECISION-ENGINEVERIFIED2a0d6eae0918
8d4f409785b2
fa780d3e101a
src/server/handlers/decide/stat_tests.rs:979
EG-DECISION-ENGINE-R058
Graph-sourced decision records with RLS-routed reads
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Graph-sourced decision records with RLS-routed reads.** EG can source a decision record summary from the graph, store it in content-addressed blob storage, enforce row-level visibility on reads, and apply a policy-set retention window distinct from library-sourced records. | A storage test writes a graph-sourced record and confirms content-addressed storage, visibility-filtered reads, and retention expiry on schedule.
requirementEG-DECISION-ENGINEVERIFIED25cb8189575d
8d4f409785b2
bda8269797ab
fa780d3e101a
src/server/handlers/decide/stat_tests.rs:1111
EG-DECISION-ENGINE-R059
Outcome aggregate with independent-evaluation join
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Outcome aggregate with independent-evaluation join.** EG maintains an outcome aggregate index linked to its admission records, joins only independently evaluated outcomes into that aggregate, applies censoring for incomplete observations, and enforces a minimum fidelity floor before an aggregate is used. | A test seeds self-reported and independently evaluated outcomes and asserts only the independently evaluated ones update the aggregate, with low-fidelity or censored data excluded.
requirementEG-DECISION-ENGINESPECIFIED3e6d786460c5
fa780d3e101a
crates/eg-numeric/src/decision/aggregate.rs:268
EG-DECISION-ENGINE-R060
DecisionFit and DecisionEval jobs with gated promotion
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**DecisionFit and DecisionEval jobs with gated promotion.** EG runs DecisionFit and DecisionEval as jobs that fit a ListwiseLogistic head within an explicit exploration budget, sample a fraction of acted decisions for audit, and promote a fitted head only through the component-publish-plus-receipt path. | A job test runs fit, evaluate, and replay, and asserts promotion without a matching receipt is refused as a conflict.
requirementEG-DECISION-ENGINEVERIFIED25cb8189575d
2a0d6eae0918
fa780d3e101a
crates/eg-numeric/tests/decision/scorer_promotion.rs:179
crates/eg-types/src/agent_component.rs:2307
EG-DECISION-ENGINE-R061
Assembly facts extended for the statistical path
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Assembly facts extended for the statistical path.** EG exposes typed assembly-time facts to both decision paths. The exact solver derivation layer and statistical path receive the same typed values. | A test confirms both paths read matching typed facts.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
25cb8189575d
8f38ed7cc3dc
fe3b87b09054
crates/eg-types/src/test_support/decision.rs:128
EG-DECISION-ENGINE-R061.1
Shared AgentComponentEntry cost/latency fixture
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Shared AgentComponentEntry cost/latency fixture.** EG provides one shared `test-support` fixture building an `AgentComponentEntry` with a declared cost and latency, for the exact-solver and statistical paths to read identically. | A unit test converts the fixture to `CandidateFacts` and asserts its declared cost and latency round-trip intact.
requirementEG-DECISION-ENGINEVERIFIED25cb8189575d
8f38ed7cc3dc
fe3b87b09054
crates/eg-types/src/test_support/decision.rs:128
EG-DECISION-ENGINE-R062
NlTemplate selection without a language model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**NlTemplate selection without a language model.** EG selects an NlTemplate and fills its slots using candidate-local similarity matching rather than a language model, and records any fallback to an external model as a claim rather than a proof. | A template-selection test asserts slot filling succeeds from similarity matching alone and a fallback path is recorded with claim-level evidence.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
2ffc3594800b
src/server/handlers/decide/stat_tests/nl_tests.rs:58
EG-DECISION-ENGINE-R063
Typed client wrappers and documentation for Decide
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed client wrappers and documentation for Decide.** EG ships generated typed client wrappers for the decide, decision-fit, and decision-eval calls together with their request and response types, plus documentation and usage examples backed by acceptance tests. | Generated-client tests exercise each wrapper against a running instance and a documentation build confirms the example pages render.
requirementEG-DECISION-ENGINEVERIFIED15acf1a959e5
1e9ea1ef3790
25cb8189575d
2a0d6eae0918
394f82a01e83
crates/eg-capabilities/src/contract/python/tests.rs:818
tests/test_generated_models.py:139
tests/test_generated_models.py:176
EG-DECISION-ENGINE-R064
Optional read views of decision records
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Optional read views of decision records.** EG may expose SPARQL, GraphQL, and pgwire read views over committed decision records, subject to the same tenant visibility rules as other decision reads. | A read-path test queries a committed record through each exposed view and confirms the results match and respect tenant visibility.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
25cb8189575d
857e20c63775
8d4f409785b2
src/server/handlers/decide/stat_tests/consumer_tests.rs:594
EG-DECISION-ENGINE-R065
Decision record size and shape limits
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision record size and shape limits.** EG caps a DecisionRecord at 64 KiB, 64 candidates, and 32 required capabilities; a record exceeding any limit is refused at commit time with a typed RecordTooLarge abstention rather than a truncated or partial write. | A boundary test commits records at and just above each limit and asserts acceptance at the boundary and a typed refusal with no partial write above it.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
2a0d6eae0918
8d4f409785b2
crates/eg-compute/src/assemble/tests/planted.rs:301
EG-DECISION-ENGINE-R066
Retention split between library and graph-sourced records
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Retention split between library and graph-sourced records.** EG keeps library-sourced decision records indefinitely, applies a policy-set retention window to graph-sourced statistical records, and treats high-frequency low-stakes decisions as evaluate-only so they are never persisted as committed records. | A retention test confirms a library-sourced record is never deleted, a graph-sourced record expires on its configured window, and an evaluate-only decision leaves no committed record.
requirementEG-DECISION-ENGINESPECIFIED1e9ea1ef3790
2a0d6eae0918
d51d225674e1
EG-DECISION-ENGINE-R066.1
Preserve library inputs
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Preserve library inputs.** `stat_retention.rs` must exclude library-sourced records from compaction and retirement. | `stat_tests/retention_tests.rs::library_records_survive_every_retention_window` verifies unchanged stored bytes.
requirementEG-DECISION-ENGINEVERIFIED4e60c54e9e49
c6d7108187aa
src/server/handlers/decide/stat_tests/retention_tests.rs:64
EG-DECISION-ENGINE-R066.2
Expire graph inputs
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Expire graph inputs.** `stat_retention.rs` must compact and retire graph inputs at configured window boundaries. | `stat_tests/retention_tests.rs::graph_inputs_expire_at_the_configured_boundaries` checks exact boundaries and retained summary digests.
requirementEG-DECISION-ENGINEVERIFIED4e60c54e9e49
c6d7108187aa
src/server/handlers/decide/stat_tests/retention_tests.rs:93
EG-DECISION-ENGINE-R066.3
Evaluate without persistence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evaluate without persistence.** `stat_decide.rs` must return low-stakes decisions without committed records. | `stat_tests/retention_tests.rs::evaluate_only_leaves_no_committed_records` checks repeated served decisions and both record stores.
requirementEG-DECISION-ENGINEVERIFIED4e60c54e9e49
c6d7108187aa
src/server/handlers/decide/stat_tests/retention_tests.rs:129
EG-DECISION-ENGINE-R066.4
Expire graph records
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Expire graph records.** `stat_retention.rs` must expire graph summaries on a configured policy window. Input retirement alone is insufficient. | Planned: `stat_tests/retention_tests.rs::graph_summaries_expire_on_policy_window`. No summary-expiry policy or implementation exists.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R067
Decision record versioning stays decodable
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision record versioning stays decodable.** Every DecisionRecord version remains decodable indefinitely, each version ships its own golden vectors, an unrecognised future version is refused rather than guessed at, and a rolling redeploy drains in-flight requests before switching versions. | A version test decodes golden vectors for every supported version and confirms an unrecognised version returns a typed refusal.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
2a0d6eae0918
d51d225674e1
crates/eg-types/src/decision/topology/tests.rs:92
EG-DECISION-ENGINE-R068
Outcome link via the existing synthesis-evidence pin
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Outcome link via the existing synthesis-evidence pin.** EG links an agent graph's outcome back to its decision record through the existing AgentGraphDraft synthesis_evidence pin, without adding new fields to the run-event or outcome-bundle types. | A test publishes a graph and asserts it resolves to its originating decision record solely through the synthesis_evidence pin.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
2a0d6eae0918
c4c13898a493
src/server/persistence/decision_record/tests.rs:262
EG-DECISION-ENGINE-R069
DecisionShape enforcement inside the commit handler
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**DecisionShape enforcement inside the commit handler.** EG validates every committed decision record against its DecisionShape SHACL shape inside the commit handler itself, failing closed on a violation independently of the separate opt-in integrity-check guard. | Commit-handler tests include at least one known-bad record and assert the shape check rejects it even when the opt-in guard is disabled.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
2a0d6eae0918
c4c13898a493
src/server/handlers/decide/shape.rs:134
EG-DECISION-ENGINE-R070
Bounded no-good-cut re-solve for post-solve validators
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Bounded no-good-cut re-solve for post-solve validators.** When a post-solve validator such as template or graph validation rejects a solved assembly, EG adds a no-good cut and re-solves within a bounded number of rounds, terminating with a typed result rather than looping indefinitely. | A test forces repeated post-solve validator failures and asserts the re-solve loop terminates after its bounded round count.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
2a0d6eae0918
456b8d06fc91
crates/eg-compute/src/assemble/tests/planted.rs:257
EG-DECISION-ENGINE-R071
DecideText parser kept separate from the UQL core
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**DecideText parser kept separate from the UQL core.** DecideText is parsed by its own quote-aware, typed-parameter front end that shares no code with the ordinary UQL parser or its operation and plan types, so decision clauses cannot be expressed through the general query path. | A parser test confirms the ordinary UQL parser refuses decision clauses by name while DecideText parses the same clauses successfully.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
2a0d6eae0918
456b8d06fc91
crates/eg-plan/src/decide_text/tests.rs:124
EG-DECISION-ENGINE-R072
Decision observability spans and metrics
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision observability spans and metrics.** EG emits tracing spans and metrics covering the distribution of resolution kinds, the abstention rate, the distribution of evidence classes, solver node count and optimality gap, effective sample size, and latency percentiles for decision requests. | An instrumentation test confirms each listed span or metric is emitted for a representative decision request.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
2a0d6eae0918
7e2feaaad52d
d51d225674e1
crates/eg-compute/tests/solve/instrumentation.rs:8
EG-DECISION-ENGINE-R072.1
Solver node count and optimality gap are emitted on the Assemble/solver path
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Solver node count and optimality gap are emitted on the Assemble/solver path.** Emit one completion event with solver node count and the absolute scalarized objective gap when checked incumbent-minus-bound is available and nonnegative; omit missing, invalid, or overflowing gaps. Do not record model or tenant data. | Test: `crates/eg-compute/tests/solve/instrumentation.rs::assemble_emits_solver_node_count_and_optimality_gap_metrics`.
requirementEG-DECISION-ENGINEVERIFIED7e2feaaad52d
crates/eg-compute/tests/solve/instrumentation.rs:8
EG-DECISION-ENGINE-R073
Decision-owned storage tables and outbox events (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision-owned storage tables and outbox events (rollup).** EG stores decision-pack state in five dedicated owner tables, refuses to open a pack stored in an outdated format, issues a receipt covering every intent in a batch, resolves batch pin references, handles components marked Withdrawn, enforces compare-and-set on the current head, and emits an outbox event per affected component. | Storage tests cover a fresh open, a stale-format refusal, a multi-intent receipt, a withdrawn-component read, head compare-and-set contention, and the resulting outbox events.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
4c25220f6e1b
771c32a45353
795a1ea18fa6
a0743ba9b542
crates/eg-capabilities/src/error_routing.rs:367
src/server/handlers/admin/connector_pack/tests/content_model.rs:372
src/server/handlers/admin/connector_pack/tests/content_model.rs:407
src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs:29
src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs:74
EG-DECISION-ENGINE-R073.1
One durable outbox event per imported component
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**One durable outbox event per imported component.** A served multi-component import stores one validated component-revision event per affected component, followed by one pack-import event, under the receipt's batch identity; repeating the identical pack creates no additional owner or outbox rows. | Test: `src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs::multi_component_import_emits_one_durable_event_per_component`.
requirementEG-DECISION-ENGINEVERIFIED771c32a45353
src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs:29
EG-DECISION-ENGINE-R073.2
Competing served imports share one head compare-and-set
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Competing served imports share one head compare-and-set.** Two distinct imports over the same prior head have exactly one winner. The loser gets PACK_HEAD_CONFLICT, and retrying that stale head changes no component, holder, import or outbox rows. | Test: `src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs::competing_imports_have_one_head_winner_without_loser_effects`.
requirementEG-DECISION-ENGINEVERIFIED771c32a45353
795a1ea18fa6
a0743ba9b542
src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs:74
EG-DECISION-ENGINE-R073.3
Fresh owner open and outdated-format refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Fresh owner open and outdated-format refusal.** The 21-table Agent Library registry includes five ConnectorPack tables. Production open must initialize them empty and preserve them on reopen. The lineage gate must refuse genuine predecessors before catalog access without changing file bytes. | Tests: `src/server/persistence/agent_library/open_tests.rs::fresh_open_initializes_all_pack_tables_and_reopens_empty` and `production_open_refuses_each_genuine_predecessor_without_writing`.
requirementEG-DECISION-ENGINEVERIFIEDa93e5bd00d51
src/server/persistence/agent_library/open_tests.rs:49
src/server/persistence/agent_library/open_tests.rs:6
EG-DECISION-ENGINE-R073.4
Receipt covers every batch intent
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Receipt covers every batch intent.** The committed receipt binds every component and pack intent, including order, topic, key, payload and headers. | `storage_acceptance::receipt::committed_multi_intent_receipt_binds_all_effects_and_survives_replay` reads typed owner evidence after signed import. It detects omitted, reordered and modified intents, then checks admitted replay preserves the receipt.
requirementEG-DECISION-ENGINEVERIFIEDbb72cb292060
d1d4e74f5520
src/server/handlers/admin/connector_pack/tests/storage_acceptance/receipt.rs:137
EG-DECISION-ENGINE-R073.5
Batch pins and withdrawn-component reads
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Batch pins and withdrawn-component reads.** Batch references must pin committed transitive revisions. Current Search must exclude withdrawn components and retain published controls. Historical pinned Content remains readable. New pins must refuse withdrawn components. | Tests: the transitive-chain and diamond regressions in `content_model.rs`, and `withdrawal.rs::withdrawn_tool_leaves_search_but_keeps_historical_content`.
requirementEG-DECISION-ENGINEVERIFIED4c25220f6e1b
a93e5bd00d51
aea4fe89bd19
crates/eg-capabilities/src/error_routing.rs:367
src/server/handlers/admin/connector_pack/tests/content_model.rs:372
src/server/handlers/admin/connector_pack/tests/content_model.rs:407
src/server/handlers/admin/connector_pack/tests/withdrawal.rs:45
EG-DECISION-ENGINE-R074
Agent-slot component-kind closure rule kept current
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Agent-slot component-kind closure rule kept current.** EG's documented rule for which component kinds may be referenced from an agent slot stays consistent with the actual kind set, including shape, A2A agent-card, and decision kinds, so no kind that can appear in a slot is missing from the rule. | `tests/test_decision_static_contracts.py::test_agent_slot_kinds_are_documented_in_closure_rule` checks every enum and slot kind against the documented closure rule. Adversarial fixtures reject missing kinds and new undocumented slot references.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
51f9c8eb6f1d
a4804f87c971
tests/test_decision_static_contracts.py:145
EG-DECISION-ENGINE-R075
Component-id uniqueness and forbidden decision kinds (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Component-id uniqueness and forbidden decision kinds (rollup).** EG enforces that every component id is unique within its scope and refuses to import a pack entry whose kind is reserved for decision-owned state, such as DecisionRecord, DecisionHead, or DecisionPolicy. Split into child requirements by code root: `.1` check_unique_component_ids rejects a duplicate component id, `.2` wire the duplicate-id check into the real pack-import entry point. | Import tests assert a duplicate component id is rejected and a pack entry using a reserved decision kind is refused before any state change.
requirementEG-DECISION-ENGINEVERIFIED0ea0a0dcfa62
1e9ea1ef3790
d16ee611a394
e8aaa8ae5ccd
crates/eg-types/src/connector_pack/rapid_r075.rs:43
src/server/handlers/admin/connector_pack/import/validation.rs:956
EG-DECISION-ENGINE-R075.1
check_unique_component_ids rejects a duplicate component id
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**check_unique_component_ids rejects a duplicate component id.** Add `check_unique_component_ids` (`crates/eg-types/src/connector_pack/rapid_r075.rs`), the duplicate-component-id rejection the existing `PackViolationCode::DuplicateComponentId` code names but no test previously exercised. `PackEntryKind` already structurally excludes decision-owned kinds (no `DecisionRecord`/`DecisionHead`/`DecisionPolicy` variant exists). | Test: `crates/eg-types/src/connector_pack/rapid_r075.rs::tests::refuses_a_duplicate_component_id`.
requirementEG-DECISION-ENGINEVERIFIEDe8aaa8ae5ccd
crates/eg-types/src/connector_pack/rapid_r075.rs:43
EG-DECISION-ENGINE-R075.2
Wire the duplicate-id check into the real pack-import entry point
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wire the duplicate-id check into the real pack-import entry point.** Remaining scope from the split (2026-10-09): wiring the check into the real pack-import entry point. | Import tests assert a duplicate component id is rejected and a pack entry using a reserved decision kind is refused before any state change.
requirementEG-DECISION-ENGINEVERIFIEDd16ee611a394
src/server/handlers/admin/connector_pack/import/validation.rs:956
EG-DECISION-ENGINE-R076
Opt-in nested models for decision result markers
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Opt-in nested models for decision result markers.** EG's Python decision client represents decision-type result markers with opt-in nested Pydantic models, scoped to this specification's decision types only, ahead of any broader client-model migration. | A client test confirms decision-type responses deserialize into the nested Pydantic models while other response types are unaffected.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
bad0283526ba
tests/test_decision_client.py:152
EG-DECISION-ENGINE-R077
Component schema version bump to add decision kinds
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Component schema version bump to add decision kinds.** EG raises the shared component schema from version 2 to version 3 under a single numbering authority, so the new Withdrawn state and the new decision component kinds land in one schema change rather than in separate changes. | A schema migration test confirms every writer agrees on version 3 and that Withdrawn and the new kinds decode correctly from the bumped schema.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
9ffc5197866a
a1bb9fb9503e
crates/eg-types/src/agent_component.rs:2335
EG-DECISION-ENGINE-R078
Contract freeze reissued with the decide feature (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Contract freeze reissued with the decide feature (rollup).** EG reissues its generated contract freeze to include the decide feature, so the frozen contract artifact reflects every decision method and type this specification introduces. Split into child requirements by code root: `.1` the producer check that refuses a stale profile, `.2` the reissued artifact itself. | A contract-freshness check confirms the reissued freeze file matches the current generated output including the decide feature.
requirementEG-DECISION-ENGINEVERIFIED1527a97f2118
1e9ea1ef3790
1f2d473cf663
45beac8d810b
e8aaa8ae5ccd
crates/eg-capabilities/src/contract.rs:637
crates/eg-capabilities/src/contract.rs:665
EG-DECISION-ENGINE-R078.1
Typed refusal for a feature-profile freeze omitting an enabled feature
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed refusal for a feature-profile freeze omitting an enabled feature.** The hand-maintained `feature_profile()` list in `crates/eg-capabilities/src/contract.rs` can omit a shipped feature. A typed `MissingFrozenFeature` error and `require_feature_frozen` check refuse omissions. The check accepts a profile that names the feature. Add `decide` to the enumeration. The generator’s `canonical-ledger` profile enables the existing marker. Canonical generation and workspace `--all-features` produce the same frozen feature list. | A unit test covers profiles with missing and present features. A `decide`-gated test confirms the compiled profile includes `decide`.
requirementEG-DECISION-ENGINEVERIFIED1527a97f2118
1f2d473cf663
crates/eg-capabilities/src/contract.rs:637
crates/eg-capabilities/src/contract.rs:665
EG-DECISION-ENGINE-R078.2
Reissue the committed contract freeze artifacts with the decide feature
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reissue the committed contract freeze artifacts with the decide feature.** `contract/FREEZE-RECEIPT.json` and `contract/receipt.json` are regenerated under the authorized generation ceremony with the `decide` feature enabled and committed, so `feature_profile` in the frozen artifact names `decide`. | The existing `package_surface_is_complete_identical_and_receipt_bound` test, run with `--all-features`, passes against the freshly committed artifacts.
requirementEG-DECISION-ENGINEVERIFIED1527a97f2118
45beac8d810b
e8aaa8ae5ccd
crates/eg-capabilities/src/contract.rs:665
EG-DECISION-ENGINE-R079
Per-unit embedding admission classifier for ingestion
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Per-unit embedding admission classifier for ingestion.** Ingestion applies a deterministic per-unit classifier before embedding any derived text: it admits prose, document, and comment content while excluding generated, lockfile, vendored, and minified content, skips embedding when an exact, BM25, or graph lookup already answers the content, deduplicates near-identical text by entropy and content hash, enforces size bounds, and for SQL columns embeds only high-cardinality free text rather than enumerations, foreign keys, timestamps, booleans, or numeric columns. Retrieval telemetry feeds back into the classifier to demote content classes that are never retrieved. | A classifier test feeds each excluded content class and asserts no embedding call is made, while an eligible class embeds and a cheaper-index hit is skipped.
requirementEG-DECISION-ENGINESPECIFIED1e9ea1ef3790
dd6d5b55fb20
EG-DECISION-ENGINE-R079.1
Typed content-class taxonomy and pure admission gate (producer slice of R079)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed content-class taxonomy and pure admission gate (producer slice of R079).** A closed `ContentClass` enum fixes the taxonomy -- prose, document, and comment as eligible; generated, lockfile, vendored, and minified as excluded -- behind a single pure `admits()` gate, so every later ingestion call site consults one deterministic registry instead of an ad hoc per-site check. Real ingestion wiring, the embedding client, cheaper-index skip, entropy/hash dedup, size bounds, SQL-column cardinality, and retrieval-telemetry feedback are out of scope for this slice and remain open under `R079`. | A unit test feeds each excluded content class and asserts `admits() == false`, and feeds each eligible class and asserts `admits() == true`.
requirementEG-DECISION-ENGINEVERIFIEDd51d225674e1
dd6d5b55fb20
crates/eg-types/src/decision/ingestion_admission.rs:109
EG-DECISION-ENGINE-R079.2
Embedding admission at the ingestion boundary
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Embedding admission at the ingestion boundary.** Add the served ingestion fixture in `tests/test_decision_ingestion_acceptance.py` against the existing ingestion-to-embedding path and content-class gate. Eligible content can embed; excluded classes and sufficient exact, BM25, or graph hits make no embedding call. | Planned `tests/test_decision_ingestion_acceptance.py::test_ingestion_embedding_admission_and_cheaper_index_skip`; not implemented or executed acceptance evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R079.3
Duplicate and size admission
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Duplicate and size admission.** Add the served fixture in `tests/test_decision_ingestion_acceptance.py` proving entropy/content-hash deduplication and size bounds before an embedding call. Retain the parent requirement for near-identical content. | Planned `tests/test_decision_ingestion_acceptance.py::test_duplicate_and_oversized_units_do_not_embed`; not implemented or executed acceptance evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R079.4
SQL column admission
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**SQL column admission.** Add the served fixture in `tests/test_decision_ingestion_acceptance.py` proving that ingestion admits high-cardinality free-text SQL columns and excludes enumerations, foreign keys, timestamps, booleans, and numeric columns. | Planned `tests/test_decision_ingestion_acceptance.py::test_sql_column_kinds_and_cardinality_control_embedding`; not implemented or executed acceptance evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R079.5
Retrieval feedback admission
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Retrieval feedback admission.** Add the served fixture in `tests/test_decision_ingestion_acceptance.py` proving that retrieval-use telemetry demotes never-retrieved content classes at the ingestion admission path. The fixture must exercise the production admission path rather than only the typed taxonomy. | Planned `tests/test_decision_ingestion_acceptance.py::test_retrieval_feedback_demotes_unused_content`; not implemented or executed acceptance evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R080
Ingestion cost ladder with provenance rungs
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Ingestion cost ladder with provenance rungs.** Ingestion derives each fact through the cheapest sufficient rung of a six-level cost ladder covering AST extraction, symbol or type resolution, statistical or community derivation, classical machine-learning or named-entity modelling, embeddings, and finally a language model, tagging each fact with its rung's provenance class. A higher rung runs only when every lower rung abstains, and no rung may overwrite a fact a lower, more deterministic rung already established. Split producer-first into `EG-DECISION-ENGINE-R080.1` (the typed model); further child slices wire in the real per-rung extractors. | A ladder test seeds inputs answerable at each rung and asserts the fact is produced by the lowest sufficient rung with the matching provenance tag, and that a higher rung never overwrites an existing deterministic fact.
requirementEG-DECISION-ENGINESPECIFIED1e0050b97b3a
1e9ea1ef3790
EG-DECISION-ENGINE-R080.1
Typed provenance-rung model and overwrite-protection rule
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed provenance-rung model and overwrite-protection rule.** `crates/eg-types/src/decision/ingestion_ladder.rs` defines the six-level `ProvenanceRung` enum (cheapest first) and a pure `resolve_rung` function: a candidate fact from a higher (more expensive) rung never overwrites a fact a lower rung already established, and between two candidates the lowest-rung one wins. The real per-rung extractors (AST walking, symbol resolution, embeddings, an LLM call) are out of scope for this slice. | A unit test resolves a deterministic fact against a higher-rung guess and asserts the deterministic fact survives, and resolves a higher-rung guess against a later lower-rung fact and asserts the lower-rung fact replaces it.
requirementEG-DECISION-ENGINEVERIFIED1e0050b97b3a
crates/eg-types/src/decision/ingestion_ladder.rs:64
crates/eg-types/src/decision/ingestion_ladder.rs:72
crates/eg-types/src/decision/ingestion_ladder.rs:90
EG-DECISION-ENGINE-R080.2
Served enrichment ladder qualification
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Served enrichment ladder qualification.** Add the served fixture in `tests/test_decision_ingestion_acceptance.py` against the existing ingestion and enrichment entry points. For each of the six parent rungs, require every cheaper rung to abstain before escalation, persist the actual producing rung, and refuse overwrite of a cheaper established fact. The producer-only `resolve_rung` test does not discharge this integration acceptance. | Planned `tests/test_decision_ingestion_acceptance.py::test_real_extractors_follow_the_lowest_sufficient_rung`; not implemented or executed acceptance evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R081
Confidence-weighted community detection excluding similarity edges
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Confidence-weighted community detection excluding similarity edges.** Community detection computes edge weights from the entity resolver's confidence score, so a scoped match binds a community more strongly than a unique-guess match, instead of leaving every edge unweighted. The structural adjacency used to detect communities excludes, or heavily discounts, similar_to resemblance edges, since two code shapes looking alike is not a structural relationship. | A unit test compares community assignments across inputs with varying resolver confidence and asserts that adding similar_to edges does not change community membership.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
9ffc5197866a
b5fe3c140c21
crates/eg-compute/src/algorithms/tests.rs:200
crates/eg-compute/src/algorithms/tests.rs:663
EG-DECISION-ENGINE-R082
Single-pass option-marker scoring head for Decide
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Single-pass option-marker scoring head for Decide.** The eg-decision scoring head encodes the decision state once and scores every candidate option at its own marker position within that single forward pass, applying softmax across the option-marker outputs in-process rather than iterating a decoder once per option. | A unit test issues one encoder pass over more than one option and asserts all option scores are returned together and sum to one under softmax, with no per-option re-encoding.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
4952a2edced4
9ffc5197866a
crates/eg-numeric/tests/decision/scorer.rs:192
EG-DECISION-ENGINE-R083
Options encode structured facts, not option-label text (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Options encode structured facts, not option-label text (rollup).** The decision scorer encodes each candidate option from the structured facts attached to its IRI, including SHACL shape, declared capabilities, and cost and latency facts, rather than from a serialized text label, so the encoded feature width is bounded by a declared cardinality instead of a token budget. Split into child requirements by code root: `.1` typed OptionFacts encoding bounded by declared capability cardinality, `.2` wire OptionFacts encoding into the real FeatureMatrix computation. | A test scores an option set large enough to exceed a plausible text-token budget and asserts scoring still succeeds because feature width is bounded by cardinality, not text length.
requirementEG-DECISION-ENGINESPECIFIED1e9ea1ef3790
7a89c881dad4
e9da9f0a77e1
crates/eg-numeric/tests/decision/scorer.rs:367
EG-DECISION-ENGINE-R083.1
Typed OptionFacts encoding bounded by declared capability cardinality
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed OptionFacts encoding bounded by declared capability cardinality.** Add the typed `OptionFacts::encode` (`crates/eg-numeric/src/decision/rapid_r083.rs`), bounded by the declared `MAX_OPTION_CAPABILITIES` cardinality rather than by any text-token budget. | Test: `crates/eg-numeric/src/decision/rapid_r083.rs::tests::scores_an_option_whose_capability_text_would_exceed_a_token_budget`.
requirementEG-DECISION-ENGINEVERIFIEDe8aaa8ae5ccd
crates/eg-numeric/src/decision/rapid_r083.rs:64
EG-DECISION-ENGINE-R083.2
Wire OptionFacts encoding into the real FeatureMatrix computation
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wire OptionFacts encoding into the real FeatureMatrix computation.** Remaining scope from the split (2026-10-09): wiring this encoding into the real `FeatureMatrix` computation in `decision::features`. | A test scores an option set large enough to exceed a plausible text-token budget and asserts scoring still succeeds because feature width is bounded by cardinality, not text length.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R084
Conformal calibration as primary rung over temperature scaling
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Conformal calibration as primary rung over temperature scaling.** Decide calibrates confidence using eg-numeric's conformal prediction as the primary mechanism, reporting distribution-free empirical coverage and a principled abstention threshold, and falls back to size-specific temperature scaling only when the exchangeability assumption conformal coverage needs does not hold. Every calibrated decision reports both expected calibration error and empirical coverage. | An integration test measures expected calibration error and empirical coverage across option sets of varying size and asserts the declared coverage target holds without a size-specific temperature parameter.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
481fa6ea2c55
4952a2edced4
7765cab2e500
crates/eg-numeric/tests/decision/calibration_coverage.rs:37
EG-DECISION-ENGINE-R084.1
ECE/coverage measurement across option sets of varying size
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**ECE/coverage measurement across option sets of varying size.** No expected-calibration-error/coverage measurement exists across option sets of varying size. Fixtures are fixed at 3 options, so the declared coverage-holds-without-a-size-specific-parameter claim is untested. | Test: `tests/decision/calibration_coverage.rs::measures_ece_and_empirical_coverage_across_option_sets_of_varying_size`.
requirementEG-DECISION-ENGINEVERIFIED481fa6ea2c55
7765cab2e500
crates/eg-numeric/tests/decision/calibration_coverage.rs:37
EG-DECISION-ENGINE-R085
Legal option sets are derived from the ontology, never received as-is
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Legal option sets are derived from the ontology, never received as-is.** EG derives the candidate option set from SHACL shapes and a bounded SPARQL shortlist query rather than accepting a caller-supplied option list, so only type-valid, policy-admissible candidates are ever scored. A learned ranking rung may narrow this set or abstain but can never add an option the derivation excluded. | A negative test supplies a caller-asserted option that violates a SHACL shape or policy constraint and asserts it never appears in the derived option set presented to the scorer.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
29da53bfbe8d
crates/eg-numeric/src/decision/legal_option_filter.rs:57
EG-DECISION-ENGINE-R085.1
Typed legal-option-set filter (producer-first split of R085)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed legal-option-set filter (producer-first split of R085).** A pure, typed filter derives the legal option set from a caller-supplied candidate list and an admissibility predicate, excluding every candidate the predicate rejects, as the type-level contract ahead of the real SHACL-shape / SPARQL-shortlist-backed predicate (`R085.2`). | A negative test constructs a candidate set containing one option that fails a fixture admissibility predicate and asserts it is excluded from the derived set, plus a positive case that an admissible option passes through.
requirementEG-DECISION-ENGINEVERIFIED29da53bfbe8d
crates/eg-numeric/src/decision/legal_option_filter.rs:57
EG-DECISION-ENGINE-R085.2
Remaining scope of EG-DECISION-ENGINE-R085 (slice .2): Legal option sets are derived from the ontology, never received as-is
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Remaining scope of EG-DECISION-ENGINE-R085 (slice .2): Legal option sets are derived from the ontology, never received as-is.** Child slice of `EG-DECISION-ENGINE-R085` (see tasks.md). | A negative test supplies a caller-asserted option that violates a SHACL shape or policy constraint and asserts it never appears in the derived option set presented to the scorer
requirementEG-DECISION-ENGINEVERIFIED29da53bfbe8d
crates/eg-numeric/src/decision/legal_option_filter.rs:57
EG-DECISION-ENGINE-R086
DecisionFit promotion protocol reports nine metrics
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**DecisionFit promotion protocol reports nine metrics.** Before a fitted head may be promoted, DecisionEval reports accuracy, soft accuracy, Brier score and score mean absolute error alongside empirical coverage paired with expected calibration error, abstention rate paired with accuracy on answered decisions, cost per decision, decision stability where the same state and option set always produce the same answer, and calibration drift measured over bitemporal history, computed per tenant and per domain over a fixed evaluation workflow set. | A promotion-gate test asserts a receipt missing any of the nine metrics, or showing decision instability for a repeated identical request, blocks promotion.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
4952a2edced4
dc6a3c243a1f
crates/eg-numeric/tests/decision/scorer_promotion.rs:180
EG-DECISION-ENGINE-R087
Scorer always receives a bounded shortlist, never a full catalog
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Scorer always receives a bounded shortlist, never a full catalog.** EG always shortlists candidates with a bounded SPARQL LIMIT before handing an option set to the statistical scorer, so the scorer never receives an unbounded catalog of candidates. | A test against a large candidate catalog asserts the scorer's input option set never exceeds the declared shortlist bound.
requirementEG-DECISION-ENGINEVERIFIED1e9ea1ef3790
4952a2edced4
dc6a3c243a1f
crates/eg-numeric/tests/decision/scorer.rs:171
EG-DECISION-ENGINE-R088
Belief-as-of-t exposed as a Decide primitive over prefixes
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Belief-as-of-t exposed as a Decide primitive over prefixes.** Decide exposes a primitive that computes a belief or probability as of a given point in a sequence, such as a conversation prefix, using the existing bitemporal AS OF query over temporal slices rather than a bespoke per-domain sequential model. | A unit test evaluates belief as of successive prefixes of a recorded sequence and asserts the results match direct bitemporal AS OF queries at the corresponding points.
requirementEG-DECISION-ENGINESPECIFIED1e9ea1ef3790
4034a361535b
4952a2edced4
crates/eg-numeric/tests/decision/scorer.rs:215
EG-DECISION-ENGINE-R088.1
Belief-as-of-t uses the bitemporal AS OF mechanism, not a bespoke per-feature recompute
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Belief-as-of-t uses the bitemporal AS OF mechanism, not a bespoke per-feature recompute.** Belief-as-of-t is currently a bespoke per-feature recompute. It does not go through the required bitemporal AS OF query mechanism over temporal slices. | Test: `crates/eg-types/src/decision/rapid_r088.rs::tests::belief_as_of_successive_prefixes_matches_direct_bitemporal_as_of_queries`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R089
Learned ranking never replaces the constraint-first decision ladder
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Learned ranking never replaces the constraint-first decision ladder.** A statistical rung in the decision ladder may only rank or narrow the option set that the constraint, entailment and optimization steps have already produced, or abstain; it is never the mechanism that determines which options are legal. | A test disables the statistical scorer and asserts the constraint, entailment and optimization steps still produce the identical legal option set, with only ranking or abstention behavior affected.
requirementEG-DECISION-ENGINEVERIFIED19b44d216062
1e9ea1ef3790
aaef8290c8e2
crates/eg-numeric/tests/decision/ladder.rs:257
EG-DECISION-ENGINE-R090
Resident native decision-scorer head in eg-decision
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Resident native decision-scorer head in eg-decision.** eg-decision implements its option-attention scoring head natively in Rust as a small resident model, on the order of 700,000 parameters and a few megabytes, serving a decision in single-digit milliseconds on CPU, compiled directly into the engine binary with no Python runtime, sidecar process, inter-process hop, or GPU dependency required. Children `.1`, `.2`, and `.3` preserve this scope: declared budgets, compiled execution, and measured resource acceptance. | A benchmark measures the compiled scorer's per-decision CPU latency and binary footprint. It asserts both stay within the declared resident budget.
requirementEG-DECISION-ENGINEVERIFIED010477d72b7f
19b44d216062
1e9ea1ef3790
26be257523bc
29de5f09030f
crates/eg-numeric/benches/decision_resident_scorer.rs:218
crates/eg-types/src/decision/statistical/scorer.rs:156
crates/eg-types/src/decision/statistical/scorer.rs:164
crates/eg-types/src/decision/statistical/scorer.rs:172
crates/eg-types/src/decision/statistical/scorer.rs:180
EG-DECISION-ENGINE-R090.1
Typed resident-scorer budget (producer-first split of R090)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed resident-scorer budget (producer-first split of R090).** `eg-types::decision::statistical::scorer` defines `ResidentScorerBudget` and a `RESIDENT_SCORER_CEILING` ("on the order of 700,000 parameters and a few megabytes", single-digit-millisecond `p99`), with `ResidentScorerBudget::declare` refusing any declared budget that exceeds the ceiling, as the type-level contract ahead of the real compiled-benchmark harness (a further child). | A test declares a budget at the ceiling and asserts it is accepted, and a negative test declares a budget over the parameter and latency ceilings and asserts both are refused.
requirementEG-DECISION-ENGINEVERIFIED010477d72b7f
19b44d216062
d68c292be084
crates/eg-types/src/decision/statistical/scorer.rs:156
crates/eg-types/src/decision/statistical/scorer.rs:164
crates/eg-types/src/decision/statistical/scorer.rs:172
crates/eg-types/src/decision/statistical/scorer.rs:180
crates/eg-types/src/decision/statistical/scorer.rs:189
EG-DECISION-ENGINE-R090.2
Compiled resident scorer execution
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Compiled resident scorer execution.** The engine must execute the native option-attention scorer in process. Execution must require no Python runtime, sidecar, inter-process hop, or GPU. Code roots: `crates/eg-numeric/src/decision/scorer/` and `src/server/handlers/decide/`. | Planned test: `tests/test_decision_resident_scorer.py::test_compiled_engine_scores_without_external_runtime`. The test must exercise the engine binary and verify equivalent deterministic scores without external runtimes.
requirementEG-DECISION-ENGINEVERIFIED26be257523bc
tests/test_decision_resident_scorer.py:143
EG-DECISION-ENGINE-R090.3
Measured resident scorer resource budget
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Measured resident scorer resource budget.** The compiled scorer must satisfy the declared parameter, memory, and CPU latency limits. The benchmark must measure per-decision p99 latency and resident model footprint. Code root: `crates/eg-numeric/benches/decision_resident_scorer.rs`. | Planned benchmark: `crates/eg-numeric/benches/decision_resident_scorer.rs::resident_scorer_meets_declared_budget`. It must report parameter count, model bytes, binary footprint, and p99 CPU latency against `RESIDENT_SCORER_CEILING`.
requirementEG-DECISION-ENGINEVERIFIED29de5f09030f
9f5da56a6f62
crates/eg-numeric/benches/decision_resident_scorer.rs:218
EG-DECISION-ENGINE-R091
Resident scorer is bit-reproducible via fixed-point arithmetic
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Resident scorer is bit-reproducible via fixed-point arithmetic.** The resident decision-scorer head computes entirely in fixed-point integer arithmetic, following eg-numeric's no-floating-point-transcendental discipline, so scoring the same recorded decision input reproduces byte-identical results across machines and over time rather than only remaining stable within a single run. | A golden-vector test replays a committed DecisionRecord on a different machine or build and asserts the recomputed score is byte-identical to the recorded value.
requirementEG-DECISION-ENGINEVERIFIED4952a2edced4
534f763afc81
crates/eg-numeric/tests/decision/scorer.rs:109
EG-DECISION-ENGINE-R092
Scorer selection and structured encoding apply ladder-wide
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Scorer selection and structured encoding apply ladder-wide.** Across every decision question, the statistical scorer selects only among options the deterministic constraint, entailment and optimization rungs have already derived and can never introduce a new option, and every option is encoded from its structured ontology features rather than natural-language text, so scoring is not limited by option-label language or length. | A cross-question test exercises two distinct decision question types and asserts both enforce select-only-from-derived-options behavior and structured, non-text option encoding.
requirementEG-DECISION-ENGINEVERIFIED534f763afc81
e9e12f168722
src/server/handlers/decide/stat_tests/scorer_tests.rs:190
EG-DECISION-ENGINE-R093
Resident scorer is trained from the served synthetic-episode generator
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Resident scorer is trained from the served synthetic-episode generator.** Training data for the resident decision-scorer head comes from EG's seeded, ground-truth-bearing synthetic episode generator exercised through the real served request path, rather than manually authored synthetic examples, so training labels originate from the same engine the scorer runs inside. Split per the rapid-delivery contract: `.1` is the typed provenance model and its validation/refusal tests below; `.2` wires `export_gold_corpus` to actually drive episodes through a served client and tag them `SOURCE_SERVED`, and is not yet built. | A test confirms a training run consumes episodes produced by the synthetic generator's served path and that each episode carries a verifiable ground-truth label.
requirementEG-DECISION-ENGINESPECIFIED163a1e6bc8ad
534f763afc81
EG-DECISION-ENGINE-R093.1
Typed served-path provenance and ground-truth verification
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed served-path provenance and ground-truth verification.** A gold-corpus item's label carries an explicit provenance source (`SOURCE_IN_PROCESS` vs. `SOURCE_SERVED`), and `verify_ground_truth` refuses any item claiming `SOURCE_SERVED` whose acceptable set is empty or not a subset of its own candidates. | Unit tests confirm `verify_ground_truth` accepts a well-formed served-path item, ignores a non-served item, and refuses (raises `UnverifiableGroundTruthError`) a served item with an empty or leaking acceptable set.
requirementEG-DECISION-ENGINEVERIFIED163a1e6bc8ad
19b44d216062
tests/synthetic/test_synthetic_decision_export.py:63
tests/synthetic/test_synthetic_decision_export.py:71
tests/synthetic/test_synthetic_decision_export.py:78
tests/synthetic/test_synthetic_decision_export.py:85
EG-DECISION-ENGINE-R093.2
Served corpus export
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Served corpus export.** Children `.2.1` through `.2.3` track the remaining served export and training acceptance. | Each child must pass before this rollup is complete.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R093.2.1
Collect served episode results
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Collect served episode results.** `epistemic_graph/testing/synthetic/decision_export.py::export_gold_corpus` must collect seeded episode results through the existing served client. | Planned: `tests/synthetic/test_synthetic_decision_export.py::test_corpus_collects_seeded_served_results`. Record client calls and compare their results with exported candidates.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R093.2.2
Bind served labels to collected results
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Bind served labels to collected results.** `epistemic_graph/testing/synthetic/decision_export.py` must assign `SOURCE_SERVED` only to collected served results and validate each ground-truth label. | Planned: `tests/synthetic/test_synthetic_decision_export.py::test_served_labels_require_collected_results`. Refuse forged served provenance, empty acceptable sets, and labels outside collected candidates.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R093.2.3
Verify served corpus training
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Verify served corpus training.** `tests/synthetic/test_served_corpus_training.py` must exercise corpus export through a real server and consume it in training. | Planned: `tests/synthetic/test_served_corpus_training.py::test_training_consumes_served_ground_truth`. Check each consumed episode against the server response and its verifiable label.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R094
Decision scoring requires no GPU or model-server dependency
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision scoring requires no GPU or model-server dependency.** The resident decision scorer runs on CPU inside every instance of the engine, requiring no GPU, model-serving sidecar, or separate inference cluster, and retraining it is a short, self-contained job rather than a cluster-scale undertaking. | A deployment test runs the engine, including decision scoring, with no GPU device or model-server sidecar present and confirms decisions are still served.
requirementEG-DECISION-ENGINEVERIFIED534f763afc81
af5dc5ad78bd
src/server/handlers/decide/stat_tests/scorer_tests.rs:275
EG-DECISION-ENGINE-R095
Solver certificate digest matches its committed golden vector
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Solver certificate digest matches its committed golden vector.** The solver's certificate digest, recomputed for the fixed reference input in crates/eg-compute/tests/solve/determinism.rs, matches the committed golden digest, and this golden-vector check runs as part of the publication gate rather than being limited to within-run stability checks. | The determinism test suite, including the certificate-digest golden-vector test and the repeated-solves byte-identical test, runs and passes as part of the publication gate.
requirementEG-DECISION-ENGINEVERIFIED534f763afc81
be0f1acb05c6
dc6a3c243a1f
crates/eg-compute/tests/solve/determinism.rs:50
crates/eg-compute/tests/solve/determinism.rs:79
EG-DECISION-ENGINE-R096
Community-detection wire contract carries edge weight and quality function
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Community-detection wire contract carries edge weight and quality function.** The community-detection request contract carries a weight, and optional properties, on each edge and an explicit quality-function selector, not only a modularity resolution parameter, so confidence-weighted edges and alternative quality functions reach the kernel through the default request path rather than only a rarer fallback path. | A contract test constructs a community-detection request with weighted edges and a non-default quality-function selector and asserts the kernel receives and applies both.
requirementEG-DECISION-ENGINEVERIFIED03bb9b81b3a4
2a0d6eae0918
534f763afc81
crates/eg-compute/src/algorithms/tests.rs:662
crates/eg-compute/src/algorithms/tests.rs:717
EG-DECISION-ENGINE-R097
Replay-nonce rejection and blob GC grace period behave correctly
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Replay-nonce rejection and blob GC grace period behave correctly.** The transport anti-replay record in src/server/contract_wave.rs rejects a request that reuses a nonce already recorded, regardless of which served surface presented it, and the blob garbage collector in graph_pipeline.rs reclaims an unreferenced blob only after its configured grace period has elapsed, not immediately on dereference. | Reachability and garbage-collection tests use a distinct nonce per request and advance time past the configured grace period before asserting reclamation, matching the anti-replay record's and collector's actual contracts.
requirementEG-DECISION-ENGINEVERIFIED03bb9b81b3a4
534f763afc81
be0f1acb05c6
src/server/auth.rs:2151
src/server/blob/store/tests.rs:369
EG-DECISION-ENGINE-R098
Decide ladder excludes generative free-text models by design
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decide ladder excludes generative free-text models by design.** EG's decision ladder provides legal-option derivation, calibrated probabilities, cost-sensitive choice, provenance, abstention, templated natural-language responses through NlTemplate, and a constrained, typed DecideText and UQL surface, without an in-engine generative language model or autoregressive text generation. The bounded resident scorer selects and ranks typed options and does not generate free text. | A contract test confirms DecideText and NlTemplate responses are produced only from fixed templates and typed slot values, never from free-form generated text.
requirementEG-DECISION-ENGINEVERIFIED534f763afc81
fa3eda2b7961
src/server/handlers/decide/stat_tests/nl_tests.rs:143
src/server/handlers/decide/stat_tests/nl_tests.rs:58
EG-DECISION-ENGINE-R099
Wikidata alignment connector supplies entity-resolution keys
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wikidata alignment connector supplies entity-resolution keys.** A connector aligns EG's Region, Country, Taxon, Food and Nutrient entities to Wikidata using wikidataId and skos:exactMatch, supplying the entity-resolution keys consumed by EG-DECISION-ENGINE-R032, and a schema_mappings definition maps the same connector's fields to world_model-v1 properties, validated against the world-model SHACL shapes. | A SHACL validation test checks the produced schema_mappings data against the world-model shapes, and an entity-resolution test confirms the Wikidata-aligned keys resolve the expected entities.
requirementEG-DECISION-ENGINESPECIFIED534f763afc81
a1bb9fb9503e
EG-DECISION-ENGINE-R099.1
Wikidata alignment connector and schema_mappings SHACL validation exist
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wikidata alignment connector and schema_mappings SHACL validation exist.** No Wikidata connector, schema_mappings data, or SHACL test exists supplying the Region/Country/Taxon/Food/Nutrient entity-resolution keys EG-DECISION-ENGINE-R032 consumes. | Test: `tests/connectors/wikidata_alignment.rs::schema_mappings_validate_against_world_model_shacl_shapes_and_resolve_expected_entities`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100
Retrieval decisions join cited evidence with independent outcomes
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Retrieval decisions join cited evidence with independent outcomes.** EG joins each retrieval DecisionRecord's cited evidence with an independently evaluated outcome and persists the resulting hard-negative examples durably for reuse in later training and evaluation. Extension .100 defines pinned retrieval-evaluation and exact context-span inputs; `.101` defines grounded topic coverage and soft-label unsupported-claim evaluation. Neither replaces the independent-outcome join or hard-negative persistence. | The original integration test records a retrieval decision, attaches an independent outcome and reads the hard-negative example. `.100` verifies pinned labels, metrics, context offsets and refusal behavior. `.101` verifies scoped topic coverage, soft-label arithmetic and empty-denominator refusal.
requirementEG-DECISION-ENGINESPECIFIED03bb9b81b3a4
534f763afc81
e429630278b8
src/server/handlers/decide/stat_tests/retrieval_tests.rs:208
EG-DECISION-ENGINE-R101
Query-side embedding adapter head promoted via DecisionEval
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Query-side embedding adapter head promoted via DecisionEval.** EG applies a low-rank adapter to the query embedding after row-level-security filtering and before the approximate nearest-neighbor probe, and promotes a fitted adapter head only on a passing DecisionEval receipt, consistent with the guarded publish path used for other fitted heads. | A test asserts the adapter applies only to post-filter query vectors and that an adapter head without a passing DecisionEval receipt cannot be promoted.
requirementEG-DECISION-ENGINEVERIFIED03bb9b81b3a4
534f763afc81
e429630278b8
src/server/handlers/decide/stat_tests/learning_tests.rs:145
EG-DECISION-ENGINE-R102
Schema repair proposals pass a decided mapping and shadow-branch check
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Schema repair proposals pass a decided mapping and shadow-branch check.** EG's decision ladder evaluates a schema-repair mapping into a candidate GraphSchema or pack, validates the candidate with an ABox consistency check, and requires the candidate to be ingested on a shadow branch and explicitly approved before it is activated against the live schema. Rollup: split into `.1` (below) per SPEC-SIZING §5; a further child wires `GraphSchemaOp::AttachApproved` to a real shadow-branch ingest. | An integration test runs a schema-repair proposal through the mapping, ABox check, shadow-branch ingest and approval sequence and asserts activation only occurs after approval.
requirementEG-DECISION-ENGINESPECIFIED202b90167359
534f763afc81
EG-DECISION-ENGINE-R102.1
Typed schema-repair activation gate (producer-first split of R102)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed schema-repair activation gate (producer-first split of R102).** `eg-types::graph_schema::shadow_branch` defines `SchemaRepairStep` and `SchemaRepairActivation`, whose `checked_for_activation` refuses activation unless mapping-decided, ABox-check-passed, shadow-branch-ingested and approved steps are all recorded in that exact order, as the type-level contract ahead of the real mapping ladder and shadow-branch ingest wiring (further children). | A positive test records every step in order and asserts activation succeeds; negative tests omit the shadow-branch-ingest step and reorder approval ahead of it, and assert both are refused.
requirementEG-DECISION-ENGINEVERIFIED202b90167359
9c5b587a7145
crates/eg-types/src/graph_schema/shadow_branch.rs:109
crates/eg-types/src/graph_schema/shadow_branch.rs:88
crates/eg-types/src/graph_schema/shadow_branch.rs:95
EG-DECISION-ENGINE-R102.2
Served shadow repair qualification
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Served shadow repair qualification.** Wire and test the full schema-repair sequence at `src/server/graph_schema/approved.rs`. The sequence is decided mapping, ABox validation, real shadow-branch ingestion, then approval before activation. Reuse the existing approval lease and schema owner. A recorded step enum alone is not evidence of shadow ingestion. | Planned `src/server/graph_schema/approved/tests.rs::schema_repair_requires_real_shadow_ingest_before_activation`; not implemented or executed acceptance evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R103
Calibrated per-horizon flip confidence with conformal abstention
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Calibrated per-horizon flip confidence with conformal abstention.** EG's finance decision questions report a calibrated confidence for a predicted directional flip at each forecast horizon and abstain, using the same conformal abstention mechanism as other statistical decision rungs, when coverage cannot be guaranteed at that horizon. | A test evaluates flip predictions across multiple horizons and asserts each reports a calibrated confidence and abstains whenever conformal coverage fails at that horizon.
requirementEG-DECISION-ENGINEVERIFIED532418b7e55b
534f763afc81
9c5b587a7145
crates/eg-compute/src/finance/market/record_tests.rs:299
EG-DECISION-ENGINE-R104
DecideText shares the UQL lexer and grammar family
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**DecideText shares the UQL lexer and grammar family.** DecideText is parsed by the same lexer and grammar family as UQL, supporting dollar-prefixed parameters, a quote-aware candidate block, structured parse errors, and a shared grammar table, rather than a separate bespoke parser. | A parser test runs the same grammar-table-driven fixtures against DecideText and UQL inputs and asserts both produce structured errors in the same shape.
requirementEG-DECISION-ENGINEVERIFIED534f763afc81
857e20c63775
9c5b587a7145
crates/eg-plan/src/decide_text/tests.rs:145
EG-DECISION-ENGINE-R105
GraphSchema.attach publishes the swarm-topology ontology
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**GraphSchema.attach publishes the swarm-topology ontology.** EG's GraphSchema.attach publishes the swarm-topology TBox and SHACL shapes as a versioned schema package, and SHACL positive and negative fixtures prove the shapes accept valid swarm-topology facts and reject invalid ones. | A SHACL fixture test attaches the swarm-topology schema and asserts the positive fixtures validate and the negative fixtures fail validation.
requirementEG-DECISION-ENGINEVERIFIED4ded009c7d6e
534f763afc81
src/server/graph_schema/swarm_topology_tests.rs:128
EG-DECISION-ENGINE-R106
AgentGraph templates carry topology facts for standard shapes
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**AgentGraph templates carry topology facts for standard shapes.** EG's AgentGraph template representation supports the standard agent arrangement shapes used by downstream topology templates, including single-agent, pipeline, fan-out/join, supervisor-to-workers, critique-loop and council arrangements, and carries topology facts on each template for validation against the swarm-topology schema. | A contract test constructs an AgentGraph template for each standard shape and asserts its topology facts validate against the swarm-topology SHACL shapes.
requirementEG-DECISION-ENGINESPECIFIED534f763afc81
ca2bc11e6d73
src/server/graph_schema/swarm_topology_tests.rs:128
EG-DECISION-ENGINE-R107
Typed topology contract in eg-types with versioned goldens
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed topology contract in eg-types with versioned goldens.** eg-types defines a typed topology contract of at most twelve types in crates/eg-types/src/decision/topology.rs, adds a topology field to AssemblyRequirements and to template facts, increments the decision record version with accompanying v1 golden fixtures, and generates the matching Python bindings and capability pin. | Generated-contract and golden-fixture tests confirm the new topology types, the incremented record version, and the regenerated Python bindings stay in sync.
requirementEG-DECISION-ENGINEVERIFIED534f763afc81
9c5b587a7145
c0edc96d1e10
crates/eg-types/src/decision/topology/tests.rs:56
crates/eg-types/src/decision/topology/tests.rs:68
EG-DECISION-ENGINE-R108
Publish-time topology-shape validation fails closed
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Publish-time topology-shape validation fails closed.** Publishing an agent template runs a programmatic TemplateTopologyShape validation hook from the admin agent handler, implemented in src/server/handlers/decide/topology_shape.rs, and rejects any template whose topology does not validate rather than publishing it unchecked. | A negative test publishes a template with an invalid topology shape and asserts the publish request is rejected rather than silently accepted.
requirementEG-DECISION-ENGINEVERIFIED534f763afc81
9c5b587a7145
c0edc96d1e10
src/server/handlers/decide/topology_shape/tests.rs:77
EG-DECISION-ENGINE-R109
OWL entailment derives topology admissibility before assembly
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**OWL entailment derives topology admissibility before assembly.** Agent assembly runs an admissibility entailment stage in crates/eg-compute/src/assemble/topology/admissible.rs that includes the composed schema digest among its inputs, derives a TopologyAdmissible fact through OWL derivation, and eliminates any topology option the derivation does not admit. | A test varies the composed schema digest and asserts the derived TopologyAdmissible facts and eliminated topology options change accordingly.
requirementEG-DECISION-ENGINEVERIFIED47990cdbcb2b
534f763afc81
c0edc96d1e10
src/server/handlers/decide/topology_schema.rs:213
EG-DECISION-ENGINE-R109.1
Topology admissibility entailment test varies the composed schema digest
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Topology admissibility entailment test varies the composed schema digest.** Entailment lives in `topology_schema.rs::entail`, not the named `admissible.rs`, and no test varies the composed schema digest to show the derived TopologyAdmissible facts and eliminated options actually change. | Test: `crates/eg-compute/src/assemble/topology/admissible.rs::tests::varying_the_composed_schema_digest_changes_derived_topology_admissibility`.
requirementEG-DECISION-ENGINEVERIFIED47990cdbcb2b
src/server/handlers/decide/topology_schema.rs:213
EG-DECISION-ENGINE-R110
Topology optimization model rows with a brute-force oracle
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Topology optimization model rows with a brute-force oracle.** The topology assembly model in crates/eg-compute/src/assemble/topology/model.rs encodes one-hot width and round variables plus lease, deadline, demand, verify and capacity rows using precomputed tables, and a brute-force oracle checks the model's solutions against small instances of at most twenty variables. | A property test compares the solver's output against the brute-force oracle for topology instances up to twenty variables and asserts they agree.
requirementEG-DECISION-ENGINEVERIFIED1bd4d6b1cdea
1e1a100670b5
534f763afc81
c0edc96d1e10
crates/eg-compute/src/assemble/tests/topology_oracle.rs:144
EG-DECISION-ENGINE-R110.1
Topology brute-force oracle property test covers n<=20 variables
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Topology brute-force oracle property test covers n<=20 variables.** The assembly test compares deterministic topology instances against independent exhaustive enumeration. Actual model and certificate counts include twenty variables. | Test: `crates/eg-compute/src/assemble/tests/topology_oracle.rs::property_oracle_agrees_with_the_solver_for_instances_up_to_twenty_variables`.
requirementEG-DECISION-ENGINEVERIFIED1bd4d6b1cdea
1e1a100670b5
crates/eg-compute/src/assemble/tests/topology_oracle.rs:144
EG-DECISION-ENGINE-R111
Decide exposes the topology decision as a single typed question
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decide exposes the topology decision as a single typed question.** EG's decision ladder exposes swarm-topology selection as a single typed Decide question that callers ask directly, returning a derived, calibrated and recorded answer in place of a heuristic success-rate estimate computed outside the ladder. | A contract test issues a topology Decide request and asserts the response is a typed DecisionRecord rather than a heuristic score computed outside the ladder.
requirementEG-DECISION-ENGINESPECIFIED534f763afc81
c0edc96d1e10
EG-DECISION-ENGINE-R111.1
Topology selection is exposed as its own standalone typed Decide question
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Topology selection is exposed as its own standalone typed Decide question.** No dispatch-level standalone typed Topology Decide question exists; topology selection is still only reachable inside `graph.assemble()`. | Test: `src/server/handlers/decide/stat_tests/consumer_tests.rs::a_standalone_topology_decide_question_returns_a_typed_decision_record`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R112
Capacity premise derives headroom observations by priority
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Capacity premise derives headroom observations by priority.** src/server/handlers/decide/capacity_premise.rs derives headroom observations from capacity status at the requesting priority level, and reports infeasibility using a typed Infeasible result named by the specific lease constraint that could not be met. | A test exhausts capacity at a given priority and asserts the response is a typed, lease-named Infeasible result rather than a generic failure.
requirementEG-DECISION-ENGINEVERIFIED26a0f185448a
534f763afc81
c0edc96d1e10
crates/eg-compute/src/assemble/tests/topology.rs:116
EG-DECISION-ENGINE-R113
EG commits capacity acquisition atomically with synthesis evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**EG commits capacity acquisition atomically with synthesis evidence.** EG's decision commit path for a topology-backed run publishes synthesis evidence alongside the committed record and performs capacity acquisition as a single all-or-nothing operation, so a caller denied capacity can request exactly one further decision rather than partially holding resources. Rollup: split into `.1` (below) per SPEC-SIZING §5; `.2` tracks the atomic runtime commit; `.3` tracks retry enforcement. | A test simulates a denied capacity acquisition and asserts no partial capacity is held and that exactly one further decision request is accepted.
requirementEG-DECISION-ENGINESPECIFIED202b90167359
534f763afc81
EG-DECISION-ENGINE-R113.1
Typed atomic capacity/synthesis-evidence commit outcome (producer-first split of R113)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed atomic capacity/synthesis-evidence commit outcome (producer-first split of R113).** `eg-types::decision::topology::capacity_commit` defines `CapacitySynthesisCommit` (`Committed`/`Denied`) and `RetryAllowance`, whose `from_capacity_decision` refuses a `Committed` outcome without a lease and published synthesis evidence, and refuses a `Denied` outcome holding any lease or published evidence, granting exactly one further decision on denial. | A positive test commits an accepted decision with a lease and evidence; negative tests refuse a denial holding a partial lease and an acceptance missing published evidence, and assert a denial's retry allowance is exactly one.
requirementEG-DECISION-ENGINEVERIFIED202b90167359
93183139d2e2
crates/eg-types/src/decision/topology/capacity_commit.rs:110
crates/eg-types/src/decision/topology/capacity_commit.rs:125
crates/eg-types/src/decision/topology/capacity_commit.rs:137
crates/eg-types/src/decision/topology/capacity_commit.rs:149
crates/eg-types/src/decision/topology/capacity_commit.rs:174
EG-DECISION-ENGINE-R113.2
Atomic commit transaction
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Atomic commit transaction.** Rollup of `.2.1` to `.2.4`. Targets: `src/server/persistence/decision_record.rs`, `src/server/persistence/agent_graph/write.rs`, and `src/redb_store/capacity_lease.rs`. The shared transaction path is absent. Implementation remains blocked on the owner-boundary decision documented in `test-spec.md`. | Planned tests in `src/server/persistence/decision_record/tests.rs`: `topology_commit_publishes_capacity_and_evidence`, `topology_capacity_denial_leaves_no_commit_parts`, and `topology_commit_recovery_preserves_atomic_outcome`. The handler refusal test is `.2.1`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R113.2.1
Refuse an unsupported transaction boundary
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refuse an unsupported transaction boundary.** In `src/server/handlers/decide/commit.rs`, refuse topology acquisition before writes when no shared transaction authority exists. This guard does not implement the atomic transaction. | `src/server/handlers/decide/commit.rs::tests::topology_commit_refuses_uncoordinated_owners` checks both owners. The guard targets solved plans with positive lease demand. Ordinary records retain their commit path.
requirementEG-DECISION-ENGINEVERIFIED347eb303fcc7
src/server/handlers/decide/commit/tests.rs:121
EG-DECISION-ENGINE-R113.2.2
Accepted transaction fixture
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Accepted transaction fixture.** Add one success fixture in `src/server/persistence/decision_record/tests.rs`. The fixture checks the record, lease, and graph evidence after one accepted topology commit. Production targets are the three files named in `.2`. | Planned `src/server/persistence/decision_record/tests.rs::topology_commit_publishes_capacity_and_evidence` checks all three durable outputs. This fixture depends on the missing shared transaction path.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R113.2.3
Denied transaction fixture
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Denied transaction fixture.** Add one refusal fixture in `src/server/persistence/decision_record/tests.rs`. Capacity denial must leave no new record, lease, or graph evidence. Production targets are the three files named in `.2`. | Planned `src/server/persistence/decision_record/tests.rs::topology_capacity_denial_leaves_no_commit_parts` checks both stores after denial. This fixture depends on the missing shared transaction path.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R113.2.4
Transaction recovery fixture
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Transaction recovery fixture.** Add one restart fixture in `src/server/persistence/decision_record/tests.rs`. Restart after each participant boundary and check the same atomic outcome. Production targets are the three files named in `.2`. | Planned `src/server/persistence/decision_record/tests.rs::topology_commit_recovery_preserves_atomic_outcome` refuses visible partial state after restart. This fixture depends on the missing shared transaction and recovery paths.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R113.3
One retry after capacity denial
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**One retry after capacity denial.** Rollup of `.3.1` to `.3.3`. Targets: `crates/eg-types/src/decision/topology/capacity_commit.rs`, `src/server/persistence/decision_record.rs`, and `src/server/handlers/decide/commit.rs`. The handler must consume an authoritative denial allowance before the next decision. | Planned tests: `retry_allowance_consumes_once`, `topology_denial_allowance_consumption_survives_restart`, and `topology_denial_accepts_one_followup_request`. Child rows name their exact test files.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R113.3.1
Consume the typed allowance once
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Consume the typed allowance once.** In `crates/eg-types/src/decision/topology/retry_allowance.rs`, re-exported by `capacity_commit.rs`, add a checked transition from one remaining decision to zero. A second consumption must fail. | `crates/eg-types/src/decision/topology/retry_allowance.rs::tests::retry_allowance_consumes_once` checks the successful transition and repeated refusal. This model test does not prove runtime enforcement.
requirementEG-DECISION-ENGINEVERIFIEDcb8662f24bef
crates/eg-types/src/decision/topology/retry_allowance.rs:35
crates/eg-types/src/decision/topology/retry_allowance.rs:49
EG-DECISION-ENGINE-R113.3.2
Durable consumption fixture
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Durable consumption fixture.** Add one test in `src/server/persistence/decision_record/tests.rs` for consumption by tenant and denied decision identity. Production target: `src/server/persistence/decision_record.rs`. A restart must not restore the consumed allowance. | Planned `src/server/persistence/decision_record/tests.rs::topology_denial_allowance_consumption_survives_restart` checks initial use, reopen, and refusal. The durable denial record and consume operation remain absent.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R113.3.3
Handler retry fixture
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Handler retry fixture.** Add one request test in `src/server/handlers/decide/commit.rs`. The handler permits one further decision after denial and refuses repeated or concurrent consumption. Production target: the same file. This test depends on `.3.2`. | Planned `src/server/handlers/decide/commit.rs::tests::topology_denial_accepts_one_followup_request` checks first use, replay, concurrent use, and tenant binding.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R114
Subagent allowance negotiation reads EG's topology facts
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Subagent allowance negotiation reads EG's topology facts.** The typed topology facts EG attaches to a committed decision record are the input a caller's subagent-allowance negotiation reads to decide how many subagents may run, rather than the negotiation computing its own separate topology estimate. | A contract test confirms a subagent-allowance negotiation consumes the topology-facts field of a committed EG decision record.
requirementEG-DECISION-ENGINEVERIFIED26b04e133dfd
534f763afc81
c0edc96d1e10
crates/eg-compute/src/assemble/tests/topology.rs:196
EG-DECISION-ENGINE-R116
Consumers reach EG only through the versioned client contract
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Consumers reach EG only through the versioned client contract.** EG publishes a single versioned client contract that external consumers use for every decision and engine call, so no consumer needs a separate bespoke facade, in-process engine object, or private transport path to reach EG's decision ladder. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R116.1` (the typed consumer-call-path gate) and `EG-DECISION-ENGINE-R116.2` (wiring every generated client method through it, plus the contract test). R116 is LANDED when both children are. | A contract test confirms a consumer using only the published EG client contract can perform the same calls that previously required a bespoke in-process facade, with no direct engine import required.
requirementEG-DECISION-ENGINESPECIFIED534f763afc81
EG-DECISION-ENGINE-R116.1
A typed gate admits only the published client-contract call path
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**A typed gate admits only the published client-contract call path.** A `ConsumerCallPath` type distinguishes the published, versioned contract path from a bespoke in-process facade or private transport; `admit_call_path` admits the former (with a non-empty contract version) and refuses the latter unconditionally. Adds no server surface. | Unit tests assert the published contract path is admitted, a bespoke facade is always refused, and an empty contract version is refused.
requirementEG-DECISION-ENGINEVERIFIED253a69935dfd
26b04e133dfd
crates/eg-capabilities/src/contract/access_path.rs:45
crates/eg-capabilities/src/contract/access_path.rs:54
crates/eg-capabilities/src/contract/access_path.rs:64
EG-DECISION-ENGINE-R116.2
Every generated client method is wired through the contract-only gate
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Every generated client method is wired through the contract-only gate.** Every decision and engine call the generated client exposes is routed through `EG-DECISION-ENGINE-R116.1`'s `admit_call_path` before dispatch, so no bespoke facade or private transport path can reach EG's decision ladder. Depends on `EG-DECISION-ENGINE-R116.1`. | A contract test confirms a consumer using only the published EG client contract can perform the same calls that previously required a bespoke in-process facade, with no direct engine import required.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R117
DERIVE series functions share one incremental kernel
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**DERIVE series functions share one incremental kernel.** eg-tsdb/src/derive implements lag, diff, return, log-return, and rolling mean, standard deviation, sum, min, max, rank, correlation, exponentially weighted moving average, z-score, ratio, and weighted-sum functions as checkpointed incremental kernels, with UQL's DERIVE clause, SQL window functions, and the matching PromQL functions all calling the same kernel rather than duplicating it, and a single shared rolling z-score and exponentially weighted moving average implementation. DecisionEval reports each feature's predictive power as rolling rank information coefficient, information-coefficient decay, information ratio with an effective sample size, and a bootstrap confidence interval. | A test compares UQL DERIVE, SQL window and PromQL outputs for the same function against a Python reference golden and asserts agreement, and a DecisionEval report test asserts all four feature-power metrics are present.
requirementEG-DECISION-ENGINESPECIFIED534f763afc81
9480759eb7c2
EG-DECISION-ENGINE-R117.1
UQL/SQL/PromQL golden-equivalence and 4-metric DecisionEval report test
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**UQL/SQL/PromQL golden-equivalence and 4-metric DecisionEval report test.** No UQL/SQL/PromQL golden-equivalence test or 4-metric DecisionEval report test exists for the DERIVE series functions. | Test: `crates/eg-tsdb/tests/derive_golden.rs::uql_sql_promql_outputs_agree_on_golden_reference_and_decisioneval_reports_all_four_feature_power_metrics`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R118
Reputation view backs source reliability across all readers
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reputation view backs source reliability across all readers.** EG materializes a read-only reputation relation from Decide's hierarchical Beta-Binomial option pools and proper-score forecaster records, including Brier score, log score, Murphy decomposition and calibration error, time-discounted and gated by a minimum sample size, formed only from independently evaluated outcome labels. AuthorityPolicy.source_reliability, RetrievalCandidate.source_reliability and UQL's SOURCE RELIABILITY clause all read this same materialization, and evidence fusion lives in eg-epistemic with the finance signal method kept as a thin adapter rather than a second fusion implementation. | A test asserts a sparse or unverified pool abstains rather than returning a default reliability, and that AuthorityPolicy, RetrievalCandidate and UQL SOURCE RELIABILITY all return identical values for the same source.
requirementEG-DECISION-ENGINESPECIFIED1f6d512ae013
28fbbbe2ee1e
534f763afc81
7e14801e08c3
9a85c8a49fd4
EG-DECISION-ENGINE-R118.1
Reputation-view test exists outside the unrelated privacy regression fixture
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reputation-view test exists outside the unrelated privacy regression fixture.** No real test of the reputation materialization existed. Only incidental fixture text inside an unrelated privacy regression test touched this path. Split into `EG-DECISION-ENGINE-R118.1.1` (in-crate) and `EG-DECISION-ENGINE-R118.1.2` (cross-surface agreement). | Delivered by the two child rows.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R118.1.1
A sparse pool abstains in the reputation materialization
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**A sparse pool abstains in the reputation materialization.** `learn_reputation` (`crates/eg-numeric/src/risk/reputation.rs`) returns `Reputation::InsufficientHistory` for a subject below the sample gate while a dense peer in the same pool is `Reputation::Estimated`. | Test: `crates/eg-numeric/src/risk/reputation.rs::tests::sparse_pool_abstains_while_a_dense_peer_is_estimated`.
requirementEG-DECISION-ENGINEVERIFIEDac824430b1d8
crates/eg-numeric/src/risk/reputation.rs:316
EG-DECISION-ENGINE-R118.1.2
AuthorityPolicy, RetrievalCandidate and UQL SOURCE RELIABILITY agree on the abstention
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**AuthorityPolicy, RetrievalCandidate and UQL SOURCE RELIABILITY agree on the abstention.** Remaining scope: one cross-crate test (eg-epistemic, eg-numeric, eg-plan) showing `AuthorityPolicy.source_reliability`, `RetrievalCandidate.source_reliability` and UQL's SOURCE RELIABILITY clause read the same materialized value and all abstain for a sparse pool. | Test: a cross-surface test asserting all three readers agree on a sparse-pool abstention (to be written).
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R119
Walk-forward replay seals deflated Sharpe and PBO evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Walk-forward replay seals deflated Sharpe and PBO evidence.** DecisionEval's walk-forward replay mode reads a bitemporal AS OF snapshot for every fold, refits only on that fold's training history, and records input, head and policy digests plus per-option contributions and a resume point so an interrupted replay can continue. Each run is sealed as a content-addressed EvaluationRun reporting a deflated Sharpe ratio using the real trial count, a probability of backtest overfitting figure, and a Diebold-Mariano comparison against a pinned incumbent, with finance BacktestRun as a specialization of this same sealed, verified, no-look-ahead contract, and a policy-dependent environment is refused and routed to off-policy evaluation instead. | A replay test runs walk-forward folds over bitemporal snapshots and asserts the sealed EvaluationRun's trial count, backtest-overfitting probability and Diebold-Mariano figures match independently recomputed values, and that a policy-dependent environment is rejected.
requirementEG-DECISION-ENGINEVERIFIED4034a361535b
534f763afc81
a85c8425c9f4
src/server/handlers/decide/stat_tests/replay_tests.rs:187
src/server/handlers/decide/stat_tests/replay_tests.rs:246
EG-DECISION-ENGINE-R120
Admission anchors are limited to persisted write paths
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Admission anchors are limited to persisted write paths.** A component counts as an admission anchor in the pinned-reference-resolution check only when it performs a persisted write; a read-only helper, a replay helper, or a decision-record's internal closure does not count as a separate admission point. | A test exercises a read helper, a replay helper and a persisted write path and asserts only the write path is counted as a component's admission anchor.
requirementEG-DECISION-ENGINEVERIFIED18f72d26730a
3c39771e7a44
534f763afc81
tests/test_pinned_reference_resolution.py:144
EG-DECISION-ENGINE-R121
Typed Claim and Evidence structures back evidence class
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed Claim and Evidence structures back evidence class.** EG represents claim and evidence provenance as typed Claim and Evidence data structures carried through the decision pipeline, not as naming-convention string labels, so every decision answer's evidence_class (proof, observation, or claim) is derived from structured data rather than inferred from field names. Rollup of `EG-DECISION-ENGINE-R121.1` and `EG-DECISION-ENGINE-R121.2`; both remain necessary. | A unit test constructs a decision answer and asserts evidence_class is computed from the typed Claim/Evidence structure, failing if a mislabeled string alone could produce a different class.
requirementEG-DECISION-ENGINESPECIFIED534f763afc81
a1bb9fb9503e
EG-DECISION-ENGINE-R121.1
Assembly answers use typed premise classes
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Assembly answers use typed premise classes.** Reuse `PremiseRef` in `crates/eg-compute/src/assemble/conclude.rs`. Misleading field names and subject IRIs must not change evidence class. | `crates/eg-compute/src/assemble/tests/evidence.rs::assembly_evidence_uses_typed_premises_not_labels` constructs and replays actual assembly answers across all three classes.
requirementEG-DECISION-ENGINEVERIFIEDa8e597dccba7
crates/eg-compute/src/assemble/tests/evidence.rs:8
EG-DECISION-ENGINE-R121.2
Graph candidate provenance reaches statistical answers
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Graph candidate provenance reaches statistical answers.** Reuse typed graph nodes in `src/server/handlers/decide/candidates.rs` and `stat_decide.rs`. Preserve source identity and snapshot evidence through record sealing and replay. Graph rows currently carry text and numeric features only. | Planned `src/server/handlers/decide/stat_tests/classes_tests.rs::graph_claim_and_evidence_control_answer_class` exercises typed graph rows, misleading labels, malformed provenance, and replay.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R122
Synthetic decision data stays separate from calibration
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Synthetic decision data stays separate from calibration.** EG runs synthetic decision data with outcomes known by construction through its full decision pipeline and flags the resulting records as synthetic, so synthetic evaluations are never merged with real-world calibration statistics. | An integration test runs the synthetic suite end to end and asserts synthetic-origin records are excluded from real-world calibration aggregates.
requirementEG-DECISION-ENGINEVERIFIED0c9f08ddbbae
534f763afc81
cfbe22464008
src/server/handlers/decide/stat_tests.rs:569
EG-DECISION-ENGINE-R123
Solve DTOs canonical in eg-types, no duplicate copies
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Solve DTOs canonical in eg-types, no duplicate copies.** The solver data types under eg-types/src/solve/** are the single canonical definition of the solver's request and result shapes. Any other crate re-exports them from eg-types instead of maintaining its own copy. | `tests/test_decision_static_contracts.py::test_solve_dtos_have_no_second_definition` scans Rust sources for duplicate canonical DTO declarations. Adversarial fixtures reject added structs, enums, and aliases. Reviewed unrelated domain homonyms remain distinct.
requirementEG-DECISION-ENGINEVERIFIED51f9c8eb6f1d
534f763afc81
a4804f87c971
tests/test_decision_static_contracts.py:87
EG-DECISION-ENGINE-R124
eg-numeric statistical kernel tests compile and run
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**eg-numeric statistical kernel tests compile and run.** Every statistical kernel implementation in eg-numeric is exercised by a compiled test entry point (tests/stat_kernels.rs) so the crate's test suite builds and runs all kernel test files, clippy.toml's declared self-check file exists and matches what clippy actually runs, and confidence-level and statistical-power assertions in those tests use correctly calibrated values. | The eg-numeric test suite compiles and executes tests/stat_kernels.rs with all five kernel test files included, and clippy runs against the declared self-check file.
requirementEG-DECISION-ENGINEVERIFIED30405ee73d13
534f763afc81
a1bb9fb9503e
crates/eg-numeric/tests/stat_kernels/clippy_policy.rs:34
crates/eg-numeric/tests/stat_kernels/clippy_policy.rs:50
EG-DECISION-ENGINE-R125
Telemetry binds to ontology entities as BehaviourObservation
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Telemetry binds to ontology entities as BehaviourObservation.** EG binds incoming telemetry events to their corresponding ontology entities and rolls them up into BehaviourObservation facts that downstream decision and reputation computations can read. | An integration test ingests sample telemetry, confirms correct entity binding, and asserts the resulting BehaviourObservation rollup facts are queryable.
requirementEG-DECISION-ENGINEVERIFIED30405ee73d13
534f763afc81
cae7ecad71e2
tests/served_telemetry_facts.rs:232
EG-DECISION-ENGINE-R126
Capability coverage answers which components can serve a task
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Capability coverage answers which components can serve a task.** EG extends `AgentAssemble` (EG-DECISION-ENGINE-R036) with a read-only coverage query. The query takes native task IRIs and returns the capability closure of each task. For each capability, it lists the visible Agent Library templates and registered A2A agent cards that cover it. Each entry carries its derivation premises and their evidence class. A2A agent cards stay claims. The query uses no model and ranks nothing. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R126.1` (the pure capability-coverage derivation) and `EG-DECISION-ENGINE-R126.2` (the served query and its generated client). R126 is LANDED when both children are. | A served fixture proves closure, per-capability covering components, premise classes, visibility filtering and the absence of invisible components.
requirementEG-DECISION-ENGINEVERIFIED1b6af1990ea8
253a69935dfd
2b7d88e9b456
30405ee73d13
4b6e3e19af6b
crates/eg-types/src/decision/derivation/tests.rs:138
src/server/handlers/decide/coverage_tests.rs:152
src/server/handlers/decide/coverage_tests.rs:232
tests/test_capability_coverage_client.py:28
tests/test_capability_coverage_client.py:37
EG-DECISION-ENGINE-R126.1
Capability coverage is a pure function of required capabilities and candidate facts
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Capability coverage is a pure function of required capabilities and candidate facts.** `eg-types`'s `decision::derivation` module computes, for each of a task closure's required capabilities, every visible Agent Library candidate that covers it (reusing `coverage_chain`, the same chain `AgentAssemble` already proves) paired with its evidence class, and every registered A2A agent card that self-declares it, always at claim strength. Adds no server surface and no ranking. | Unit tests assert the join: only covering library candidates and self-declaring A2A cards appear, and a library entry's evidence class matches the weakest premise of its chain.
requirementEG-DECISION-ENGINEVERIFIED253a69935dfd
e5edf018cbba
crates/eg-types/src/decision/derivation/tests.rs:138
EG-DECISION-ENGINE-R126.2
The capability-coverage query is served beside `AgentAssemble`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The capability-coverage query is served beside `AgentAssemble`.** A read-only method accepts native task IRIs, resolves the tenant's visible Agent Library candidates and registered A2A cards, calls `EG-DECISION-ENGINE-R126.1`'s `capability_coverage`, and returns the result with a generated client method. Depends on `EG-DECISION-ENGINE-R126.1`. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R126.2.1` (the served RPC: `Method` variant, dispatch wiring and handler) and `EG-DECISION-ENGINE-R126.2.2` (the generated client, cut once the orchestrator regenerates the contract). R126.2 is LANDED when both children are. | A served fixture proves closure, per-capability covering components, premise classes, visibility filtering and the absence of invisible components.
requirementEG-DECISION-ENGINEVERIFIED1b6af1990ea8
253a69935dfd
2b7d88e9b456
30405ee73d13
4b6e3e19af6b
src/server/handlers/decide/coverage_tests.rs:152
src/server/handlers/decide/coverage_tests.rs:232
tests/test_capability_coverage_client.py:28
tests/test_capability_coverage_client.py:37
EG-DECISION-ENGINE-R126.2.1
The capability-coverage query answers over the wire
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The capability-coverage query answers over the wire.** A new `Method` variant carries native task IRIs; dispatch routes it to a handler beside `handle_agent_assemble` that resolves the tenant's visible Agent Library candidates and registered A2A agent cards (the existing `A2aAgentCard`-kind `AgentComponent`s) from the same Agent Library store `AgentAssemble` reads, and calls `EG-DECISION-ENGINE-R126.1`'s `capability_coverage_query`. No generated client yet. Depends on `EG-DECISION-ENGINE-R126.1`. | A served fixture proves closure, per-capability covering components, premise classes, visibility filtering and the absence of invisible components, driven directly against the dispatcher.
requirementEG-DECISION-ENGINEVERIFIED1b6af1990ea8
2b7d88e9b456
9c778cfdfff0
fcb2e15d572c
src/server/handlers/decide/coverage_tests.rs:152
src/server/handlers/decide/coverage_tests.rs:232
EG-DECISION-ENGINE-R126.2.2
The capability-coverage query gets a generated client method
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The capability-coverage query gets a generated client method.** Once `EG-DECISION-ENGINE-R126.2.1` is wired, `gen_contract` is rerun to publish the method's request/response subschema and regenerate `crates/eg-capabilities/generated/method_catalog.rs` and the client bindings. Depends on `EG-DECISION-ENGINE-R126.2.1`; requires a build-host `cargo run -p eg-capabilities --features contract --bin gen_contract` the delivering lane does not itself run. | The regenerated generated-client contract test exercises the method end to end.
requirementEG-DECISION-ENGINEVERIFIED4b6e3e19af6b
tests/test_capability_coverage_client.py:28
tests/test_capability_coverage_client.py:37
EG-DECISION-ENGINE-R127
Guardrail entailment lists the rules a task must follow
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Guardrail entailment lists the rules a task must follow.** EG returns the governance rules, standards and SHACL shapes that apply to a task class by ontology entailment. Each rule carries the entailment path and its source generation. The answer is advisory; enforcement stays with the owning policy gate. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R127.1` (the pure entailment function) and `EG-DECISION-ENGINE-R127.2` (the served query and its generated client). R127 is LANDED when both children are. | A fixture proves entailed rules for a subclassed task, no rule for an unrelated task, and stable premises after restart.
requirementEG-DECISION-ENGINEVERIFIED18a745706c46
2110b293cdf0
253a69935dfd
30405ee73d13
334c101eb64f
crates/eg-types/src/decision/guardrail.rs:254
crates/eg-types/src/decision/guardrail.rs:292
crates/eg-types/src/decision/guardrail.rs:317
crates/eg-types/src/decision/guardrail.rs:324
src/server/handlers/decide/guardrail_tests.rs:139
EG-DECISION-ENGINE-R127.1
Guardrail entailment is a pure function of a task IRI and a rule set
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Guardrail entailment is a pure function of a task IRI and a rule set.** `eg-types`'s `decision::guardrail` module decides, for a task IRI and a set of `GuardrailRule`s each naming the task class they govern, which rules are entailed by task-class subsumption (reusing `agent_ontology::broader_chain`, the same subclass-entailment primitive `coverage_chain` already proves capability coverage with), each with its entailment path and source generation. Adds no server surface. | Unit tests assert a rule on the task's own class or an ancestor is entailed with the correct path, a rule on an unrelated class is never entailed, and the same inputs always produce the same premises.
requirementEG-DECISION-ENGINEVERIFIED18a745706c46
253a69935dfd
30405ee73d13
crates/eg-types/src/decision/guardrail.rs:292
crates/eg-types/src/decision/guardrail.rs:317
crates/eg-types/src/decision/guardrail.rs:324
EG-DECISION-ENGINE-R127.2
The guardrail-entailment query is served, backed by a stored rule set
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The guardrail-entailment query is served, backed by a stored rule set.** A read-only method accepts a task IRI, reads the tenant's published `GuardrailRule`s, calls `EG-DECISION-ENGINE-R127.1`'s `entailed_guardrails`, and returns the result with a generated client method. Depends on `EG-DECISION-ENGINE-R127.1`. The query reuses the Agent Library component publish path and its tenant-bound snapshot reader. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R127.2.1` (the `GuardrailRule` storage/publish path), `EG-DECISION-ENGINE-R127.2.2` (the served RPC) and `EG-DECISION-ENGINE-R127.2.3` (the generated client). R127.2 is LANDED when all three children are. | A fixture proves entailed rules for a subclassed task, no rule for an unrelated task, and stable premises after restart.
requirementEG-DECISION-ENGINEVERIFIED2110b293cdf0
253a69935dfd
30405ee73d13
334c101eb64f
45beac8d810b
crates/eg-types/src/decision/guardrail.rs:254
src/server/handlers/decide/guardrail_tests.rs:139
src/server/handlers/decide/guardrail_tests.rs:161
src/server/handlers/decide/guardrail_tests.rs:78
src/server/persistence/guardrail_rule/tests.rs:46
EG-DECISION-ENGINE-R127.2.1
A `GuardrailRule` can be published and read back per tenant
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**A `GuardrailRule` can be published and read back per tenant.** Adds the storage component kind and the publish/list path a `GuardrailRule` (`rule_id`, `applies_to_class`, `source_generation`) needs before any query can read a tenant's rule set, mirroring how Agent Library components are published today. Malformed rule attributes fail publish with the declared `MALFORMED_GUARDRAIL_RULE` code on `AgentComponent`; unrelated methods do not inherit that allowance. Adds no new served query. | A persistence test publishes a `GuardrailRule` and reads it back unchanged after a restart.
requirementEG-DECISION-ENGINEVERIFIED334c101eb64f
45beac8d810b
eff92845d271
src/server/persistence/guardrail_rule/tests.rs:46
src/server/persistence/guardrail_rule/tests.rs:79
EG-DECISION-ENGINE-R127.2.2
The guardrail-entailment query answers over the wire
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The guardrail-entailment query answers over the wire.** A new `Method` variant carries a task IRI; dispatch routes it to a handler that reads the tenant's published `GuardrailRule`s via `EG-DECISION-ENGINE-R127.2.1`'s storage path and calls `EG-DECISION-ENGINE-R127.1`'s `guardrail_entailment_query`. The typed read is `GuardrailEntailment`, binds the requested tenant to the verified caller before opening the rule snapshot, and returns the ontology digest, rule generations and entailment paths. It uses the existing `agent:assemble-read` authority and never changes the owning enforcement policy. Retired and withdrawn heads and other tenants are invisible. Generated bindings are owned by R127.2.3. Depends on `EG-DECISION-ENGINE-R127.1` and `EG-DECISION-ENGINE-R127.2.1`. | A fixture proves entailed rules for a subclassed task, no rule for an unrelated task, and stable premises after restart, driven directly against the dispatcher.
requirementEG-DECISION-ENGINEVERIFIEDe7580aeb141f
crates/eg-types/src/decision/guardrail.rs:254
src/server/handlers/decide/guardrail_tests.rs:139
src/server/handlers/decide/guardrail_tests.rs:161
src/server/handlers/decide/guardrail_tests.rs:78
EG-DECISION-ENGINE-R127.2.3
The guardrail-entailment query gets a generated client method
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The guardrail-entailment query gets a generated client method.** Once `EG-DECISION-ENGINE-R127.2.2` is wired, `gen_contract` is rerun to publish the method's request/response subschema and regenerate `crates/eg-capabilities/generated/method_catalog.rs` and the client bindings. Depends on `EG-DECISION-ENGINE-R127.2.2`. The native `cargo run -p eg-capabilities --features contract --bin gen_contract` command owns every generated artifact, including the Python request validator and typed result decoder. | The regenerated generated-client contract test exercises the method end to end.
requirementEG-DECISION-ENGINEVERIFIED2110b293cdf0
d13f43cd3e1f
f5677b486e1f
tests/test_guardrail_entailment_served.py:49
EG-DECISION-ENGINE-R128
HarnessConfig decision answers how to configure an agent run
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**HarnessConfig decision answers how to configure an agent run.** One new `Decide` question kind, `harness_config`, returns the context policy, plan scaffold and action space for a model profile, a task class, a usable context budget and a request priority. It reuses the decision ladder and the `ToolSubset` selection. It is not a planner. Children `.1` through `.15` split it by producer, behaviour, wiring and proof. R128 is LANDED when all children are. | Test: A served test submits one `harness_config` question and asserts the committed record names all three parts with premises.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R128.1
The question kind exists in the enum
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The question kind exists in the enum.** `QuestionKind` at `crates/eg-types/src/decision/statistical.rs:57` must gain the variant `HarnessConfig`, serialised as `harness_config`, with a doc comment that cites R128 and states the question is evaluate-only. | Test: `crates/eg-types/src/decision/statistical.rs::question_kind_declared_tests::harness_config_kind_serialises_snake_case`
requirementEG-DECISION-ENGINEVERIFIEDc7da75413a3c
crates/eg-types/src/decision/statistical.rs:369
src/server/handlers/decide/stat_tests/harness_config_tests.rs:57
src/server/handlers/decide/stat_tests/harness_config_tests.rs:98
EG-DECISION-ENGINE-R128.2
The request carries typed params
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The request carries typed params.** A new module `crates/eg-types/src/decision/statistical/harness_config.rs` must define `HarnessConfigRequestBody` with `model_profile_ref` (iri), `task_class` (iri), `usable_context_budget_tokens` (int), `priority` and an optional `expected_trajectory_tokens` (int). Each param name must match a `DecideRequest.params` entry, as `tool_subset.rs:29` does. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::body_requires_every_input`
requirementEG-DECISION-ENGINEVERIFIED5b6086e4075d
crates/eg-types/src/decision/statistical/harness_config.rs:407
crates/eg-types/src/decision/statistical/harness_config.rs:434
crates/eg-types/src/decision/statistical/harness_config.rs:453
EG-DECISION-ENGINE-R128.3
The answer type states each part and its abstention
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The answer type states each part and its abstention.** `harness_config.rs` must define `HarnessConfigAnswer` with `context_policy` (`none`, `elide`, `elide_then_summarize`), `soft_threshold`, `hard_threshold` and `recent_window_fraction` (Q32 fractions), `plan_scaffold` (`on`, `off`), `action_space` (`tool_set`, `shell_only`) and `tool_subset`. Each part must be `Decided` or `Abstained { missing_fact, conservative_default }`. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::answer_round_trips_through_serde`
requirementEG-DECISION-ENGINEVERIFIEDa565bdb085f2
c0466b57ce04
crates/eg-types/src/decision/statistical/harness_config.rs:536
crates/eg-types/src/decision/statistical/harness_config.rs:566
crates/eg-types/src/decision/statistical/harness_config.rs:593
EG-DECISION-ENGINE-R128.4
Named defaults hold the thresholds and are replaceable
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Named defaults hold the thresholds and are replaceable.** `harness_config.rs` must define `HarnessDefaults` with `soft_threshold` 0.6, `hard_threshold` 0.85 and `recent_window_fraction` 0.3. The handler must read a tenant policy override through `resolve_policy` before it uses a default. Each value used must appear as a premise. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::policy_override_replaces_default`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R128.5
Context policy follows budget pressure
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Context policy follows budget pressure.** A pure function `decide_context_policy` must compute pressure as `expected_trajectory_tokens` divided by `contextWindowTokens`. It must return `none` only when the profile window makes overflow impossible for the task class, otherwise `elide_then_summarize` with the `HarnessDefaults` thresholds. A missing window or trajectory estimate must abstain with default `elide_then_summarize`. | Test: `crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs::context_policy_none_only_when_overflow_impossible`
requirementEG-DECISION-ENGINEVERIFIED2e4e94789ddf
crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:27
crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:50
crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:7
crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:78
crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:90
EG-DECISION-ENGINE-R128.6
Plan scaffold follows stopping behaviour
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Plan scaffold follows stopping behaviour.** A pure function `decide_plan_scaffold` must return `on` for `stops_early` (premise: accuracy) and for `over_verifies` (premise: cost). It must return `off` only for `balanced` when the cited evaluation run records a no-gain plan-scaffold ablation. A missing fact must abstain with default `on`. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::plan_scaffold_rules`
requirementEG-DECISION-ENGINEVERIFIED4cd26ef35745
crates/eg-types/src/decision/statistical/harness_config.rs:302
crates/eg-types/src/decision/statistical/harness_config.rs:345
crates/eg-types/src/decision/statistical/harness_config.rs:374
EG-DECISION-ENGINE-R128.7
Action space follows shell proficiency and task class
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Action space follows shell proficiency and task class.** A pure function `decide_action_space` must return `shell_only` only when `shellProficiency` is `high` and the task class is `shellCentric`. Otherwise it must return `tool_set`. A missing `shellProficiency` or `shellCentric` must abstain with default `tool_set`. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::shell_only_needs_both_facts`
requirementEG-DECISION-ENGINEVERIFIEDa565bdb085f2
crates/eg-types/src/decision/statistical/harness_config.rs:639
EG-DECISION-ENGINE-R128.8
The handler reads model and task facts
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The handler reads model and task facts.** A new handler `src/server/handlers/decide/stat_harness_config.rs` must read the model profile by `model_profile_ref` through `ctx.store` (`AgentLibraryStore`, the store `read_candidates` at `candidates.rs:415` uses). It must read `shellCentric` from the task class. An unknown profile reference must refuse with `StatisticalErrorCode::ParameterInvalid`. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::unknown_profile_is_refused`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R128.9
The action-space part reuses the tool-subset selection
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The action-space part reuses the tool-subset selection.** `stat_harness_config.rs` must call `tool_subset::smallest_covering_subset` (`tool_subset.rs:59`) for a `tool_set` result. It must pass the declared candidates and `usable_context_budget_tokens` as the budget. A `ToolSubsetRefusal` must become an abstention on `tool_subset`. A `shell_only` result must carry an empty subset. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::tool_set_reuses_covering_subset`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R128.10
The dispatch hook routes the new kind
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The dispatch hook routes the new kind.** `stat_decide.rs:134` must match `harness_config_outcome(request)` beside `tool_subset_outcome(request)` and seal the result through `seal` (`stat_decide.rs:372`). `Method::Decide` at `src/server/dispatch/router/decision_plane.rs:95` must need no new method variant. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::decide_routes_harness_config`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R128.11
Premises and why-not explain every part
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Premises and why-not explain every part.** The handler must emit one premise per rule input and per default used. It must emit one why-not entry for each rejected option of each part. A part answered by a conservative default must emit a `Claim`-class premise naming the missing fact. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::premises_and_why_not_cover_each_part`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R128.12
The outcome encodes decided and abstained parts
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The outcome encodes decided and abstained parts.** The handler must seal a `StatisticalOutcome::Advisory` (`outcome.rs:101`) with one `ScoredOption` per decided part, using the option id `<part>:<value>`. When every part abstains, it must seal `StatisticalOutcome::Abstained` (`outcome.rs:107`). The record must read `ResolutionKind::Statistical` or `Abstention` accordingly. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::all_parts_abstained_seals_abstention`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R128.13
The committed answer is accepted by the commit path
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The committed answer is accepted by the commit path.** `handle_decision_commit` must accept and re-derive a sealed `harness_config` record without a kind-specific branch. A test must commit the record and read it back with identical premises. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::harness_config_record_commits`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R128.13.1
Typed harness evaluation evidence is part of sealed statistical inputs
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed harness evaluation evidence is part of sealed statistical inputs.** An optional evidence object retains the resolved model-profile dependency, typed request body and complete HarnessConfigAnswer, including per-part abstentions. Absent evidence is omitted from serialization so legacy input and record digests remain unchanged. Commit replay rejects attached evidence even on supported question kinds. Evidence is data for future replay, not authority; the unsupported evaluator and advisory-commit refusals remain in force. | Run typed roundtrip, legacy serialization/digest compatibility and changed-evidence digest tests in the harness-config producer module. Also run `src/server/handlers/decide/stat_tests/harness_config_tests.rs::harness_config_replay_refuses_a_relabelled_generic_record` through native dispatch. It commits the valid route control, then refuses rehashed injected evidence and verifies no mutated record exists. Acceptance requires both test groups to pass on the exact source. No deployed execution is claimed.
requirementEG-DECISION-ENGINEVERIFIEDcfe7d38376a4
crates/eg-types/src/decision/statistical/harness_config.rs:682
crates/eg-types/src/decision/statistical/harness_config.rs:694
src/server/handlers/decide/stat_tests/harness_config_tests.rs:99
EG-DECISION-ENGINE-R128.13.2
Re-derive and persist the complete HarnessConfig answer
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Re-derive and persist the complete HarnessConfig answer.** Preserve R128.13 beyond its evidence type. The shared evaluator must resolve each pinned premise and independently reproduce the complete answer before commit. Commit must reject forged answers, changed premises and unsupported evidence. Read back the stored record with identical premises. This child remains unimplemented; R128.13.1 does not satisfy it. | Planned native regression: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::harness_config_record_commits`, with changed-premise and forged-answer refusal cases. No execution result is claimed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R128.14
The generated contract and clients carry the kind
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The generated contract and clients carry the kind.** `gen_contract` must be rerun so `contract/schemas/method.request.json` and the `result.*.json` schemas list `harness_config` beside `tool_subset`. The Python DTO in `crates/eg-capabilities/src/contract/python/dto.rs` and the JS and Go codecs under `clients/` must regenerate. The `gen_contract --check` step at `.github/workflows/release.yml:210` must pass. | Test: `crates/eg-capabilities/tests/contract_generated.rs::question_kind_lists_harness_config`
requirementEG-DECISION-ENGINEVERIFIEDc7da75413a3c
crates/eg-capabilities/tests/contract_generated.rs:44
EG-DECISION-ENGINE-R128.15
End-to-end proof uses the served path
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**End-to-end proof uses the served path.** A served test must publish a model profile with measured facts, submit `Method::Decide` for `harness_config` over the wire, and assert the answer, premises and the unchanged tool-subset result. A second case must submit a profile without `shellProficiency` and assert the `tool_set` abstention. | Test: `tests/decide/test_harness_config_served.py::test_harness_config_end_to_end`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R129
Promoted rules cannot contradict a stored invariant (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Promoted rules cannot contradict a stored invariant (rollup).** The engine must check every rule promoted from repeated human overrides against stored invariants. Statistical consensus must never promote a rule that contradicts an invariant. | Test: `crates/eg-types/src/decision/guardrail.rs::tests::promotion_obeys_invariants`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R129.1
Locate and wire the attach point
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Locate and wire the attach point.** The implementer must find where a proposal from R034 becomes an active rule and record `file:line` in `plan.md`. | Test: `src/server/handlers/decide/stat_tests/rule_promotion_tests.rs::attach_point_is_reached`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R129.2
Typed `RulePromotionVerdict`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed `RulePromotionVerdict`.** Add `RulePromotionVerdict { Promotable, RejectedInvariant { invariant_iri } }` to `crates/eg-types/src/decision/guardrail.rs`. | Test: `crates/eg-types/src/decision/guardrail.rs::tests::verdict_serialises_snake_case`
requirementEG-DECISION-ENGINEVERIFIEDdcd3f241e93c
crates/eg-types/src/decision/guardrail.rs:215
crates/eg-types/src/decision/guardrail.rs:239
EG-DECISION-ENGINE-R129.3
Pure invariant check
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Pure invariant check.** Add `check_rule_against_invariants(rule, invariants)` to `guardrail.rs`. It must name the first contradicted invariant IRI. | Test: `crates/eg-types/src/decision/guardrail.rs::tests::first_contradicted_invariant_is_named`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R129.4
Consensus gives no override
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Consensus gives no override.** The check must run before any confidence threshold. A rule with full human agreement that contradicts an invariant must still be rejected. | Test: `crates/eg-types/src/decision/guardrail.rs::tests::full_consensus_does_not_override`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R129.5
Wire the check into promotion
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wire the check into promotion.** The promotion path must call `check_rule_against_invariants` and persist a `RejectedInvariant` record for audit. It must not activate the rule. | Test: `src/server/handlers/decide/stat_tests/rule_promotion_tests.rs::rejected_rule_is_audited_not_active`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R129.6
End-to-end proof over the wire
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**End-to-end proof over the wire.** A served test must submit five overrides of a rule that violates a stored invariant and assert rejection. A compatible rule must promote. | Test: `tests/decide/test_rule_promotion_served.py::test_invariant_blocks_promotion`
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R130
Calibrated candidate ranking with item-level tie-break (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Calibrated candidate ranking with item-level tie-break (rollup).** The engine ranks candidates by a calibrated relevance score. Candidates that share one code receive an item-level tie-break score instead of one shared score. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R130.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `RankedCandidate{id, calibrated_score, code, tie_break_score, evidence_class}` and `TieBreakPolicy` in `crates/eg-epistemic/src/ranking.rs`. Closed values of `TieBreakPolicy` are `ItemScore` and `StableId`. Proving test: `crates/eg-epistemic/src/ranking.rs::tests::ranked_candidate_round_trips`. | A serde round trip keeps every field and rejects an unknown policy value.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R130.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Extend `rank` so the calibrated score orders candidates before sequence likelihood. Candidates with equal codes must be ordered by `tie_break_score`. Each rule is a named replaceable default: `calibrated_first` and `item_level_tie_break`. Proving test: `crates/eg-epistemic/src/ranking.rs::tests::equal_codes_order_by_item_score`. | Three candidates with one code and distinct item scores return in item-score order; the same input gives byte-identical output twice.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R130.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The behavior attaches at `crates/eg-epistemic/src/ranking.rs:116` (`rank`). Today only the re-export at `crates/eg-epistemic/src/lib.rs:97` and unit tests reference it. This row creates the call site in the statistical `Decide` path (`crates/eg-compute/src/assemble/conclude.rs`). Proving test: `tests/decide/test_ranked_decide_served.py::test_decide_orders_by_calibrated_score`. | The served `Decide` answer lists options in calibrated order, and a search shows one production caller of `rank`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R130.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** When a candidate lacks a calibrated score, the engine must abstain for that option with reason `uncalibrated_candidate`. It must not substitute a likelihood. Proving test: `crates/eg-epistemic/src/ranking.rs::tests::uncalibrated_candidate_abstains`. | A candidate without a calibration receipt yields a typed abstention, and the ranked list omits it.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R130.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each ranked option must carry `calibrated_score`, `tie_break_applied` and `tie_break_policy` as decision premises in the decision record. The record must state the weakest evidence class of the premises. Proving test: `crates/eg-compute/src/assemble/tests/ranking_premises.rs::premises_name_tie_break`. | The decision record for a tied pair contains `tie_break_applied=true` and the policy name.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R130.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method with a ranking question. The test `tests/decide/test_ranked_decide_served.py::test_tied_codes_resolve_by_item_score` submits tied candidates. It passes through the wired `rank` call and observes the item-score order and the premises in the returned record. | The served answer orders tied candidates by item score and exposes the premises.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R131
Limit guard pipeline refuses an order with a typed reason (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Limit guard pipeline refuses an order with a typed reason (rollup).** The engine checks every proposed action against configured limits first. A breach refuses with a typed reason and records an observation linked to the affected signal. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R131.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `LimitRule{id, metric, bound, scope}` and `LimitBreach{rule_id, observed, bound, signal_iri}` in `crates/eg-types/src/decision/limit_guard.rs`. Closed `metric` values are `position_size`, `drawdown` and `sector_concentration`. Proving test: `crates/eg-types/src/decision/limit_guard.rs::tests::limit_types_round_trip`. | A serde round trip keeps every field and rejects an unknown metric.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R131.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `check_limits(action, rules)` returning every breach in rule order. Each metric check is a named replaceable default, and a request may only tighten a bound. Proving test: `crates/eg-types/src/decision/limit_guard.rs::tests::check_returns_all_breaches`. | An action that breaches two limits returns two breaches; a loosening request bound is ignored.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R131.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The check attaches at `crates/eg-types/src/decision/guardrail.rs:201` (`guardrail_entailment_query`), which already reads the stored rule set. A second call site is created in the `Decide` chokepoint `crates/eg-compute/src/assemble/conclude.rs`, before an option becomes `Advisory`. Proving test: `tests/decide/test_limit_guard_served.py::test_breach_refuses`. | A breaching option never reaches an advisory answer in the served response.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R131.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A breach must return `ResolutionKind::Abstention` with reason `limit_breach` naming the rule id. The engine must not perform the action. Proving test: `crates/eg-compute/src/assemble/tests/limit_refusal.rs::breach_abstains_with_rule_id`. | The abstention names the first breached rule and carries no executable option.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R131.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must store each breach as an observation node. An edge links it to the affected signal. The observation carries `rule_id`, `observed` and `bound`. Proving test: `crates/eg-compute/src/assemble/tests/limit_refusal.rs::breach_observation_links_signal`. | A graph query from the signal returns the breach observation with its three fields.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R131.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method. The test `tests/decide/test_limit_guard_served.py::test_oversize_order_refused_and_recorded` submits an oversize order. It passes through the wired check and observes the typed refusal and the stored observation node. | The served answer refuses with `limit_breach` and the observation exists.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R132
Retrieved entries carry a trust tier and a poisoned-entry check gates premises (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Retrieved entries carry a trust tier and a poisoned-entry check gates premises (rollup).** A retrieved memory or knowledge entry carries provenance and a trust tier. A lower-tier entry must not override a higher-tier fact. A poisoned-entry check must pass before the engine uses an entry as a premise. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R132.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `TrustTier` (closed values `verified`, `attested`, `unverified`) and `EntryTrust{tier, source_digest, observed_at}` in new `crates/eg-types/src/decision/entry_trust.rs`. `PremiseClass` at `crates/eg-types/src/decision/record/premise.rs:17` grades premise strength, not retrieved-entry origin. `Provenance` at `crates/eg-modality/src/provenance.rs:22` holds a confidence only. Proving test: `crates/eg-types/src/decision/entry_trust.rs::tests::entry_trust_round_trips`. | A serde round trip keeps every field and rejects an unknown tier.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R132.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `admit_entries(entries, policy)` in `entry_trust.rs`. An entry of a lower tier must not replace a higher-tier entry on the same subject and fact key. Each rule is a named replaceable default: `tier_order` and `poison_check`. `poison_check` refuses an entry whose source digest is absent from the source record. It also refuses an unverified entry that contradicts a verified fact. The monotone rule at `crates/eg-types/src/decision/ingestion_ladder.rs:46` (`resolve_rung`) is the pattern to reuse. Proving test: `crates/eg-types/src/decision/entry_trust.rs::tests::lower_tier_never_overrides_higher`. | A verified fact survives an unverified contradiction. An entry with an unknown source digest is refused.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R132.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** `admit_entries` attaches in `crates/eg-compute/src/assemble/conclude.rs:180`, where premises are built from the required capabilities, before any retrieved entry becomes a premise. The caller is `decide_one` at `conclude.rs:93`, reached from `conclude.rs:87` and `template.rs:74`, and served by `handle_decide` at `src/server/handlers/decide/stat_decide.rs:48`. No production caller of `resolve_rung` exists today. The trust check creates the call site at `conclude.rs:180`. Proving test: `crates/eg-compute/src/assemble/tests/entry_trust_wiring.rs::admit_runs_before_premises`. | The served `Decide` path calls `admit_entries` once per decision.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R132.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A refused entry must not become a premise. When a required premise has only refused entries, the engine must abstain with `AbstainReason::PoisonedEntry` naming the entry id and the failed check. `AbstainReason` is exported from `crates/eg-types/src/decision/record/outcome.rs`. Proving test: `crates/eg-compute/src/assemble/tests/entry_trust_refusal.rs::poisoned_only_premise_abstains`. | The abstention names the entry id and carries no executable option.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R132.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** `PremiseRef` at `crates/eg-types/src/decision/record/premise.rs:89` gains an optional `trust_tier`. The engine must record each refused or overridden entry in the decision record with its tier and check name. Replay must reproduce the same record. Proving test: `crates/eg-compute/src/assemble/tests/entry_trust_refusal.rs::refused_entries_are_recorded`. | The record lists every refused entry with tier and check name.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R132.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method. The test submits a decision whose candidate set holds a verified fact and an unverified contradicting entry. It passes through the wired check at `conclude.rs:180` and observes that the verified fact is the premise and the unverified entry is recorded as refused. Proving test: `tests/decide/test_entry_trust_served.py::test_unverified_entry_cannot_override_verified`. | The served answer uses the verified fact and lists the refused entry.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R133
The engine stores each agent run as a trace fact and decides its runtime quotas (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The engine stores each agent run as a trace fact and decides its runtime quotas (rollup).** The engine stores an execution trace for each agent run as a typed fact. The engine decides the wall time, memory, process count and grace period of a run and hands them to the harness. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R133.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `RunTraceRecord{run_id, task_signature, steps, outcome, started_at}` and `RuntimeQuota{wall_time_ms, memory_bytes, process_count, grace_ms}` in new `crates/eg-types/src/decision/run_governance.rs`. Add `QuestionKind::RuntimeQuota` at `crates/eg-types/src/decision/statistical.rs:58`. Proving test: `crates/eg-types/src/decision/run_governance.rs::tests::quota_round_trips`. | A serde round trip keeps every field and rejects an unknown field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R133.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add the pure function `decide_runtime_quota(task_class, policy, request)` in `run_governance.rs`. For each field resolve an effective default D and hard tenant ceiling C with D <= C. Named replaceable `QuotaDefaults` are `wall_time_ms` 600000, `memory_bytes` 2147483648, `process_count` 32 and `grace_ms` 10000. First refuse any requested R > C; otherwise use min(D, R), or D when omitted. Increases above D through C are ignored and reductions below D tighten the quota. Proving test: `crates/eg-types/src/decision/run_governance.rs::tests::request_only_tightens_quota`. | For D=10 and C=20, omission returns 10, R=5 returns 5, R=15 and R=20 return 10, and R=21 refuses before clamping.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R133.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; a new `runtime_quota_outcome` is matched beside it. The caller is `Method::Decide` through `handle_decide` at `stat_decide.rs:48`. `Decide` remains read-only. A separate served `CommitWorkItemResult` reuses `lower_terminal_outcome_extensions` in `src/server/mutation_batch/terminal_outcome.rs:22` and `apply_commit_work_item_result_row` in `src/redb_store/work_item/commit.rs:211`; trace receipts and their produced link may materialize only after the successful fenced terminal CAS in the same transaction. `RunTraceRecord` adaptation and produced-link materialization are new work; `outcome_bundle.rs:56` is a participant-domain constant, not a write call. Proving test: `src/server/handlers/decide/stat_tests/runtime_quota_tests.rs::decide_routes_runtime_quota`. | The served `Decide` answer for `RuntimeQuota` returns the four values.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R133.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A quota request above any hard tenant ceiling must refuse with `StatisticalErrorCode::ParameterInvalid` before clamping or missing-task fallback. A missing task class must abstain with the effective defaults D (resolved under C) and a `Claim`-class premise naming the missing fact. Proving test: `src/server/handlers/decide/stat_tests/runtime_quota_tests.rs::missing_task_class_abstains_to_default`. | The abstention carries effective defaults and names the missing task class; an above-ceiling request still refuses when the task class is missing.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R133.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The terminal commit must adapt `RunTraceRecord` into a `RunTrace` receipt and materialize its execution-unit `produced` link after the fenced terminal CAS in `src/redb_store/work_item/commit.rs:343`. Reuse the pure node/edge descriptors from `project` at `crates/eg-durable/src/project.rs:68`; adaptation and link materialization are new, and `project` performs no writes. Each decided quota value must appear as a premise, and each default used must be named. Proving test: `src/redb_store/work_item/commit.rs::tests::run_trace_is_linked_to_unit`. | After a successful terminal commit, a graph query from the execution unit returns the trace node; a fenced refusal, no-op or retry scheduling creates no trace or link. The decision record lists each default used.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R133.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The test `tests/decide/test_runtime_quota_served.py::test_quota_and_trace_end_to_end` first queries quotas through served `Decide` with a `RuntimeQuota` question, then commits the run summary through served `CommitWorkItemResult` with the terminal outcome extension. It inspects quota premises and queries the persisted execution-unit-to-trace link after the fenced terminal commit. Proving test: `tests/decide/test_runtime_quota_served.py::test_quota_and_trace_end_to_end`. | Decide returns tightened quotas without a trace write; the subsequent successful CommitWorkItemResult stores the trace and produced link, while an invalid fence stores neither.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134
The engine selects tools, decomposes tasks and plans over the skill library (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The engine selects tools, decomposes tasks and plans over the skill library (rollup).** The engine chooses the tools for a run by relevance search over the fleet catalog. It decomposes a task into independent subtasks, routes each to a specialist and picks the aggregation operator. It plans over the skill library from skill metadata only. Children `.1` to `.8` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `Subtask{id, text, independent, depends_on}`, `AggregationOp` (closed values `concat`, `majority_vote`, `reduce`, `first_valid`), `SkillStep{subtask_id, skill_id, depends_on}` and `TaskPlan` in new `crates/eg-types/src/decision/task_plan.rs`. Add `QuestionKind::ToolRelevance` and `QuestionKind::TaskPlan` at `crates/eg-types/src/decision/statistical.rs:58`. Proving test: `crates/eg-types/src/decision/task_plan.rs::tests::task_plan_round_trips`. | A serde round trip keeps every field and rejects an unknown aggregation value.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `rank_tools_by_relevance(query, catalog, required_capabilities, context_budget_tokens, policy)` in `task_plan.rs`. First filter by `relevance_floor`, rank descending by relevance with tool-id ties, and retain `top_k` candidates. Then pass those candidates and the explicit required capabilities and token budget to the existing R045 `smallest_covering_subset` at `crates/eg-types/src/decision/statistical/tool_subset.rs:59`. Its selection remains greedy uncovered-capability gain per token, then lower token cost and tool id; relevance is a prefilter, not the subset objective. Preserve its coverage/budget refusals after filtering. The defaults are `top_k` 12 and `relevance_floor` 0.2. The existing code to move is `agent_utilities/capabilities/fleet_tool_search.py:54`. Proving test: `crates/eg-types/src/decision/task_plan.rs::tests::relevant_tools_fit_budget`. | Assert floor/top-k filtering first, then the exact R045 coverage-per-token selection and deterministic cost/id ties within the budget. Include a lower-relevance retained tool that wins on coverage per token and a filtered catalog that cannot cover required capabilities; do not assert relevance optimality.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.3
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `decompose_task(task, facts, policy)` in `task_plan.rs`. It returns subtasks, routes each to a specialist, sets `independent` per subtask and chooses an `AggregationOp`. `TopologyRequirements.subtasks` at `topology.rs:110` receives the independent count. Each rule is a named replaceable default: `independence_test` and `default_aggregation`. The existing code to move is `agent_utilities/graph/planning/__init__.py:165`. Proving test: `crates/eg-types/src/decision/task_plan.rs::tests::independent_subtasks_set_flag_and_operator`. | Two independent subtasks yield `independent=true` for both and a `majority_vote` or `concat` operator.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.4
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `plan_over_skills(query, skill_index, policy)` in `task_plan.rs`. It decomposes the query into atomic subtasks. It retrieves one skill per subtask from skill metadata only. It merges or splits subtasks when the retrieved skills show a different granularity. It orders steps by `depends_on`. The existing code to move is `agent_utilities/decide/consumers/task_planner.py:211`. Proving test: `crates/eg-types/src/decision/task_plan.rs::tests::plan_respects_dependencies`. | Every step appears after the steps it depends on, and each step names one skill.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.5
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The decisions attach in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; `tool_relevance_outcome` and `task_plan_outcome` are matched beside it. The topology question is already posed at `crates/eg-compute/src/assemble/topology.rs:54` (`pose`), called from `conclude.rs:99`. The skill index is read through `AgentLibraryStore` at `src/server/handlers/decide/candidates.rs:415`. The match arms create the call site. Proving test: `src/server/handlers/decide/stat_tests/task_plan_tests.rs::decide_routes_task_plan`. | The served `Decide` answer for each new kind returns a typed plan or tool list.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.6
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A subtask with no skill above `relevance_floor` must abstain with `no_skill_for_subtask` naming the subtask id. A dependency cycle must refuse with `plan_cycle`. An empty catalog must abstain with `empty_catalog`. Proving test: `src/server/handlers/decide/stat_tests/task_plan_tests.rs::uncovered_subtask_abstains`. | The abstention names the first uncovered subtask and carries no plan.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.7
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit one premise per subtask holding the chosen skill, its relevance score and the independence flag. It must emit the aggregation operator and the default used as premises. The record must state the weakest evidence class. Proving test: `src/server/handlers/decide/stat_tests/task_plan_tests.rs::premises_name_skill_and_flag`. | The decision record lists skill, score and flag for every subtask.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.8
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method with a `TaskPlan` question. The test `tests/decide/test_task_plan_served.py::test_plan_end_to_end` publishes a skill index and submits a query. It passes through the wired dispatch and observes the ordered steps, the flags and the aggregation operator. Proving test: `tests/decide/test_task_plan_served.py::test_plan_end_to_end`. | The served answer returns dependency-ordered skill steps with premises.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135
A successful run compiles into a stored program keyed by task signature (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**A successful run compiles into a stored program keyed by task signature (rollup).** The engine compiles a successful run into a stored state-machine program keyed by task signature. Literals become parameters, and a program holds at most 40 steps. The engine returns a program by task signature. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `CompiledProgram{task_signature, steps, parameters, source_run_id}`, `ProgramStep{state, action, next}` and `MAX_PROGRAM_STEPS` (40) in new `crates/eg-types/src/decision/program_store.rs`. Add `QuestionKind::ProgramLookup` at `crates/eg-types/src/decision/statistical.rs:58`. Proving test: `crates/eg-types/src/decision/program_store.rs::tests::program_round_trips`. | A serde round trip keeps every field and rejects a program with more than 40 steps.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `compile_program(trace, policy)` in `program_store.rs`. It replaces each literal in the trace with a named parameter and keeps the step order. The named replaceable defaults are `max_steps` 40 and `literal_to_parameter`. `lookup_program(store, task_signature)` returns the stored program or none. The existing code to move is `agent_utilities/observability/replay_engine.py:48`. Proving test: `crates/eg-types/src/decision/program_store.rs::tests::literals_become_parameters`. | Two traces that differ only in literals compile to one program with parameters.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The lookup attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `program_lookup_outcome` is matched beside `tool_subset_outcome`. Programs are stored through `AgentLibraryStore`, the store `read_candidates` uses at `src/server/handlers/decide/candidates.rs:415`. The commit path is `handle_decision_commit`. The match arm and the store write create the call site. Proving test: `src/server/handlers/decide/stat_tests/program_store_tests.rs::decide_routes_program_lookup`. | The served `Decide` answer for `ProgramLookup` returns the stored program.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A run that did not succeed must refuse with `run_not_successful`. A trace that compiles to more than 40 steps must refuse with `program_too_long`. A lookup with no stored program must abstain with `no_program`. Proving test: `src/server/handlers/decide/stat_tests/program_store_tests.rs::overlong_trace_is_refused`. | The refusal names the reason and the step count, and nothing is stored.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit premises for the task signature, the step count, the parameter count and the source run id. A stored program must link to its source `RunTrace` node from `EG-DECISION-ENGINE-R133`. Proving test: `src/server/handlers/decide/stat_tests/program_store_tests.rs::program_links_source_trace`. | A graph query from the program returns its source trace node.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method with a `ProgramLookup` question. The test `tests/decide/test_program_store_served.py::test_compile_then_lookup` commits a successful trace, then looks up its signature. It passes through the wired dispatch and observes the stored program with parameters. Proving test: `tests/decide/test_program_store_served.py::test_compile_then_lookup`. | The second call returns the program committed by the first.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136
The engine gives the round verdict and allocates models per evolution stage (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The engine gives the round verdict and allocates models per evolution stage (rollup).** The engine compares the next round's task outcomes with the declared prediction and returns a verdict. The engine allocates a model to each evolution stage under a run budget and hands the harness the allocation and the limit. Children `.1` to `.7` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `PredictionDeclaration{round, fixes, regressions}`, `RoundVerdict` (closed values `verified`, `falsified`, `unverified`) and `EvolutionDefaults{rounds, flip_fraction}` in new `crates/eg-types/src/decision/evolution_round.rs`. Add `StageAllocation{stage, model_ref, impact}` and `RunBudget{max_cost, max_stronger_stages}`. Add `QuestionKind::RoundVerdict` and `QuestionKind::StageAllocation` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/evolution_round.rs::tests::round_types_round_trip`. | A serde round trip keeps every field and rejects an unknown verdict.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `decide_round_verdict(prediction, outcomes, defaults)` in `evolution_round.rs`. Evaluate declared-direction and opposite-direction fractions separately against `flip_fraction`. Return `verified` only when the declared-direction threshold alone is met; return `falsified` only when the opposite-direction threshold alone is met. If both thresholds or neither threshold is met, return `unverified`. The defaults are `rounds` 1 and `flip_fraction` 0.5. Proving test: `crates/eg-types/src/decision/evolution_round.rs::tests::verdict_follows_flip_fraction`. | At flip_fraction=0.5, six of ten flipping as declared and four opposite yields `verified`; four as declared and six opposite yields `falsified`; five each yields `unverified`. Neither threshold met also yields `unverified`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.3
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `allocate_stage_models(stages, models, budget)` in `evolution_round.rs`. It gives a stronger model only to the highest-impact stages while the cost stays within `max_cost`. Every other stage gets the cheapest adequate model. The named replaceable default is `impact_first`. The existing code to move is `agent_utilities/decide/consumers/routing.py:58`. Proving test: `crates/eg-types/src/decision/evolution_round.rs::tests::stronger_models_go_to_high_impact_stages`. | With a budget for one stronger stage, only the top-impact stage gets the stronger model.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.4
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Both decisions attach in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; `round_verdict_outcome` and `stage_allocation_outcome` are matched beside it. The caller is `Method::Decide` through `handle_decide` at `stat_decide.rs:48`. Model facts come from the model profile read at `candidates.rs:415`. The match arms create the call site. Proving test: `src/server/handlers/decide/stat_tests/evolution_round_tests.rs::decide_routes_round_kinds`. | The served `Decide` answer for each kind returns a typed verdict or allocation.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.5
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A prediction with no declared tasks must abstain with `no_prediction`. A budget below the cheapest allocation must refuse with `budget_below_minimum` naming the shortfall. A missing impact estimate must abstain to the cheapest adequate model. Proving test: `src/server/handlers/decide/stat_tests/evolution_round_tests.rs::empty_prediction_abstains`. | The abstention names the missing input and carries no verdict.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.6
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit premises for the flip fraction used, the counts of tasks that flipped each way and the verdict. For an allocation it must emit the budget, the cost and each stage's impact. Defaults used must be named. Proving test: `src/server/handlers/decide/stat_tests/evolution_round_tests.rs::premises_name_counts_and_budget`. | The decision record lists the counts, the budget and each default used.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.7
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method with a `RoundVerdict` question, then a `StageAllocation` question. The test `tests/decide/test_evolution_round_served.py::test_verdict_and_allocation` submits a prediction with outcomes and a stage list. It passes through the wired dispatch and observes the verdict and the allocation within the budget. Proving test: `tests/decide/test_evolution_round_served.py::test_verdict_and_allocation`. | The served answers return the verdict and an allocation within the limit.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137
The engine decides the context budget and the limits of recursive parallel work (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The engine decides the context budget and the limits of recursive parallel work (rollup).** The engine decides the context policy, the window budget and the over-window margin. It decomposes an over-window prompt recursively under a depth and cost budget. It fixes the depth, item, cost and model-call limits of parallel-map work. Children `.1` to `.6` retain those obligations. Children `.7` to `.12` add certified multi-resolution context-package selection under window, reserved output, caller, monetary and latency budgets. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `ParallelMapLimits{max_depth, max_items, max_cost, max_model_calls}`, `WindowBudget{window_tokens, over_window_fraction}` and `OverWindowPlan{exceeds, chunks, depth}` in new `crates/eg-types/src/decision/context_budget.rs`. Add `QuestionKind::ContextBudget` at `statistical.rs:58`. `ContextPolicy` at `crates/eg-types/src/decision/statistical/harness_config.rs:81` is reused. Proving test: `crates/eg-types/src/decision/context_budget.rs::tests::context_budget_round_trips`. | A serde round trip keeps every field and rejects an unknown field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `decide_over_window(prompt_tokens, budget, limits)` in `context_budget.rs`. The prompt exceeds the window when `prompt_tokens` passes `over_window_fraction` of `window_tokens`. The plan then splits the prompt into chunks, depth by depth, until each chunk fits or `max_depth` or `max_cost` is reached. The named replaceable defaults are `over_window_fraction` 0.8, `max_items` 1000, `max_depth` 3 and `max_model_calls` 1000. The existing code to move is `agent_utilities/rlm/config.py:60` and `agent_utilities/knowledge_graph/retrieval/context_knapsack.py:422`. Proving test: `crates/eg-types/src/decision/context_budget.rs::tests::over_window_prompt_is_split_within_limits`. | A prompt at 0.9 of the window yields a plan whose chunks each fit and whose depth stays within the limit.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; `context_budget_outcome` is matched beside it. The context policy comes from the `harness_config` decision of `EG-DECISION-ENGINE-R128.5`. The window comes from the model profile read at `candidates.rs:415`. The match arm creates the call site. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::decide_routes_context_budget`. | The served `Decide` answer for `ContextBudget` returns the policy, the budget and the plan.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A prompt that cannot fit within `max_depth` and `max_cost` must refuse with `budget_exhausted` naming the limit reached. A work list above `max_items` must refuse with `too_many_items`. A missing window size must abstain with the policy default. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::too_many_items_is_refused`. | The refusal names the limit and the observed count, and carries no plan.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit premises for the window, the prompt size, the fraction used and each limit applied. Each default used must be named. The record must state the weakest evidence class. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::premises_name_window_and_limits`. | The decision record lists the window, the fraction and every default used.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method with a `ContextBudget` question. The test `tests/decide/test_context_budget_served.py::test_over_window_plan_end_to_end` publishes a model profile and submits an over-window prompt size. It passes through the wired dispatch and observes the plan and the limits handed to the harness. Proving test: `tests/decide/test_context_budget_served.py::test_over_window_plan_end_to_end`. | The served answer returns a chunk plan within the limits.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.7
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Extend the planned `crates/eg-types/src/decision/context_budget.rs` with typed package records. `ContextPackageCandidate` carries a stable candidate id, evidence-unit/resolution group, resolution, source id and cited range. It also carries source revision/content digest, tokenizer identity/version, exact measured token weight, value and measurement provenance. `ContextPackageBudget` carries window tokens, reserved output tokens and an optional caller token ceiling. It carries monetary ceiling, per-input-token price, latency ceiling and token throughput with units and known/unknown facts. `ContextPackageSelection` carries chosen candidate ids, effective capacity, token/cost/latency totals, objective, input/model/certificate digests and verified status. The request includes the marginal value floor and deterministic solver budget. These are planned records, not existing wire fields. Proving test: `crates/eg-types/src/decision/context_budget.rs::tests::package_records_round_trip`. | Round trips preserve every constraint, source/range/revision and measurement identity. Validation rejects duplicate candidate ids, inconsistent resolution groups and malformed ranges. Negative/nonfinite measurements and arithmetic overflow refuse before solving.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.8
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Lower package candidates to the existing bounded 0-1 solver model under R014. Select at most one resolution per evidence unit. Limit total exact token weight to `max(0, min(window - reserved_output, caller_ceiling, floor(money / price), floor(latency * throughput)))`. Include each optional ceiling only when supplied and its required facts are known. Use checked, unit-normalized arithmetic and round capacity downward to whole tokens without exceeding any ceiling. A known zero price makes monetary capacity unbounded. Known zero throughput makes latency capacity zero. Missing rates for active ceilings remain unknown under R018. Preserve the source objective: maximize summed net value `round_ties_even((value - floor_per_token * weight) * 1_000_000)`, then minimize total tokens. Record scale/rounding and stable candidate order. Reuse `crates/eg-compute/src/solve/model/` constraint primitives and `solve::solve`; add no selector authority. Proving test: `crates/eg-compute/src/solve/tests/context_package.rs::matches_tiny_multiresolution_oracle` (planned). | Exhaustive tiny models match the optimum and fewer-token tie-break. Independent window, output reservation, caller, money and latency cases each become the tightest bound; fractional and zero-capacity boundaries never overrun. Changing candidate order must not change objective or totals; remaining ties use the recorded stable order.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.9
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend the planned `ContextBudget` arm beside `tool_subset_outcome` in `src/server/handlers/decide/stat_decide.rs:134` to accept package records. Lower and solve them through the existing EG solver. Independently verify the certificate before sealing the served `Decide` result. Reuse R004/R049 through `crates/eg-compute/src/solve/search/mod.rs:29` and `crates/eg-compute/src/solve/verify/mod.rs:23`. Preserve existing tenant, policy, candidate visibility and record-sealing checks. The current dispatch lacks this arm. A generic `Solve` response is not the completed `ContextBudget` contract. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::decide_routes_package_selection` (planned). | An authenticated served `Decide` request reaches package lowering, solver, independent verifier and sealed typed answer. The test rejects an unwired helper or local selection that replaces any step. Package selection, whole-prompt fit and R137.1–.6 recursive decomposition remain distinct operations.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.10
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The planned package handler in `src/server/handlers/decide/stat_decide.rs` returns typed outcomes naming the candidate, fact or bound. Outcomes include `invalid_measurement`, `missing_required_fact`, `no_admissible_package`, `stale_source`, `work_budget_exhausted` and `certificate_unacceptable`. They carry no certified package. Missing tokenizer/mandatory window, missing rates for active ceilings and unknown objective facts cannot become zero or estimates (R018). An empty selection abstains. Exhausted deterministic search preserves R011 unresolved/gap evidence. Only an independently verified optimal result with zero gap satisfies this package's certified optimum acceptance. A greedy fallback or feasible incumbent alone cannot qualify as certified. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::package_refusals_are_typed` (planned). | Negative cases cover invalid/missing measurements, no fitting nonempty package, empty/zero-capacity results and stale revisions. Work exhaustion tests cover no incumbent and unacceptable gaps. Certificate tests corrupt the proof, digests and selection bindings. No refusal silently relaxes a ceiling or returns a certified selection.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.11
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Extend the planned `context_budget.rs` package result and the `stat_decide.rs` sealed record. Bind the complete candidate universe, including unchosen resolutions, with source/range/revision and content digests. Bind tokenizer measurements/provenance, full original budget, derived capacity and objective/rounding policy. Bind solver configuration/version, model digest and independently checked certificate digest/status. Recompute chosen token, monetary and latency totals from those inputs. Totals unavailable because an unused rate is unknown stay explicitly unknown. The consumer contract is AU-CONTEXT-R004: apply the exact chosen ids/resolutions without reranking or substituting content, and retain citations. A changed source or budget requires a fresh decision. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::package_evidence_binds_inputs` (planned). | Changes to unchosen candidates, token weights, tokenizer, cited ranges or revisions invalidate reuse. So do changes to active rates, output reservation, ceilings or objective. Independent recomputation checks selection, totals and certificate against the bound model. The record states the weakest evidence class and all defaults used.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.12
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Add `tests/decide/test_context_package_served.py::test_certified_package_end_to_end`. Enter the real served `Decide` method with a `ContextBudget` package request. Observe the typed, verified selection through the R137.9 dispatch. Cross-repository acceptance depends on AU-CONTEXT-R004's served context-compile consumer applying that result unchanged. Source/range/revision citations must survive. Link its public receipt; the consumer implementation belongs to its owner. A tiny multi-resolution exhaustive oracle proves optimality and fewer-token ties. Isolate each capacity and refusal from R137.8/R137.10. Proving test: `tests/decide/test_context_package_served.py::test_certified_package_end_to_end` (planned). | The EG served receipt records source SHA, features/configuration, exact command, input/model/certificate digests and results. The linked AU receipt records its SHA, served caller and applied package/citations. Cover reserved output, monetary/latency ceilings, caller/window limits, fractional rounding, zero capacity, unknown rates, stale sources and rejected certificates. Unit-only solves, mock transports, greedy fits, planned test names and documentation commits do not establish this proof.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R138
The engine holds red-team records and returns a verdict for each probe (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**The engine holds red-team records and returns a verdict for each probe (rollup).** The engine holds the red-team attack, transform and scorer records. It selects scorers for each probe and returns the verdict. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R138.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `RedTeamAttack{id, category, goal}`, `RedTeamTransform{id, kind}`, `RedTeamScorer{id, category, threshold}` and `ProbeVerdict` (closed values `resisted`, `compromised`, `inconclusive`) in new `crates/eg-types/src/decision/red_team.rs`. Add `QuestionKind::ProbeVerdict` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/red_team.rs::tests::red_team_records_round_trip`. | A serde round trip keeps every field and rejects an unknown verdict.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R138.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `select_scorers(attack, scorers, policy)` and `decide_probe_verdict(results, policy)` in `red_team.rs`. A scorer is selected when its category matches the attack category. The verdict is `compromised` when any selected scorer passes its threshold, `resisted` when all fail it, otherwise `inconclusive`. The named replaceable defaults are `category_match` and `any_scorer_compromises`. The existing code to move is `agent_utilities/harness/reliability_scorers.py:1`. Proving test: `crates/eg-types/src/decision/red_team.rs::tests::one_passing_scorer_compromises`. | One passing scorer among three yields `compromised`; three failing scorers yield `resisted`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R138.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; `probe_verdict_outcome` is matched beside it. The records are stored and read through `AgentLibraryStore`, the store `read_candidates` uses at `src/server/handlers/decide/candidates.rs:415`. The match arm and the record store create the call site. Proving test: `src/server/handlers/decide/stat_tests/red_team_tests.rs::decide_routes_probe_verdict`. | The served `Decide` answer for `ProbeVerdict` returns the selected scorers and the verdict.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R138.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A probe whose attack category has no scorer must abstain with `no_scorer_for_category` naming the category. A scorer result with a missing score must count as `inconclusive`, not as `resisted`. Proving test: `src/server/handlers/decide/stat_tests/red_team_tests.rs::missing_scorer_abstains`. | The abstention names the category and carries no verdict.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R138.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit one premise per selected scorer holding its score and threshold. It must emit the attack and transform ids. The record must state the weakest evidence class. Proving test: `src/server/handlers/decide/stat_tests/red_team_tests.rs::premises_name_scorers_and_scores`. | The decision record lists each scorer with score and threshold.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R138.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method with a `ProbeVerdict` question. The test `tests/decide/test_red_team_served.py::test_probe_verdict_end_to_end` publishes attack, transform and scorer records and submits probe results. It passes through the wired dispatch and observes the selected scorers and the verdict. Proving test: `tests/decide/test_red_team_served.py::test_probe_verdict_end_to_end`. | The served answer returns the verdict with premises for each scorer.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R139
Comparative-analysis plan producer (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Comparative-analysis plan producer (rollup).** EG emits a revision-pinned plan for zero-model vector discovery, selective synthesis in one or two model-service calls, and high-weight-only deep extraction. Every stage has an explicit call budget and the plan has a total ceiling. EG returns a plan and premises; AU owns generation and the separate invocation receipt. R080.1 and R136.3 are adjacent reusable mechanisms, not comparative-analysis coverage. | Served `Method::Decide` returns the plan with zero model calls during discovery; AU invokes only budgeted synthesis/extraction. Stale inputs and exhausted budgets refuse before a later call.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R139.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `ComparativeAnalysisRequest`, `ComparativeCandidate{candidate_id, candidate_revision, score, importance}`, `ComparativeAnalysisStage`, `ComparativeStageBudget`, `ComparativeAnalysisPlan`, `ComparativeAnalysisRefusal` and `ComparativeAnalysisEvidence`; add `QuestionKind::ComparativeAnalysisPlan` serialized as `comparative_analysis_plan`. Define `ComparativeAnalysisPlan` fields `plan_digest`, `tenant_id`, `space_id`, `space_revision`, `query_vector_digest`, `unified_query_result_digest`, `candidates`, `policy_version`, `synthesis_importance_threshold`, `extraction_importance_threshold`, `stage_budgets` and `total_call_ceiling`. Each ordered candidate has `candidate_id`, `candidate_revision`, `score` and `importance`. Each ordered stage budget has `stage` and `max_calls`. Reuse the existing 64-candidate decision limit. The EG plan contains no generated text or AU execution receipt. | Round-trip every binding, candidate, threshold, stage budget and question kind; reject malformed, duplicate and over-limit candidates.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R139.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Reuse only caller-supplied, revision-pinned vectors and completed `UnifiedQuery` results; discovery makes exactly zero model-service calls and does not synthesize embeddings. Preserve visible-candidate stable order. Versioned defaults select synthesis candidates at normalized importance `>= 0.50` and extraction candidates at `>= 0.80`. Budgets are discovery `0`, synthesis `1` or `2`, extraction `0–64`; stage sums must fit an explicit total ceiling. The AU caller must not retry implicitly or issue an unbudgeted subcall. | Prove zero-call discovery, inclusive thresholds, stable ties, one/two-call synthesis, high-weight-only extraction, and refusal before it crosses a stage or total budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R139.3
Wiring and authority
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring and authority.** Add the question to public `Method::Decide`: wire dispatch -> `src/server/handlers/decide/statistical.rs::handle_decide` -> `src/server/handlers/decide/stat_decide.rs::handle_decide`. EG validates pinned inputs and returns only a plan/refusal; it never invokes a model or treats AU output as EG-produced. AU may invoke only after plan receipt, at its existing `agent_utilities/knowledge_graph/retrieval/context_compiler_serving.py::compiled_chat_completion` boundary. `AU-HARNESS-R024.3` trace digests do not establish a comparative-analysis consumer contract. | Actual Decide dispatch returns a plan without calling a model transport. Current AU main defines no R139 consumer or receipt at this boundary. The pending dependency is reserved as `AU-SEMANTIC-R030` and `.1`–`.6` in `specs/au-semantic-client`; its owner must define and serve-test it.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R139.4
Typed refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed refusal.** Before returning a consumable plan, refuse missing/stale query inputs or candidate revisions; invisible, malformed, duplicate or over-limit candidates; importance outside `[0,1]`; invalid threshold ordering; absent/invalid stage budgets; and stage sums above total. A stage that cannot fit its remaining ceiling refuses with stage, requested and remaining calls. Never clamp, return a partial plan or make a model call on refusal. | Served negative cases cover stale bindings, invalid values, and each stage/total exhaustion; observe typed refusal and zero model calls.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R139.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind plan digest to tenant/space revision, query-vector/result digests, exact visible candidate IDs/scores/weights/order, policy and thresholds, and stage/total budgets. The proposed AU receipt fields are `plan_digest`, `run_id`, `caller_id`, `actual_stage_calls` (ordered `{stage, call_count}` entries), `request_digest`, `result_digest`, `status` (`completed` or `refused`) and `refusal_code` (refusal only; `result_digest` is absent on refusal). AU validates each stage and total ceiling. EG records premises and plan only and cannot mint or attest this receipt. | Mutating a bound input changes the plan digest; AU receipt validation rejects a mismatched plan or calls above budget. EG stores no generated output and makes no claim about AU execution evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R139.6
Served acceptance
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Served acceptance.** Exercise the authenticated EG `Method::Decide` producer positively and with stale/over-budget refusals, then exercise the separate served AU consumer receiving the plan and invoking its configured service only within synthesis/extraction budgets. Use the real adapters, not only the pure planner. Preserve R080.1/R136.3 as adjacent mechanisms. | EG: `tests/decide/test_comparative_analysis_served.py::test_plan_and_refusal_through_served_decide`. AU: `tests/decide/test_comparative_analysis_consumer.py::test_served_consumer_obeys_plan_and_binds_invocation_receipt`. The AU consumer and receipt remain pending the reserved `AU-SEMANTIC-R030` definition and owner-served test. Both exact source SHAs and receipts are required for an end-to-end claim.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.101
Grounded topic coverage and probability-scored unsupported claims
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Grounded topic coverage and probability-scored unsupported claims.** Extend `DecisionEval` with `GroundedAnswerSubmit` and `GroundedAnswerEvaluationV1`. Bind corpus/query/answer/claim/citation revisions and digests. Record scope (`single_document`, `local_multi_document`, `global_corpus`), evaluator/policy revisions and independent label-set revision/digest. Each query carries a nonempty `ExpectedTopicSetV1` of unique required topic ids. For each expected topic, bind answer claim ids mapped to it and per-claim/per-citation support votes. A topic is covered only when a mapped answer claim cites a source labeled supporting. Its valid support-vote fraction must meet `minimum_topic_support_probability`. Fewer than `minimum_valid_votes` refuses scoring. Return exact `expected_topic_ids` and `covered_topic_ids`. Per scope, coverage is `sum(|covered_topic_ids|) / sum(|expected_topic_ids|)` over the complete pinned query set, not an average of per-query ratios. Require exactly one `GroundedClaimPredictionV1` per scored claim. Bind claim/answer/input digests and pinned scorer id/revision/artifact digest. The scorer cannot access evaluation labels. It supplies fixed-point predicted unsupported probability `p_i` in [0,1]. Independently labeled votes bind unique annotator refs and `unsupported_votes`/`supported_votes`. Set target `q_i = unsupported_votes / valid_votes_i`. `C` is the complete required claim set. Each claim needs exactly one prediction and at least one valid independent vote. Missing/extra claims or predictions, duplicate annotator votes, empty `C`, or zero total vote weight refuses before scoring. Report weighted soft-label Brier score `sum(valid_votes_i * (p_i - q_i)^2) / sum(valid_votes_i)` for `i ∈ C`, with numerator, positive denominator `sum(valid_votes_i)`, fixed-point precision and one final rounding rule bound to policy. Label votes never stand in for detector predictions. Preserve R100's independent-outcome hard-negative join. `Method::UnifiedQuery` supplies retrieved evidence and `Method::DecisionEval` seals the receipt. The scorer and AU answer/topic/label producers must bind their independent provenance. WebUI remains a consumer. Source objective EG:18 SHA-256 `d978b4b4201059c2e7bcc7a78def0d5845cf7db1e361f2f50ee57f8bcc5733ae`. | Serve fixtures with known expected/covered topic sets and non-unanimous labels. Independently recompute each scope's summed topic numerator and denominator. Recompute weighted Brier numerator and positive vote denominator from distinct predictions and votes. Hold labels fixed and vary only `p_i`. The Brier score must change by the formula while topic coverage remains constant. Refuse empty query, topic or claim sets. Refuse missing/extra predictions or labels, duplicate annotator refs, zero vote denominator or probabilities outside [0,1]. Also refuse label access by the scorer and stale answer/corpus/evidence/scorer/evaluator/policy revisions or digests. Read back exact prediction, label, topic-set and score bindings. AU/scorer producer receipts remain separately required. No implementation is claimed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R001.100
Quantitative physical/safety bounds before recommendation surfacing
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Quantitative physical/safety bounds before recommendation surfacing.** Extend `Method::Decide` with `RecommendationSafetyV1`. Bind recommendation id/revision/digest, candidate result refs and policy id/revision/digest. Each `SafetyBoundV1` binds its id/revision/digest, metric id/unit, comparison operator, limit and measured value/source revision. Return each checked bound and a verdict (`pass` or `withheld`). Include the exact violated bound id, configured limit and measured value on refusal. Missing, stale, non-finite, unit-incompatible or unmeasured bounds, unsupported comparison operators and any out-of-bound metric withhold the recommendation. EG emits the bound evaluation result only. GraphOS must invoke and validate it before surfacing a recommendation. Its exact producer/consumer operation and served receipt are a pending companion prerequisite, not covered by this EG definition. Preserve partial `AU-HARNESS-R021.4/.6/.7`. Those do not prove a pre-surface gate. Source objective GRAPHOS:19 SHA-256 `cd33b64c1d759f3c7dd0a83112b77955d25a49c69d20288fe4c917716c711ff6`. | Served cases place an in-bound and out-of-bound recommendation through `Decide`. Verify exact units, values, limits and the withheld bound id. Refuse absent/stale bounds, NaN/infinity, unit mismatch, unsupported comparison operator, missing measurement and stale recommendation/policy digests. Assert GraphOS cannot surface until it supplies the separately served pre-surface validation receipt. That GraphOS operation remains pending and this requirement does not claim it exists.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.7
Pre-plan test evidence, verifier scores and successful-cycle reuse
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Pre-plan test evidence, verifier scores and successful-cycle reuse.** Define the AU-supplied `PrePlanTestReceiptV1` as `{tenant_id, run_id, repository_id, repository_revision, command_id, command_digest, started_at_ms, completed_at_ms, exit_code, artifact_manifest_digest, artifact_count, result_digest}`. Planning and verification bind the same receipt id/digest. `tests_ran` is true only when command and repository revision match and completion precedes planning. `artifacts_exist` is true only when the non-empty manifest is independently readable at its pinned digest. The verifier returns both booleans, their evidence refs and a policy revision. A reusable pattern requires exit code zero. Both checks must be true. Persist that pattern in the existing `CompiledProgram`/`AgentLibraryStore` model and index it through the existing `ProgramLookup` path (`compile_program` → `AgentLibraryStore` → `handle_decide`). Do not add a second program store. Refuse missing, stale, mismatched or unreadable receipts. Failed tests or artifact checks also block pattern promotion. The AU pre-plan producer/verifier-consumer ID and receipt schema remain pending. `AU-HARNESS-R022.2` is adjacent run-experience coverage, not this contract. Preserve `EG-DECISION-ENGINE-R135.2`, `.3`, `.5`. Source record AU:18 SHA-256 `90828a09b388b9910d870ce944aa2baeb561af14d8f7bf88b48a4d51c4da877f`. | Planned served tests through `handle_decide` and `ProgramLookup`: valid pre-plan evidence is present in both plan and verifier result and only a successful cycle is promoted. Refuse command/revision mismatch, late receipt, unreadable or empty artifact manifest, and nonzero exit. Preserve the prior library. Independently read back receipt, pattern and source trace refs. AU producer/verifier receipts remain a separate dependency. This definition claims no runtime evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R106.1
Council positions are coordinated into one evidence-bound decision
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Council positions are coordinated into one evidence-bound decision.** Extend the existing `Method::Decide` request with `CouncilCoordinationV1`: each closed `CouncilPositionV1` carries `{council_id, topology_revision, position_id, persona_id, persona_revision, option_id, claim_digest, evidence_refs[], constraint_refs[]}`. Each evidence ref carries `{id, revision, digest}`. Bind a caller-pinned `CouncilPolicyV1` id/revision, declared quorum and deterministic conflict rule. The sealed result returns `{council_id, topology_revision, input_position_ids, accepted_position_ids, rejected_position_ids, outcome, abstention_reason, policy_revision, positions_digest, decision_digest}` and retains every participating position ref. `outcome` is selected or abstained. Abstention reason is a closed enum for no quorum, unresolved conflict, missing evidence or policy refusal. Attach the typed branch to existing `Decide`/`handle_decide` and decision sealing. Validate council shape through `AgentGraphDraft.topology` and `topology_shape.rs`. `swarm:loopsBackTo` still describes topology, not position coordination. Refuse missing or duplicate positions and mismatched topology/council. Refuse stale evidence, unauthorized refs, incomplete input coverage or invalid policy without a decision. AU persona-position execution has no reviewed producer contract/id; `AU-CONTROL-R010` supplies topology facts only and is not credited for position production. Preserve `EG-DECISION-ENGINE-R106` and `EG-ORCH-VOCAB-R006.3`. Source record AU:19 SHA-256 `0bce81c137b521ea446644d2880498e23d67c3ab5701f09ba3f67a4b2c0e00fc`. | Planned served tests through `Method::Decide`: coherent quorum returns a sealed result containing all input positions and their evidence digests. Conflicting positions produce the policy-defined choice or typed abstention. Missing, duplicate, stale, cross-tenant or topology-mismatched positions refuse. Independently read back the decision and position refs. AU position-producer acceptance remains a separate pending dependency. No runtime receipt is claimed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R106.2
AU position producer identity and execution-to-decision linkage
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**AU position producer identity and execution-to-decision linkage.** Name AU persona-position execution producer from AU-CONTROL spec. Bind AU-CONTROL-R010 persona execution to EG-DECISION-ENGINE-R106.1 council coordination. Each position producer records producer id/revision/digest; EG sealer records consumer id/revision/digest. AU position producer delivers position facts with persona id and option; EG coordinates and seals at handle_decide. Source record AU:19 SHA-256 `3b7f2e1a9d8c5f4a6e3b2d1c9a8f7e6d5c4b3a2f`. | Served Decide through Method::Decide shows produced position ids and AU producer identity. Sealed decision includes producer digests. Missing or unrecognized position producer refuses.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.13
Measured tool-output and graph-size signals select recursive mode in the decision ladder
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Measured tool-output and graph-size signals select recursive mode in the decision ladder.** Extend `Method::Decide` with `QuestionKind::ContextBudget` and closed `ContextBudgetSignalsV1`: `{run_id, tool_output_bytes, tool_output_digest, tool_call_ref, graph_snapshot_ref, graph_node_count, observed_at_ms, signal_digest}` plus a tenant-bound trace/snapshot revision. A pinned `ContextBudgetPolicyV1` supplies versioned byte and node-count thresholds and the decision-ladder mapping. The result binds both observations and policy revisions and returns `{selected_mode: direct|recursive, selected_rung, reason_codes, inputs_digest}`. The ladder is the only selector, not a separate router. Wire the new decision arm beside `tool_subset_outcome` in `src/server/handlers/decide/stat_decide.rs::handle_decide`; AU `run_full_rlm` consumes the `DecisionBatch` before choosing direct or recursive execution. Missing, negative, stale, digest-mismatched or cross-tenant observations, and absent policy refuse before execution. This mode choice is separate from R137.7-.12 context-package selection. `AU-HARNESS-R026.3/.4` remain adjacent spans/context coverage. The exact AU observation-producer contract/id binding these two measurements is pending and not implied. Preserve `EG-DECISION-ENGINE-R137.1-.3`. Source record AU:25 SHA-256 `9724fcb9db21705fe9ac6a4b26d6d27280f55bf8a22bf11907b3ad9449383290`. | Planned served tests through `handle_decide` and `run_full_rlm`: vary tool-output bytes and graph-node count independently around each pinned threshold, then jointly. Assert the decision-ladder mode and consumed input digests. Missing, stale, negative, altered-digest or cross-tenant observations refuse before model execution. Keep package-selection tests for R137.7-.12 independent. AU observation and run-consumer receipts remain separate dependencies. No runtime evidence is claimed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.9
Reviewed residual `AU:34`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:34`.** The EG-owned portion of the source objective . An explicit skill tree and outcome-tuned EG exploration over that tree are absent. AU-HARNESS-R022.3 says retrieval ranks locally, while AU-CONTEXT-R001 assigns ranking/feedback to EG. Resolve this authority conflict. The EG contract SHALL meet this residual through the following reviewed closure: Define TaskPlanSkillNodeV1. Bind task_plan_id/revision/digest, skill_id and nullable parent_skill_id. Bind context_match_policy_revision and evidence refs. Bind prior_outcome_refs with source revisions/digests. Record score, rank and ranking_policy_revision. EG emits relevant skills in a deterministic tree. A versioned score/rank policy binds the comparison operator and tie rule. Missing or unpinned policy refuses. Outcome feedback changes later breadth only through R140.102 and its pinned policy/outcome set. Original source objective. Select multiple relevant skills from a tree for each task. Tune selection from run outcomes, so exploration can use more than one skill. Producer/consumer boundary. EG plan_over_skills -> AgentLibraryStore -> served TaskPlan; AU experience feedback lacks a named EG selection-policy update consumer. Preserve existing coverage `EG-DECISION-ENGINE-R134.4`, `EG-DECISION-ENGINE-R134.5`, `AU-HARNESS-R022.3`, `AU-CONTEXT-R001`. Owner source hash: `ced4d0bb75fa260e4291aea5f71c28b407a95fc3e06047666e1278b043a3cdbd`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.9-ranked-plan. Served Decide(TaskPlan) returns multiple skill nodes. Each has stable parent links, cited context matches, pinned outcome refs, score/rank and plan digest. Equal scores use the declared tie-break. Refuse missing/stale context or outcome evidence and malformed/cyclic parent links. AU application of this rank is not asserted. Attach the proposed result at plan_over_skills -> AgentLibraryStore -> served TaskPlan. AU-HARNESS-R022.3 local ranking and AU-CONTEXT-R001 feedback authority remain existing adjacent obligations. The AU consumer that applies EG rank and the feedback-to-R140.102 receipt contract are not yet specified. Keep SPECIFIED pending those owner definitions and served evidence. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.14
Reviewed residual `AU:37`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:37`.** The EG-owned portion of the source objective . The judge checks retained values, methods and validation steps. It does not compare held-out answers with full-context answers under a declared tolerance. The EG contract SHALL meet this residual through the following reviewed closure: Define PairedContextEvaluationV1. Bind the held_out_query_set id/revision/digest, raw_context revision/digest and candidate_context revision/digest. Bind evaluator/model revision and each query's raw/candidate answer digests. Record the quality metric, aggregation rule, tolerance and policy revision. Require a complete per-query verdict set. Replace raw context only when all queries are present and the aggregate satisfies the declared tolerance. Any failed or incomplete evaluation retains the raw revision. Original source objective. Compress long run context into updatable memory only when held-out answer quality stays within declared tolerance. Otherwise retain the full context. Producer/consumer boundary. AU ContextManager.before_model_request -> run_agent replaces context only after its summary gate. No held-out paired-answer verdict is a named prerequisite. Preserve existing coverage `AU-HARNESS-R013.5`, `AU-HARNESS-R013.10`, `AU-HARNESS-R013.12`, `AU-HARNESS-R013.13`. Owner source hash: `7e1405981aa8b697a73eb7e8c3c3170be8edefc674c23beef740884450fc1add`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R137.14-paired-context. a complete held-out set within the declared tolerance permits the replacement verdict. A beyond-tolerance result, missing query or stale context/evaluator digest refuses. Undefined metric, aggregation or tolerance also refuses. An incomplete verdict set leaves the active raw-context revision unchanged. AU ContextManager.before_model_request -> run_agent is the existing replacement point. The AU held-out evaluator and receipt schema are absent. So is the consumer that atomically applies EG acceptance. R013.5/.10/.12/.13 remain adjacent coverage, not evidence of this gate. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.10
Reviewed residual `AU:39`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:39`.** The EG-owned portion of the source objective . There is no summary-only sub-run return schema, parent-remaining-context bound or explicit rejection of raw/oversized returns. Generic spans do not bind delegation decision, child run and accepted summary as one trajectory. The EG contract SHALL meet this residual through the following reviewed closure: Define ChildSummaryV1. Bind plan/decision id and digest, parent run id and child run id. Record the expected child-id set and summary artifact kind/schema/version/digest. Bind the exact tokenizer revision, summary token count and source/result evidence refs. A parent budget record binds remaining context tokens at dispatch and the maximum aggregate child-summary tokens. Child output exposed to the parent contains only the declared summary artifact, never raw transcript. The accepted fan-out receipt accounts for every child as one summary or named failure gap. Original source objective. A main run delegates subtasks to sub-runs. Each child returns only contract-bounded summaries. The main run conserves context budget and records delegation decisions as trajectories. Producer/consumer boundary. AU _fork_fanout -> FanoutResult and parallel workspace synthesis; EG decides plans. The bounded child-summary producer/parent consumer boundary is absent. Preserve existing coverage `AU-CONTROL-R043.2`, `AU-CONTROL-R043.5`, `AU-HARNESS-R020.4`, `AU-HARNESS-R024.1`. Owner source hash: `742906721351687d032991b4e9c0255baf7a6c480e21ac7a616975d40e38ce84`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.10-bounded-child-summary. valid summary-only children whose checked token total fits the parent remaining budget are linked to decision, child and summary digests. Refuse raw or oversized output and missing, duplicate or unknown children. Refuse tokenizer/budget revision mismatch or totals above the bound before parent synthesis. AU _fork_fanout -> FanoutResult and parallel workspace synthesis are the observed attachment points; EG owns TaskPlan authority. AU summary producer, parent remaining-context budget field and consumer validation/readback receipt are missing. AU-CONTROL-R043.2/.5, AU-HARNESS-R020.4 and AU-HARNESS-R024.1 remain adjacent. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.15
Reviewed residual `AU:40`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:40`.** The EG-owned portion of the source objective . A primitive handle and span digests omit recursive sub-model input/output signatures, tool bindings and boundary validation. The trace also lacks signature/model/tool linkage. The EG contract SHALL meet this residual through the following reviewed closure: Define RecursiveCallV1 request/result records. Bind parent run/span, call id and signature id/revision/digest. Record typed input schema/digest, admitted tool id/revision set and selected model id/revision. Bind typed output schema/digest and terminal status. Validate input and tool membership before dispatch and output against the same signature before recording success. Bind all revisions/digests in the recursive trace. Original source objective. A recursive runtime lets a model call sub-models through typed signatures and tools. The run trace records interpretable trajectories. Producer/consumer boundary. AU run_full_rlm -> RLMEnvironment.run_parallel_sub_calls executes EG limits. Span instrumentation records calls. No recursive-call signature producer/validator is named. Preserve existing coverage `AU-HARNESS-R026.1`, `AU-HARNESS-R026.4`, `AU-HARNESS-R024.1`, `AU-HARNESS-R024.3`, `EG-ORCH-VOCAB-R005`. Owner source hash: `4edb15328650ebf084f0ab1d073b092e5b684aafad9b7b1ca7f412859390b923`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R137.15-signature-boundary. an admitted typed call records matching signature/model/tool/input/output digests. Refuse unknown or changed signatures and unadmitted tools. Refuse malformed input/output, missing parent span or revision mismatch before accepting a result. AU run_full_rlm -> RLMEnvironment.run_parallel_sub_calls is the observed execution point. EG resource limits and span instrumentation are adjacent only. No AU recursive signature producer/validator receipt or exact EG-to-AU call contract is named. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.11
Reviewed residual `AU:45`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:45`.** The EG-owned portion of the source objective . Depth/item bounds do not define an execution horizon or per-step budget. They do not split excess steps before execution or checkpoint credit across sub-horizons. The EG contract SHALL meet this residual through the following reviewed closure: Define HorizonPartitionV1 for one committed TaskPlan revision. Bind ordered step ids and dependency edges. Set positive max_steps_per_horizon, per-step budget policy id/revision/unit and a credit ceiling. Partition only at dependency-safe boundaries before start. Each completed horizon returns a durable credit checkpoint with plan/horizon ids, consumed/reserved/remaining amounts, budget revision and digest. Require a versioned accounting rule for debits. Original source objective. Long tasks decompose into sub-horizons under a declared per-step budget with checkpointed credit. A plan whose step count exceeds the configured horizon is split before execution, not attempted whole. Producer/consumer boundary. EG decompose_task/TaskPlan -> AU bounded map primitives. The horizon partition and durable credit receipt are not a named producer/consumer interface. Preserve existing coverage `AU-HARNESS-R026.1`, `AU-HARNESS-R026.2`, `EG-DECISION-ENGINE-R134.3`, `EG-DECISION-ENGINE-R134.4`. Owner source hash: `c1bfd61241a0fd02ada2816f173a3b9568da5b48e490e76058fd740b356886da`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.11-horizon-credit. a plan within the limit remains one horizon. A longer valid plan is split at dependency-safe boundaries and its checkpoint balances reconcile exactly. Refuse an unsplittable dependency component or absent/invalid budget rule. Refuse over-credit horizons, missing checkpoints and stale plan revisions before the next start. EG decompose_task/TaskPlan feeds AU bounded map primitives, but no named partition/credit receipt interface exists. AU durable checkpoint/debit semantics and the consumer that blocks start on a missing receipt remain unspecified. Do not substitute Finance forecast horizons or solver budgets. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R059.1
Reviewed residual `AU:57`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:57`.** The EG-owned portion of the source objective . No merged skill tree binds candidates across model backbones to independent per-skill evaluations. It also lacks a robustness/transferability estimate across those backbones. The EG contract SHALL meet this residual through the following reviewed closure: Define BackboneSkillEvaluationV1 rows. Key each by candidate id and canonical skill identity. Bind source model/backbone id/revision and task-distribution id/revision. Bind evaluation dataset id/revision/digest, metric id/revision, sample count and result digest. An aggregate may be emitted only with complete independent rows for every declared backbone and a versioned transferability policy. Publish the full per-backbone evidence with the aggregate, not a bare score. Original source objective. Merge skill candidates from multiple models into one tree. Aggregate independent evaluations into a robust estimate of effectiveness and transferability across backbones. Producer/consumer boundary. AU experience/skill candidates -> EG admission-linked outcome aggregate. The shared tree and backbone-bound per-skill evaluation join remain unnamed. Preserve existing coverage `AU-HARNESS-R022.1`, `AU-HARNESS-R022.2`, `EG-DECISION-ENGINE-R059`. Owner source hash: `0c7c2eed61e3cfe6fe6c863c75fb66092f3a8bea97e3942b635c7b69f715d3a9`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R059.1-backbone-evidence. complete independent evaluations for the same canonical skill identity produce a result that lists every backbone and policy revision. Refuse missing/duplicate backbone rows, candidate identity mismatch, reused non-independent evidence, incomplete dataset coverage or absent metric/transferability aggregation policy. AU supplies experience/skill candidates; EG R059 is the existing independent-outcome admission path. No shared canonical skill merge key, robust aggregation/threshold decision, or AU multi-backbone evaluation producer is specified. These decisions are explicit holds. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.12
Reviewed residual `AU:85`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:85`.** The EG-owned portion of the source objective . Hard-task alternative trajectories and deliberative summary aggregation. Explicit width/depth decision ladder and remeasurement against a single-trajectory baseline. The EG contract SHALL meet this residual through the following reviewed closure: Define TrajectoryDecisionV1. Bind one task/plan digest and policy revision. Record chosen width/depth and ordered trajectory ids. Bind the identical input snapshot digest per arm, single-trajectory baseline id, per-arm outcome/evaluation refs and paired comparison receipt. The decision names the selection and evaluation policies. It does not prescribe an unsupported scoring formula. A pass requires complete paired arms over the same task/input and an explicit R018 comparison verdict. Original source objective. Hard tasks run in two stages: parallel reasoning over multiple trajectories, then a summarization step aggregating them. Width and depth are chosen by the decision ladder and re-measured against a single-trajectory baseline. Producer/consumer boundary. R134 plan explicitly connects Decide TaskPlan to AU-CONTROL-R042/R043; R137 plan connects ContextBudget to AU-CONTEXT-R004/AU-HARNESS-R026. AU-HARNESS-R018 has run_agent paired arms. These dependencies lack the alternative-trajectory/summarization/baseline binding. Preserve existing coverage `AU-HARNESS-R020.4`, `EG-DECISION-ENGINE-R134.1`, `EG-DECISION-ENGINE-R134.3`, `AU-CONTROL-R007`, `EG-DECISION-ENGINE-R137.1`, `EG-DECISION-ENGINE-R137.3`, `AU-HARNESS-R018.1`, `AU-HARNESS-R018.2`, `AU-HARNESS-R018.5`. Owner source hash: `a28929a50cbfcb691664403ce456fbf9dc38d6bd64b34424932e4fa22f9cbda1`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.12-paired-trajectories. selected width/depth and all trajectory/baseline ids bind to the same plan and input snapshot. Each arm has an outcome and the paired R018 verdict is readable. Refuse missing/mismatched arm, baseline, policy revision or result, and refuse any claim of improvement without the declared paired verdict. Existing points are Decide(TaskPlan), AU-CONTROL-R042/R043, AU-HARNESS-R020.4, and paired arms in AU-HARNESS-R018.1/.2/.5. AU trajectory generation, summary aggregation and EG selection-policy consumer receipt are absent. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.13
Reviewed residual `AU:91`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:91`.** The EG-owned portion of the source objective . Distinct analyst roles provide cited findings to one decision role. Required abstention on unresolved conflict or missing citations. The EG contract SHALL meet this residual through the following reviewed closure: Define AnalystFindingV1. Bind task/plan digest, expected analyst id/role and finding id. Record claim text/digest, cited evidence ids/revisions/digests and source spans. Define SynthesisResultV1. Include the complete expected analyst-id set and all finding ids. Record each analyst outcome, cited evidence, conflicts and final decision-role id. Return a supported conclusion or typed abstention reason. Never drop a failed or absent analyst from accounting. Original source objective. Parallel analyst roles produce structured, cited findings for one decision role. That role abstains when findings conflict or lack citations. Producer/consumer boundary. EG R134.5 plans TaskPlan through served Decide; AU R020.5 constructs worker slots through _dispatch_parallel_batch. The selected aggregation consumer lacks a cited-finding/conflict abstention contract. Preserve existing coverage `EG-DECISION-ENGINE-R134.3`, `AU-HARNESS-R020.1`, `AU-HARNESS-R020.4`, `AU-HARNESS-R020.2`, `EG-DECISION-ENGINE-R134.6`. Owner source hash: `f5ddb0ac9b0329ac031c01c56c49ee03c922a991dbf2d0e29c111515424d3455`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.13-cited-synthesis. cited compatible findings produce a result that accounts for every expected analyst. Refuse missing/duplicate analysts and unsupported findings. Refuse unresolved conflict, invalid citation, plan mismatch or absent decision role. Abstain without recommendation. EG R134.5 served Decide(TaskPlan) is the planning point; AU R020.5 _dispatch_parallel_batch constructs worker slots. The exact AU finding producer/collector and aggregation consumer contract is missing. Existing fan-out clauses do not prove it. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R029.1
Reviewed residual `AU:93`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:93`.** The EG-owned portion of the source objective . Replaceable search-grounding provider independently selected from reasoning model and bound to a committed route. Unavailable committed provider must refuse rather than substitute. The EG contract SHALL meet this residual through the following reviewed closure: Define RetrievalProviderBindingV1 in the committed retrieval plan. Bind provider id/revision/config digest, query/request digest and tenant scope. Identify reasoning model id/revision separately. The binding has an explicit no-substitution policy. Execution evidence records the exact provider, binding digest, request/result digests and provider revision. Original source objective. Search grounding is a replaceable provider selected through the committed routing decision, independent of the reasoning model. An unavailable provider is refused, not silently substituted. Producer/consumer boundary. Preserve ARBORA-OPS-R021.2.1 retrieval.search and its tenant-scoped retriever. EG must produce the committed provider binding and the SDK/GraphOS consumer must execute that exact provider. That edge is missing. Preserve existing coverage `EG-DECISION-ENGINE-R029`, `ARBORA-OPS-R021.2.1`. Owner source hash: `c9552392eb813763a83fc96fb48ad1bd18fd805ef608736f1dae5d48ab12c984`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R029.1-exact-provider. independently vary provider and reasoning-model ids while verifying the committed provider is executed. If the bound provider is unavailable, stale, unauthorized or mismatched, refuse before retrieval and record zero calls to alternate providers. Preserve ARBORA-OPS-R021.2.1 retrieval.search and its tenant-scoped retriever. EG must commit the provider binding. The SDK/GraphOS consumer contract that executes and receipts that exact binding is not defined. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.14
Reviewed residual `AU:105`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:105`.** The EG-owned portion of the source objective . Search planner explores candidate solution branches using experience memory, fuses branch solutions and records every branch outcome for later retrieval. The EG contract SHALL meet this residual through the following reviewed closure: Define BranchOutcomeV1. Bind branch id, parent task/plan digest and branch input digest. Record experience snapshot revision and ordered fusion position. Include terminal outcome or named failure gap and immutable result digest. The fusion receipt lists every planned branch in deterministic order. It binds the versioned fusion-policy id/revision, all outcome refs and fused result digest. A later branch retrieval records the exact outcome refs and revisions it consumed. Original source objective. A search-based planner explores solution branches using experience memory. It fuses branch results and records each outcome for later retrieval. Producer/consumer boundary. Use the same missing branch-experience producer and committed planning consumer identified for AU:84. Existing attachment points are R134.5 Decide, R020.5 worker execution and R022.4 run outcome distillation. Preserve existing coverage `EG-DECISION-ENGINE-R134.3`, `AU-HARNESS-R022.3`, `AU-HARNESS-R020.4`, `AU-HARNESS-R022.1`, `AU-HARNESS-R022.6`. Owner source hash: `4fd31dd504f158f43bcf77d81a39c2419303a538b32553a77a39f6b5a575e9d2`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.14-branch-readback. a complete branch set produces an ordered fusion receipt and independent readback for every outcome. A later branch cites the exact pinned prior outcome. Refuse missing/duplicate branch, changed parent/input/snapshot, omitted failure gap, absent fusion policy, or stale readback. Existing points are Decide R134.5, AU R020.5 worker execution and AU R022.4 outcome distillation. The AU branch-experience producer, committed-plan consumer and durable per-outcome receipt schema remain missing. Do not substitute R140.102 breadth adaptation. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R020.1
Reviewed residual `AU:110`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `AU:110`.** The EG-owned portion of the source objective . Separate per-agent exploitation trajectory pool and generated exploration pool. Explore only when context has no matching past trajectory. Define CandidatePoolV1. Bind tenant/agent id, task/context feature digest and policy revision. Record candidate ids and each candidate's source revisions. The selection receipt partitions candidates into exploitation (matched prior trajectories) and exploration (eligible only when no match exists). It records context-match policy revision, evidence refs and deterministic tie-break. Cross-agent history is never eligible. Original source objective. Each agent keeps past trajectories in an exploitation pool and generated candidates in an exploration pool. Use exploration only when no trajectory matches the context. Producer/consumer boundary. EG owns candidate selection and orchestration evidence; AU R022 supplies run experience. No per-agent two-pool producer or context-miss-only selection contract exists. Preserve existing coverage `AU-HARNESS-R022.1`, `EG-DECISION-ENGINE-R020`, `AU-HARNESS-R022.3`. Owner source hash: `dafa8396b5a7c2a168253c7be219718c78186266610e5a91e7dc318d35fc552b`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R020.1-agent-isolated-pools. a same-agent matching trajectory selects from the exploitation pool and excludes exploration. A declared no-match case may select from exploration. Refuse missing match policy/evidence and cross-tenant or cross-agent history. Bind result to the candidate snapshot. EG owns candidate selection and AU-HARNESS-R022.1/.3 provide adjacent experience inputs. No AU per-agent pool producer or context-match evidence contract exists. Exact match dimensions/threshold must be supplied by that owner policy before implementation. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R133.7
Reviewed residual `EG:13`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `EG:13`.** The EG-owned portion of the source objective . Define recursive code/subcall/intermediate node/edge identity and verifier/improvement read-and-critique contracts. The EG contract SHALL meet this residual through the following reviewed closure: Define RecursiveTraceNodeV1. Bind run id/revision, step id/revision and parent node id. Record ordered child ids and input/output/evidence refs/digests. Include source revision and trace snapshot id. Define TraceCritiqueQueryV1 with root node, authorized projection, snapshot revision, filters and opaque cursor. The response includes the complete selected ancestry and source refs. Parent/child links must be complete and acyclic within the selected snapshot. Original source objective. Store each recursive-reasoning trajectory as typed graph nodes. Include code runs, sub-calls and intermediates for verifier and improvement critique. Producer/consumer boundary. Terminal CommitWorkItemResult adapts traces after fenced CAS; AddNode validates traces. Graph queries read them. Recursive hierarchy production and critique consumption are absent. Preserve existing coverage `EG-DECISION-ENGINE-R133.1`, `EG-ORCH-VOCAB-R013.1`, `EG-DECISION-ENGINE-R133.5`, `EG-ORCH-VOCAB-R013.5`, `EG-ORCH-VOCAB-R009.15`, `EG-ORCH-VOCAB-R013.6`. Owner source hash: `9e0be988c182da3c7f440c14d2fc8e56f60426e543e3f53ba39f250f235e6c8d`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R133.7-trace-critique. ingest and independently read back a nested trace, then critique it at the same authorized snapshot with complete ancestry. Refuse incomplete ancestry, cycle, stale cursor/snapshot, missing digest or unauthorized projection without returning protected fields. Terminal CommitWorkItemResult adapts traces, AddNode validates records and graph queries read them. The recursive node producer and named authorized critique-query operation/consumer are absent. Existing fencing/projection rules remain binding. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.1
Reviewed residual `EG:16`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `EG:16`.** The EG-owned portion of the source objective . Define attributed agent-error/human-correction ingestion and lineage from examples to fitted adapters before existing promotion. The EG contract SHALL meet this residual through the following reviewed closure: Define FeedbackEventV1. Bind stable event id and decision id/revision/digest. Record option/action id, actor id and outcome/evidence refs/digests. Include event time and source revision. A versioned mapping policy converts only a complete joined event into a fit example. Deduplication is by event id plus source revision. Bind example-set digest to R100 fitting, resulting adapter id/revision to R101, and publish admission to R040. Original source objective. A promoted adapter adjusts embeddings from feedback signals. Signals include agent errors and human corrections, closing a feedback loop into vector space. Unpromoted adjustments never alter served results. Producer/consumer boundary. R100 persists examples, R101 applies promoted post-RLS/pre-ANN query adapters, R040 gates publish. Signal production and example-to-fit linkage are absent. Preserve existing coverage `EG-DECISION-ENGINE-R100`, `EG-DECISION-ENGINE-R101`, `EG-DECISION-ENGINE-R040`. Owner source hash: `eca485ffdff9cea5394130b53e12a0edc235e342ab01accc36ad9d06f496daa8`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R100.1-feedback-join. an authorized complete event is read back as exactly one fit example bound to the expected R100 dataset digest. Replaying the same event is idempotent. Refuse duplicate identities with changed content or missing decision/option/outcome joins. Refuse invalid mapping policy, stale source revision or evidence mismatch before fitting. R100 persists examples, R101 applies a promoted adapter post-RLS/pre-ANN and R040 gates publish. The AU signal producer and outcome-to-label mapping policy are not specified. Do not treat an independent outcome record as the producer contract. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R088.2
Reviewed residual `EG:17`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `EG:17`.** The EG-owned portion of the source objective . Define event cursor/period, forecasts, adaptation and no-future-event visibility at the simulator/harness boundary. The EG contract SHALL meet this residual through the following reviewed closure: Define ReplayEventV1. Bind event id, strictly ordered sequence number and event time. Record state snapshot id/revision/digest, observed action id, outcome/evidence refs and source revision. Replay uses an AS OF snapshot and opaque deterministic cursor. The sealed ReplayReceipt binds ordered event digests, cursor, policy id/revision and result digest. Identical duplicate delivery is idempotent. A conflicting duplicate or sequence gap refuses. When the environment is policy-dependent, route to R119 off-policy evaluation. Original source objective. Evaluation replays real-world events chronologically over a simulated period. The agent forecasts outcomes and adapts as information arrives. No future event is visible before its turn. Producer/consumer boundary. DecisionEval owns AS OF and fold replay. A real-world event simulator feeding an AU adaptive harness is undefined. Policy-dependent environments must respect R119 off-policy routing. Preserve existing coverage `EG-DECISION-ENGINE-R088`, `EG-DECISION-ENGINE-R119`, `EG-DECISION-ENGINE-R088.1`. Owner source hash: `d01db99df0c6c22b37f82cd815e129956fa151e7da2b670b73348ca5058e629e`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R088.2-ordered-replay. replay a fixed event sequence and resume from its receipt/cursor to the same event order and sealed digest. Refuse gaps, out-of-order events, conflicting duplicate ids, changed snapshots or policy-dependent on-policy claims without R119 routing. DecisionEval provides AS OF and fold replay. The real-world event simulator and AU adaptive-harness producer/consumer are undefined. This row specifies EG replay envelope and refusal only, not an external event source. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.16
Reviewed residual `EG:26`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `EG:26`.** The EG-owned portion of the source objective . The statement that only window/chunking budgets exist is stale. R137.7-.12 cover exact-token package sizing and monetary/model-price bounds. The remaining gap is an explicit task-complexity input and selection policy. Bind the caller ceiling to current remaining tokens, including consumed and reserved tokens. R128 task-class pressure does not itself prove that joint payload-sizing linkage. Extend ContextBudgetSignalsV1 with task-complexity feature set/digest and complexity-policy id/revision. At a pinned snapshot, derive remaining tokens as the total ceiling minus committed and reserved consumption. Use the same tokenizer revision. Return both operands and the checked result. Bind the complexity decision and remaining budget to the sealed ContextPackageSelection and its R137.7-.12 solver certificate. R128.5 task-class pressure remains a separate input. Original source objective. Adapt retrieval payload size per request to task complexity, remaining token budget and model cost. Never exceed the remaining budget. Producer/consumer boundary. Planned served Decide(ContextBudget) -> existing solver -> independent certificate verifier -> sealed ContextPackageSelection -> AU-CONTEXT-R004 context-compile consumer. R137.11/.12 explicitly name the consumer. Current dispatch absence is stated in R137.9. Preserve existing coverage `EG-DECISION-ENGINE-R137.7`, `EG-DECISION-ENGINE-R137.8`, `EG-DECISION-ENGINE-R137.10`, `EG-DECISION-ENGINE-R137.9`, `EG-DECISION-ENGINE-R137.11`, `EG-DECISION-ENGINE-R137.12`. Owner source hash: `ccbc35ba3595763696c824434868079aeb401ce8b601041e913b323a2d2fb575`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R137.16-complexity-and-remaining-budget. vary complexity while holding model cost and remaining tokens fixed, then vary remaining tokens while holding complexity fixed. Verify the declared policy and certified package bind both decisions. Refuse missing/invalid policy, tokenizer or snapshot mismatch, negative/overflowing remainder, or package cost above remaining tokens. Planned Decide(ContextBudget) -> existing solver -> independent certificate verifier -> sealed ContextPackageSelection -> AU-CONTEXT-R004. R137.11/.12 name the consumer. The dispatch and receipt binding remain pending as recorded in R137.9. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R029.2
Reviewed residual `EG:30`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `EG:30`.** The EG-owned portion of the source objective . The complete candidate universe is not necessarily the complete available-source universe. No exhaustive, explicit omitted-source report with relevance/budget reasons is required. Displaced authority-conflict sources cover only one omission cause. Define AvailableContextSourceV1. Bind authorized source id/revision/digest and relevance evidence. Record authority class, token/cost estimate and enumeration snapshot. ContextSourceSelectionV1 returns complete selected and omitted partitions with reason enum IRRELEVANT, OVER_BUDGET, AUTHORITY_DISPLACED, or UNAUTHORIZED, plus deterministic policy revision and source snapshot digest. Every enumerated source appears exactly once. Protected source identifiers are omitted from unauthorized caller-visible details. Original source objective. An agent loads task-relevant context from available sources within a stated budget. It does not load the full persistent memory. Omitted sources are reported. Producer/consumer boundary. Served Decide(ContextBudget) -> certified package -> AU-CONTEXT-R004 context compile. Ontology source selection R072 and source-authority conflict handling supply distinct inputs. Preserve existing coverage `EG-DECISION-ENGINE-R029`, `EG-DECISION-ENGINE-R137.7`, `EG-DECISION-ENGINE-R137.8`, `EG-DECISION-ENGINE-R137.11`, `EG-DECISION-ENGINE-R137.12`, `EG-FEDERATED-QUERY-R072`, `EG-SRC-AUTH-R010.6`. Owner source hash: `05fcbe47e588141000ec329927406270abd30b590d2624f22e9239079f829d38`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R029.2-complete-source-partition. the same served compile journey includes relevant selected sources and omitted examples for irrelevance, over-budget and authority displacement. Every authorized source is accounted for once. Refuse incomplete enumeration, duplicate source, unknown reason, stale budget/authority snapshot or unauthorized disclosure. Served Decide(ContextBudget) -> certified package -> AU-CONTEXT-R004 context compile; R072 ontology selection and EG-SRC-AUTH-R010.6 provide distinct source inputs. The AU consumer receipt for the exhaustive partition is not named. Preserve the parent retrieval/authorization obligations. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.15
Reviewed residual `EG:36`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `EG:36`.** The EG-owned portion of the source objective . No duration/weight-based longest-path calculation or critical-chain output is required. A DAG and dependency order alone do not define critical-path scheduling. For each TaskPlan DAG step, require positive duration_ms and nonnegative integer priority_weight. Bind source evidence, weight-policy id/revision and input digest. Compute checked integer path totals from duration_ms multiplied by priority_weight using the declared weight scale. Return ordered critical_chain_step_ids, total_weighted_duration_ms, policy revision, plan revision and input digest. Ties choose the lexicographically smallest step-id sequence. Original source objective. Task scheduling computes critical paths over plan graphs using topological order and longest path, and reports the critical chain. Cyclic plans are rejected. Producer/consumer boundary. Served Decide(TaskPlan) -> plan_over_skills -> typed TaskPlan -> execution consumer. Critical-chain fields and computation remain to be defined. Preserve existing coverage `EG-DECISION-ENGINE-R134.1`, `EG-DECISION-ENGINE-R134.4`, `EG-DECISION-ENGINE-R134.5`, `EG-DECISION-ENGINE-R134.6`, `EG-DECISION-ENGINE-R134.8`, `EG-ORCH-VOCAB-R006`. Owner source hash: `6e1f0c3ab1626a00c8392e8a304b4c4a28a86d0aee8fff1933317bbdb4893966`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.15-weighted-critical-chain. a branched DAG returns the independently calculated longest weighted path and total, source-duration/weight provenance, and deterministic tie result. Refuse cycles and missing/invalid duration or weight. Refuse absent scale policy, stale source evidence or checked multiplication/sum overflow before emitting TaskPlan. Attach the proposed fields to served Decide(TaskPlan) -> plan_over_skills -> typed TaskPlan. The execution consumer schema for critical-chain fields is not defined. The decision producer and consumer remain SPECIFIED pending that schema. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.8
Reviewed residual `EG:52`
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reviewed residual `EG:52`.** The EG-owned portion of the source objective . Successful-trace compilation is not on-demand compilation from natural-language or graph-stored workflow definitions. Persisted ProgramStep lacks a reusable agent-configuration contract. Compile failure reports run failure/size instead of the missing workflow step. The EG contract SHALL meet this residual through the following reviewed closure: Define WorkflowCompileRequestV1. Bind source kind (NL or graph), exact source revision/digest and workflow identifier. Record compiler id/revision and referenced step/agent-config ids. The deduplicated CompiledWorkflowV1 binds the canonical typed step graph digest and each agent configuration id/revision/digest. Define `semantic_reuse_key_v1` as the exact tuple `{canonical_typed_step_graph_digest, compiler_id, compiler_revision, sorted_agent_config_refs}`, where each sorted config ref is `{id, revision, digest}` and sorting is lexicographic by config id. Exclude source kind, source revision/digest and source-to-step mapping from the key. Retain them in a separate WorkflowCompileReceiptV1 bound to source provenance, reuse key and compiled program id. A missing referenced step returns MISSING_WORKFLOW_STEP with the exact id/source location and publishes no partial program. Reuse one NL/graph program only when canonical graph digest, compiler id/revision and sorted agent-config refs match. Different source provenance remains in separate compile receipts, and no source equivalence is inferred from text alone. Original source objective. Workflows written in natural language or stored in the knowledge graph compile on demand to typed graph flows. Compiled steps and agent configurations are saved for fast routing on reuse, and a compile failure names the missing step. Producer/consumer boundary. Served Decide(TaskPlan) and ProgramLookup -> AgentLibraryStore/handle_decision_commit -> harness; SourceIngest is the workflow ingestion authority. A definition-to-program compiler between those surfaces remains unspecified. Preserve existing coverage `EG-DECISION-ENGINE-R134.1`, `EG-DECISION-ENGINE-R134.4`, `EG-DECISION-ENGINE-R134.5`, `EG-DECISION-ENGINE-R134.6`, `EG-DECISION-ENGINE-R135.1`, `EG-DECISION-ENGINE-R135.2`, `EG-DECISION-ENGINE-R135.3`, `EG-DECISION-ENGINE-R135.4`, `EG-DECISION-ENGINE-R135.5`, `EG-DECISION-ENGINE-R135.6`, `EG-ORCH-VOCAB-R006`, `EG-REPO-INGEST-R002`. Owner source hash: `1ee5f2b5bd5bc45c9b9ff8ccaab8de944ed41eceab17a8c1e88cc86d4725e2dc`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R135.8-workflow-compile. Identical graph digests, compiler id/revision and sorted config refs identify one semantic reuse key. The key returns a complete stored configuration across NL/graph inputs. Keep a separate source-kind/revision/digest/mapping receipt for each. A new source revision with unchanged semantic inputs reuses the program but records new provenance. A changed graph, compiler, or config ref changes the key. Refuse a missing step with the exact diagnostic, stale source/config/compiler revision, or partial program publication. Proposed attach points are served Decide(TaskPlan), ProgramLookup and AgentLibraryStore/handle_decision_commit; SourceIngest remains the workflow ingestion authority. The compiler interface and stored configuration schema between these surfaces are unspecified. No implementation, served test, or receipt is claimed by this SPECIFIED definition.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.9
Producer/consumer identity and receipt binding for pre-plan test results
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Producer/consumer identity and receipt binding for pre-plan test results.** Name AU pre-plan test producer from AU-HARNESS spec and verifier consumer at handle_decide. Bind AU-HARNESS-R022.8 to EG-DECISION-ENGINE-R135.7 with explicit identity. Each party records producer id/revision/digest and consumer id/revision/digest. AU pre-plan producer delivers test receipt with command and artifact digests; EG verifier consumes at ProgramLookup decision point. Source record AU:18 SHA-256 `9c5f2e1a8d7c4b3f6e2a1d9c8b7a6f5e4d3c2b1a`. | Served Decide through ProgramLookup shows producer and consumer identity digests. Cross-reference validation succeeds. Missing producer or consumer identity refuses.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.10
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define InsightRecordV1 in the program store. It binds insight text, source_run_ids, context signature, success counts and selection revision. Every insight must name at least one source run. | A schema test rejects an insight with no source run.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.11
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The engine must consolidate submitted insights and rank them by context match and success. It must select insights for a task context. Ties must order by insight id. | A fixture of insights yields the expected consolidation and selection order.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.12
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The Harness observes outcomes and submits them to the engine. The engine owns storage, consolidation and selection. The Harness applies selected insights when it compiles model context. The selection attaches in handle_decide beside the program lookup. | A served Decide call returns selected insights with their source runs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.13
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The engine must refuse a submission that has no source run. It must refuse a selection request with an unknown context signature. Each refusal must carry a typed reason. | Each refusal case returns its typed reason and stores nothing.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.14
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit premises for the selected insights, their source runs and the selection revision. The Harness must record which insights it injected. | A trace links each injected insight to its source runs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R135.15
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served Decide wire method. The integration test is tests/decide/test_insight_selection_served.py::test_post_run_write_then_context_injection. It writes after a run, selects later, and checks injection with source-run provenance. A source-less submission must refuse. | That test passes against the served engine.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R042.100
Tool-path outcome history and repeated-failure skip rule
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Tool-path outcome history and repeated-failure skip rule.** Model `ToolPathHistory` by tenant, connector, capability and stable path id/version. Bind observation window, sample/success/failure counts, as-of time and source invocation ids. Behavior ranks only already-admitted equivalent paths by observed success rate. Skip a path only when the versioned decision policy declares a minimum sample and failure threshold and both are met. Missing, stale or undersampled history is `unknown` and cannot suppress a path. Wiring adds the evidence to the existing R042 Decide advisory and consumes current attempt outcomes from SDK `ordered_equivalent_fallback`. It must not replace the SDK declared fallback order or execute writes. Evidence binds policy, candidate paths and observation window. Producer/consumer boundary. EG R042 remains evaluate-only connector tool-choice advisory; SDK owns ordered transport fallback and current attempt outcomes. Preserve existing parent obligations: `EG-DECISION-ENGINE-R042; SDK-SOURCE-INGEST-R012.2; preserve deterministic admitted fallback`. Source record `AU:28` SHA-256 `9dac8e5f41f6948885215836733ce3116b8246ca5c9c4725a12a62bdb11cb400`. Parent `R042` remains unchanged. | Planned served acceptance. In served Decide, prefer adequately sampled higher-success paths. Skip threshold-qualified repeated failures. Preserve declared order for missing, stale or undersampled history. Verify the advisory cannot trigger write-back and every score recomputes from its bound counts. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R042.101
Per-model measured tool necessity and every-call mismatch trace
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Per-model measured tool necessity and every-call mismatch trace.** Define `ToolNecessityMeasurement`. Bind model id/revision, tool/capability id and task-cohort digest. Record paired enabled/disabled trial identities, outcome metric, sample counts, threshold, measurement time and digest. A measurement is `necessary`, `not_necessary` or `unknown` only under the declared minimum-sample and outcome-delta policy. No data, stale model revision or insufficient pairs yields `unknown`. Compare every AU tool-call decision to the current model/tool measurement. Emit a mismatch trace event with run, step, decision, model revision, measurement digest and mismatch kind (`unnecessary_call` or `omitted_necessary_tool`). The EG R042 decision remains authoritative; AU consumes at the existing per-tool span path. Producer/consumer boundary. R134.2 relevance is only a candidate prefilter. AU-HARNESS-R018.5 generic profile metrics do not measure tool necessity. AU run_agent per-tool spans are the consumer boundary. Preserve existing parent obligations: `EG-DECISION-ENGINE-R134.2; AU-HARNESS-R018.5; AU-HARNESS-R024.2/.4`. Source record `AU:86` SHA-256 `38315c5f9a088c33c4b81b88b813ed851f97f454d788c9fb07185c88c752f979`. Parent `R042` remains unchanged. | Planned served acceptance. For each paired fixture, show necessary/not-necessary/unknown results. At the AU call boundary prove every disagreement creates a linked trace event and matching decisions create none. Stale or insufficient evidence must not become a necessity verdict. Served EG and AU receipts remain separate and linked by decision/measurement ids. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R129.100
Human correction to approved, versioned behavioral rule lifecycle
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Human correction to approved, versioned behavioral rule lifecycle.** Bind a correction to tenant, run, original output id/digest and correction author/time. A proposal carries rule id, proposed version, scope, source output, predecessor version and lifecycle state. It remains inactive until explicit approval and the existing R129 invariant gate both pass. Invariant compliance is necessary but never substitutes for approval. Activation supersedes the declared prior version atomically. Revocation names the active version and prevents future use while retaining audit history. AU future invocations consume only the approved current version and return its id/version in the run trace. Producer/consumer boundary. Extend R129 promotion authority and AU future-invocation application; R034 contradiction-retraction remains separate. Preserve existing parent obligations: `EG-DECISION-ENGINE-R129/.3/.5; EG-DECISION-ENGINE-R034`. Source record `AU:38` SHA-256 `1d54abebd7cbc92bd3d6c397f334b42d602b4c3b9f77e0091f1c683774701d72`. Parent `R129` remains unchanged. | Planned served acceptance. Served tests cover correction/output mismatch refusal and proposal-only state. They cover approval plus invariant pass, invariant rejection, version replacement and revocation. Future invocations use only the approved version. Every state transition reads back with actor, version and source-output lineage. Existing R129 invariant behavior stays mandatory. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.100
Public aggregation operation bound to FanoutResult and fleet receipts
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Public aggregation operation bound to FanoutResult and fleet receipts.** Define the generated `AggregateFanout/v1` request. Bind the selected existing `AggregationOp`, TaskPlan digest and AU `FanoutResult` identity. Include expected subtask ids and GraphOS durable instance-receipt ids/digests. Define the result with operation/version, ordered input receipts, one typed aggregate artifact/schema version, result digest and graph revision. EG applies the already-selected operator to the complete receipt set. It adds no fan-out width, concurrency policy or second aggregation authority. A served independent readback resolves the returned artifact by tenant/id/revision and compares the digest before success. Producer/consumer boundary. AU owns FanoutResult production; GraphOS `agents.run` owns durable instance receipts and capacity/refusal. EG owns selected operator and public application/readback contract only. Preserve existing R134.1/.3 and ARBORA-FLEET-R024.5-.9. Preserve existing parent obligations: `EG-DECISION-ENGINE-R134.1/.3; AU-CONTROL-R043.2/.3; ARBORA-FLEET-R024.5-.9`. Source record `AU:30` SHA-256 `8f2ff3030a71d67b20cd19301f0ed8cef75e975403595cec4060abf9fa8952c1`. Parent `R134` remains unchanged. | Planned served acceptance. At served `agents.run` -> AU `_fork_fanout` -> EG aggregation, test all-success results and named failure gaps. Refuse missing, duplicate or stale receipts and concurrent-budget excess. Independently read back the artifact. The output must bind the same selected operation/version and exact AU/GraphOS receipt set. No extrapolated capacity claim is added. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.101
Designated coordinator delivers one complete structured artifact
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Designated coordinator delivers one complete structured artifact.** Extend the existing task plan with one designated `coordinator_id` and a typed final-artifact declaration (schema id/version and artifact kind). The coordinator receives the complete FanoutResult and produces exactly one artifact. Bind each expected subtask id to its result or named failure gap. No result may disappear in synthesis. The artifact and delivery receipt bind plan digest, coordinator, child receipt ids, schema version, artifact digest and final readback identity. Reuse R134 aggregation and AU fan-out. Do not add a second orchestrator. Producer/consumer boundary. EG-selected TaskPlan/AggregationOp -> AU `_fork_fanout` FanoutResult -> named coordinator -> one final artifact. Retains AU-CONTROL-R043.2/.4 named gaps. Preserve existing parent obligations: `EG-DECISION-ENGINE-R134.1/.3; AU-CONTROL-R043.2/.4; AU-HARNESS-R020.4/.8`. Source record `AU:94` SHA-256 `19331af6d24dacefccebddcae637919b39cb111b800e3bd239a68b42b8ad10c7`. Parent `R134` remains unchanged. | Planned served acceptance. The served fan-out test sends multiple outputs and a named failed gap through the coordinator. Read back one structured artifact. Refuse absent coordinator, missing/duplicate child accounting, schema-invalid artifact or mismatched digest. Verify a non-coordinator cannot finalize and every child is accounted for. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.100
Relevance-triggered instruction disclosure with separate initial/runtime versions
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Relevance-triggered instruction disclosure with separate initial/runtime versions.** Define an EG disclosure decision/event bound to instruction-set id, immutable version/digest, relevance trigger, decision id and scope. Initial rules are a distinct phase delivered before the first agent action. Runtime refinements are disclosed only when their declared relevance trigger occurs. Each event records phase, trigger, instruction version/digest, run and sequence, plus applied/refused outcome. EG owns relevance selection; AU run loop applies the exact selected version and records the event. No duplicate local context selector is introduced. Producer/consumer boundary. Existing EG context/decision authority -> AU run loop. General context selection, reminder and trace counters do not cover disclosure. AU sole writer owns runtime application. Preserve existing parent obligations: `EG-DECISION-ENGINE-R137; AU-HARNESS-R024.2/.6`. Source record `AU:59` SHA-256 `0b55041f0517baa9de449e3d712356a0e252cd194365e09ae559e9067cc8eb1f`. Parent `R137` remains unchanged. | Planned served acceptance. Through served Decide and the AU run-loop consumer, prove initial instructions precede execution. Withhold runtime refinement before its trigger, disclose it at the trigger and trace-link each disclosure. Stale or unauthorized instruction revisions refuse without application. Verify distinct initial/runtime tags and exact version readback. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.101
Held-out question identity and full/compressed answer comparison in replacement gate
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Held-out question identity and full/compressed answer comparison in replacement gate.** Extend this existing replacement gate with held-out question identity. Bind full and compressed answer digests for comparison. Record declared tolerance for answer quality degradation. Define typed verdict when paired answer comparison fails. Retain raw context when paired verdict fails. Prove tests compare identified held-out questions. Producer/consumer boundary. AU ContextManager gates context replacement; EG verdict controls raw/summary selection. Preserve AU-HARNESS-R013 validation contracts. Source record `AU:37` SHA-256 hash pending. | Served replacement gate accepts full answer and summary. Degradation below tolerance retains raw context. Failed paired verdict returns typed refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R137.102
Recursive call signature producer and validation at every boundary
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Recursive call signature producer and validation at every boundary.** Extend existing recursive request/result contracts with input/output and admitted tool signatures. Bind primitive/function handle and span digests. Record each recursive sub-model's typed input/output signature and tool binding. Validate signature at every call boundary with refusal on mismatch. Define signature/model/tool trace binding through execution. Producer/consumer boundary. AU run_full_rlm/RLMEnvironment executes within EG limits. EG records and validates signatures. Preserve AU-HARNESS-R026 request tracing. Source record `AU:40` SHA-256 hash pending. | Served recursive calls bind all signatures and tool admits. Mismatched signature refuses with evidence of expected/actual.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.102
Delegation quality threshold over a stable outcome window
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Delegation quality threshold over a stable outcome window.** Define an EG delegation-admission verdict. Bind task class, quality metric, declared threshold and observation-window start/end. Record sample count, outcome-set digest and policy revision. Admit delegation only when the measured quality over the complete stable window meets the declared threshold. Insufficient samples, gaps, mixed revisions or stale evidence return typed not-ready/refusal. AU executes delegation only against the committed verdict. Do not substitute retrieval saturation, generic test coverage or a free-floating data-plane window. Producer/consumer boundary. EG owns authoritative TaskPlan/delegation admission; AU executes the admitted plan. Existing retrieval quality-saturation logic is adjacent only. Preserve existing parent obligations: `EG-DECISION-ENGINE-R134.1/.3; EG-FEDERATED-QUERY-R082`. Source record `AU:24` SHA-256 `7cbecf865c6185e23ec202d541c5f8d33388338af413ac06209709c619fbe200`. Parent `R134` remains unchanged. | Planned served acceptance. Served Decide matrix proves below-threshold and unstable/incomplete windows refuse, while a complete above-threshold window admits. Mutate a sample, threshold, metric or policy revision and require a new verdict. AU consumer demonstrates no delegation effect on refusal. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.103
Summary-only sub-run return schema and parent-remaining context
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Summary-only sub-run return schema and parent-remaining context.** Extend the existing fan-out result and trace contract with summary fields. Bind parent budget enforcement and decision/child/summary links atomically. Define typed rejection of raw oversized returns. Record each sub-run's summary digest and parent-context remainder. Producer/consumer boundary. EG decides delegation; AU summary producer returns only the bounded result. Preserve existing fan-out obligations and planning authority. Source record `AU:39` SHA-256 hash pending owner validation. | Served fan-out routes the typed summary and budget enforcement. Oversized/raw result refusal is typed. Parent remainder is retained after verdict fails.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.104
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define AnswerCandidateRankingV1 under the decide contract. It binds candidate ids, pairwise comparison records, verifier_present as false, global order, tie rule, retained ids and revision actions. | A schema test round-trips the record and rejects a missing tie rule.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.105
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The engine must compare answer candidates pairwise without a verifier. It must derive one global order. Equal scores must order by the lowest candidate id. The engine must retain the top k candidates and must propose bounded revisions for the others. | A fixture of four candidates yields the expected order, retention and revision actions.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.106
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The ranking attaches in handle_decide beside the existing task-plan decisions. The served response carries the ranking. A readback call returns the recorded ranking by decision id. | A served Decide call returns the ranking, and the readback returns the same record.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.107
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The engine must refuse a ranking request that names a verifier, has fewer than two candidates, or exceeds the revision bound. Each refusal must carry a typed reason. | Each refusal case returns its typed reason and records no ranking.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.108
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit one premise per pairwise comparison and one for the global order. It must record the retained set and every revision action. | A trace shows the premises, the retained set and the revision actions.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.109
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served Decide wire method. The integration test is tests/decide/test_answer_ranking_served.py::test_revisions_only_for_non_retained. It observes revisions only for non-retained candidates and reads the ranking back. | That test passes against the served engine.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.100
Trace-derived fix admission requires paired before/after regression receipts
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Trace-derived fix admission requires paired before/after regression receipts.** Define a correction proposal bound to failed-run trace digest, proposed fix revision, exact regression-test identity and test environment. Require a before receipt showing the test fails at the declared pre-fix revision. Require an after receipt showing it passes at the declared post-fix revision. Both receipts bind test digest, source revision and run identity. Mismatch, missing receipt or reversed outcome refuses. Reuse existing correction/admission authority and preserve propose-only flow. Producer/consumer boundary. AU CorrectionProposal/study_admit supplies trace and benchmark; EG decides admission. Generic benchmark lift does not replace paired proof. Preserve existing parent obligations: `EG-DECISION-ENGINE-R136.1-.6; AU-HARNESS-R004.1; AU-HARNESS-R019.9/.10`. Source record `AU:32` SHA-256 `1d12449ecff9c30c5999933324f1f705fd826539eba6182f3e6d2773c263fec3`. Parent `R136` remains unchanged. | Planned served acceptance. Positive paired test uses identical test digest and environment across before/after revisions and proves fail then pass. Negative cases alter either revision/test digest, omit a receipt, pass before or fail after. Each refuses admission. Read back the admitted proposal with both receipt links. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R031.100
Paper relevance admission against platform goals and graph content
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Paper relevance admission against platform goals and graph content.** Define an EG per-paper admission request/decision. Bind paper locator/content digest, summary digest and platform-goal/graph-snapshot revisions. Record relevance dimensions/scores, threshold and selected claim ids. Select a paper for ingestion only when it meets the relevance rule against platform goals and current graph content. The verdict names the scored evidence and selected claims. Excluded papers produce no graph write. This definition covers scoring/admission only, not scheduled retrieve. Producer/consumer boundary. GraphOS owns six-hour durable scheduler; SDK owns paper retrieve/provider receipts; EG owns relevance scoring/admission and selected-claim contract. Preserve existing parent obligations: `EG-DECISION-ENGINE-R031; ARBORA-OPS-R022.2; SDK-SOURCE-INGEST-R005`. Source record `AU:41` SHA-256 `8c69b66d62c833b4da482e38a51efa624c3e3fc924d6fd6d3e2ef114378a8527`. Parent `R031` remains unchanged. | Planned served acceptance. For served EG admission, test a paper relevant to both goals and graph. Also test one relevant to only one, below threshold and duplicate/stale snapshots. Only the both-relevant accepted record yields a selected-claim ingestion request. Read back the decision and source bindings. Do not claim six-hour schedule or provider retrieve is implemented. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R036.100
Typed substitutable prompt, tool, memory and control-flow primitives
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed substitutable prompt, tool, memory and control-flow primitives.** Extend graph.assemble primitives to a closed typed union covering prompt, tool, memory and control-flow components. Each primitive exposes identity/version, input/output schema digest, capability/effect declaration and substitution compatibility contract. A candidate harness graph is accepted only when every edge type-checks and replacement preserves declared capabilities/effects. Recorded run traces can create improvement proposals for each primitive kind, but proposals never mutate active composition. Producer/consumer boundary. EG graph.assemble is composition authority; AU HarnessPort executes selected composition. Existing prompt-only optimization proposal path remains and typed HarnessPort is preserved. Preserve existing parent obligations: `EG-DECISION-ENGINE-R036; AU-CONTROL-R002; AU-HARNESS-R007/.011`. Source record `AU:46` SHA-256 `04556089bf2790a52c59ede225b6212ccd90c0f7ca1dfad07b869ac9de6a19a1`. Parent `R036` remains unchanged. | Planned served acceptance. Test substitution for all four primitive classes. Include compatible/incompatible schema/effect changes. Keep trace-derived proposals inactive until normal admission. Served assembly receipt names each primitive/version and compatibility proof. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.101
Per-criterion report revision nonregression
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Per-criterion report revision nonregression.** Bind each report revision to a stable rubric digest and criterion ids. Record prior satisfaction states, new evidence/outcome ids and independent grader revision. For every previously satisfied criterion, the new revision must preserve satisfaction. A regression blocks promotion and records the failing criterion. Self-reflection text is not a measured outcome. Use AU ContinuousEvaluationEngine reports as inputs and preserve EG R136 round verdict authority. Producer/consumer boundary. AU ContinuousEvaluationEngine produces per-criterion evidence/report revisions; EG evaluates the bound round verdict. Aggregate divergence and self-reflection are not criterion-level nonregression. Preserve existing parent obligations: `EG-DECISION-ENGINE-R136.1/.2/.4; AU-HARNESS-R021.3/.6`. Source record `AU:47` SHA-256 `9f72c0e6cb8d476050ffde54043ba0e37a063bfda05eb3e27020312cd9eeb69b`. Parent `R136` remains unchanged. | Planned served acceptance. Start the served sequence with satisfied and unsatisfied criteria. Apply process-level feedback. Accept nonregressing revisions and refuse a previously satisfied criterion regression. Mutating rubric or prior report digest invalidates the comparison. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R121.100
Step verification binds uncertainty and trace proof before continuation
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Step verification binds uncertainty and trace proof before continuation.** Define a `StepVerification`. Bind run/step id, input/output digests and evidence ids. Record verifier/policy revision, uncertainty interval and proof/trace digest. Each reasoning step receives a typed verdict (`verified`, `failed`, `uncertain`). Only `verified` steps may feed dependent conclusions. A failed or uncertain step and all derived dependents are withheld/refused with the dependency chain named. Reuse typed Claim/Evidence provenance. A Claim class alone does not imply step verification. Producer/consumer boundary. EG owns proof/evidence/verdict; AU run execution gates continuation on the returned verdict. Existing Claim/Evidence and ordered trace digest semantics remain intact. Preserve existing parent obligations: `EG-DECISION-ENGINE-R121 typed Claim/Evidence; AU run-step continuation owner`. Source record `AU:54` SHA-256 `78c1b58ee2c97f19ad4834981d1b75adeb89c82881710aed055a0cc6f5c36760`. Parent `R121` remains unchanged. | Planned served acceptance. The served AU/EG chain verifies a supported step and rejects an under-evidenced step. Downstream conclusions must be absent for failed/uncertain dependencies. Alter proof digest, evidence revision or uncertainty bounds and require re-verification. Trace readback shows the entire dependency chain. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R138.100
Adversarial generated-code verifier is a mandatory admission gate
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Adversarial generated-code verifier is a mandatory admission gate.** Define a changeset-bound adversarial verifier request over generated artifact digest, declared tests, threat/attack policy revision and verifier revision. Its receipt enumerates attempted break cases and edge-case ids with fixed/retested state. Require a complete verifier receipt for generated-code admission. Fix each surfaced edge case against a new artifact digest and recheck it. Unresolved, missing, stale or mismatched cases block acceptance. Keep materialization under existing governed write authority. Producer/consumer boundary. AU generates/proposes code and verifier evidence; EG admission consumes it. Existing governed write path retains materialization authority. ProbeVerdict R138.1-.6 is a separate red-team probe capability. Preserve existing parent obligations: `EG-DECISION-ENGINE-R138.1-.6; existing correction/evaluation admission and governed write path`. Source record `AU:55` SHA-256 `3d07d9e40d19b8d4502fcbf3fc2e682f67bcdeaa0730d5d698f7af32767bb785`. Parent `R138` remains unchanged. | Planned served acceptance. Served admission accepts only a complete receipt matching the proposed artifact digest. Every edge case must be resolved and retested. Negative cases include skipped verifier, unresolved edge case, stale artifact, changed tests and failed recheck. None can activate/write code. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R136.102
Outcome, rubric and artifact-bound criterion grading required before proposal admission
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Outcome, rubric and artifact-bound criterion grading required before proposal admission.** Require proposal evidence bound to declared outcome and immutable rubric id/version/digest. Bind the exact graded artifact id/digest and grader revision. Include a score/verdict and evidence reference for every rubric criterion. Every required criterion must be graded. Missing, ungraded, mismatched or stale artifacts return a typed refusal before any proposal is admitted. Aggregate score cannot hide a missing criterion. Producer/consumer boundary. AU study_admit/ContinuousEvaluationEngine supplies the report; EG decision verdict controls admission. Preserve R019/R021 evidence and per-criterion R136.101 behavior. Preserve existing parent obligations: `EG-DECISION-ENGINE-R136.1/.2/.4; AU-HARNESS-R019.9/.10; AU-HARNESS-R021.1/.6/.7`. Source record `AU:56` SHA-256 `712793000145f8e6b1c3ac1de647e91256312eb601def299653a9671de2757ba`. Parent `R136` remains unchanged. | Planned served acceptance. Serve one fully graded report admitted against a proposal. Refuse missing outcome/rubric, ungraded criteria, wrong artifact digest, stale rubric or absent grade evidence. Read back the proposal and prove no admission side effect on refusal. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R138.101
Five-class semantic changeset review with evidence and impact filtering
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Five-class semantic changeset review with evidence and impact filtering.** Define a review request bound to base/head revisions and changed-file digest. The semantic review evaluates injection, authentication bypass, data exposure, cryptographic flaws and business-logic flaws. Each finding carries class, affected path/range, exploit/impact evidence, severity, confidence and trace to reviewed artifact. A versioned impact policy filters low-impact false positives with a retained disposition. No high-impact or unreviewed class may be silently dropped. This is distinct from R138 probe scorer selection. Producer/consumer boundary. EG owns review verdict/schema. Named GraphOS authenticated changeset-review producer/consumer must be served and linked separately. Existing R138.3 probe endpoint is not that consumer. Preserve existing parent obligations: `EG-DECISION-ENGINE-R138.1/.2/.5; GraphOS changeset review owner pending exact served integration`. Source record `AU:83` SHA-256 `0c5f2631be262ba69472eb94841b7acfbcfd6d0cb379382c528ccd0efb4d22e7`. Parent `R138` remains unchanged. | Planned served acceptance. Served review fixtures include one finding from each class, one evidence-backed low-impact false positive, and an injected high-impact finding. Verify five-class coverage, changed-range binding, evidence retention and filtering disposition. Reject missing revision, unsupported class, absent proof or silently omitted high-impact findings. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R036.101
Compose discovered coding-agent facts with skill transformations
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Compose discovered coding-agent facts with skill transformations.** Extend graph.assemble with verified coding-agent facts: identity, capability and path-discovery receipt/revision. Include ordered skill transformation ids/versions and input/output schema digests. EG chooses only from supplied verified facts and emits a deterministic composition plan binding agent, skills and artifact contract. It never scans PATH or renders a UI. AU owns executable discovery; WebUI owns sandboxed frame rendering. Producer/consumer boundary. EG composition authority -> AU PATH discovery and skill execution -> WebUI isolated generated-artifact frame. Existing DESIGN guidance does not provide these producer/consumer receipts. Preserve existing parent obligations: `EG-DECISION-ENGINE-R036; AU-CONTROL-R003; AU-HARNESS-R009; WEBUI-DESIGN-R001; WEBUI-APPS-R001`. Source record `AU:107` SHA-256 `d179fc0eb33039df3a87efe8a59ce2a635f0e39f360c58f925011448d0401cdc`. Parent `R036` remains unchanged. | Planned served acceptance. Served EG assembly accepts verified agent/skill facts and returns a plan with exact revisions and transformation order. Refuse absent/stale discovery receipts, incompatible transformation schemas or changed artifact digest. Separate AU discovery receipt and WebUI sandbox receipt must be linked for end-to-end closure. No runtime implementation is claimed. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R014.100
Choose the smallest adequate legal solution from explicit size and cost facts
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Choose the smallest adequate legal solution from explicit size and cost facts.** Extend bounded composition with candidate source-size facts: exact artifact bytes and line count. Bind measured per-run cost, adequacy verdict and legal/policy constraints to candidate/revision. First exclude candidates failing required behavior, tests, policy or legal constraints. Among adequate candidates apply the declared size/cost objective and emit each measured fact and tie-break. Unknown size/cost or adequacy evidence cannot be treated as zero. This child does not settle the shortcut-comment policy, which remains held for coordinator resolution. Producer/consumer boundary. Reuse R014 exact bounded solver/graph.assemble authority. AU records execution cost. Code-size measurement and candidate adequacy feed EG. Preserve legal/policy constraints and hold comment-style conflict. Preserve existing parent obligations: `EG-DECISION-ENGINE-R014 existing bounded composition semantics; AU-HARNESS-R009; AU-CONTROL-R006; AU108 comment-policy conflict held`. Source record `AU:108` SHA-256 `2dfb2ab7469f19faf03d91782fa276ed2c613dec2e1d1fce2c629e5b8974b476`. Parent `R014` remains unchanged. | Planned served acceptance. Tiny exhaustive candidates prove the selected result is the smallest/cost-optimal eligible composition under the declared objective and constraints. Test equal-size/cost ties, unknown facts, inadequate smaller candidate and illegal candidate refusal. The output preserves separate size and cost measurements. No test imposes or removes shortcut comments. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R147
Index-time distillation of language-model relevance judgments (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Index-time distillation of language-model relevance judgments (rollup).** Index-time scoring replaces query-time model calls. Define teacher-quality ranking scores persisted per document. Declare score identity, revision and fidelity bounds. Define query-time ranking that accepts pre-computed scores. Children `.1`–`.6` deliver it. | Served ranking chains distilled scores from index; no models called.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R147.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `TeacherJudgmentV1{document_id, score, fidelity, scorer_id, scorer_revision}`, `DistilledRankerV1{candidate_ids, scores, score_digest}`, `QueryTimeRankingV1{top_k, no_model_call_contract}`. Each score binds document id, exact value, fidelity bounds and scorer provenance. No query-time model is permitted. Proving test: `crates/eg-types/src/decision/distilled_ranker.rs::tests::distilled_scores_round_trip`. | Round-trip preserves all field types; rejects missing scorer/digest.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R147.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Index builds a fully populated scorer and persists all document scores. Query-time ranking selects top-K by stored score only. No dynamic reranking, feature computation or model inference occurs at query time. Score lookup is O(1) per candidate. Preserve existing retrieval flow and collection boundaries. Proving test: `crates/eg-types/src/decision/distilled_ranker.rs::tests::no_query_time_calls`. | Query-time code path makes no model transport call. Top-K selection uses exact stored scores.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R147.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Index producer computes teacher scores offline. Route through index-time ETL. Query consumer reads stored scores in `src/server/handlers/query/planning.rs:424`. No fallback to live scoring permitted. Proving test: `src/server/handlers/query/federated_tests.rs::distilled_ranking_wired`. | Served query returns only stored scores. Missing scores are handled by refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R147.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Missing document score, stale scorer revision or zero score count refuse. Refusing before ranking. Invalid top-K bounds refuse. Proving test: `src/server/handlers/query/federated_tests.rs::missing_score_refuses`. | Negative cases cover absent documents, stale scorer, invalid K.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R147.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind scorer id/revision/digest, all document ids and scores, fidelity bounds and persisted-score timestamp. Record that no live scoring occurred. Proving test: `src/server/handlers/query/federated_tests.rs::distilled_evidence_binds_scorer`. | Decision records scorer version, score count and zero-model-call proof.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R147.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::UnifiedQuery` with distilled ranking. Observe top-K results from persisted scores. Cross-owner: AU consumer accepts no-model-call contract. Proving test: `tests/query/test_distilled_ranking_served.py::test_index_time_scoring_and_query_ranking`. | Query served with stored scores; zero model calls recorded.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R148
Typed command-config/mode schema and loading/replay contract (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed command-config/mode schema and loading/replay contract (rollup).** Define versioned command/config/inference-mode producer. EG decides mode; AU command loader applies config. Define reproducible receipt bound to config and inputs. Children `.1`–`.6` deliver it. | Served decision binds config schema; AU receipt proves replay.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R148.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `CommandConfigV1{schema_id, mode_id, config_digest, settings_hash}`, `ModeDecisionV1{mode, config, validation_rules}`, `ConfigReplayReceiptV1{config_digest, input_digest, result_digest}`. Config schema is versioned and bound to mode. Each config is immutable and hashable. Proving test: `crates/eg-types/src/decision/command_config.rs::tests::config_round_trip`. | Round-trip preserves schema, mode, settings and hash. Rejects unknown schema.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R148.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** EG selects mode and config based on decision inputs. Config is immutable after decision. AU loader validates config against declared schema before application. Repeated same-input invocation must produce identical result/receipt. Invalid config is refused at load time. Proving test: `crates/eg-types/src/decision/command_config.rs::tests::replay_idempotence`. | Same input/config yields same output digest. Changed config yields different result.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R148.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend `Method::Decide` to route mode selection through existing EG decision path. Wire schema validation into AU `HarnessConfig` loader. Config is supplied immutably to execution. Proving test: `src/server/handlers/decide/stat_tests/command_config_tests.rs::decide_routes_mode`. | Served decision returns mode and validated config. AU receipt links applied config.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R148.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Unknown schema, stale mode revision or invalid config against schema refuse before execution. Changed config between decision and invocation refuses. Proving test: `src/server/handlers/decide/stat_tests/command_config_tests.rs::invalid_config_refuses`. | Negative cases cover schema mismatch, stale mode, changed config.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R148.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind schema id/version/digest, mode id, config digest and settings hash. Record validation rules applied and AU loader acceptance. Proving test: `src/server/handlers/decide/stat_tests/command_config_tests.rs::config_evidence_binds_schema`. | Decision record lists schema, mode and validation outcome.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R148.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::Decide` mode selection. Apply config through AU command loader. Verify replay and result stability. Proving test: `tests/decide/test_command_config_served.py::test_mode_decision_and_replay`. | EG served decision; AU loader validates and applies config.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R149
Search-state record combining transcript, evidence, constraints and claims (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Search-state record combining transcript, evidence, constraints and claims (rollup).** Define unified search-state binding all four dimensions. No continuation contract restores incomplete state. Define context-eviction readback acceptance. Children `.1`–`.6` deliver it. | Served search continuation reads complete four-field state.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R149.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `SearchStateV1{transcript_digest, evidence_set_digest, active_constraints, open_claims, state_version, timestamp}`. Include all four fields immutably. Transcript is conversation history digest. Evidence set is all cited sources digest. Constraints are current search rules. Claims are unresolved questions. Proving test: `crates/eg-types/src/decision/search_state.rs::tests::state_round_trip`. | Round-trip preserves all four fields and version/timestamp.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R149.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Capture state atomically after each message. State restores all four components after context eviction. No field may be partially recovered or reconstructed. State version increments on any change. Proving test: `crates/eg-types/src/decision/search_state.rs::tests::eviction_readback`. | Eviction + readback recovers identical transcript, evidence, constraints.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R149.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend AU harness continuation interface to accept and emit complete search state. Route through durable memory store for persistence. Proving test: `src/server/handlers/query/search_tests.rs::state_continuation_wired`. | AU consumer reads state; durable store persists all fields.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R149.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Incomplete state, missing field or stale version refuses continuation. Proving test: `src/server/handlers/query/search_tests.rs::incomplete_state_refuses`. | Negative cases cover missing transcript, evidence, constraints.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R149.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind all four field digests, state version and recovery timestamp. Proving test: `src/server/handlers/query/search_tests.rs::state_evidence`. | Record lists all four field digests and version.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R149.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve search continuation with complete state. Observe all four fields restored post-eviction. Proving test: `tests/query/test_search_state_served.py::test_eviction_and_recovery`. | Continuation restored identical transcript, evidence, constraints.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R150
Session-note capture and reuse with stale/conflict behavior (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Session-note capture and reuse with stale/conflict behavior (rollup).** Define automatic session-note capture from prior runs. Extend memory/context consumer to apply captured notes. Define stale and conflicting note behavior. Children `.1`–`.6` deliver it. | Served context includes automatically captured prior session notes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R150.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `SessionNoteV1{note_digest, session_id, user_id, task_id, timestamp, relevance_score}`, `NoteCacheV1{current_notes, stale_notes, conflict_notes}`. Notes are tenant-isolated and content-addressed. Relevance is a [0,1] score from content matching. Conflicts arise when different outcomes occur for identical input. Proving test: `crates/eg-types/src/decision/session_notes.rs::tests::notes_round_trip`. | Round-trip preserves all note fields and relevance. Rejects unknown user.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R150.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Capture notes automatically from successful runs. Apply notes when relevance exceeds threshold (default 0.7). Stale notes (>7 days) are marked but retained for audit. Conflicting notes (same input, different output) are both retained with conflict flag. No note overwrites another; all precedents stay visible. Proving test: `crates/eg-types/src/decision/session_notes.rs::tests::capture_and_apply`. | Relevant notes applied; stale notes marked; conflicts visible.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R150.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend AU context consumer to read captured notes from EG memory. Route through authorized memory dispatch respecting tenant isolation. Proving test: `src/server/handlers/decide/memory_tests.rs::notes_wired`. | Authorized context read includes captured notes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R150.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Missing user id, invalid relevance (not in [0,1]) or unauthorized user refuses note read. Stale >14 days are archived but may be retrieved. Proving test: `src/server/handlers/decide/memory_tests.rs::unauthorized_refuses`. | Negative cases cover invalid user, relevance out of range.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R150.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind user/task/session ids, note digest, capture timestamp and applied relevance score. Record whether note was stale/conflicting. Proving test: `src/server/handlers/decide/memory_tests.rs::notes_evidence`. | Record lists applied notes with relevance and staleness.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R150.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve authenticated query with automatic session-note capture. Apply relevant notes to context. Observe stale/conflict handling. Proving test: `tests/query/test_session_notes_served.py::test_capture_and_reuse`. | Query served with captured notes; conflicts visible to consumer.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R151
Importance-weighted penalty resisting feature loss and post-sync consolidation (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Importance-weighted penalty resisting feature loss and post-sync consolidation (rollup).** Define importance evidence for each feature. Apply weighted penalty to loss. Separate consolidation from routing. Children `.1`–`.6` deliver it. | Serve feature importance; post-sync consolidation queued separately.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R151.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `FeatureImportanceV1{feature_id, importance_weight, evidence_digest}`, `PenaltyObjectiveV1{loss_coefficient, importance_scale}`. Importance is [0,1] normalized. Each feature binds measured importance and evidence source. Penalty objective combines loss and importance linearly. Proving test: `crates/eg-types/src/decision/importance_penalty.rs::tests::importance_round_trip`. | Round-trip preserves feature id, weight, evidence. Rejects weight outside [0,1].
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R151.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Compute weighted loss = loss_component + importance_scale * importance_weight * feature_loss. High-importance features incur higher penalty on loss. Preserve low-importance feature variability. Proving test: `crates/eg-types/src/decision/importance_penalty.rs::tests::penalty_respects_importance`. | High-importance feature loss incurs larger penalty than identical low-importance loss.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R151.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend embedding producer to emit feature importance. Route penalty through EG solver. Separate post-sync consolidation trigger from routing logic. Proving test: `src/server/handlers/decide/embedding_tests.rs::penalty_wired`. | Embedded importance; penalty computed; consolidation queued separately.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R151.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Invalid importance (not in [0,1]), missing evidence or zero feature count refuse. Proving test: `src/server/handlers/decide/embedding_tests.rs::invalid_importance_refuses`. | Negative cases cover out-of-range weights, missing evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R151.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind each feature id, importance weight and evidence digest. Record penalty objective and applied loss/importance scales. Proving test: `src/server/handlers/decide/embedding_tests.rs::penalty_evidence`. | Record lists all feature weights, evidence and penalty scale.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R151.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve embedding with importance weights. Apply weighted penalty. Verify post-sync consolidation is queued, not routed. Proving test: `tests/decide/test_importance_penalty_served.py::test_penalty_and_consolidation_queue`. | Penalty computed; consolidation separately queued post-sync.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R140
Trajectory refinement and ranking family (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Trajectory refinement and ranking family (rollup).** Groups complexity-gated K-trajectory deliberation, provenance-preserving experience reinsertion, outcome-driven branch breadth and verifier-free pairwise ranking. Preserve calibrated-ranking requirements in R130 and AU generation/execution ownership. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R141
Memory-change evaluation and rewrite admission (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Memory-change evaluation and rewrite admission (rollup).** Requires fidelity and memory-quality evidence before activating a memory change. Failed candidates preserve the prior active memory. R060 fitted-head promotion remains a separate model gate. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R142
Atomic-before-workflow local-model certification (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Atomic-before-workflow local-model certification (rollup).** Defines the EG attestation producer, AU local-model evaluation consumer and GraphOS validation gate. Existing GraphOS R034 identity bindings and host policy remain authoritative. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R139.100
Graph-backed comparative sources with exact revision provenance
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Graph-backed comparative sources with exact revision provenance.** Extend comparative `StudySource` admission with a `graph_ref` containing tenant, graph, node, revision and content digest. Resolve the exact revision through the authorized graph read/query path. Compare papers and codebases from graph refs alongside existing filesystem sources without copying source bodies. Record ordered source kind, locator/reference, exact revision, digest and comparison membership in the comparative result. Missing, stale, invisible or digest-mismatched graph references refuse before comparison. Preserve filesystem intake and AU study/feature ownership. Preserve existing parent obligations: `EG-DECISION-ENGINE-R139`. Source record `AU:58` SHA-256 `f13717cacb9e87ff76591467e17b5f9d76d44577f62d71b57d57c42bc89d37ba`. | Serve one graph paper, one graph codebase and one filesystem source in the same comparison. Assert exact ordered references, revisions and digests in readback. Refuse stale, unauthorized and mismatched graph refs before comparison, while filesystem-only intake remains valid. AU consumer receipts remain a separate dependency.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R019.100
Decision-wide evidence provenance and human approval before recommendation commit
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Decision-wide evidence provenance and human approval before recommendation commit.** Bind each decision record to its id/revision. Record the simulation, inspection and process-knowledge stream ids/revisions/digests used. Expose an authorized reviewer-readable provenance read. Before any recommendation commit, require an approval receipt bound to decision revision and recommendation digest. Include reviewer principal, approval time and approval-record revision. Missing, stale or mismatched approval refuses before commit. Retain existing R019 re-derivation/CAS and R047 reference semantics. Do not duplicate governed-effect audit rows. Preserve existing parent obligations: `EG-DECISION-ENGINE-R019`. Source record `GRAPHOS:17` SHA-256 `0e4858352b73b18661ed21ef503cc4c4f36e72045c3ffeff8d2094d9f8f8e50a`. | Serve a decision with all three evidence streams and independently read back exact provenance. Refuse a recommendation commit with missing, stale, wrong-reviewer-scope or digest-mismatched approval and prove no decision revision/effect changed. Approve the exact revision, commit once, and verify reviewer provenance and idempotent retry under R019.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R029.100
Typed retrieval command configuration and inference-mode digest binding
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed retrieval command configuration and inference-mode digest binding.** Define a versioned typed command-config document per retrieval command. Bind command id/schema version, typed parameters and referenced inference-mode id/version/digest. EG Decide binds the retrieval plan and inference-mode digest to its decision. AU loads the immutable command file and validates its schema. Its mode digest must match the EG decision before use. AU run evidence binds command/config digest, mode digest, input digest, selected-plan revision and result digest. Missing, malformed, stale or mismatched configuration refuses before execution. File loading remains AU-owned. Preserve existing parent obligations: `EG-DECISION-ENGINE-R029`. Source record `PIPE:22` SHA-256 `0d3964cba3359a3b454f2fd7b61f2b893b3aec0d58613062b859c2201344980c`. | Through the real retrieval command, load a valid file. Assert config/mode/plan digests in the run record. Refuse missing file, invalid typed field, unknown mode and stale/mismatched mode digest before command effects. Repeat the same command/input and verify identical config, mode and decision bindings. Do not assert result determinism beyond declared source behavior.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R140.100
Complexity-gated K-trajectory decision
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Complexity-gated K-trajectory decision.** Extend the existing `Method::Decide` / `QuestionKind::TaskPlan` path from R134.5. Do not execute models in EG. The request binds task id/digest and ordered complexity features. Each feature has id, value, unit and source ref/revision/digest. Bind scorer id/revision/digest and policy id/revision/digest. The policy declares the score calculation/units, threshold, simple branch K=1, and complex-branch permitted K range `[2,max_k]`. Return `TrajectoryBudgetDecisionV1` with decision id/revision/digest, all input and policy digests, score, branch and permitted K. It is a plan for AU, not a deliberation result. AU must bind every alternative and execution receipt to this decision digest. AU-CONTROL-R043 independent-subtask fan-out does not cover this consumer. Missing or stale features/scorer/policy, unpinned score calculation, invalid K, or complex K<2 refuses before AU execution. Preserve existing parent obligations: `EG-DECISION-ENGINE-R140`. Source record AU:44 SHA-256 `74416937af9a4934ae1f5d1a02e30336deb1535189a07f53fb81fb352f81779f`. **Pending owner prerequisite:** AU has no reviewed `orchestrate` consumer field binding the decision digest to K trajectory requests/results. Keep the row SPECIFIED until that contract and served receipt exist. | Named served acceptance: `tests/decide/test_trajectory_refinement_served.py::test_complexity_selects_single_or_bounded_k` proves simple K=1 and no deliberation dispatch, and complex K in `[2,max_k]` with exact plan digest. `::test_complexity_policy_and_k_refusals` covers missing/stale scorer, absent policy and invalid/below-minimum K. AU execution receipt acceptance remains an explicit AU dependency. No producer evidence is inferred.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R140.101
Provenance-preserving trajectory projection and reinsertion
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Provenance-preserving trajectory projection and reinsertion.** The TaskPlan/Decide path binds each source trajectory by run id, candidate id, source revision and trace digest. Return the pinned redaction-policy id/revision/digest and tokenizer id/revision. Record removed reasoning-token half-open ranges, retained task/result/evidence ranges, deterministic shuffle seed, and ordered projected ids. AU performs the projection and deliberation. Return a new candidate id/digest and the exact decision digest. Name every consumed source id/digest in its parent list. Accept the new outcome only after validating source revisions and non-overlapping in-bounds ranges. Also validate policy/tokenizer revisions and complete parent bindings. Source trajectories are immutable. Producer is AU `record_outcome -> SkillGraphPipeline` (AU-HARNESS-R022.4). No AU projection/reinsertion receipt defines these fields. This child does not claim existing implementation. Preserve existing parent obligations: `EG-DECISION-ENGINE-R140`. Source record AU:51 SHA-256 `be286cbd079c08493be1dcc0512aa562b6e2f2fec8d3566437837d91b5f36ba0`. **Pending owner prerequisite:** AU must specify the exact projection and appended-candidate receipt on R022.4 before end-to-end acceptance. | Named acceptance: `tests/decide/test_trajectory_refinement_served.py::test_projection_preserves_sources_and_links_candidate` verifies deterministic projection order, removed/retained ranges and source readback; `::test_projection_refuses_bad_ranges_or_missing_parent` proves range/provenance refusal without source mutation. AU R022.4 receipt and deliberation generation remain separate unserved dependencies.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R140.102
Branch-start experience retrieval and outcome-driven breadth
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Branch-start experience retrieval and outcome-driven breadth.** On the R134.5 `Method::Decide` / `QuestionKind::TaskPlan` path, accept search id, branch id/ordinal, tenant and plan digest. Bind ordered prior-attempt refs, each `{branch_id, outcome_revision, outcome_digest, result_class}`, and `BreadthPolicyV1` id/revision/digest. The policy declares the outcome-to-breadth mapping and an initial breadth used only when history is explicitly absent. Return `BreadthDecisionV1` binding the complete retrieved-history digest, previous breadth, selected breadth, policy, task and decision digests. Stale, unauthorized, cross-tenant or incomplete history refuses and is never interpreted as a zero outcome. AU must put decision id/digest and selected breadth in each branch request. Return an outcome receipt tied to that decision before the next branch adapts. Existing AU attachment points are `_dispatch_parallel_batch -> parallel_batch_processor` (R020.5) and `record_outcome -> SkillGraphPipeline` (R022.4). Neither currently binds this breadth decision. Preserve existing parent obligations: `EG-DECISION-ENGINE-R140`. Source record AU:84 SHA-256 `b56fbf074624786b4a8c2b499f985ecc2d14d1e8349d08781cf28aba07c3abef`. **Pending owner prerequisite:** AU branch-start and outcome receipt fields are not defined. Keep SPECIFIED until reviewed and served. | Named acceptance: `test_later_branch_adapts_from_pinned_outcome` records and reads an earlier outcome at the next branch start. Prove the pinned mapping changes breadth. `test_branch_history_refuses_stale_or_cross_tenant` refuses stale/unauthorized history. `test_no_history_uses_declared_initial_breadth` verifies explicit absence. AU R020.5/R022.4 receipt acceptance remains pending and is not claimed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R140.103
Verifier-free pairwise candidate ranking with bounded revision
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Verifier-free pairwise candidate ranking with bounded revision.** Bind the ordered candidate set and digests to pairwise records. Each record has both candidate ids/digests, judge/model revision, verdict and evidence digest. AU:87 requires global ranking, retained top candidates and bounded revision of the rest. It does not select aggregation rules for cycles, incomplete pairs or ties. Existing R130 calibrated relevance ranking is not a pairwise aggregation rule. Do not assume Bradley–Terry or publish rankings before owner selection of a versioned aggregation policy. It must specify cycle/incomplete-pair/tie cases and keep-count/revision bounds. The existing `Method::Decide` TaskPlan path is the proposed EG decision boundary; AU owns comparison execution and revisions. Missing/unpinned aggregation policy, incomplete policy-required pairs, digest mismatch or absent revision limits refuses before any revision request. Preserve existing parent obligations: `EG-DECISION-ENGINE-R140`. Source record AU:87 SHA-256 `6f67238075c0bf262188d97a1813b18bfb0c71e13c6689a583c788d956287612`. **Exact source decision hold:** AU:87 provides no pairwise aggregation/cycle/tie policy or request bounds. This row remains SPECIFIED until that decision and the AU comparison/revision receipt contract are reviewed. | Named hold acceptance: `tests/decide/test_pairwise_ranking_served.py::test_refuses_unselected_aggregation_policy` verifies no ranking or revisions are emitted without an approved versioned policy. After the source owner chooses the algorithm, add `::test_global_order_retains_top_and_revises_rest` with a complete comparison matrix and exact tie/cycle fixture. No global-ranking success or AU execution is claimed before that decision.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R140.104
TaskPlan trajectory-decision wiring row

EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md.

requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R140.105
Trajectory-refinement hot-path proof row

EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md.

requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R141.100
Fidelity-gated memory rewrite evaluation
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Fidelity-gated memory rewrite evaluation.** Extend `Method::DecisionEval` with `MemoryRewriteSubmit` and typed `MemoryRewriteProposalV1`. Bind tenant/memory id and active/candidate revisions/digests. Record fidelity metric id/revision/specification digest/value and signal/token counts. Bind signal-per-token (`signal_count/token_count`, positive denominator), degradation-history refs/digest and rewrite-policy id/revision/digest. The policy pins fidelity and signal-efficiency thresholds plus the degradation rule. The source does not name the fidelity formula or normalization. The metric id must resolve to an immutable reviewed specification, and missing semantics refuse rather than produce Admit. An unresolved metric specification, missing policy or history, or zero token denominator returns typed refusal. Seal an `Admit` or `Discard` `MemoryRewriteEvaluationV1` receipt with all inputs, metric values and reason codes. A failed gate keeps the active revision/digest and discards the candidate; R059 outcome-aggregate fidelity and R128 context elision are not substitutes. **Exact activation-path hold:** current EG requirements do not identify the authoritative memory store or complete set of memory mutation entrypoints. They do not identify a transaction/CAS where this receipt is mandatory. Do not claim a universal rewrite gate until the owning memory mutator and atomic receipt check are named. Preserve existing parent obligations: `EG-DECISION-ENGINE-R141`. Source record EG:23 SHA-256 `ac1b5df0212beaade03e78502a494148692e1a0007c3fa68ee37a2bb6dbe8cce`. | Named hold acceptance at Method::DecisionEval: test_refuses_unresolved_fidelity_metric refuses an absent/unreviewed fidelity formula or normalization. Test_discards_failed_or_stale_rewrite proves failed policy gates preserve the baseline. A positive Admit fixture is pending review of the fidelity metric semantics. Even after that review, activation/readback remains held until the authoritative memory mutation and atomic CAS path are identified. No active-memory change is claimed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R141.101
Memory-change benchmark receipt before admission
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Memory-change benchmark receipt before admission.** Extend the existing `Method::DecisionEval` job with `DecisionEvalOp::MemoryChangeBenchmarkSubmit`. Bind tenant and baseline/candidate snapshot ids/revisions/digests. Bind versioned dataset id/revision/digest, nonempty query ids, expected evidence refs and reference-answer digests. Record `k` and metric, evaluator and policy ids/revisions/digests. Return recall@k and answer-accuracy numerators, positive denominators, values and input digests. The metric/evaluator specification must define exact numerator, denominator, query aggregation, answer-correctness rule and rounding. The source does not supply these formulas. Absent or unreviewed definitions refuse and block positive admission. Refuse an empty dataset, missing expected evidence/answer, zero denominator or incomplete candidate coverage. Refuse any snapshot/dataset/metric/policy mismatch. Require both policy thresholds on the same baseline, candidate and dataset for admission. Require the matching receipt before activating any add, edit, delete, rewrite or consolidation. R060 fitted-head promotion remains distinct. **Exact activation-path hold:** no current EG spec enumerates authoritative memory mutation APIs. No current EG spec shows this gate on every write path. This row cannot claim universal admission until that operation map and atomic gate point are named. Preserve existing parent obligations: `EG-DECISION-ENGINE-R141`. Source record AU:125 SHA-256 `27a6a74820b2b646163d8f7bd58b94167b9f0a3e423b8bf5210fe6e758deb440`. | Named hold acceptance at Method::DecisionEval: test_refuses_unresolved_metric_semantics refuses absent/unreviewed recall@k and answer-accuracy formulas. After review, `test_binds_metrics_to_same_snapshots` verifies exact numerators and positive denominators. `test_each_failed_metric_blocks_admission` verifies independent threshold failures. These passing cases remain pending the formula decision. The authoritative memory mutation map and atomic gate also remain required before end-to-end admission.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R141.102
DecisionEval memory-change wiring row

EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md.

requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R141.103
Memory-change hot-path proof row

EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md.

requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R142.100
Atomic-before-workflow local-model certification attestation
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Atomic-before-workflow local-model certification attestation.** Add a typed EG evaluation input to existing `Method::DecisionEval`. Bind skill id/revision/digest and classification (`atomic` or `workflow`). Include ordered workflow dependencies plus local model, dataset and criteria-policy ids/revisions/digests. Include the AU run receipt. The receipt must bind those same identities plus run id, per-criterion id/result/evidence digest and completion revision. EG emits an immutable certification attestation only when every criterion passes. The attestation binds the same skill/model/dataset/criteria inputs, result and digest. Workflow evaluation refuses unless each named atomic dependency has a current matching attestation. GraphOS consumes this attestation at its existing `ARBORA-FLEET-R034.7-.12` validation point before normal `orchestrate`/`agents.run` invocation. Certification-mode orchestration is a separately authorized evaluation run and must not be mistaken for normal invocation. EG does not execute the local model or decide host policy. **Pending owner prerequisites:** AU has no reviewed `orchestrate` evaluation-receipt schema for these fields. GraphOS R034 has not yet been shown to consume this EG attestation. Specify both links before claiming end-to-end certification. Preserve existing parent obligations: `EG-DECISION-ENGINE-R142`. Source record GRAPHOS:8 SHA-256 `5df3f5a45d486aeba5765a31b6c6283637adf2bd8ce63a87938eddd28b90f082`. | Named boundary acceptance: `tests/decide/test_local_skill_certification_served.py::test_attests_matching_atomic_evaluation` submits an AU receipt and reads a digest-bound EG attestation. `::test_workflow_requires_current_atomic_attestations` refuses missing/stale/failed dependencies. `::test_stale_input_invalidates_attestation` changes skill/model/dataset/criteria revision and verifies refusal. AU `orchestrate` receipt and GraphOS R034 consumption tests are required owner dependencies and are not claimed here.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R142.101
DecisionEval certification wiring row

EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md.

requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R142.102
Local-model-certification hot-path proof row

EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md.

requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R143
Instruction-set disclosure policy and typed event (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Instruction-set disclosure policy and typed event (rollup).** EG owns relevant-context authority. AU runtime applies disclosed instructions. Define the disclosure policy and typed event through existing EG context and AU harness owners, with initial/runtime separation and per-disclosure trace evidence. Children `.1`–`.6` deliver it. | Serve-test each child; cross-owner AU receipt acceptance is pending.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R143.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `InstructionSetDisclosure`, `InitialInstructions`, `RuntimeRefinement`, `DisclosureEvent{trigger, version, timestamp, instructions_hash}`, `DisclosureTrigger` (trigger types: initial, relevance_update, constraint_change, timeout). Initial rules are disclosed once. Runtime refinements are disclosed only on trigger. Each version is immutable and pinned by hash. Proving test: `crates/eg-types/src/decision/instruction_disclosure.rs::tests::disclosure_events_round_trip`. | Types serialize/deserialize correctly; versions are stable and hashable.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R143.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** EG context/decision produces initial and triggered runtime-refinement disclosure events. Define: trigger conditions, initial-disclosure timing, per-event hash, version immutability and per-disclosure trace. Preserve EG decision authority. AU harness applies disclosed instruction set without substitution. Proving test: `crates/eg-types/src/decision/instruction_disclosure.rs::tests::triggers_produce_distinct_versions`. | Initial disclosure precedes execution. Each trigger produces distinct version hash.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R143.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend decision-context path to emit disclosure events. Route through `stat_decide.rs:134` context-decision handler. Record events in served `Decide` result. AU-HARNESS consumer reads events and applies versioned instructions. Proving test: `src/server/handlers/decide/stat_tests/instruction_disclosure_tests.rs::decide_routes_disclosure_events`. | Served decision returns typed events; AU receipt binds applied versions.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R143.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Missing trigger, stale version or hash mismatch refuses disclosure. Undefined instruction set abstains. Proving test: `src/server/handlers/decide/stat_tests/instruction_disclosure_tests.rs::invalid_trigger_or_hash_refuses`. | Negatives cover stale versions, hash collision and missing facts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R143.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind disclosed instruction-set id/version/hash, trigger/timestamp, initial/runtime separation and AU receipt version binding. Proving test: `src/server/handlers/decide/stat_tests/instruction_disclosure_tests.rs::disclosure_binds_version_and_hash`. | Record traces each disclosed version with trigger and hash.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R143.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::Decide` context request. Observe initial disclosure and trigger-based refinements. Cross-owner: AU must bind received disclosure event version/hash to its applied instruction set. Proving test: `tests/decide/test_instruction_disclosure_served.py::test_disclosure_events_and_au_application`. | EG record lists each disclosure; AU receipt links applied versions.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R144
Indexless retrieval operations and cost budgeting (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Indexless retrieval operations and cost budgeting (rollup).** GraphOS retrieval serves GovernedRetriever. EG federated-query returns top-K boundary and budgets row visits. Define: indexless raw-corpus operation, exact file-read/context-verification primitives, per-scan cost reporting and budget refusal. Children `.1`–`.6` deliver it. | Link existing EG retrieval/source-access contracts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R144.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `IndexlessRetrieval{raw_file_read, raw_corpus_scan, context_verify_primitive}`, `PerQueryBudget{max_rows, max_visits, max_cost_units}`, `CostReport{rows_visited, cost_used, remaining_budget}`. Operations are: raw file read (no index), corpus scan (enumerate all), context verification (decode/validate spans). Proving test: `crates/eg-types/src/decision/indexless_retrieval.rs::tests::operations_and_budget_round_trip`. | Types/budgets serialize correctly; costs are measurable.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R144.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Indexless operations succeed within per-query budget. Each operation reports rows and cost incurred. Refusal before budget exhaustion. Preserve authorized source scope. Proving test: `crates/eg-types/src/decision/indexless_retrieval.rs::tests::budget_enforcement`. | Budget=100 rows with 50 visited succeeds; 101 visited refuses.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R144.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend EG retrieval path in federated-query handler to emit indexless operations and cost reports. Route through `Method::UnifiedQuery` answer. Proving test: `src/server/handlers/query/federated_tests.rs::indexless_routes_cost_report`. | Served query returns exact cost and remaining budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R144.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Budget exhaustion refuses with remaining_budget=0 and rows_visited count. Unauthorized sources refuse. Proving test: `src/server/handlers/query/federated_tests.rs::budget_exhaustion_refuses`. | Over-budget and unauthorized scans refuse cleanly.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R144.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind per-query budget, rows/cost/remaining, operation ids and authorization revision. Proving test: `src/server/handlers/query/federated_tests.rs::cost_reports_bind_budget`. | Record traces budget, costs and authorization.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R144.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::UnifiedQuery` with indexless operations. Observe cost reports and budget refusal. Cross-owner: AU/GraphOS exploration consumers apply budgets. Proving test: `tests/query/test_indexless_retrieval_served.py::test_budget_enforcement_and_cost_reporting`. | EG report bounds queries; consumer obeys budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R145
Fidelity-gated memory rewrite decision (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Fidelity-gated memory rewrite decision (rollup).** EG evaluates memory rewrites by fidelity, signal/token metrics and degradation history. Define: original/candidate identities, fidelity/signal-token measurements, degradation history, failed-candidate discard with original retained, and served positive/negative acceptance. Children `.1`–`.6` deliver it. | Store/harness consumers bind rewrite admission receipts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R145.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `MemoryRewriteCandidate`, `FidelityMetric{name, id, value, measured_at}`, `SignalEfficiency{signals_per_token, degradation_history_digest}`, `RewriteAdmissionDecision` (Admit/Discard). Original memory is retained. Discard preserves baseline. Admit requires independent verification. Proving test: `crates/eg-types/src/decision/memory_rewrite.rs::tests::rewrite_types_round_trip`. | Types encode identity, fidelity and decision correctly.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R145.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Compute signal-per-token and fidelity score. Gate by policy thresholds. Degrade failed candidates and discard; retain original. Only verified optimal candidates admit. Proving test: `crates/eg-types/src/decision/memory_rewrite.rs::tests::policy_gates_admission`. | Fidelity above threshold admits; below refuses. Failed candidate discards.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R145.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend `Method::DecisionEval` to route rewrite evaluation through `stat_jobs.rs:30`. Seal typed admission result. Proving test: `src/server/handlers/decide/stat_tests/memory_rewrite_tests.rs::decide_eval_routes_rewrite`. | Served eval returns Admit/Discard decision.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R145.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Stale revisions, unresolved metrics or zero token denominator refuse. Proving test: `src/server/handlers/decide/stat_tests/memory_rewrite_tests.rs::stale_or_invalid_refuses`. | Negative cases refuse cleanly; baseline unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R145.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind original/candidate revisions/digests, fidelity/signal metrics, policy revision and decision reason. Proving test: `src/server/handlers/decide/stat_tests/memory_rewrite_tests.rs::decision_binds_metrics`. | Record names fidelity/signal values and threshold.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R145.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::DecisionEval` rewrite evaluation. Observe admission and discard paths. Cross-owner: store/harness must consume decision before mutation. Proving test: `tests/decide/test_memory_rewrite_served.py::test_fidelity_gates_admission`. | Decision and mutation receipt validation remain pending.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R146
Temporal context queries and confusion detection (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Temporal context queries and confusion detection (rollup).** Retrieval must distinguish storage date, event date and narrative time. Define: temporal fallback-query construction and insufficient-first-pass trigger. Children `.1`–`.6` deliver it. | Extend existing follow-up-query coverage with narrative-time rules.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R146.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `TemporalContext{storage_date, event_date, narrative_time}`, `TemporalConfusion{date_type_mismatch, fallback_trigger}`, `TimeBasedFallback{original_query, fallback_query, time_basis_selected}`. Three-clock confusion occurs when dates disagree. Fallback triggers on insufficient first-pass coverage. Proving test: `crates/eg-types/src/decision/temporal_query.rs::tests::temporal_context_round_trip`. | Types encode all three time dimensions and confusion flags.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R146.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Detect three-clock confusion when storage ≠ event ≠ narrative. Construct bounded fallback query on insufficient coverage. Select time basis (prefer event, fallback to narrative, final fallback to storage). Proving test: `crates/eg-types/src/decision/temporal_query.rs::tests::confusion_detection`. | All three-date-mismatch cases trigger fallback construction.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R146.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend federated-query handler to emit temporal-confusion detection in `Method::UnifiedQuery` answer. Route fallback queries through same path. Proving test: `src/server/handlers/query/federated_tests.rs::temporal_fallback_routes`. | Served query includes confusion detection and fallback results.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R146.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Missing temporal context or unmappable time basis refuses. Proving test: `src/server/handlers/query/federated_tests.rs::missing_time_refuses`. | Undefined narrative time or event date refuses gracefully.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R146.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind original query, selected time basis, detected confusion and fallback-query execution. Proving test: `src/server/handlers/query/federated_tests.rs::temporal_confusion_evidence`. | Record traces which time basis was selected and why.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R146.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::UnifiedQuery` with temporal confusion. Observe fallback queries and coverage improvement. Covering storage/event/narrative-date mismatch cases. Proving test: `tests/query/test_temporal_context_served.py::test_three_clock_confusion_and_fallback`. | First query insufficient; fallback improves coverage.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.100
Pinned retrieval evaluation and authorized context spans
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Pinned retrieval evaluation and authorized context spans.** Extend `DecisionEval` with `RetrievalRankingSubmit` and typed `RetrievalRankingV1` request/receipt. Serve it through `Method::DecisionEval` and `src/server/handlers/decide/jobs.rs`/`stat_jobs.rs`. Bind corpus and binary relevance-label set ids/revisions/digests. Bind a query-set id/revision/digest with at least one query and `k` (1..1000). Record evaluator revision and at least two registered algorithm ids/versions/settings digests. For each algorithm, define `hits_at_k = numerator / denominator`. The numerator counts labeled queries with a relevant top-k item. The denominator is the complete identically labeled query set. Return both integers, the exact query/result digest and metric value. Compare algorithms only on identical input digests. Return typed refusal for empty query sets, zero denominator or missing labels. Also refuse corpus drift, incomplete result coverage and mismatched settings; never fabricate a metric. Add public `Method::RetrievalContextSearch` (`RetrievalContextSearchV1`) on the authenticated query/read path. Return document id/revision/digest and half-open UTF-8 byte offsets into original stored text for every matched n-gram/context span. Search may normalize into a separate NFC index only when it returns that index digest and a validated normalized-to-original byte map. The public offsets always address the stored-text digest, never the normalized buffer. Also return query/index/authorization revisions and an opaque snapshot-bound cursor. Context reads are tenant-authorized, capped at 100 spans and 8 KiB per span. Denied context returns no protected count or offset. Existing `Method::UnifiedQuery`/retrieval paths supply algorithm results; `DecisionEval` seals the evaluation receipt and R100 continues joining cited evidence to independent outcomes/hard negatives. The WebUI comparison panel and labels remain consumers, not truth producers. Consumer: `WEBUI-APPS-R001.1`. WEBUI:6 source objective: “An operator inspects and compares retrieval quality interactively: hits-at-k metrics, n-gram highlighting, side-by-side algorithm comparison and context search.” SHA-256 `3dc3c464a10a5178a413463f2b43baeb015732f5b8df508f6dbab9c37cc1165d`. | Use a fixed served corpus and independently pinned labels. Run two registered retrieval algorithms over the same query set and k. Verify exact hits-at-k numerators/denominators, input/result digests and receipt readback. Search composed and decomposed Unicode plus multibyte text. Verify every returned half-open offset slices the original stored UTF-8 bytes to the exact match and binds that stored-text digest. If NFC indexing is used, verify its separate digest and normalized-to-original byte map. Refuse empty query sets/zero denominator and invalid normalization maps. Also verify bounded contexts. Refuse missing labels, incompatible revisions/settings, incomplete algorithm results, stale cursor and denied context without leaking counts. The WebUI side-by-side consumer must use the exact same evaluation receipt. Local RRF is not relevance truth. No runtime or owner receipt is claimed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R152
KG fact rendering into natural-language text (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**KG fact rendering into natural-language text (rollup).** Retrieved knowledge-graph facts must be rendered as flattened natural-language text rather than raw RDF triples. AU context compiler performs deterministic representation and layout. EG retains selection, budget and retrieval authority. Integrate AU-CONTEXT-R004.3/.6 consumer paths at AU context_compiler_serving.py:565 and core/contextual_model.py:752. | Served context compilation produces natural language text without triple leakage. Citation identity and demonstration-region placement are preserved. Final prompt byte count is exact. Refusals are typed and do not substitute fabricated prose.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R152.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** AU context compiler accepts retrieved KG facts and renders them as flattened natural-language prose. | Contract must specify input/output structures for fact rendering.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R152.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Preserve semantic meaning, source authority and exact final-prompt token count. | Rendered text preserves all material information from source facts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R152.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Map rendered text to source fact identities and citation metadata. | Bidirectional traceability from output prose to source facts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R152.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Refuse unrenderable facts or missing provenance without substituting fabricated prose. | Render errors are explicit refusals, never silent substitutions.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R152.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Golden served examples prove no triple leakage, correct placement outside demonstration regions, complete citations and budget compliance. | Tests cover raw-triple detection, citation accuracy, tenant scope boundaries and prompt length.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R152.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::CompileContext` through AU context_compiler_serving.py. Integration test: `tests/context/test_natural_language_rendering_served.py`. | Retrieved KG facts render as natural-language prose in served contexts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R153
Offline line-numbered table of contents and span-read contracts (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Offline line-numbered table of contents and span-read contracts (rollup).** Source spans and directories do not alone establish offline line numbering, offline construction, or bounded span-read behavior. Define offline line-numbered table-of-contents construction and bounded span-read consumer contracts. Link to existing GraphOS/AU retrieval consumers. Retain existing space/section mappings as partial coverage. | Line-numbered TOC producer and span-read contract are explicit and testable. Consumers bind to exact TOC identities. No implicit line-numbering or file-whole reads.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R153.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Source ingestion produces offline line-numbered tables of contents keyed by source document identity and revision. | TOC must include line ranges for each section or semantic unit.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R153.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Span-read operations use precomputed line ranges without reading whole files. | Bounded reads use offline TOC to avoid redundant disk access.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R153.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** EG immutable document/section records link SDK source ingestion to GraphOS retrieval.space directories to AU exploration. | Each consumer receives TOC identity with requests and references it in responses.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R153.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Refuse span reads when requested range exceeds offline TOC bounds. | Unbounded or missing TOC entries explicitly refuse.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R153.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Served TOC construction and line-range conformance are validated. | Tests verify TOC byte offsets match original files and span reads stay in bounds.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R153.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::RetrievalContextSearch` with offline TOC and bounded span reads. Integration test: `tests/retrieval/test_offline_toc_served.py`. | GraphOS/AU consumers retrieve bounded source spans without reading whole files.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R154
Parameter-free memory/retention scaling and corpus growth semantics (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Parameter-free memory/retention scaling and corpus growth semantics (rollup).** Define continual parameter-free memory and retention, cross-document encoding and corpus-growth and selectivity scaling criteria. EG lifecycle and filtered query operators are infrastructure; missing memory admission/encoding contract joins them with requested guarantees. | Memory layers support unbounded corpus growth without manual tuning. Scaling benchmarks confirm predictable performance. Filtered-scan coverage is retained.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R154.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Memory layers accept and retain cross-document encoded facts without external configuration. | Memory must specify admission criteria and eviction policy.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R154.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Corpus growth is linear in document count and fact density without scaling parameter retuning. | Benchmarks measure memory and query latency as corpus grows.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R154.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Filtered-scan and lifecycle operators feed memory layers and consume retention semantics. | Operators exchange memory state without lossy boundaries.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R154.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Refuse memory operations under OOM or when selectivity constraints cannot be met. | Capacity violations and constraint violations fail explicitly.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R154.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Scaling benchmarks validate linear growth under doubling corpus size. | Tests measure latency and memory footprint over 1..10x baseline corpus.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R154.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::UnifiedQuery` with growing corpus and parameter-free memory. Integration test: `tests/memory/test_parameter_free_scaling_served.py`. | Query latency and accuracy remain predictable as corpus grows.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R155
Memory layers, episode construction and cross-session retrieval (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Memory layers, episode construction and cross-session retrieval (rollup).** Define memory layers, multi-session episode construction and hybrid cross-session retrieval and temporal validation. SourceIngest validates/projects transcripts and UnifiedQuery supports filtered search. Missing episode builder and AU consumer definitions join these paths. | Episode formation uses scoped transcript and search contracts. Temporal validation ensures cross-session consistency. Hybrid retrieval spans both episode and live query scopes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R155.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Sessions produce episodes: ordered, immutable fact sequences with temporal anchors. | Episodes must bind session identity, start/end time and fact count.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R155.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Episodes enable cross-session retrieval: newer queries access older episode facts. | Temporal validation prevents stale/inconsistent multi-session results.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R155.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** SourceIngest validates transcript input; episode builder consumes filtered transcripts; UnifiedQuery retrieves across episode boundaries. | Each consumer names episode identity and temporal constraints.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R155.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Refuse cross-session retrieval when temporal ordering or episode boundaries cannot be established. | Unbounded or inconsistent temporal queries explicitly refuse.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R155.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Multi-session test data validates episode formation and temporal consistency. | Tests verify episode immutability, temporal order and cross-session query correctness.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R155.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::UnifiedQuery` with multi-session episodes. Integration test: `tests/memory/test_cross_session_retrieval_served.py`. | Queries access historical episode facts with correct temporal order.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R156
Skill document procedural compilation without separate workflow files (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Skill document procedural compilation without separate workflow files (rollup).** No reviewed clause compiles procedural steps from skill documents into executable plans or guarantees execution without separate workflow files. EG SourceIngest owns skill_workflow_ingest; AU graph_orchestrate consumes workflows after gap resolution. Missing skill-document-to-executable-plan producer and consumer binding. | Skill documents compile procedurally to AU executable plans. Directory-reference and gap-resolution clauses are retained. AU workflow consumer is named.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R156.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Skill documents define steps, branching and error handling in natural language. | Compiler must extract procedural structure and safety constraints.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R156.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Steps compile to executable AU workflow steps without separate .yml files. | Skill source is the single source of truth for procedural logic.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R156.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** EG SourceIngest documents and AU graph_orchestrate consume compiled workflows. | AU receives compiled plan with skill document digest for traceability.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R156.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Refuse compilation when steps are ambiguous, missing error handlers or lack input/output types. | Incomplete procedures refuse compilation without fallback.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R156.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Golden skill documents compile to deterministic AU plan representations. | Tests verify step ordering, error branching and type safety.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R156.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::CompileSkillWorkflow` with AU graph_orchestrate consumer. Integration test: `tests/skills/test_skill_to_workflow_compilation_served.py`. | AU executes skill-compiled workflows without separate workflow files.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R157
Delegation quality gate and observation window (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Delegation quality gate and observation window (rollup).** EG defines measured quality and delegation threshold. Stable observation window must precede delegation. Quality authority resides in EG. AU executes only admitted delegation. Retrieval-saturation windows govern retrieval, not delegation. | Gate requires explicit quality evidence. Passes above threshold. AU respects refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R157.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `DelegationQualityWindow{start_time, end_time, observation_count}`, `QualityThreshold{metric_name, minimum_value}`, `DelegationAdmission{admitted, quality_evidence_digest}`. Quality window must span enough observations. | Types encode observation window, threshold and admission decision correctly.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R157.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Measure output quality over stable observation window. Gate on declared threshold. Refuse delegation below threshold. Reset window on new measurements. Proving test: `crates/eg-types/src/decision/delegation_quality.rs::tests::quality_gate_admission`. | Quality above threshold admits. Below threshold refuses. Window spans enough samples.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R157.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend `Method::DecisionEval` to route quality measurement through decision authority. Seal typed admission result. Bind AU graph_execute consumer to admitted delegation only. Proving test: `src/server/handlers/decide/stat_tests/delegation_quality_tests.rs::quality_gate_routes`. | Served decision returns Admit/Refuse. AU respects refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R157.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Stale observation window, undefined threshold or insufficient samples refuse. Proving test: `src/server/handlers/decide/stat_tests/delegation_quality_tests.rs::stale_window_refuses`. | Negative cases refuse cleanly without delegating.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R157.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind window start/end times, observation count, quality metric, threshold and admission decision. Proving test: `src/server/handlers/decide/stat_tests/delegation_quality_tests.rs::quality_evidence_binds`. | Record observation count, quality value and threshold.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R157.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::DecisionEval` quality gate. Observe delegation admission and refusal paths. AU consumes only admitted delegation. Proving test: `tests/decide/test_delegation_quality_served.py::test_quality_gate_admits_and_refuses`. | Delegation succeeds above threshold; refuses below.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R158
Per-run error frequency and joint model-width adjustment (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Per-run error frequency and joint model-width adjustment (rollup).** Per-run error frequency within host tenant/child/operation partition must drive joint latency/cost/error model-and-width adjustment. Each adjustment records before/after model, width, budget and rationale. AU observation paths and EG routing decision authority produce separate producer/consumer contracts. | Adjustment contract joins AU observations with EG routing decisions. Before/after model/width recorded per run. Host ceiling and narrow-only enforced.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R158.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `PerRunErrorWindow{run_id, start_time, end_time}`, `ModelWidthAdjustment{before_model, after_model, before_width, after_width, before_budget, after_budget, rationale_digest}`. Window partitions errors by tenant/child/operation. Proving test: `crates/eg-types/src/decision/error_adjustment.rs::tests::adjustment_types_round_trip`. | Types encode adjustment history with exact before/after values.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R158.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Compute per-run error frequency within declared window. Drive joint model and width adjustment. Record all before/after values. Preserve host ceiling. Narrow width only, never widen without capacity increase. Proving test: `crates/eg-types/src/decision/error_adjustment.rs::tests::adjustment_gates_admission`. | Error above policy triggers adjustment. Before/after recorded. Narrowing enforced.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R158.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend existing EG routing and AU continuation contracts. Add per-run adjustment observation window binding. Bind AU ObservedCost and continuation to adjustment receipt. Route adjustment through `stat_jobs.rs:30`. Proving test: `src/server/handlers/decide/stat_tests/error_adjustment_tests.rs::per_run_adjustment_routes`. | Served decision includes adjustment receipt. AU consumes adjustment.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R158.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Unpartitioned errors, undefined adjustment policy or violated host ceiling refuse. Proving test: `src/server/handlers/decide/stat_tests/error_adjustment_tests.rs::invalid_policy_refuses`. | Undefined partitions or ceiling violations refuse cleanly.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R158.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind run identity, error window, before/after model/width/budget, rationale digest and adjustment result. Proving test: `src/server/handlers/decide/stat_tests/error_adjustment_tests.rs::adjustment_evidence_binds`. | Record exact before/after model, width and budget values.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R158.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::DecisionEval` per-run adjustment. Observe error-driven model and width changes. AU consumes adjustment receipt. Proving test: `tests/decide/test_error_adjustment_served.py::test_per_run_adjustment_and_receipt`. | Adjustment recorded and consumed per run.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R159
Tool-routing path success history and preference (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Tool-routing path success history and preference (rollup).** EG defines path identity and success rates. EG applies historical preference; SDK fallback is transport. | Path identity and success-rate measurement in EG routing authority. Historical rates drive preference. SDK fallback order remains transport contract.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R159.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `RoutingPath{connector_id, method_id, parameter_digest}`, `SuccessRateEvidence{path_id, successful_attempts, total_attempts, measurement_window}`, `PathPreferenceRule{window_duration, minimum_samples, prefer_above_rate}`. Proving test: `crates/eg-types/src/decision/path_success.rs::tests::path_identity_round_trip`. | Types encode path identity, rates and preference rules.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R159.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Measure successful attempts per path over declared window. Track total attempts. Prefer paths exceeding minimum-sample threshold. Prefer higher-rate paths within same query. Skip repeated failures under declared rule. Proving test: `crates/eg-types/src/decision/path_success.rs::tests::success_preference_gates`. | Rates above threshold preferred. Repeated failures skipped. Preference within window.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R159.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Bind connector and harness outcome observations to EG routing path-success tracking. Extend EG R039 routing contracts with path identity and success-rate evidence. Preserve SDK ordered_equivalent_fallback as transport contract. Proving test: `src/server/handlers/decide/routing_tests.rs::path_success_routes`. | Served routing decision includes preferred path.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R159.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Unmeasured paths, stale measurement windows or missing outcome data refuse. Proving test: `src/server/handlers/decide/routing_tests.rs::stale_path_data_refuses`. | Missing outcomes and stale windows refuse without defaulting.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R159.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind path identity, success rate numerator/denominator, measurement window and preference applied. Proving test: `src/server/handlers/decide/routing_tests.rs::path_success_evidence_binds`. | Record successful/total attempts and preference decision.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R159.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::DecisionEval` tool routing with path-success preference. Observe preferred and fallback paths. Connector outcomes feed success tracking. Proving test: `tests/decide/test_path_success_served.py::test_success_history_drives_preference`. | Higher-success paths preferred. History accumulates correctly.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R160
Package identity validation and publication refusal (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Package identity validation and publication refusal (rollup).** EG validates rendered packages against recorded runs. Publication refuses invalid packages. | Rendered package validated against run history before publication. Publication refuses invalid packages. Identity evidence persisted.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R160.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `PackageIdentity{content_digest, graph_revision}`, `RenderedPackageValidation{rendered_digest, run_history_digest, validation_passed}`, `PublicationReceipt{package_id, validation_result, publish_timestamp}`. Proving test: `crates/eg-types/src/decision/package_validation.rs::tests::validation_types_round_trip`. | Types encode identity, validation and publication evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R160.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Render skill package from digest/revision. Validate rendered result against recorded runs. Refuse publication if validation fails. Record publication receipt with validation result. Proving test: `crates/eg-types/src/decision/package_validation.rs::tests::validation_gates_publication`. | Invalid packages refuse publication. Valid packages recorded.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R160.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Link existing digest/revision package identity contracts to validation and publication authority. Bind AU record_outcome/SkillGraphPipeline output to validation input. Bind fleet catalog skill_row consumer to publication receipt. Proving test: `src/server/handlers/catalog/validation_tests.rs::package_validation_routes`. | Served catalog returns validated packages only.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R160.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Mismatched rendered/history digests, failed validation or missing run history refuse publication. Proving test: `src/server/handlers/catalog/validation_tests.rs::validation_fails_refuse_publication`. | Invalid packages refuse publication without fallback.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R160.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind content digest, graph revision, rendered digest, run history digest, validation result and publication timestamp. Proving test: `src/server/handlers/catalog/validation_tests.rs::validation_evidence_binds`. | Record which run history validated each published package.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R160.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::PublishSkillPackage` with validation and refusal. Catalog consumer accesses only validated packages. AU produces run history. Proving test: `tests/catalog/test_package_validation_served.py::test_invalid_packages_refuse_publication`. | Only validated packages published. Publication recorded.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R161
Failed-run trace to fix and test binding with revision receipts (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Failed-run trace to fix and test binding with revision receipts (rollup).** Trace generates fix and test. Test binds before/after revision receipts. Mismatch refuses admission. | Trace -> fix -> test -> paired receipts is required. Mismatched receipts refuse. Admission authority preserved in EG.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R161.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define `FailedRunTrace{run_id, error_trace_digest, failure_point}`, `GeneratedFix{trace_id, fix_digest}`, `RegressionTest{fix_id, test_digest, before_revision, after_revision}`, `RevisionReceipt{test_id, revision_id, outcome}`. Proving test: `crates/eg-types/src/decision/trace_fix_binding.rs::tests::binding_types_round_trip`. | Types encode trace, fix, test and revision binding.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R161.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Extract fix from failed trace. Generate regression test with input/output binding. Run test against before-revision (must fail). Run test against after-revision (must pass). Bind both receipts to test identity. Refuse if outcomes mismatch expected pattern. Proving test: `crates/eg-types/src/decision/trace_fix_binding.rs::tests::receipt_binding_gates_admission`. | Test fails on before, passes on after. Receipts bound.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R161.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extend existing correction and admission contracts with trace identity. Bind AU CorrectionProposal and study_admit engine input. Route through existing admission authority. Seal test identity and revision receipts. Proving test: `src/server/handlers/decide/admission_tests.rs::trace_to_test_routes`. | Served correction includes test identity and receipts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R161.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Absent trace, missing test, unexecuted receipts or mismatched outcome pattern refuse. Proving test: `src/server/handlers/decide/admission_tests.rs::incomplete_binding_refuses`. | Incomplete bindings refuse admission without mutation.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R161.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind failed trace digest, generated test digest, before/after revision digests, before/after outcome and admission decision. Proving test: `src/server/handlers/decide/admission_tests.rs::binding_evidence_records`. | Record which trace produced which test and fixes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R161.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Serve `Method::ProposeCorrection` with trace-test binding and receipts. Observe both before/after test execution paths. EG admission authority consumes receipts and decides. Proving test: `tests/decide/test_trace_fix_binding_served.py::test_receipts_gate_correction_admission`. | Receipts bind test to revisions. Mismatches refuse.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R162
Workspace field shielding and declared-input projection at step boundaries (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Workspace field shielding and declared-input projection at step boundaries (rollup).** Shared workspace objects leak undeclared fields across steps. Nested undeclared fields are not explicitly withheld. Step boundaries lack declared-input projection. Shielded fields reject extra fields at read time. Children `.1` to `.6` deliver it. | Field shielding at boundaries. Undeclared nested fields withheld. Schema refusal retained.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R162.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `ShieldedField{name, is_shielded}`, `DeclaredInput{field, required, depth}` and `StepProjection{step_id, declared_fields}` in new `crates/eg-types/src/decision/field_shielding.rs`. Add `QuestionKind::FieldShielding` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/field_shielding.rs::tests::types_round_trip`. | Types encode shielding, projection and nesting depth.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R162.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `apply_field_shielding(object, shielded_fields)` in field_shielding.rs. Remove marked shielded fields recursively. Add `project_declared_inputs(object, step_declaration)` to keep only declared fields per step. Both functions recursively process nested fields. Proving test: `crates/eg-types/src/decision/field_shielding.rs::tests::shielding_removes_nested`. | Shielded and undeclared nested fields are removed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R162.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Attach shielding and projection in `handle_decide` at `stat_decide.rs:134`. Apply before constructing ParallelWorkspace at dispatch. Extend ParallelWorkspace contract with projection boundaries per step. Proving test: `src/server/handlers/decide/stat_tests/field_shielding_tests.rs::shielding_routes`. | Shielding and projection applied before workspace construction.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R162.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Undeclared fields in declared-input projection must refuse with `undeclared_field` naming the field. Nested shielding violations must refuse. Schema-refusal validation at step boundary reads must reject extra fields. Proving test: `src/server/handlers/decide/stat_tests/field_shielding_tests.rs::undeclared_fields_refuse`. | Undeclared fields refuse. Shielding violations prevent read.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R162.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Emit premises for shielded field names, declared input depth and projection applied per step. Record each withheld undeclared nested field. The record must state evidence class. Proving test: `src/server/handlers/decide/stat_tests/field_shielding_tests.rs::shielding_evidence_binds`. | Record withheld fields, depth and shielding per step.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R162.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Entry point is served `Decide` with workspace sharing across steps. Test `tests/decide/test_field_shielding_served.py::test_undeclared_fields_withheld` declares inputs for step two. Step one writes extra nested fields. Step two reads must reject them. Proving test: `tests/decide/test_field_shielding_served.py::test_undeclared_fields_withheld`. | Shielded and undeclared nested fields withheld from reading step.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R163
Graph-ingested papers and codebases in study intake with revision provenance (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Graph-ingested papers and codebases in study intake with revision provenance (rollup).** Study intake reads only filesystem sources. Graph-ingested papers and codebases have no intake contract. Source/query authorities are copied with content bodies. Revision provenance is not recorded per source. Children `.1` to `.6` deliver it. | Graph sources integrated in intake. Exact revisions recorded. Authorities reused.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R163.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `GraphSource{graph_ref, content_type}`, `GraphReference{authority, query, revision, content_digest}` and `IntakeSource{filesystem_path, graph_ref, revision}` in new `crates/eg-types/src/decision/graph_intake.rs`. Add `QuestionKind::GraphIntake` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/graph_intake.rs::tests::intake_types_round_trip`. | Types encode graph sources, queries and revisions.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R163.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Extend StudySource in study_intake.rs to accept both filesystem and graph-reference inputs. Resolve graph references through EG capability graph. Record exact source revision and content digest. Preserve filesystem intake path unchanged. Proving test: `crates/eg-types/src/decision/graph_intake.rs::tests::graph_sources_resolve`. | Graph and filesystem sources both resolve. Revisions recorded.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R163.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Attach graph-reference resolution in `study_compare.compare` at existing EG lookup. Bind IntakeSource to study_fetch_once results. Reuse source/query authorities from graph node rather than copying content bodies. Proving test: `src/server/handlers/decide/stat_tests/graph_intake_tests.rs::graph_intake_routes`. | Served comparison includes graph-sourced papers and revisions.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R163.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Missing graph authority must refuse with `unknown_authority` naming the authority. Missing content revision must refuse. Unresolvable graph-reference must refuse with `resolution_failed`. Proving test: `src/server/handlers/decide/stat_tests/graph_intake_tests.rs::missing_graph_data_refuses`. | Missing authorities and revisions refuse intake.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R163.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind source type (filesystem or graph), graph authority, query used, exact revision and content digest. Record which authority was reused versus copied. The record must state evidence class. Proving test: `src/server/handlers/decide/stat_tests/graph_intake_tests.rs::graph_intake_evidence_binds`. | Record source type, authority, revision and content digest.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R163.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Entry point is served study_compare requesting graph-ingested papers alongside filesystem sources. Test `tests/decide/test_graph_intake_served.py::test_mixed_source_comparison` submits papers from graph and filesystem. Both are resolved and compared. Revisions and authorities are recorded. Proving test: `tests/decide/test_graph_intake_served.py::test_mixed_source_comparison`. | Graph and filesystem sources both appear in comparison results.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R164
Long-horizon branches retrieve and apply prior outcome evidence for breadth adaptation (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Long-horizon branches retrieve and apply prior outcome evidence for breadth adaptation (rollup).** Branches do not retrieve prior attempts or outcomes. Breadth decisions are not adapted from historical results. Branch outcome evidence is not recorded per branch. Long-horizon paths have no breadth adaptation. Children `.1` to `.6` deliver it. | Prior outcomes guide breadth. Adaptation recorded per branch.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R164.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `BranchOutcome{branch_id, attempt_count, success_count, average_cost}`, `OutcomeEvidence{prior_branch_id, outcome, adaptation_applied}` and `BreadthAdaptation{branch_id, prior_breadth, new_breadth, outcome_triggering}` in new `crates/eg-types/src/decision/branch_outcomes.rs`. Add `QuestionKind::BranchOutcome` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/branch_outcomes.rs::tests::outcome_types_round_trip`. | Types encode outcomes, evidence and breadth adaptation.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R164.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `retrieve_branch_outcomes(branch_candidates, history)` in branch_outcomes.rs. Look up prior attempts for each candidate branch. Add `adapt_breadth(outcomes, policy)` to compute new breadth from success rate evidence. Apply new breadth to branch start. Proving test: `crates/eg-types/src/decision/branch_outcomes.rs::tests::breadth_adapts_from_outcomes`. | Higher success rates increase breadth. Failed branches narrow.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R164.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Integrate outcome retrieval at branch start in TaskPlan dispatch. Attach breadth adaptation in `handle_decide` at `stat_decide.rs:134`. Bind AU execution recording to TaskPlan breadth outcome. Extend R022.4 SkillGraphPipeline to receive outcome feedback. Proving test: `src/server/handlers/decide/stat_tests/branch_outcomes_tests.rs::breadth_adapts_from_history`. | Served TaskPlan reflects prior outcome breadth adaptation.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R164.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Missing prior outcome history must refuse with `no_outcome_history`. Breadth adaptation outside configured limits must refuse with `breadth_limit_exceeded`. Contradiction between early and later outcome evidence must refuse. Proving test: `src/server/handlers/decide/stat_tests/branch_outcomes_tests.rs::inconsistent_outcomes_refuse`. | Missing or contradictory outcomes refuse planning.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R164.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind prior branch outcomes, success count, average cost and adapted breadth value. Record which earlier branch outcome triggered breadth change. Link to recorded AU execution outcomes. The record must state evidence class. Proving test: `src/server/handlers/decide/stat_tests/branch_outcomes_tests.rs::outcome_evidence_records`. | Record prior outcomes, adaptation and triggering evidence.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R164.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Entry point is served TaskPlan for a long-horizon branching query. Test `tests/decide/test_branch_outcomes_served.py::test_breadth_adapts_from_prior` submits branches with recorded prior outcomes. Later branch breadth reflects earlier success. Outcomes are retrieved and recorded. Proving test: `tests/decide/test_branch_outcomes_served.py::test_breadth_adapts_from_prior`. | Earlier branch success increases later branch breadth.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R165
Per-model empirical tool necessity measurement and decision comparison tracing (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Per-model empirical tool necessity measurement and decision comparison tracing (rollup).** Tool decisions lack provenanced necessity measurement per model. Decision comparison is not implemented. Tool mismatches are not traced. Unknown and stale measurements have no handling. Children `.1` to `.6` deliver it. | Tool necessity measured per model. Mismatches traced.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R165.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `ToolNecessity{tool_id, model_id, necessity_score, measurement_timestamp, provenance}`, `ToolComparison{tool_id, necessity_score, decision_score, agreement}` and `TraceMismatch{tool_id, necessity_score, model_call_id, reason}` in new `crates/eg-types/src/decision/tool_necessity.rs`. Add `QuestionKind::ToolNecessity` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/tool_necessity.rs::tests::necessity_types_round_trip`. | Types encode measurement, comparison and mismatch.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R165.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `measure_tool_necessity(tool_id, model_id, context)` in tool_necessity.rs. Compute necessity empirically per model. Add `compare_tool_decision(necessity, model_decision, policy)` to check agreement. Record provenance, timestamp and measurement version. Handle unknown and stale measurements explicitly. Proving test: `crates/eg-types/src/decision/tool_necessity.rs::tests::necessity_comparison_detects_mismatch`. | Mismatches between necessity and decision are detected.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R165.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Integrate tool necessity measurement in `handle_decide` at `stat_decide.rs:134`. Attach comparison consumer at existing per-tool span path in AU integration. Bind necessity contract to decision contract. Record tool decision call alongside necessity measurement. Proving test: `src/server/handlers/decide/stat_tests/tool_necessity_tests.rs::necessity_comparison_routes`. | Served tool decision includes necessity score and comparison.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R165.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Unknown measurement versions must not default or estimate. Stale measurements (older than configured window) must refuse with `stale_measurement`. Tool id mismatch must refuse. Model id mismatch must refuse with `model_mismatch`. Proving test: `src/server/handlers/decide/stat_tests/tool_necessity_tests.rs::unknown_measurements_refuse`. | Unknown and stale measurements refuse. No estimation.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R165.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind tool id, model id, measured necessity score, decision score and measurement timestamp. Record comparison result and any mismatch with linked trace. Trace includes model_call_id and mismatch reason. Record measurement provenance and version. Proving test: `src/server/handlers/decide/stat_tests/tool_necessity_tests.rs::mismatch_traces_link`. | Every mismatch links to trace. Provenance recorded.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R165.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Entry point is served tool decision in per-tool span path. Test `tests/decide/test_tool_necessity_served.py::test_necessity_mismatch_trace` submits tool request. Necessity measured per model. Decision compared. Mismatch traced with linked model_call. Proving test: `tests/decide/test_tool_necessity_served.py::test_necessity_mismatch_trace`. | Tool necessity and decision comparison appear in trace.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R166
Workflow registration and lazy engine initialization (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Workflow registration and lazy engine initialization (rollup).** The workflow registry must hold registered workflows and start its engine only on first use. The GraphOS host keeps its semantic workflow match and the AU orchestrate path keeps its execute_workflow edge. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R166.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define a workflow registration record with a workflow id, a version and a content digest. The registry must expose a read by that identity. | Registration and read return the same id, version and digest.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R166.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The registry must not start the workflow engine at registration time. The registry must start the engine once on the first invocation and reuse it afterwards. | Counter shows zero starts before first use and exactly one start after several invocations.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R166.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The AU orchestrate path must resolve each workflow through this registry before execution. The host semantic match must keep returning registry identities. | Invocation through the real orchestrate entry resolves the registered record.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R166.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The registry must refuse an unknown workflow id with a typed error before any engine start. The registry must not fall back to a default workflow. | Unknown id refuses and the start counter stays at zero.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R166.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The registry must record the resolved workflow identity and the engine start event on each invocation receipt. | Receipt readback shows identity and a single start event.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R166.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served graph_orchestrate execute_workflow call. The integration test is `tests/workflows/test_registry_lazy_init_served.py::test_registered_invocation_lazy_init`. | The test covers no eager start, one first-use start, registered invocation and unknown-workflow refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R167
Skill upgrade compatibility and declared migration (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Skill upgrade compatibility and declared migration (rollup).** Skill admission must compare the previous and new consumer contracts on every upgrade. The GraphOS invoke certification step keeps its place before dispatch, and EG keeps selection and scoring. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R167.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define a skill upgrade receipt with the previous consumer contract digest, the new consumer contract digest and an optional declared migration id. | Receipt readback shows both digests and the migration id.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R167.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Admission must accept an upgrade whose new contract is compatible with the previous one. Admission must accept a breaking upgrade only with a declared migration identity. | Compatible upgrade and declared-migration upgrade both admit.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R167.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The check must run in skill admission before the invoke certification step dispatches. The host must read the receipt at that step. | Invoke reads the receipt from the real admission path.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R167.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Admission must refuse a breaking upgrade that lacks a declared migration before any effect. Admission must not add a compatibility wrapper. | Breaking upgrade without migration refuses and no effect row exists.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R167.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit one premise for the contract comparison and one for the migration identity. | Premises name both digests and the migration id.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R167.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served skill invoke path. The integration test is `tests/skills/test_upgrade_compat_served.py::test_upgrade_admission`. | The test covers compatible upgrade, breaking upgrade without migration and declared migration.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R168
Typed agent lifecycle model across construction, transition, persistence and serialization (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Typed agent lifecycle model across construction, transition, persistence and serialization (rollup).** The engine must own one typed agent lifecycle model that the generated client types reuse. The harness must not add a parallel wire authority. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R168.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define the agent state type and its lifecycle states. Name the construction, transition, persistence and serialization boundaries. Bind each boundary to the existing generated strict client types. | Readback lists each boundary and its bound generated type.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R168.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The engine must validate state at construction and on every transition. Persistence and serialization must preserve every field of the state. | Valid construction and transition succeed. A persisted state reads back equal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R168.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The harness port and run contract must construct and advance the agent through this model. The engine must not add a second wire type. | The run path imports the model from the generated types only.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R168.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The engine must refuse malformed state at construction, on transition and on read from storage. The engine must not repair or default the state. | Each malformed case refuses with a typed reason and writes nothing.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R168.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit one premise per transition naming the prior state, the next state and the state digest. | Premises name both states and the digest.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R168.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served agent run path. The integration test is `tests/lifecycle/test_agent_lifecycle_served.py::test_agent_lifecycle_roundtrip`. | The test covers construction, transition, persistence, serialization, malformed refusal and a full lifecycle roundtrip.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R169
Every-output checker feedback loop with durable continuation and explicit stop (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Every-output checker feedback loop with durable continuation and explicit stop (rollup).** The harness must grade each output and turn checker findings into the next instruction. The loop must repeat until no fix remains or an explicit bound is reached. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R169.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define a feedback record with the output digest, the checker report digest, the findings and the next instruction. Define a continuation record and a stop reason. | Readback shows all fields and one stop reason.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R169.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The harness must grade every output, not one output per evaluation round. The next instruction must derive only from the findings. The loop must stop on no findings or on the explicit round bound. | A run with fixes repeats. A run with none stops. A run at the bound stops.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R169.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The engine must hold the continuation in durable state. The host loop status, run and pause facade must read it. The existing scope and idempotency checks must still fail closed. | The facade reports the continuation after a restart.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R169.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The loop must refuse a missing bound, an ungraded output and a replayed idempotency key. The loop must not continue after a refusal. | Each case refuses and the continuation does not advance.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R169.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit one premise per round with the findings digest and the instruction digest. | Premises name both digests for every round.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R169.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served loop run path. The integration test is `tests/loops/test_checker_feedback_served.py::test_feedback_loop_stops`. | The test covers repeat, no-fix stop, bound stop, restart resume and replay refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R170
Team coordination fallback and graph-discoverable team records (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Team coordination fallback and graph-discoverable team records (rollup).** The coordinator must fall back to team coordination when the primary session channel is unavailable. Library membership must not stand in for team membership. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R170.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define a team record with team id, members, and the persisted task status of each task. Define a channel-unavailable signal. | Readback shows members and task status.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R170.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The coordinator must start team coordination when the primary channel is unavailable. Task status must persist in the durable task store. | An unavailable channel starts the team path. Status survives a restart.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R170.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The host agent-to-agent endpoint and task store must write the record. The engine must project the team, members and task status into the graph beside the agent library projection. | A graph query finds the team, its members and each task status.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R170.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The coordinator must refuse to treat a library member as a team member without an explicit team binding. The coordinator must not fall back while the channel is available. | Each case refuses and writes no team record.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R170.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit one premise for the channel signal and one for the team membership. | Premises name the signal and the member set.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R170.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served team coordination path. The integration test is `tests/a2a/test_team_fallback_served.py::test_fallback_and_team_record`. | The test covers fallback, team record discovery and restart acceptance.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R171
Planning admission requires an architecture and wiring gap comparison (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Planning admission requires an architecture and wiring gap comparison (rollup).** The engine must compare the architecture view with the study gap proposals before it admits a plan. The engine must refuse any plan feature that lacks a hot-path attach point. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R171.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Define a planning admission request with the architecture view digest, the gap proposal digests and the plan features. Define an attach point for each feature. | Readback shows the digests and one attach point per feature.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R171.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The engine must run the comparison before admission and not after. Every new feature must name its hot-path attach point. The engine must reuse the served architecture view and not derive it again. | A fully wired plan admits. The comparison runs first.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R171.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The study consumer must submit gap proposals to this admission. The engine must read the existing architecture view and capability query. | The admission reads the view from the served query.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R171.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The engine must refuse a plan with no comparison, a stale view, or a feature without an attach point. The engine must name the feature. | Each case refuses with the feature name and admits nothing.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R171.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit one premise for the comparison and one per feature attach point. | Premises name the view digest and each attach point.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R171.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served planning admission path. The integration test is `tests/planning/test_wiring_admission_served.py::test_unwired_feature_refused`. | The test covers admitted, unwired-refused and stale-view cases.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172
Capability designation index moved from agent-utilities (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Capability designation index moved from agent-utilities (rollup).** EG owns capability designation. Given a task embedding and optional required capabilities, the engine selects the agents, tools and skills that handle the task. The engine filters by capability, tenant and policy. It ranks by cosine similarity, a learned outcome reward and an ontology prior. It explains why each candidate is eligible. This replaces the deleted AU module `agent_utilities/knowledge_graph/retrieval/capability_index.py` (`CapabilityIndex`, `Designation`, `compute_eligibility`) and its feeders. The EG implementation is native Rust only. No designation, scoring or reward logic goes into `epistemic_graph/` beyond the generated client binding. Children `.1` to `.11` deliver it. Child `.13` applies scoped adapters and drift refresh to the index. Producer: the engine-resident index. Consumer: the AU run loop through a typed designation port that receives EG answers. | See each child. R172 is LANDED when every child is VERIFIED.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `crates/eg-types/src/decision/capability_designation.rs`. Define `CapabilityRecordV1{tenant_id: Option<TenantId>, entity_id, entity_kind (closed: agent, tool, skill), capabilities: BTreeSet<CapabilityIri>, ontology_type: Option<ClassIri>, policy_tags: BTreeSet<String>, swappable_with: BTreeSet<EntityId>, embedding_version, dim: u16, record_revision: u64}`. A record with no tenant is a commons record. Define `CapabilityRewardV1{tenant_id, entity_id, reward_q32, outcome_count: u64, generation: u32, updated_revision}`; the neutral value is 0.5. Define `CapabilityDesignationQuestionV1{tenant_id, query_vector{embedding_version, dim, f32le_b64}, required_capabilities, required_policy_tags, k: u8, weights{reward_q32, prior_q32}, ontology_prior: Option<Vec<(EntityId, q32)>>}`. Define `CapabilityDesignationV1{designations: Vec<DesignatedCapabilityV1>, candidate_pool_size, capability_filtered, index_epoch, embedding_version}`. Each `DesignatedCapabilityV1` binds `entity_id, score_q32, cosine_q32, reward_q32, prior_q32, ontology_type, capabilities, alternatives, eligibility: CapabilityEligibilityV1`. `CapabilityEligibilityV1` keeps the field set of AU `compute_eligibility`. The capability fields are capabilities, required_caps, missing_caps and capabilities_matched. The tenant fields are tenant, required_tenant and a tri-state tenant_match. The policy fields are policy_tags, required_policy_tags, missing_policy_tags and policy_matched. The other fields are reward, ontology_type, eligible and subsumption_paths. Scores and weights are Q32 integers on the wire. Only the query vector is f32, as little-endian base64. Proving test: `crates/eg-types/src/decision/capability_designation.rs::tests::designation_types_round_trip`. | A serde round trip keeps every field. It rejects an unknown entity kind, a dim of zero, and a base64 vector whose length is not `4 * dim`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add the resident index in new module `crates/eg-compute/src/capability_index/`. It reuses `eg-ann` (`flat` and `hnsw`) and stores nothing itself. Keep one index per tenant shard plus one commons shard. Intern entity ids and capability IRIs to dense `u32` ids. Store capability postings as compressed bitmaps (`capability -> bitmap of entity ids`). Store policy-tag postings the same way. Store vectors in a columnar SQ8 arena (one byte per dimension) with an f32 re-score tier for the final top-k. Metadata is a struct-of-arrays indexed by the dense id. Apply each record change as an incremental upsert or tombstone. Never rebuild the index for one change. Compact tombstones when they exceed 20 percent (named default `tombstone_compact_ratio`). Build is O(N log N) for the ANN graph. Build is O(N c) for postings, with c capabilities per record. A capability filter costs one bitmap intersection per required capability, plus a union over subsumed subtypes. If the filtered pool is at most `flat_threshold` (default 4096), rank by an exact SQ8 scan with f32 re-score. Otherwise, run filtered HNSW traversal with the bitmap as the admit predicate. If `eg-ann` hnsw search has no predicate, add one. Readers use a lock-free snapshot (an atomically swapped `Arc` per shard). One writer per shard publishes a new epoch after each change batch. The query path takes no global lock. Memory is bounded by `max_records_per_shard` (default 1,000,000); an upsert past the bound refuses. It does not evict silently. This replaces AU `CapabilityIndex.add`, `remove`, `build_from_edges`, `_candidate_ids` and the 4096-entry LRU cache. Proving test: `crates/eg-compute/src/capability_index/tests.rs::incremental_upsert_and_tombstone_match_rebuild`. | Build an index by N incremental upserts and deletes. It returns the same top-k as a full rebuild of the surviving records. A change touches only the changed id. A bound overflow refuses with no partial write.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.3
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `compute_capability_eligibility(record, question, projection)` in `capability_designation.rs` as a pure function. Each rule is a named replaceable default. `capability_rule`: the record meets a required capability T when it declares T. It also meets T when it declares a subtype of T. The composed GraphSchema `rdfs:subClassOf` closure defines subtypes. The first matching declared class in sorted order gives the reported subsumption path. `tenant_rule`: a commons record is visible to every tenant; a record of a different tenant is never a candidate. Tenant filtering runs before any score or count (R013). `policy_rule`: fail-closed; a record must carry every required policy tag, and an untagged record fails any non-empty requirement. `eligible` is the AND of the gates that the question asked for. An omitted filter never disqualifies. The subsumption projection comes from the engine's own `OwlReason` closure at the question's schema digest. It is not supplied by the caller. This replaces AU `compute_eligibility`, `_satisfied_required_caps`, `_tenant_match`, `_is_eligible` and `CapabilityIndex.explain`. AU acceptance cases: `tests/retrieval/test_capability_index.py::test_injected_hierarchy_matches_declared_subtype`, `::test_policy_filter_excludes_ineligible_candidate`, `::test_tenant_filter_scopes_candidates_but_admits_unscoped`, `::test_combined_capability_tenant_policy_filters`, `::test_explain_reports_eligible_candidate_features`, `::test_explain_reports_why_an_ineligible_candidate_was_excluded`. Proving test: `crates/eg-types/src/decision/capability_designation.rs::tests::eligibility_gates_match_au_cases`. | Each listed AU case, re-expressed as a fixture, gives the same eligible verdict, missing sets and subsumption path.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.4
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `rank_capability_candidates(pool, question, rewards, policy)` in `crates/eg-compute/src/capability_index/rank.rs`. L2-normalize the stored and query vectors; similarity is the inner product. Each rule is a named replaceable default. `oversample_rule`: take `min(pool_size, max(k, 4k))` candidates by pure cosine. `reward_blend`: add `reward_weight * (reward - 0.5)`; default `reward_weight` 0.15. `prior_blend`: add `prior_weight * (prior - 0.5)`; default `prior_weight` 0.15. `default_ontology_prior` applies when the question gives no prior and records carry an ontology type. The modal type of the oversampled pool gets 1.0. Other types get 0.5. With no stored types, the prior is off. A weight of zero turns its term off. With both terms off the order is pure cosine. Ties order by entity id, ascending. Return at most k designations, each with its swappable alternatives sorted by id. This replaces AU `CapabilityIndex.designate`, `_blend_ranked`, `_resolve_ontology_prior`, `_rank_brute_force`, `_rank_via_hnsw` and `alternatives`. AU acceptance cases: `tests/retrieval/test_capability_index.py::test_ranking_returns_planted_top1`, `::test_capability_filter_shrinks_results`, `::test_alternatives_returns_swappable_partner`, and all five cases in `tests/retrieval/test_kg_2_44b_ontology_prior.py`. Proving test: `crates/eg-compute/src/capability_index/tests.rs::blend_order_matches_au_cases`. | Fixtures show planted top-1 recovery and type-coherent top-k. They show exact cosine parity with both weights at zero. They show an explicit prior that overrides the default, and id-ordered ties.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.5
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `apply_capability_outcome(reward, outcome, policy)` in `capability_designation.rs`. The outcome is `success: bool` (1 or 0) or an explicit reward clamped to [0, 1]. The update is an exponential moving average: `new = (1 - alpha) * old + alpha * observed`, with named default `alpha` 0.3 and neutral start 0.5. All arithmetic is Q32 fixed point, so replay is deterministic (R007). `generation_erasure` applies when a writer upserts a record again with a changed vector. If the cosine distance to the stored vector is above 0.25, reset the reward to neutral. Then increment `generation`. `selective_erase(ids)` resets only the named ids and is order-independent. `decay(factor)` moves every reward toward 0.5 by `0.5 + (r - 0.5) * factor`, with default factor 0.99. A durable reward seeds a record only when the shard has no newer reward for it. Rewards persist in a new Agent Library table `capability_reward` through `AgentLibraryStore` in redb. They survive restart. This replaces AU `record_outcome`, `reward_of`, `_maybe_erase_stale_reward`, `selective_erase_rewards`, `decay_rewards`, and the AU durable EMA in `retrieval/durable_outcome_store.py`. AU acceptance cases: all five cases in `tests/retrieval/test_reward_writeback.py`, `tests/retrieval/test_capability_index.py::test_material_reembed_erases_stale_reward`, `::test_selective_erase_rewards_is_targeted_and_order_independent`, and `tests/unit/graph/test_capability_routing_x4.py::test_bandit_prefers_the_historically_better_tool_over_a_marginally_closer_one`. Proving test: `crates/eg-types/src/decision/capability_designation.rs::tests::reward_ema_erasure_and_decay`. | Fixtures show a bounded EMA. A material re-embed resets reward, and a minor re-embed keeps it. Fixtures also show targeted erasure, decay toward neutral, and a reward that survives store reopen.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.6
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Each shard pins one `embedding_version` and one `dim` at its first record. A record or question with a different version or dim is refused. A shard with zero live records releases the pin. A re-index can then fill it under a new version. Re-indexing to a new version builds a second shard generation beside the live one and swaps it atomically. Readers never see a mixed generation. This replaces AU `_pin_or_check_embedding_version`, `_check_query_embedding_version` and the drained-pin release in `CapabilityIndex.remove`. Proving test: `crates/eg-compute/src/capability_index/tests.rs::version_pin_refuses_mixed_spaces`. | A mismatched version or dim refuses on upsert and on question. A drained shard accepts a new version. A generation swap is atomic to readers.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.7
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Add `QuestionKind::CapabilityDesignation` at `crates/eg-types/src/decision/statistical.rs:58`. Add `capability_designation_outcome` in new `src/server/handlers/decide/stat_capability_designation.rs`. Match it in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:137`, beside `tool_subset_outcome`. The served method is the existing `Decide`; its answer carries `CapabilityDesignationV1` in the decision record. Outcomes use the existing `DecisionLog` method with a new op `capability_outcome{tenant_id, entity_id, success | reward_q32, decision_id, source_ids}`. It returns the updated `CapabilityRewardV1`. The engine keeps the index current from its own committed changes. The existing CDC feed sends Agent Library writes to the shard writer. It also sends changes to agent, tool and skill nodes. There is no client-side feed and no client-side index. Rerun `gen_contract` so the generated client has `send_decide` for the new kind and the new `DecisionLog` op. Proving test: `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::decide_routes_capability_designation`. | The served `Decide` answer for the new kind returns typed designations. A committed Agent Library write is visible to the next question without a rebuild.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.8
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Refuse with a typed reason and write nothing. `embedding_version_mismatch` and `dim_mismatch` name the expected and actual values. `empty_query_vector` and `malformed_query_vector` cover a bad vector. `too_many_required_capabilities` applies above 32, and `too_many_candidates` applies when k is above 64 (R065). `capability_schema_unavailable` applies when required capabilities exist and the GraphSchema closure or its digest is unavailable. The engine fails closed and never falls back to literal matching. `index_capacity_exceeded` applies on a bound overflow. `capability_outcome` refuses `outcome_value_missing` when it has neither success nor reward. It refuses `access_denied` for an entity outside the caller's tenant. When no visible candidate meets the filters, the engine abstains with `no_capable_candidate`. That reason names the first missing capability (R010). A k of zero returns an empty designation list. Proving test: `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::capability_designation_refusals`. | Each case returns its typed reason. No reward, index epoch or decision record changes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.9
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The decision record emits one premise per returned designation. The premise holds the entity id, cosine, reward, prior, blended score and eligibility verdict. It emits premises for each named default and its value. It emits premises for the index epoch, the embedding version, the GraphSchema digest and the candidate pool size. It emits one premise per subsumption path used. Capability facts from pack annotations or A2A cards are claims; the record states the weakest evidence class (R002). A `capability_outcome` trace records the prior and new reward, alpha, generation and source ids. Proving test: `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::premises_name_scores_and_defaults`. | The decision record lists every score term and default for every designation. The outcome trace links to its source ids.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.10
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The index meets measured budgets. Reference load: N = 100,000 records, dim = 1024, 8 capabilities per record, k = 5, on one build-host core. Filtered case: one required capability selects at most 5 percent of records. Its budget is 2 ms at p50 and 10 ms at p99 or less. Unfiltered case: the budget is 3 ms at p50 and 15 ms at p99 or less. Its recall@5 is at least 0.95 against an exact scan. Incremental upsert: the budget is 1 ms at p99 or less, without durable commit. Resident memory is at most `1.25 * N * dim` bytes for vectors plus 96 bytes per record for metadata and postings. At the reference load this is about 132 MiB. Query cost is sub-linear in N for the unfiltered and large-pool paths. Read throughput scales with reader threads, because no global lock is on the query path. Benchmark: `benches/capability_designation_bench.rs`. | The benchmark reports p50, p99, recall@5 and resident bytes at the reference load and at N = 10,000. Each value is within its budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.11
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method with a `CapabilityDesignation` question. The test `tests/decide/test_capability_designation_served.py::test_designation_end_to_end` writes agent, tool and skill components through the served Agent Library. It submits a question with required capabilities, a tenant and policy tags, and observes subsumption-aware, filtered, ranked designations with eligibility. It then records outcomes through `DecisionLog` and observes the re-ranked order. It restarts the engine and observes the same rewards. Acceptance mirrors the deleted AU tests: `tests/retrieval/test_capability_index.py`, `tests/retrieval/test_kg_2_44b_ontology_prior.py`, `tests/retrieval/test_reward_writeback.py`, `tests/unit/graph/test_capability_routing_x4.py` and `tests/unit/graph/test_capability_designation.py` on agent-utilities branch `fix/au300-queries`. The `.10` benchmark runs in the same lane. Proving test: `tests/decide/test_capability_designation_served.py::test_designation_end_to_end`. | The served test passes against a real engine, and the benchmark meets the `.10` budgets.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.12
Designation and selection read imported connector-pack relationships (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Designation and selection read imported connector-pack relationships (rollup).** Capability designation selects tools, skills and prompts from the surface triples of `EG-TYPED-PACKS-R102`. It also answers which domain method applies to a target class. Children `.12.1` to `.12.6` deliver it. | Rollup closes when every child `.12.1` to `.12.6` passes its proving test.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.12.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `applies_to: BTreeSet<ClassIri>` and `executes: BTreeSet<ClassIri>` to `CapabilityRecordV1` in `crates/eg-types/src/decision/capability_designation.rs`. Add `target_classes: BTreeSet<ClassIri>` to the designation question. The engine fills records from `cp:operatesOn`, `cp:appliesTo`, `cp:executes` and `cp:providesCapability` triples. Owner: epistemic-graph. | `crates/eg-types/src/decision/capability_designation.rs::tests::pack_surface_fields_round_trip`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.12.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** `capability_rule` must also match a record when one `applies_to` or `executes` class is a subclass of a target class. Subsumption reads `rdfs:subClassOf` over the composed schema within the shared step budget. A method question returns the method class and each tool that executes it. Owner: epistemic-graph. | `crates/eg-types/src/decision/capability_designation.rs::tests::target_class_subsumption_selects_tools`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.12.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The surface projection of `EG-TYPED-PACKS-R102.2` upserts records into the index of `crates/eg-compute/src/capability_index/` at projection commit. `capability_designation_outcome` is matched in `handle_decide` beside `tool_subset_outcome` (`src/server/handlers/decide/stat_decide.rs:137`). Owner: epistemic-graph. | `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::projection_commit_upserts_pack_records`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.12.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A target class with no matching record must abstain with `no_designated_component`, naming the class. A record from a stale pack revision must refuse with `stale_pack_revision`. An unknown target class must refuse with `unknown_target_class`. Owner: epistemic-graph. | `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::pack_target_refusals`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.12.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The engine must emit one premise per candidate. Each premise names the subclass path, the component IRI, the pack digest and the graph revision. Owner: epistemic-graph. | `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::premises_name_subclass_path_and_pack`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.12.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` method with a `CapabilityDesignation` question. The test imports a connector pack through `ConnectorPack.Import` and asks for a target class. It must observe the executing tool and the subclass path. With the pack withdrawn, the question must abstain. Owner: epistemic-graph. | `tests/decide/test_capability_designation_pack_served.py::test_designation_reads_imported_pack`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R172.13
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The capability index applies the active capability-scope adapter of `EG-DECISION-ENGINE-R174.7` to the task embedding before `rank_capability_candidates`. Capability outcomes from `EG-DECISION-ENGINE-R172.5` feed that adapter's fit. A drift refresh of `EG-DECISION-ENGINE-R174.8` re-indexes a shard through the generation swap of `EG-DECISION-ENGINE-R172.6`. With no active adapter, ranking uses the base vector. Proving test: `crates/eg-compute/src/capability_index/tests.rs::capability_adapter_applies_before_rank`. | The adapted ranking differs from the base ranking only through the active adapter, and no adapter yields the base ranking.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R175
Implicit-reasoning recommendation over temporal semantic ids (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Implicit-reasoning recommendation over temporal semantic ids (rollup).** The engine must rank catalog items for a query and a history. It encodes items as temporal semantic ids and refines a latent target for a bounded number of pause steps. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R175.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `SemanticId{time_bucket: u16, codes: [u8; 4]}`, `RecommendRequestV1` and `RecommendAnswerV1` in `crates/eg-types/src/decision/recommend.rs`. The request holds a catalog reference, a query embedding, history item ids, `pause_steps` from 0 to 8, `top_k` from 1 to 100 and `as_of`. Add `QuestionKind::ItemRecommendation`. Proving test: `recommend.rs::tests::request_round_trips`. | A serde round trip keeps every field and rejects `pause_steps = 9`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R175.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add residual quantization and refinement in `crates/eg-numeric/src/recommend/`. Fitting uses seeded k-means per level with at most 4 levels of 256 codes. Each pause step moves the working vector toward the history and its nearest items. Ranking uses code-prefix buckets, then cosine. Encode cost is O(L·C·d) per item. Query cost is O(p·(h + m)·d) plus the candidate bucket size. | A seeded fixture returns the same ranking on two runs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R175.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:137`, beside `tool_subset_outcome`. Catalog vectors come from the graph's semantic store. The fitted encoder persists through `decision_jobs::encode_artifact` per catalog revision. A new item encodes with the frozen codebooks. | A dispatch test routes the new kind and reads the stored encoder.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R175.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** An empty catalog must abstain with `empty_catalog`. A dimension mismatch must return `INVALID_ARGUMENT`. An encoder older than the catalog revision must abstain with `encoder_stale`. | Each case returns its typed reason and no ranking.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R175.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The record must name encoder revision, catalog digest and pause steps. It must hold one premise per returned item with its score. The NDCG reproduction must persist as a `BenchmarkClaim` from `crates/eg-types/src/benchmark_claim.rs`. | A record readback lists the premises and the claim.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R175.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` method. The test `tests/decide/test_recommend_served.py::test_pause_steps_lift_ndcg` uses a seeded catalog of 4 clusters with 6 items each. NDCG@6 with 2 pause steps must be at least NDCG@6 with 0 pause steps. The benchmark `crates/eg-numeric/benches/semantic_id_rank.rs` must show p50 under 5 ms and p99 under 20 ms for 100,000 items. | The served test passes, and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R173
Cross-round edit concentration cap (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Cross-round edit concentration cap (rollup).** The engine must decide keep or revert for a candidate harness edit. It counts shipped edits per dimension over a round window against a received threshold. The default threshold is 3 shipped edits within 5 rounds. The same threshold must drive a shape the engine validates. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R173.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `ConcentrationPolicy{policy_iri, min_shipped, window_rounds, revision}`, `EditFact{edit_id, dimension_iri, round, status}` and `ConcentrationVerdict{dimension_iri, count, first_round, last_round, action}` in `crates/eg-types/src/decision/concentration.rs`. Closed `action` values are `keep` and `revert`. Add `QuestionKind::EditConcentration`. Proving test: `concentration.rs::tests::policy_round_trips`. | A serde round trip keeps every field and rejects `window_rounds = 0`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R173.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add `concentration_verdict(facts, candidate, policy)` in `concentration.rs`. It counts shipped edits on the candidate's dimension inside the window. It returns `revert` when the count with the candidate reaches `min_shipped`. Otherwise it returns `keep`. Each dimension keeps a ring buffer of rounds. A new edit costs O(1) amortized. | Unit tests cover the third edit in rounds 2 to 4 and two edits only.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R173.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:137`. The policy node supplies the threshold. A concentration shape in `crates/eg-core/ontology/` reads the same policy node. `ShaclValidate` evaluates it through `eg-shacl`. | A test asserts the same verdict from `Decide` and from `ShaclValidate`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R173.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A missing policy must abstain with `no_concentration_policy`. Facts with mixed policy revisions must abstain with `mixed_policy_revision`. | Each case returns its typed reason and no verdict.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R173.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The record must list the counted edit ids, the window bounds, the threshold and the policy revision. | A record readback lists each field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R173.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` method. The test `tests/decide/test_concentration_served.py::test_third_same_dimension_edit_reverts` submits shipped edits in rounds 2 to 6 on one dimension. The third edit must return `revert`. Two edits must return `keep`. The benchmark `crates/eg-types/benches/concentration.rs` must show p99 under 2 ms for 10,000 edit facts. | The served test passes, and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.110
Native tool relevance index and task-to-tool assignment (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Native tool relevance index and task-to-tool assignment (rollup).** The engine must hold one tool relevance index for the fleet catalog. It must assign tools to a task and an agent role from that index. Every tool search surface must receive this one ranking. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.110.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `ToolEntry{tool_id, server_id, name_tokens, description_tokens, capability_iris, token_cost}` with interned `u32` ids. Add `ToolAssignmentRequestV1{task_text, task_embedding, agent_role_iri, top_k, context_budget_tokens}` with `top_k` from 1 to 50. Add `ToolAssignmentV1` in `crates/eg-types/src/decision/task_plan.rs`. Proving test: `task_plan.rs::tests::assignment_round_trips`. | A serde round trip keeps every field and rejects `top_k = 51`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.110.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add an inverted token index in `crates/eg-text/src/tool_relevance.rs` and an embedding arm in `eg-ann`. Lexical and embedding ranks fuse by reciprocal rank with `k = 60`. The role allowlist filters before ranking. The result feeds `rank_tools_by_relevance` from `EG-DECISION-ENGINE-R134.2`. A catalog change updates postings in O(t) tokens. | A fixture asserts the fused order and an incremental update.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.110.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The `ToolRelevance` arm from `EG-DECISION-ENGINE-R134.5` at `src/server/handlers/decide/stat_decide.rs:137` reads this index. Fleet catalog writes update the index through the `FleetCatalog` record path. | A served test changes the catalog and observes the new ranking.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.110.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** An empty catalog must abstain with `empty_catalog`. A budget below the cheapest tool must abstain with `budget_below_minimum`. An embedding dimension mismatch must return `INVALID_ARGUMENT`. | Each case returns its typed reason and no tools.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.110.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each returned tool must carry a premise with lexical score, embedding score, fused rank and index revision. | A record readback lists the premise fields.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.110.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` method with a `ToolRelevance` question. The test `tests/decide/test_tool_assignment_served.py::test_role_assignment_uses_one_ranking` loads a catalog of 123 tools on 66 servers. Two search surfaces must receive the same order. The benchmark `crates/eg-text/benches/tool_relevance.rs` must show p50 under 1 ms and p99 under 5 ms for 10,000 tools. | The served test passes, and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.102
Run retrieval outcomes and per-step credit (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Run retrieval outcomes and per-step credit (rollup).** The engine must record a delegated run's retrieval outcome and per-step credit. The harness sends the answer and the trace only. The engine joins cited rows to retrieved rows and credits each step. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.102.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `LearningWrite::RunOutcome(RunOutcomeV1)` at `crates/eg-types/src/decision/statistical/retrieval.rs:295`. `RunOutcomeV1` holds run id, decision ids, answer digest, cited row ids, success and at most 256 `StepRecord{step_idx, agent_iri, capability_iri, reward}`. Proving test: `retrieval.rs::tests::run_outcome_round_trips`. | A serde round trip keeps every field and rejects 257 steps.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.102.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Cited rows become positives. Retrieved rows that the answer does not cite become hard negatives under `EG-DECISION-ENGINE-R100`. Each step's advantage is reward minus a per-capability moving baseline. The default baseline weight is 0.1 and is a replaceable default. Cost is O(s + r) in steps and rows. | A unit test computes positives, negatives and advantages for a fixture.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.102.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The write enters `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398`. The decide handlers dispatch it to a new `src/server/handlers/decide/stat_run_credit.rs`. The capability baseline persists in the decision jobs store. | A dispatch test routes the write and reads the stored baseline.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.102.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** An unknown decision id must return `INVALID_ARGUMENT`. A repeated run id with a new digest must return `IDEMPOTENCY_CONFLICT`. A cited row absent from every referenced result must refuse with `CITATION_NOT_RETRIEVED`. The generated error contract must declare that code. | Each case returns its code and writes nothing.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.102.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The receipt must hold run id, decision ids, positive and negative counts, per-step advantages and baseline revisions. | A test reads the receipt after one run.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R100.102.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is a served `Discover` call followed by a served `DecisionLog` `Learn` call. The test `tests/decide/test_run_credit_served.py::test_cited_rows_and_step_credit_recorded` reads back the hard negatives and the moved baseline. The benchmark `benches/run_credit.rs` must show p99 under 5 ms for a 256-step run. | The served test passes, and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174
Engine-run embedding generation swap cycle (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Engine-run embedding generation swap cycle (rollup).** The engine must run the embedding generation cycle end to end. The cycle publishes a model, re-embeds into a shadow generation, receipts the comparison and activates the generation. Children `.1` to `.6` deliver it. Child rollups `.7` (scoped adapters), `.8` (drift-driven refresh) and `.9` (search-connector freshness) extend it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `GenerationCycleV1{logical_graph, model_ref, state, shadow_graph, receipt_digest}` in `crates/eg-types/src/decision/statistical/retrieval_generation.rs`. `model_ref` holds id, revision and dimension. Closed `state` values are `published`, `reembedding`, `evaluated`, `activated` and `rejected`. Proving test: `retrieval_generation.rs::tests::cycle_round_trips`. | A serde round trip keeps every field and rejects an unknown state.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** A cycle is idempotent per logical graph and model revision. A model that is already active is a no-op. Re-embedding runs in batches of 256 nodes and checkpoints each batch. Evaluation reuses `src/server/handlers/decide/stat_generation.rs`. Activation moves the pointer by compare-and-set against the active generation. | A unit test resumes a cycle from a checkpoint and activates once.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The cycle enters through `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398`. A new `stat_generation_cycle.rs` runs it as an `eg-jobs` analytics job. The job holds a background capacity lease from `AcquireCapacity`. The embedding call uses the engine's configured embedding endpoint. | A served test submits a cycle and observes the job and the lease.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A caller without `admin:decision-head` must receive `ACCESS_DENIED`. A dimension mismatch must return `INVALID_ARGUMENT`. A failing receipt must end in `rejected` with no pointer move. A concurrent pointer move must return `CONFLICT`. | Each case returns its code and leaves the active pointer unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The receipt must hold model revision, re-embedded node count, comparison metrics and the pointer before and after. | A test reads the receipt after one activation.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `DecisionLog` method. The test `tests/decide/test_generation_cycle_served.py::test_cycle_resumes_and_activates` re-embeds 10,000 nodes. It restarts the engine during re-embedding and observes resume from the checkpoint. A later served `Discover` must read the new generation. Engine overhead must stay under 1 ms per 256-node batch. | The served test passes, and the measured overhead meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R176
Job-scoped load set from the overlay of all connector packs (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Job-scoped load set from the overlay of all connector packs (rollup).** A client asks what a job needs. The engine answers with the tools, the skills and the local agents with their prompts. It reads the surface relationships of every imported connector pack (`EG-TYPED-PACKS-R102`). It reuses capability designation (`EG-DECISION-ENGINE-R172`). graph-os loads only the answered set (`ARBORA-FLEET-R037`). Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R176.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `LoadSetQuestion{job_text, job_embedding, required_capabilities, max_tools, max_agents}` and `LoadSetAnswer{tools, skills, agents, graph_revision, premises}` in `crates/eg-types/src/decision/load_set.rs`. An agent entry is `AgentStart{agent_iri, prompt_iri, model_profile}`. Add `QuestionKind::LoadSet` (`crates/eg-types/src/decision/statistical.rs:58`). The default `max_tools` is 32 with a hard limit of 128. The default `max_agents` is 4. Proving test: `crates/eg-types/src/decision/load_set.rs::tests::load_set_round_trips`. | A serde round trip keeps every field and rejects `max_tools` above 128.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R176.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The engine runs capability designation for each required and each job-derived capability. It unions the candidates and removes duplicate component ids. It keeps the top `max_tools` by designation score. Skills join with the tools they use. Agents and prompts come from the orchestration answers of `EG-CQ-ORCH-R002` and `EG-CQ-ORCH-R005`. The p95 answer time must stay under 50 ms for 5,000 tools across 100 packs. Proving test: `src/server/handlers/decide/stat_tests/load_set.rs::bounded_union_in_stable_order`. | A job over three packs returns a bounded, duplicate-free set in a stable order.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R176.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** `handle_decide` (`src/server/handlers/decide/statistical.rs:11`) matches `QuestionKind::LoadSet` beside capability designation. No production caller answers a load set today. Proving test: `src/server/handlers/decide/stat_tests/load_set.rs::served_decide_reaches_load_set`. | A served `Decide` with a load-set question reaches the new arm.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R176.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** An empty job text with no capabilities must refuse with `INVALID_ARGUMENT`. A capability without a candidate must abstain with `no_designated_component` and name the capability. A stale pack revision must refuse with `stale_pack_revision`. Proving test: `src/server/handlers/decide/stat_tests/load_set.rs::load_set_refusals`. | Each case returns its code, and no partial set hides an abstention.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R176.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The answer must carry one premise per chosen component. A premise names the capability, the score, the pack digest and the graph revision. The answer must state the count of excluded candidates. Proving test: `src/server/handlers/decide/stat_tests/load_set.rs::premises_per_component`. | Each chosen tool has one premise with its pack digest.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R176.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` method with a load-set question. The test imports three connector packs with 300 tools. It asks for one job. Proving test: `tests/decide/test_load_set_served.py::test_job_returns_bounded_tool_skill_agent_set`. | The answer holds 32 tools or fewer, their skills and one agent start, and meets the time budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R177
Connector usage guidance is a graph query (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Connector usage guidance is a graph query (rollup).** A client asks how and when to use connector X for job J. The engine answers from the graph. The answer holds the conditions, the ordered tool steps, the prompts and the cautions. A skill becomes this query. Static skill text is a secondary premise only. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R177.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `UsageGuidance{connector, job_class, conditions, steps, prompts, cautions, graph_revision}` and `UsageStep{tool, inputs_from, precedes}` in `crates/eg-types/src/decision/usage_guidance.rs`. Add `QuestionKind::UsageGuidance`. Proving test: `crates/eg-types/src/decision/usage_guidance.rs::tests::guidance_round_trips`. | A serde round trip keeps every field and rejects a step without a tool.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R177.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The engine derives conditions from capability and precondition triples. It derives steps from `eg:TaskStep` and `eg:precedes` (`EG-CQ-ORCH-R001`) joined to pack tools. When two step orders are legal, it orders them by recorded success rate. Static skill text enters as a premise labelled `declared`. Proving test: `src/server/handlers/decide/stat_tests/usage_guidance.rs::steps_ordered_by_outcome`. | A fixture connector returns ordered steps, and success rate breaks a tie.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R177.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** `handle_decide` (`src/server/handlers/decide/statistical.rs:11`) matches `QuestionKind::UsageGuidance`. Proving test: `src/server/handlers/decide/stat_tests/usage_guidance.rs::served_decide_reaches_guidance`. | A served `Decide` with a guidance question reaches the new arm.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R177.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** An unknown connector must refuse with `UNKNOWN_CONNECTOR`. A connector without steps must abstain with `no_usage_steps`. A cyclic step order must refuse with `CYCLIC_STEPS`. Proving test: `src/server/handlers/decide/stat_tests/usage_guidance.rs::guidance_refusals`. | Each case returns its code.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R177.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each step must cite the triples and the outcome counts it used. Proving test: `src/server/handlers/decide/stat_tests/usage_guidance.rs::steps_cite_triples`. | Each step lists its supporting triples.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R177.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` method with a guidance question. The test imports one connector pack and records outcomes for two step orders. Proving test: `tests/decide/test_usage_guidance_served.py::test_how_to_use_connector_answers_from_graph`. | The answer lists the steps in the order with the higher success rate, with citations.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.7
Scoped outcome-trained adapters on the frozen base embedding (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Scoped outcome-trained adapters on the frozen base embedding (rollup).** The engine must fit a small learned transform over the frozen base embedding. It trains from outcomes the engine already records. Each adapter is versioned per tenant, corpus or capability scope. It applies at query time, or at index time over stored vectors, without re-embedding the corpus. Keep or revert is decided by measured retrieval quality on held-out outcomes. Any failure serves the base embedding. Children `.7.1` to `.7.6` deliver it. It extends `EG-DECISION-ENGINE-R101`. | Rollup closes when every child `.7.1` to `.7.6` passes its proving test.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.7.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add closed `AdapterScope` values `graph`, `corpus{corpus_iri}` and `capability{capability_iri}` in `crates/eg-types/src/decision/statistical/retrieval_adapter.rs`. Add closed `AdapterSide` values `query` and `index`. Add closed `OutcomeSource` values `retrieval_outcome`, `run_outcome` and `capability_outcome`. Extend `AdapterFitRequest` with `scope`, `side` and `sources`. Extend `QueryAdapterBody` with `revision: u32` and `parent_digest: Option<String>`. Add `PointerRef::ScopedAdapter{graph, scope}` at `crates/eg-types/src/decision/statistical/retrieval.rs:263`. Proving test: `retrieval_adapter.rs::tests::scoped_fit_request_round_trips`. | A serde round trip keeps every field and rejects an unknown scope, side or source.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.7.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Extend the fit in `crates/eg-numeric/src/decision/adapter.rs`. The transform is `W = I + sum(g_i * u_i * u_i^T)` with rank 1 to 8 and orthonormal units. Rank 1 to 8 covers the low-rank layer; a diagonal projection is rank `d` and is out of scope. Cited rows are positives. Retrieved rows that are not cited are hard negatives (`EG-DECISION-ENGINE-R100`, `EG-DECISION-ENGINE-R100.102`). Capability outcomes (`EG-DECISION-ENGINE-R172.5`) weight task-to-entity pairs by reward. All arithmetic is Q30 fixed point with a seeded order, so a refit replays bit for bit. The held-out split hashes each decision id. Keep needs the existing Wilson lower bound above one half and adapted MRR at least base MRR. After activation, a monitor dual-scores new outcomes against the base. It rolls back when the Wilson upper bound falls below one half over at least 50 outcomes. Resolution order is capability, then corpus, then graph, then base. An `index` adapter transforms stored vectors at read, with no embedding endpoint call. Budgets: fit at most 30 s for 100,000 examples at `d = 1024` and rank 8 on one core. Fit memory is at most 64 MiB. A resident adapter is at most 40 KiB. A tenant holds at most 64 active adapters. | Unit tests cover deterministic refit, the keep and revert rules, scope resolution order and the memory cap.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.7.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The fit enters `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398` through `LearningWrite::FitAdapter` and `stat_adapter.rs`. Activation and rollback move the pointer through `stat_pointer.rs`. Serving resolves the scoped adapter in `src/server/handlers/decide/served_adapter.rs` and applies it at `src/server/handlers/graph_ops/semantic.rs:233` on `Discover` and `SemanticSearch`. The capability index applies it before `rank_capability_candidates` (`EG-DECISION-ENGINE-R172.13`). An `index` adapter materializes through the generation cycle of `EG-DECISION-ENGINE-R174` with no endpoint call. Fits run as `eg-jobs` analytics jobs on a background lease from `AcquireCapacity`. Non-urgent runs take downtime priority from the downtime scheduling of `EG-DURABLE-KERNEL-R101`. | A dispatch test routes a scoped fit, an activation and a served query through each named call site.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.7.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A caller without `admin:decision-head` must receive `ACCESS_DENIED`. An unknown scope IRI must refuse with `adapter_scope_unknown`. Fewer held-out outcomes than `min_eval_items` must refuse with `insufficient_outcomes`. A space digest that differs from the graph's space must refuse with `adapter_space_mismatch`. Rank times dimension above the resident cap must refuse with `adapter_memory_budget`. A 65th active adapter in a tenant must refuse with `too_many_adapters`. A failing receipt must move no pointer. An unreadable adapter state serves the base query and is not a refusal. | Each case returns its code, writes no pointer and leaves the served adapter unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.7.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The fit receipt must hold scope, side and each outcome source with its count. It must also hold the training digest, both MRR values, the Wilson bounds, the parent digest and the revision. A rollback receipt must hold the monitor window and its bounds. The `Discover` verdict names the applied adapter digest or `base` (`EG-FEDERATED-QUERY-R089.7`). | A test reads the fit receipt, a rollback receipt and the verdict field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.7.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `DecisionLog` method followed by served `Discover`. The test `tests/decide/test_scoped_adapter_served.py::test_outcome_adapter_lifts_and_reverts` records cited outcomes through `Learn`. It fits a capability-scope adapter, activates it and observes the re-ordered `Discover` rows with the adapter digest. It then feeds degrading outcomes and observes rollback to `base`. The benchmark `crates/eg-numeric/benches/scoped_adapter.rs` must show at most 50 µs p99 added query latency at `d = 1024` and rank 8. It must show the fit and memory budgets of `.7.2`. | The served test passes, and the benchmark receipt meets each budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.8
Drift-driven embedding refresh with atomic per-shard versions (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Drift-driven embedding refresh with atomic per-shard versions (rollup).** The engine must keep embeddings current as data and vocabulary drift. It detects distribution shift, out-of-vocabulary growth, retrieval-quality decay and staleness per shard. It re-embeds only the changed regions into a new generation and swaps each shard atomically. Readers never mix generations. Refresh runs in downtime windows unless a job needs it now. Children `.8.1` to `.8.6` deliver it. | Rollup closes when every child `.8.1` to `.8.6` passes its proving test.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.8.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `DriftSignalV1{scope, kind, value_q16, threshold_q16, window, reference_generation, observed_at}` in new `crates/eg-types/src/decision/statistical/retrieval_drift.rs`. Closed `kind` values are `distribution_shift`, `vocabulary_growth`, `quality_decay` and `staleness`. Add `RefreshPlanV1{logical_graph, regions, reason, priority, target_generation}` with at most 4,096 regions. Add `RegionRef{shard_id, node_type, revision_from, revision_to}`. Closed `priority` values are `downtime` and `on_demand`. Proving test: `retrieval_drift.rs::tests::refresh_plan_round_trips`. | A serde round trip keeps every field and rejects 4,097 regions.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.8.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Add the per-shard monitor in new `crates/eg-numeric/src/decision/drift.rs`. It keeps a running mean and diagonal variance of written vectors with Welford updates. Shift is the symmetric divergence of two diagonal Gaussians against the activation reference. Vocabulary growth compares written tokens with an 8 KiB Bloom filter built at generation activation. Quality decay compares the rolling MRR of cited outcomes with the activation baseline. Staleness reuses the `stale_index` test of `EG-FEDERATED-QUERY-R089.2`. Named defaults: shift 0.2, vocabulary growth 5 points, quality decay 10 percent. A signal must fire on two consecutive evaluations. A compressed bitmap per shard records nodes changed since the generation watermark. The plan selects only firing shards and their changed regions. Memory is at most 64 KiB per shard at `d = 1024`, excluding the bitmap. | Unit tests fire each signal kind, show hysteresis and select only changed regions.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.8.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The write commit path and `LearningWrite::RecordOutcome` update the monitor. Evaluation runs as an `eg-jobs` analytics job on a background lease from `AcquireCapacity`. A firing plan submits the generation cycle of `EG-DECISION-ENGINE-R174` through `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398`. Each refreshed shard swaps under the per-shard pin of `EG-DECISION-ENGINE-R172.6`. `discover` at `src/server/handlers/graph_ops/semantic.rs:88` pins one generation per shard at query start. Non-urgent runs take downtime priority from the downtime scheduling of `EG-DURABLE-KERNEL-R101`. A job that declares a freshness need runs the plan with `on_demand` priority. | A dispatch test observes a monitor update, one scheduled plan and one per-shard swap.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.8.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A logical graph without a drift policy must abstain with `drift_policy_missing`. A plan above 4,096 regions or the policy node budget must refuse with `refresh_region_budget`. A concurrent shard swap must return `CONFLICT` and leave the live generation. An `on_demand` plan without `admin:decision-head` must receive `ACCESS_DENIED`. | Each case returns its code and leaves every shard generation unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.8.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each signal must persist as a premise with kind, value, threshold, window and reference generation. The refresh receipt must list the regions, the re-embedded node count and each shard's generation before and after. | A test reads the signal premises and the refresh receipt.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.8.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served graph write path followed by served `Discover`. The test `tests/decide/test_drift_refresh_served.py::test_vocabulary_drift_refreshes_changed_shards` writes 4 shards. It adds new vocabulary to one shard and observes `vocabulary_growth`. It runs the scheduled downtime refresh and observes re-embedding of that shard only. Concurrent `Discover` readers must see one generation per shard in each response. The benchmark `crates/eg-numeric/benches/drift_monitor.rs` must show a monitor update under 2 µs p99 per write at `d = 1024`. It must show evaluation under 5 ms per shard. | The served test passes, and the benchmark receipt meets each budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.9
Fresh data through the search connector's virtual-graph source (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Fresh data through the search connector's virtual-graph source (rollup).** When drift, staleness or a job needs fresher data, the engine must schedule a refresh. The refresh runs through the `searxng` connector's virtual-graph source. It reads through the virtual-graph source and runs no extract-transform-load copy. Every result carries its source, retrieval time and query provenance. Refreshes deduplicate by URL and content digest. New and changed results feed the drift refresh of `EG-DECISION-ENGINE-R174.8`. Children `.9.1` to `.9.6` deliver it. | Rollup closes when every child `.9.1` to `.9.6` passes its proving test.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.9.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `FreshnessRefreshV1{logical_graph, queries, trigger, priority, acl_policy_ref, privacy_policy_ref, budget}` in new `crates/eg-types/src/decision/statistical/retrieval_refresh.rs`. `queries` holds 1 to 32 query texts. Closed `trigger` values are `drift_signal`, `staleness` and `job_demand`. `budget` holds `max_requests` and `max_cost_units`. Add `FreshResultV1{url, content_digest, source_connection_iri, retrieved_at, query_text, query_digest, refresh_id}`. Add `LearningWrite::RefreshFreshness` at `crates/eg-types/src/decision/statistical/retrieval.rs:295`. Proving test: `retrieval_refresh.rs::tests::refresh_round_trips`. | A serde round trip keeps every field and rejects 33 queries.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.9.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Canonicalize each URL by scheme and host case, default port and fragment removal. A result whose URL and content digest are already stored is a no-op. A stored URL with a new digest supersedes the earlier row. A new or superseding row marks its region changed in the drift bitmap of `.8.2`. A per-tenant token bucket enforces `max_requests` per window. Each request spends its declared cost units against `max_cost_units`. Cost is O(r) in results. | Unit tests cover canonical URLs, each dedupe outcome, the region mark and both budgets.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.9.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The refresh enters `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398`. A new `src/server/handlers/decide/stat_freshness.rs` runs it as an `eg-jobs` job. It reads the `searxng` `vg:VirtualMapping` of `EG-MEDIA-VOCAB-R015` through its registered `SourceConnection` (`EG-UNIFIED-DATA-PLANE-R037`). Hot results materialize under `EG-UNIFIED-DATA-PLANE-R038`. The web metasearch source category is `EG-UNIFIED-DATA-PLANE-R038.7`, listed in the source-category matrix `EG-UNIFIED-DATA-PLANE-R022.4`. Triggers come from `.8.3`, from `stale_index` of `EG-FEDERATED-QUERY-R089.2`, or from a job's freshness request. Non-urgent runs take downtime priority from the downtime scheduling of `EG-DURABLE-KERNEL-R101`. A `job_demand` refresh runs with `on_demand` priority on an interactive lease. | A dispatch test routes a refresh, observes one virtual-graph read and one region mark.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.9.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A refresh without an ACL policy must refuse with `refresh_acl_policy_missing`. A refresh without a privacy policy must refuse with `refresh_privacy_policy_missing`. A refresh above the request budget must refuse with `refresh_rate_budget_exceeded`. A refresh above the cost budget must refuse with `refresh_cost_budget_exceeded`. A graph with no registered search source must refuse with `search_source_unregistered`. The generated error contract must declare each code. | Each case returns its code and writes no row and no region mark.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.9.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each stored result must carry its source connection, retrieval time, query text and query digest. The refresh receipt must list new, unchanged and superseded counts, the budget spent and the marked regions. | A test reads the result provenance and the receipt.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.9.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `DecisionLog` method followed by served `Discover`. The test `tests/decide/test_freshness_refresh_served.py::test_search_refresh_dedupes_and_feeds_refresh` uses the recorded `searxng` fixture of `EG-MEDIA-VOCAB-R015.2`. A repeated refresh must report every result unchanged. A changed content digest must supersede its row and mark its region. The next drift refresh must re-embed that region. `Discover` must return the row with its provenance. Engine overhead must stay under 2 ms p99 per 100 results, excluding connector latency. | The served test passes, and the measured overhead meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R174.9.7
Held web Documents refresh by drift
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Held web Documents refresh by drift.** A staleness or drift signal of `EG-DECISION-ENGINE-R174.8` must schedule the URLs of the web Documents in its region as refresh candidates. The candidates pass the fetch selection of `EG-DECISION-ENGINE-R802`. An unchanged content digest is a no-op. A changed digest supersedes the Document through `EG-UNIFIED-DATA-PLANE-R651.7` and marks its region. Proving test: `tests/decide/test_freshness_refresh_served.py::test_stale_web_document_refetches_on_digest_change`. | A stale Document with an equal digest writes nothing; a changed digest supersedes it and marks its region.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R614
Capability cards, distilled proposals, topic classes and relation projection are engine enrichment (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Capability cards, distilled proposals, topic classes and relation projection are engine enrichment (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R614.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `crates/eg-enrich/src/semantic.rs` defines CapabilityCard, EnhancementCandidate, SpecDraft, TopicAssignment, ProjectionRule. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R614.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** A capability card summarizes a symbol, file or feature and is stored with the model and prompt that produced it. Research concepts rank into enhancement proposals and spec drafts by value. Documents classify into a fixed subject taxonomy with a confidence and link to topic nodes. A node's own properties project into the edges they encode through declared taxonomy and reference rules. | Unit tests cover each rule with positive and boundary cases.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R614.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Scheduled by the expected-value rule of EG-DECISION-ENGINE-R031; model calls go through the engine's embedding and text heads, never a harness. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R614.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A card whose summary cites no stored fact id is refused. The stable code is `CARD_UNGROUNDED`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R614.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Per card: model, prompt digest, source fact ids. | Test reads the trace or metrics after one success and one refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R614.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** projection of 100k nodes under 1 s p99; classification of one document under 30 ms p99. The benchmark is `benches/r614_decision_engine.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R615
Write-back proposals queue for approval, then reach vendors only through the governed contract (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Write-back proposals queue for approval, then reach vendors only through the governed contract (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R615.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `crates/eg-decision/src/writeback.rs` defines WritebackProposal{risk_tier, as_of}, ProposalQueue, InventoryCreation, FindingTicket. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R615.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** High-stakes proposals are previewed and queued; approval releases them as one governed change set. Reconciled inventory becomes creation proposals for every enabled system of record and risk findings become ticket proposals, each stamped with the as-of instant they derive from and deduplicated by external id. Source-conflict preflight yields refuse, queue or proceed. | Unit tests cover each rule with positive and boundary cases.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R615.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extends EG-DECISION-ENGINE-R043; vendor execution is the SDK sinks of SDK-SOURCE-INGEST-R600. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R615.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A queued proposal executed without an approval record is refused. The stable code is `PROPOSAL_UNAPPROVED`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R615.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Per proposal: tier, approver, change-set id, as-of. | Test reads the trace or metrics after one success and one refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R615.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** enqueue plus approve round trip p99 under 15 ms. The benchmark is `benches/r615_decision_engine.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R617
Conversation logs, project rules and memory pruning are engine-held memory (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Conversation logs, project rules and memory pruning are engine-held memory (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R617.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `crates/eg-memory/src/conversation.rs` defines ConversationRecord, ProjectRules, RetentionPolicy, ContextBudget. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R617.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Chat logs from several IDE formats parse into ordered, provenance-keyed messages stored as transcript threads (EG-INGEST-WORKER-R003.13). Project rule files load layered and attach as scoped facts. Retention prunes by policy with a legal-hold exception, and memory nodes are created, read and expired through one surface. The context budget optimizer chooses the smallest covering set (EG-DECISION-ENGINE-R045). | Unit tests cover each rule with positive and boundary cases.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R617.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** SourceIngest transcript path; the harness only requests a context under a budget. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R617.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Pruning a node under legal hold is refused and logged. The stable code is `RETENTION_LEGAL_HOLD`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R617.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Per prune: examined, removed, held. | Test reads the trace or metrics after one success and one refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R617.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** parse plus store of 10k messages p99 under 1.5 s. The benchmark is `benches/r617_decision_engine.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R043.600
Approval queue and as-of stamping for write-back proposals
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Approval queue and as-of stamping for write-back proposals.** High-stakes proposals queue until an approval record exists and carry the as-of instant they derive from, as `EG-DECISION-ENGINE-R615` defines. Enqueue plus approve p99 stays under 15 ms. | Test queues a high-stakes proposal, asserts refusal without approval and one change set after approval.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R750
Bounded multi-step reasoning search with explicit budgets (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Bounded multi-step reasoning search with explicit budgets (rollup).** Rust-native in `crates/eg-compute/src/reasoning`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R750.750
Model: Bounded multi-step reasoning search with explicit budgets
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model: Bounded multi-step reasoning search with explicit budgets.** A reasoning strategy is a closed enum over chain, tree, graph and planning-with-world-model search. Each strategy runs over an arena of thought nodes. The decision ladder gives it a deterministic budget for nodes, depth, branching and tokens. A stored `ReasoningPolicy` selects the strategy per task class. Types: `ReasoningStrategy` (Chain, Tree, Graph, Planning), `ReasoningState`, `BudgetLedger`, `ThoughtNode` in a bump arena indexed by `u32`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R750.751
Behavior: Bounded multi-step reasoning search with explicit budgets
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior: Bounded multi-step reasoning search with explicit budgets.** Expansion, scoring, pruning, aggregation and merge are pure functions of the state and the fixed-point scores. The same inputs replay to the same best path and digest. An exhausted budget returns a typed best-so-far result with a certified-gap flag. It never continues without a bound. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R750.752
Refusal: Bounded multi-step reasoning search with explicit budgets
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal: Bounded multi-step reasoning search with explicit budgets.** The engine refuses four inputs with typed errors. The first is a strategy name outside the closed set. The second is a budget field of zero or above its ceiling. The third is a cyclic merge in graph search. The fourth is a score that is not a fixed-point value. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R750.753
Hot-path proof: Bounded multi-step reasoning search with explicit budgets
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof: Bounded multi-step reasoning search with explicit budgets.** Criterion benchmark `reasoning_search` expands 100k nodes on one core. The p50 is under 40 ms and the p99 is under 90 ms. Peak memory stays under 64 MiB per search. The search makes zero allocations after arena reservation. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R751
Horizon curriculum, step reward decomposition and hierarchical task decomposition (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Horizon curriculum, step reward decomposition and hierarchical task decomposition (rollup).** Rust-native in `crates/eg-plan/src/horizon`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R751.750
Model: Horizon curriculum, step reward decomposition and hierarchical task decomposition
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model: Horizon curriculum, step reward decomposition and hierarchical task decomposition.** The engine stores curriculum stages with promotion thresholds. It decomposes a task into a bounded hierarchy of subgoals with checkpoints. It attributes a trajectory outcome to per-step rewards. These rewards sum to the trajectory reward within a fixed-point tolerance. Types: `CurriculumStage`, `PromotionPolicy`, `SubgoalCheckpoint`, `StepReward`, `TrajectoryReward`, `HtnNode` in a flat `Vec` with parent indices. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R751.751
Behavior: Horizon curriculum, step reward decomposition and hierarchical task decomposition
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior: Horizon curriculum, step reward decomposition and hierarchical task decomposition.** Promotion to a longer horizon happens only when measured success over the stage window clears the received threshold. Reward decomposition is deterministic and idempotent per trajectory id. Normalized-advantage, dynamic-sampling, difficulty-floor and cache-tier-aware reward terms are pure numeric kernels in `eg-numeric`. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R751.752
Refusal: Horizon curriculum, step reward decomposition and hierarchical task decomposition
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal: Horizon curriculum, step reward decomposition and hierarchical task decomposition.** The engine refuses four inputs. The first is a decomposition deeper than the received recursion limit. The second is a reward that does not sum to the trajectory reward. The third is a promotion without a full stage window. The fourth is a non-finite advantage. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R751.753
Hot-path proof: Horizon curriculum, step reward decomposition and hierarchical task decomposition
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof: Horizon curriculum, step reward decomposition and hierarchical task decomposition.** Criterion benchmark `reward_decompose` over 10k-step trajectories with p50 under 5 ms and p99 under 12 ms, memory under 8 MiB, linear time in steps. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R752
Population drift, diversity-aware fan-out width and safe-autonomy ramp (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Population drift, diversity-aware fan-out width and safe-autonomy ramp (rollup).** Rust-native in `crates/eg-numeric/src/drift`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R752.750
Model: Population drift, diversity-aware fan-out width and safe-autonomy ramp
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model: Population drift, diversity-aware fan-out width and safe-autonomy ramp.** The engine measures agent-population drift as a one-dimensional Wasserstein distance between a reference window and a current window. It selects a fan-out width from pairwise output diversity. It accrues trust per action class. It returns a corrigibility verdict, and that verdict requires confirmation for irreversible actions. Types: `DriftReading`, `Wasserstein1`, `PopulationSpread`, `TrustLedger`, `IrreversibilityClass`, `CorrigibilityVerdict`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R752.751
Behavior: Population drift, diversity-aware fan-out width and safe-autonomy ramp
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior: Population drift, diversity-aware fan-out width and safe-autonomy ramp.** Drift readings, diversity-based width and trust assessments are deterministic fixed-point computations. An autonomy ramp clears a class only after the received number of clean outcomes. A cost-aware cap never exceeds the replica ceiling. An assurance verifier checks an action against per-kind invariants before it returns a verdict. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R752.752
Refusal: Population drift, diversity-aware fan-out width and safe-autonomy ramp
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal: Population drift, diversity-aware fan-out width and safe-autonomy ramp.** Self-reported outcomes cannot raise trust. An irreversible action never passes without an explicit approval fact. An empty window returns abstention, not a zero drift. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R752.753
Hot-path proof: Population drift, diversity-aware fan-out width and safe-autonomy ramp
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof: Population drift, diversity-aware fan-out width and safe-autonomy ramp.** Criterion benchmark `population_drift` over 4k-sample windows. The p50 is under 1 ms and the p99 is under 3 ms. Memory stays under 2 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R753
Verification, adversarial and synthesis steps over parallel trajectories (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Verification, adversarial and synthesis steps over parallel trajectories (rollup).** Rust-native in `crates/eg-compute/src/verify`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R753.750
Model: Verification, adversarial and synthesis steps over parallel trajectories
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model: Verification, adversarial and synthesis steps over parallel trajectories.** The engine joins parallel trajectories and verifies a step. It recovers from a step error. It distills a set of trajectories into one. Each operation returns a typed verdict with proof bindings. An adversarial pass runs a bounded set of probes against a candidate before admission. Types: `StepVerdict`, `TrajectoryJoin`, `AdversarialProbe`, `DistilledTrajectory`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R753.751
Behavior: Verification, adversarial and synthesis steps over parallel trajectories
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior: Verification, adversarial and synthesis steps over parallel trajectories.** A join keeps the highest-evidence trajectory under a deterministic tie-break. A verifier binds its verdict to the trace digest. Distillation emits a derivation record that names every source trajectory. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R753.752
Refusal: Verification, adversarial and synthesis steps over parallel trajectories
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal: Verification, adversarial and synthesis steps over parallel trajectories.** The engine refuses a verdict without a trace binding. It refuses a join over an empty set. It refuses a probe set larger than its budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R753.753
Hot-path proof: Verification, adversarial and synthesis steps over parallel trajectories
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof: Verification, adversarial and synthesis steps over parallel trajectories.** Criterion benchmark `trajectory_join` over 256 trajectories. The p50 is under 2 ms and the p99 is under 6 ms. Memory stays under 4 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R035.750
Model and behavior: Routing strategies: fast-path, learned policy, team reuse, workflow-context shielding and fallback chain
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model and behavior: Routing strategies: fast-path, learned policy, team reuse, workflow-context shielding and fallback chain.** Rust-native in `crates/eg-decision/src/route`. Each strategy is a pure stage in an ordered pipeline, and the first decision wins. A fast path serves simple turns. A trace-learned, cost-aware policy ranks specialists. The engine reuses a proven team before planning. Workflow context stays shielded per boundary. The final fallback extracts a structured plan. | Unit tests assert the behaviour and replay determinism.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R035.751
Hot-path proof: Routing strategies: fast-path, learned policy, team reuse, workflow-context shielding and fallback chain
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof: Routing strategies: fast-path, learned policy, team reuse, workflow-context shielding and fallback chain.** Criterion benchmark `route_pipeline` with p50 under 300 microseconds and p99 under 1.2 ms over 500 specialists and under 4 MiB. | Benchmark runs in CI and fails on regression.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R046.750
Model and behavior: Elastic topology admission with sandbox resource limits and commit-time plan admission
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model and behavior: Elastic topology admission with sandbox resource limits and commit-time plan admission.** Rust-native in `crates/eg-compute/src/topology`. An elastic admission check tests a committed topology plan against sandbox resource limits and turns it into one enforcement record. The engine re-admits width and depth changes at run time. A plan never grants them to itself. | Unit tests assert the behaviour and replay determinism.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R046.751
Hot-path proof: Elastic topology admission with sandbox resource limits and commit-time plan admission
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof: Elastic topology admission with sandbox resource limits and commit-time plan admission.** Criterion benchmark `topology_admit`. The p50 is under 200 microseconds and the p99 is under 800 microseconds. | Benchmark runs in CI and fails on regression.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.750
Model and behavior: Tool resolution, adaptive provisioning and subagent pattern choice
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model and behavior: Tool resolution, adaptive provisioning and subagent pattern choice.** Rust-native in `crates/eg-decision/src/tools`. The engine resolves tools and provisions them on demand for an execution context. It also chooses among subagent patterns by task complexity. Both decisions run over the skill and tool library. | Unit tests assert the behaviour and replay determinism.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.751
Hot-path proof: Tool resolution, adaptive provisioning and subagent pattern choice
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof: Tool resolution, adaptive provisioning and subagent pattern choice.** Criterion benchmark `tool_resolve` over 20k tools. The p50 is under 2 ms and the p99 is under 6 ms. | Benchmark runs in CI and fails on regression.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R650
Capability descriptors and request-scoped designation (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Capability descriptors and request-scoped designation (rollup).** EG holds one versioned descriptor per capability. A descriptor carries typed inputs and outputs, side effects, data types, scopes, cost, latency, reliability, locality and approval class. EG projects the classified closure for a request. The harness receives the designation; it holds no descriptor index. The Rust home is `crates/eg-types/src/agent_component/capability_descriptor.rs`. Satisfied only when children `EG-DECISION-ENGINE-R650.1`-`EG-DECISION-ENGINE-R650.6` are satisfied. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R650.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `CapabilityDescriptor` (versioned), `CapabilityPowerDescriptor`, `DesignationRequest`, `Designation`, `ClosureProjection` in `crates/eg-types/src/agent_component/capability_descriptor.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R650.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Persist a descriptor as properties of the capability node. Derive reliability from the learned reward and do not store it. Generate the power descriptor from the registry and the capability ledger. Project the request-scoped closure from OWL classification in O(closure size). | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R650.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extends `AgentAssemble` (`EG-DECISION-ENGINE-R036`) and the pack publisher; served `CapabilityDesignate`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R650.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** EG refuses a descriptor that lacks a side-effect class or approval class at publication. A designation request outside the caller's tenant returns nothing. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R650.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Record descriptor version, ontology digest, closure members and the reward revision used. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R650.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Benchmark `capability_designate` (10k capabilities, closure of 200): p50 150 us, p99 900 us, peak memory 4 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-types capability_designate` against the stored baseline.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R651
Agent-native memory lifecycle and consolidation (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Agent-native memory lifecycle and consolidation (rollup).** EG owns the memory tiers and their lifecycle. The lifecycle covers summary nodes, episodic-to-procedural distillation, decay and semantic merge hygiene. It also covers context compression into mementos, per-session memento priming and trajectory pruning. It ends with embedding drift and stability checks, background learning, and the export of consolidated memory for weight training. The Rust home is `crates/eg-epistemic/src/memory.rs`. Satisfied only when children `EG-DECISION-ENGINE-R651.1`-`EG-DECISION-ENGINE-R651.8` are satisfied. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R651.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `MemoryTier{Working,Episodic,Procedural,Semantic}`, `MemoryEntry{timescale,salience,decay}`, `Memento`, `DriftReport`, `ConsolidationPlan`, `TrajectoryEntry` in `crates/eg-epistemic/src/memory.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R651.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Decay salience by timescale with a deterministic half-life. Merge near-duplicates above a similarity threshold in O(n log n) with an ANN index. Distil repeated episodes into procedures with support counts. Compress a context window into mementos under a token cap. Report drift between embedding snapshots with CKA and Fisher-weighted consolidation. Consolidation is a proposal until the owner verifies it. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R651.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Served `MemoryRemember`, `MemoryRecall`, `MemoryConsolidate` and `MemoryExport` methods; the harness reads recalled entries and sends observations only. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R651.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** EG refuses writes without tenant scope and entries over the size cap. It also refuses a consolidation that drops an entry with live references. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R651.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Record tier moves, merged IDs, support counts, drift metrics and the export manifest digest. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R651.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Benchmark `memory_consolidate_10k` (10k entries, 384-d vectors): p50 25 ms, p99 120 ms, peak memory 96 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-epistemic memory_consolidate_10k` against the stored baseline.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R652
Claim lifecycle, evidence channels and perspective arbitration (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Claim lifecycle, evidence channels and perspective arbitration (rollup).** EG records every research claim through a legal lifecycle. It gathers evidence from typed channels: outcome evaluation, optimization, health anomalies, process signals and mined insight. It arbitrates competing perspectives and grades feeds against fleet relevance. It compiles agent-native research artifacts. These artifacts carry claims, code specs, exploration graphs and a seal. The Rust home is `crates/eg-epistemic/src/claims.rs`. Satisfied only when children `EG-DECISION-ENGINE-R652.1`-`EG-DECISION-ENGINE-R652.6` are satisfied. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R652.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `ClaimState` (state machine), `LifecycleTransition`, `EvidenceChannel`, `Evidence{outcome,weight}`, `Cohort`, `PerspectiveMap`, `ResearchArtifact`, `ArtifactSeal` in `crates/eg-epistemic/src/claims.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R652.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Reject illegal transitions by table lookup in O(1). Combine evidence with log-odds addition and a per-channel prior. Compute contradiction maps between perspectives. Seal an artifact by content digest and check seal violations on read. Grade feeds with deterministic relevance scoring. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R652.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Claim lifecycle on the `eg-statechart` engine; served `ClaimPropose`, `ClaimAdvance`, `EvidenceRecord`, `ArtifactCompile`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R652.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** An illegal transition, evidence without a channel, or an unsealed artifact presented as sealed is refused with a stable code. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R652.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Record transition log, evidence inputs and weights, contradiction pairs and seal digest. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R652.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Benchmark `claim_advance_with_evidence` (50 evidence items per claim): p50 120 us, p99 700 us, peak memory 2 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-epistemic claim_advance_with_evidence` against the stored baseline.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R653
Loop engine state, gap market and improvement ledger (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Loop engine state, gap market and improvement ledger (rollup).** EG keeps the state of every long-running objective. That state holds loop status and priority, and gaps with severity and evidence. It holds the gap-to-work-offer market, saturation and stage beacons, and the improvement ledger and velocity. It also holds runtime reliability reconciliation, mined trace and placement patterns, and the capability ratchet verdict. The Rust home is `crates/eg-statechart/src/loops.rs`. Satisfied only when children `EG-DECISION-ENGINE-R653.1`-`EG-DECISION-ENGINE-R653.6` are satisfied. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R653.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `LoopInstance`, `LoopStatus`, `Gap{severity_ppm,evidence}`, `WorkOffer{rate}`, `StageBeacon`, `ImprovementLedger`, `RatchetVerdict`, `MinedPattern` in `crates/eg-statechart/src/loops.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R653.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Claim a loop with a fenced lease. Order loops by priority and age with a heap. Settle a gap exactly once. Derive offer rates deterministically. Mine failure sequences with a bounded frequent-pattern miner. Keep or revert a capability by comparing the ledger before and after. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R653.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Runs on `eg-statechart` and `eg-jobs` beside `src/loop_statechart.rs` and `src/work_item_statechart.rs`; the harness executes the loop step it is handed. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R653.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A stale lease, a double settle or a ratchet comparison with missing baseline is refused. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R653.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Record lease epochs, state transitions, offer inputs, mined support and the ratchet comparison. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R653.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Benchmark `loop_claim_and_settle` (10k open loops): p50 80 us, p99 500 us, peak memory 2 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-statechart loop_claim_and_settle` against the stored baseline.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R654
Skill evolution, promotion gate and spec proposals (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Skill evolution, promotion gate and spec proposals (rollup).** EG evaluates skill revisions by rollout and extracts failure patterns. It versions each revision by content and records transfer scores. It applies the promotion gate and auto-merge policy. It tracks spec proposals through review and development. The Rust home is `crates/eg-epistemic/src/evolution.rs`. Satisfied only when children `EG-DECISION-ENGINE-R654.1`-`EG-DECISION-ENGINE-R654.6` are satisfied. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R654.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `SkillRevision{version_hash}`, `Rollout`, `FailurePattern`, `TransferScore`, `PromotionVerdict`, `MergePolicy`, `SpecProposal` in `crates/eg-epistemic/src/evolution.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R654.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Hash revisions by content. Compare rollouts with paired bootstrap. Gate promotion on score, risk and policy. Advance a spec proposal only through legal review states. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R654.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Served `SkillRevisionPropose`, `PromotionEvaluate`, `SpecProposalAdvance`; the harness applies the merge it is told to apply. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R654.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A promotion without a baseline, an unreviewed spec advance or a policy-forbidden merge is refused. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R654.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Record rollout seeds, paired scores, gate inputs and verdicts. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R654.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Benchmark `promotion_gate_eval` (200 rollouts per arm): p50 200 us, p99 1.2 ms, peak memory 4 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-epistemic promotion_gate_eval` against the stored baseline.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R700
Belief revision recomputes confidence and explains every change (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Belief revision recomputes confidence and explains every change (rollup).** The engine recomputes the confidence of a claim from its supporting and opposing evidence. It records an explanation of each revision, detects opposing claims, and revalidates stale truth-maintenance materializations. Every result is a proposal. No claim is retracted without a separate explicit authorization (see R034). Implemented in eg-reason, eg-core. | Every child `.1` to `.7` is verified; the rollup is landed only when all are.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R700.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `BeliefRevision { claim, prior, posterior, support: Vec<EvidenceRef>, oppose: Vec<EvidenceRef>, reason }` and `FrictionFinding { left, right, similarity, opposes }` in `crates/eg-types`, keyed by claim id in a `BTreeMap` so a pass is deterministic. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R700.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** A revision pass walks claims whose evidence changed since the last pass. Its time is linear in changed claims plus their evidence edges. Opposition candidates come from an inverted token index (sub-linear per claim). A typed negation and antonym check confirms them. The pass revalidates stale materializations against the current assertion generation. It re-derives them only when their premises changed. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R700.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Handler `BeliefRevise` in `src/server/handlers`, wired to the outbox so only claims touched by a committed batch enter a pass. Per-graph passes run on the maintenance lane; passes on different graphs run in parallel, passes on one graph are serialized. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R700.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A revision that lowers a claim below the retraction threshold returns a `RetractionProposal` with evidence class `claim`. It never mutates the claim. A revision with a missing premise refuses with a typed reason. The reason names the premise. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R700.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each `BeliefRevision` stores its explanation and the evidence class of its weakest premise. The explanation reproduces the posterior from the recorded inputs. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R700.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_belief_revision_served.py::test_pass_proposes_and_never_retracts` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/belief_revision.rs` must show p50 under 5 ms and p99 under 40 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R701
Recurring failures cluster into patterns and file capability gaps (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Recurring failures cluster into patterns and file capability gaps (rollup).** The engine groups failed runs, anomalies and unresolved topics into recurring failure patterns. It files each pattern as a gap with a stable topic. It marks a topic addressed when it acquires a source that covers it. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R701.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `FailureRecord`, `FailurePattern { signature, members, first_seen, last_seen, count }` and `GapTopic { id, status: Open|Addressed{by} }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R701.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Records cluster by a canonical signature (normalized error class, tool, step kind) in one pass over a `HashMap<Signature, Vec<RecordId>>`. Time is O(n) and memory is O(distinct signatures). A trace is distilled to its minimal failing step sequence by a deterministic reduction. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R701.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Handler `FailureIngest` reads run-trace facts (R009 harness run-trace vocabulary) and anomaly facts from the health-anomaly derivation (UDP R036). Gap filing is idempotent on the topic id. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R701.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A record without a run-trace id is refused. A pattern below the configured minimum count files no gap. A topic is never marked addressed by a source that does not link to it. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R701.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Every gap links back to the member records that produced it. A reader can open the failing runs from the gap. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R701.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_failure_patterns_served.py::test_failures_cluster_and_gap_is_idempotent` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/failure_cluster.rs` must show p50 under 3 ms and p99 under 25 ms with peak memory under 48 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R702
Human corrections become rules, outcomes and evaluation cases (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Human corrections become rules, outcomes and evaluation cases (rollup).** A human correction of an answer is recorded once. It propagates into a candidate rule, an outcome record with an independent-evaluation tag, and an evaluation case. Experience alignment adapts behavior by retrieving the nearest prior corrected experiences. Implemented in eg-core, eg-decision. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R702.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `Correction { target, before, after, actor, at }` and `CorrectionEffect { rule_candidate, outcome, eval_case }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R702.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** A correction commits as one `MutationBatch` carrying all three effects so they are all present or all absent. Nearest corrected experiences are found with the engine vector index at k <= 16. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R702.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Handler `CorrectionRecord` on the decision lane, using the existing outcome aggregate (R059) and gated promotion (R060). A candidate rule is promoted only through R129. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R702.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A correction by an actor without the correcting role is refused. A candidate rule that contradicts a stored invariant is refused (R129). A self-reported outcome never enters calibration (R016). | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R702.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The correction, its three effects and its actor share one receipt id. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R702.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_correction_feedback_served.py::test_correction_commits_three_effects_atomically` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/correction_commit.rs` must show p50 under 4 ms and p99 under 20 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R703
Skill gaps, neologisms and merge candidates are detected as proposals (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Skill gaps, neologisms and merge candidates are detected as proposals (rollup).** The engine detects skills requested but absent. It detects terms used as skill names with no definition. It detects near-duplicate skills that should merge. It records each as a propose-only candidate. A skill is created, merged or retired only through the component-publish path. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R703.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `SkillGap`, `SkillNeologism` and `SkillMergeCandidate { a, b, overlap, evidence }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R703.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Merge candidates come from set overlap of declared capability annotations plus embedding similarity. A blocking index bounds pair comparison by block size, not by library size squared. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R703.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Handler `SkillEvolve` reads the Agent Library (typed-packs R100) and run-trace facts; publish uses the existing guarded promotion (R040). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R703.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A merge candidate whose members differ in capability class or tenant is refused. No candidate mutates the library. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R703.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each candidate cites the traces and library rows it was derived from. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R703.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_skill_evolution_served.py::test_candidates_are_proposals_only` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/skill_merge_blocking.rs` must show p50 under 8 ms and p99 under 60 ms with peak memory under 96 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R704
Fleet events and tickets route through remediation playbooks, evaluate-only (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Fleet events and tickets route through remediation playbooks, evaluate-only (rollup).** The engine correlates inbound fleet events and tickets. It matches each to a typed playbook (service down, service flapping, resource pressure, ticket classes). It answers with a proposed remediation and its evidence class. The engine takes no action on a connector's behalf. Implemented in eg-decision. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R704.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `Playbook { id, trigger, steps: Vec<ProposedStep>, evidence_class }` and `EventCorrelation { key, window, events }` in `crates/eg-types`; playbooks are graph content published as pack entries. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R704.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Correlation keys events into a sliding window per service with O(1) amortized insert. Playbook match is a hash lookup on trigger kind, then an ontology entailment check. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R704.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extends connector event triage (R041) and write-back routing (R043); steps that write are routed through `Decide` and then the governed Action path (UDP R700). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R704.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The engine refuses a playbook step that executes. The refusal carries a typed `EvaluateOnly` reason. An event with no matching playbook abstains naming the missing trigger. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R704.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Every proposal records the playbook id and revision. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R704.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_playbook_triage_served.py::test_flapping_service_proposes_without_acting` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/playbook_match.rs` must show p50 under 1 ms and p99 under 8 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R705
Research orchestration is budgeted by value of information (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Research orchestration is budgeted by value of information (rollup).** A research run decomposes a question into subtasks and walks citation links between sources. It spends a bounded budget in order of expected information value. It stops when the marginal value falls below cost. Implemented in eg-decision, eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R705.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `ResearchPlan { subtasks, budget }`, `VoiBudget { spent, limit, floor }` and `CitationWalk { frontier, depth_limit }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R705.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Frontier expansion uses a binary heap keyed by expected value. A node budget bounds the walk (as R011). The result count does not. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R705.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Consumes the sufficiency and stop rules (FQ R081, R082) and the cost ladder (R080). Language-model calls happen in the agent harness; the engine decides what to read next and when to stop. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R705.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A subtask without budget abstains with a typed reason. A walk past the depth limit refuses. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R705.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Every spent unit is recorded with the subtask that consumed it. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R705.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_research_voi_served.py::test_budget_stops_at_marginal_value` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/voi_frontier.rs` must show p50 under 2 ms and p99 under 15 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R706
Entity-resolution proposals use tenant-scoped embeddings and drift-monitored acceptance (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Entity-resolution proposals use tenant-scoped embeddings and drift-monitored acceptance (rollup).** The engine generates entity-resolution candidates from tenant-scoped embeddings. It scores them, reviews them through governance, and evaluates them per tier. It monitors the accept rate for drift. It composes a probabilistic completion only beside an exact answer, never in place of it. Implemented in eg-decision, eg-vector. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R706.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `TenantScopedEmbedding { tenant, node, model, content_hash, vector }`, `EntityResolutionProposal`, `ReviewOutcome`, `TierEvaluation` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R706.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Embeddings are content-hash keyed, so the engine never re-embeds an unchanged node. Candidates come from filtered k-NN (FQ R040) with the tenant predicate in the plan (FQ R078). | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R706.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extends the ResolveEntity path (R032.2); results pass the conformal guarantee there. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R706.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A proposal across tenants is refused. A proposal below the calibrated threshold abstains. The probabilistic result is marked `hypothesis` evidence. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R706.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each proposal records the model, content hash and tier. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R706.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_er_proposals_served.py::test_cross_tenant_candidates_never_returned` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/er_candidates.rs` must show p50 under 6 ms and p99 under 35 ms with peak memory under 128 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R707
Comparative-analysis ingest, matching, gap ledger and plan synthesis (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Comparative-analysis ingest, matching, gap ledger and plan synthesis (rollup).** The engine ingests studied external projects into the graph. It matches their features to local capabilities, deduplicates them and ranks them by synergy. It records them in a feature ledger with status. It turns them into plan proposals that close gaps. This is the engine side of R139. Implemented in eg-core, eg-decision. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R707.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `FeatureMatrixRow`, `Match { local, external, score }`, `LedgerEntry { feature, status, closed_by }` and `PlanProposal` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R707.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Matching is a blocked pairwise score (token, ontology label, embedding) bounded by block size. Dedup merges features by canonical id and entropy-aware name normalization. Ledger status changes are compare-and-set. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R707.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Extends R139 and R171 (planning admission needs a gap comparison); breadth discovery of projects is an ingest-worker job. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R707.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A close-out without a linked closing change is refused. A high-entropy token identity is never merged on name alone. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R707.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Ledger rows cite the matches and the plan that closed them. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R707.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_comparative_ledger_served.py::test_closeout_requires_linked_change` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/feature_match.rs` must show p50 under 10 ms and p99 under 70 ms with peak memory under 128 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R800
Reflective optimization and benchmark scoring for recursive-run policies (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reflective optimization and benchmark scoring for recursive-run policies (rollup).** `crates/eg-program` keeps a Pareto-front store of candidate run policies (prompt, budget, tool set). It scores them on held-out evaluation sets and on long-context benchmark tasks. The engine then picks the next policy to try. It reports cost against accuracy per task family. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R800.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `PolicyCandidate{id, parent, genes_digest, scores:[f32;K], cost_micro_usd}` and `ParetoFront` in `crates/eg-program/src/optimize/front.rs`; scores are bounded and `K` is fixed per evaluation set. | Planned: `crates/eg-program/tests/optimize_front.rs::dominated_candidate_is_dropped`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R800.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** `front.insert` keeps only non-dominated candidates in O(F) per insert for front size F. `next_parent` samples by crowding distance with a seeded generator. `scoreboard` ranks by accuracy per cost. | Planned: `crates/eg-program/tests/optimize_front.rs::same_seed_reproduces_front_digest`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R800.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The served `Decide` ladder reads the front through the existing DecisionFit job. The optimizer never writes a promoted head without the DecisionEval publish receipt of R040. | Planned: `crates/eg-program/tests/optimize_front.rs::mismatched_score_length_is_refused`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R800.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Three inputs return a typed refusal with no state change. The first is an evaluation set under the declared minimum size. The second is a candidate whose score vector length differs from `K`. The third is a reward that uses a non-independent label. | Planned: `crates/eg-program/tests/optimize_front.rs::promotion_requires_publish_receipt`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R800.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Evidence is the stored front, the evaluation-set digest and the scoreboard rows for each benchmark family. A rerun with the same seed reproduces the same front digest. | Planned: `crates/eg-program/tests/optimize_front.rs::scoreboard_ranks_accuracy_per_cost`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R800.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Hot-path proof: a Criterion benchmark inserts 100000 candidates at F up to 256. It reports p50 and p99 insert latency. The p99 stays under 50 microseconds. Resident memory stays under 64 MiB. | Planned: `crates/eg-program/tests/optimize_front.rs::insert_bench_stays_within_budget`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R801
Usage ledger and versioned price catalog (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Usage ledger and versioned price catalog (rollup).** `crates/eg-core` owns a per-tenant usage ledger of model calls (tokens in and out, cached tokens, latency, outcome). It also owns a versioned price catalog with name normalization. Cost is a derived fact. Routing (R039), budgets and reports read it through one served method. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. Child `.7` covers the served tenant-scoped read. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R801.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `UsageRecord{tenant, principal, run_id, model_key, tokens_in, tokens_out, tokens_cached, latency_ms, outcome, content_digest}` and `PriceEntry{model_key, valid_from, in_per_mtok, out_per_mtok, cached_per_mtok}` in `crates/eg-types/src/usage.rs`; prompts and completions are stored only as digests. | Planned: `crates/eg-core/tests/usage_ledger.rs::record_round_trips_digest_only`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R801.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Append is a single `MutationBatch` per call batch. Cost is derived at read time from the price entry valid at the record time. One alias table normalizes `model_key`. Rollups by tenant, model and day come from `eg-tsdb` buckets in O(buckets). | Planned: `crates/eg-core/tests/usage_ledger.rs::cost_uses_price_valid_at_record_time`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R801.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The `Usage` served domain registers scopes `usage:read` (user) and a service-only write scope in `crates/eg-capabilities`. Readers see only their tenant. Callers outside the tenant see an empty result. | Planned: `crates/eg-core/tests/usage_ledger.rs::alias_table_normalizes_model_keys`.
requirementEG-DECISION-ENGINEVERIFIED52b574819aca
cfe7d38376a4
crates/eg-capabilities/src/scopes/tests.rs:73
EG-DECISION-ENGINE-R801.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Four inputs return a typed refusal and write nothing. The first is a record with an unknown tenant. The second is a negative count. The third is a price entry that overlaps an existing validity window. The fourth is a read across tenants. | Planned: `crates/eg-core/tests/usage_ledger.rs::cross_tenant_read_is_empty`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R801.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Evidence is the audit line per append and a golden report. A fixed record set and catalog yield byte-identical cost rollups. | Planned: `crates/eg-core/tests/usage_ledger.rs::overlapping_price_window_is_refused`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R801.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** Hot-path proof: a Criterion benchmark appends 1 million records in batches of 1000 and reads a 30-day rollup. The append p99 stays under 2 ms per batch. The rollup p99 stays under 20 ms. Bucket memory stays under 128 MiB. | Planned: `crates/eg-core/tests/usage_ledger.rs::append_and_rollup_bench_within_budget`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R801.7
Served tenant-scoped usage read
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Served tenant-scoped usage read.** It completes the read half of `EG-DECISION-ENGINE-R801.3`. A served `UsageRead` method returns usage records from the durable ledger of `EG-DECISION-ENGINE-R801.2`. The dispatcher takes the tenant from the verified request context, never from a request field. A caller outside the tenant receives an empty result. | Planned served test: `tests/usage/test_usage_read_served.py::test_usage_read_is_tenant_scoped` appends records for two tenants and reads as each tenant.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R801.8
Fenced committed-run usage and caller-context aggregation
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Fenced committed-run usage and caller-context aggregation.** A terminal WorkItem extension optionally carries bounded observed token counts bound to the native run owner, tenant, principal and conversation context. The native terminal CAS co-commits the immutable receipt; retry scheduling publishes no receipt. The opt-in outcome reader projects it only for the verified owner. Canonical aggregation counts each committed run once, refuses conflicting duplicates and foreign attribution, and reports missing/per-counter coverage without fabricated counts or prices. Existing tenant aggregate and default outcome shape remain unchanged. | Native terminal/restart read and denial tests; typed aggregation tests for duplicate retries, missing counts, overflow and foreign contexts. Budget: at most 10,000 run receipts per aggregation, O(n log n) time and O(n) memory; a 10,000-receipt test exercises the bound.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R802
Web fetch selection over search candidates (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Web fetch selection over search candidates (rollup).** The engine must choose the web candidates to fetch. It ranks candidates and removes duplicates by canonical URL and content digest. It skips a held Document that is still fresh. It reads only the RLS-visible Documents of the request graph and enforces a fetch budget. No model runs. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINEVERIFIED1517690bd1d2
780ae2e14170
b3d7b62e5f61
cbda3e13e4c8
d715658809da
crates/eg-numeric/src/decision/web_fetch_selection.rs:333
crates/eg-numeric/src/decision/web_fetch_selection.rs:437
crates/eg-numeric/src/decision/web_fetch_selection.rs:452
crates/eg-types/src/decision/web_fetch_selection.rs:169
tests/web_document_enrich_served.rs:222
EG-DECISION-ENGINE-R802.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `crates/eg-types/src/decision/web_fetch_selection.rs` holds `SelectWebPagesRequest{query, candidates, max_fetches, freshness_window_s, now_ms}`, `WebCandidate{url, title, snippet, engine, rank, content_digest, published_at_ms}` and `SelectWebPagesAnswer{query_digest, selected, skipped, max_fetches, considered, now_ms}`. `max_fetches` ranges from 1 to 32. Closed skip reasons are `duplicate_url`, `duplicate_digest`, `held_fresh`, `invalid_url` and `over_budget`. Proving test: `web_fetch_selection.rs::tests::question_round_trips`. | A serde round trip keeps every field and rejects 33 fetches or an unknown skip reason.
requirementEG-DECISION-ENGINEVERIFIEDb3d7b62e5f61
crates/eg-types/src/decision/web_fetch_selection.rs:169
EG-DECISION-ENGINE-R802.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** `crates/eg-numeric/src/decision/web_fetch_selection.rs` canonicalizes each URL. Rows with one canonical URL fuse by reciprocal rank fusion with k = 60. A digest that the graph holds, or that another row carries, is skipped as `duplicate_digest`. A held Document younger than `freshness_window_s` is skipped as `held_fresh`. The default window is 86,400 s. A stale held Document is selectable as a refresh. The score is `0.5 relevance + 0.3 rank + 0.2 freshness` in integer millionths. The budget keeps the top `max_fetches`. Cost is O(c log c) in candidates. Proving test: `crates/eg-numeric/src/decision/web_fetch_selection.rs::tests::ranks_dedupes_and_skips_fresh`. | Unit tests cover each skip reason, the ranking order and the budget.
requirementEG-DECISION-ENGINEVERIFIEDb3d7b62e5f61
crates/eg-numeric/src/decision/web_fetch_selection.rs:333
EG-DECISION-ENGINE-R802.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The served `SelectWebPages` method reaches `src/server/dispatch/graph_pipeline/web_ingest.rs` after graph ACL. It reads the RLS-visible `Document` rows of the request graph as held pages. The production caller is the arbora operation `ARBORA-OPS-R067`. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | A served `SelectWebPages` call skips the held and duplicate pages.
requirementEG-DECISION-ENGINEVERIFIED1517690bd1d2
780ae2e14170
b3d7b62e5f61
tests/web_document_enrich_served.rs:223
EG-DECISION-ENGINE-R802.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** An empty query must refuse with `WEB_SELECTION_QUERY_MISSING`. An empty candidate set must refuse with `WEB_SELECTION_NO_CANDIDATES`. More than 256 candidates must refuse with `WEB_SELECTION_TOO_MANY_CANDIDATES`. A budget outside 1 to 32 must refuse with `WEB_SELECTION_BUDGET_INVALID`. Proving test: `crates/eg-numeric/src/decision/web_fetch_selection.rs::tests::web_fetch_refusals`. | Each case returns its code and selects no candidate.
requirementEG-DECISION-ENGINEVERIFIEDb3d7b62e5f61
cbda3e13e4c8
d715658809da
crates/eg-numeric/src/decision/web_fetch_selection.rs:437
EG-DECISION-ENGINE-R802.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The answer must hold one entry per candidate, selected or skipped. A selected entry names the canonical URL, the engines, the score, its three components and its reasons. A skipped entry names its reason and a detail. Proving test: `crates/eg-numeric/src/decision/web_fetch_selection.rs::tests::premises_per_candidate`. | Each candidate has one entry, and the selected order follows the score.
requirementEG-DECISION-ENGINEVERIFIEDb3d7b62e5f61
crates/eg-numeric/src/decision/web_fetch_selection.rs:452
EG-DECISION-ENGINE-R802.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `SelectWebPages` method. The benchmark selects from 50 candidates, ten of them held and fresh. The answer must hold `max_fetches` or fewer, no held fresh URL and no duplicate. The answer must stay under 3 ms p99 for 50 candidates. The benchmark is `crates/eg-numeric/benches/web_fetch_selection.rs`. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | The served test passes, and the benchmark meets the budget.
requirementEG-DECISION-ENGINEVERIFIED1517690bd1d2
b3d7b62e5f61
tests/web_document_enrich_served.rs:224
EG-DECISION-ENGINE-R803
Contrastive harness composition decision (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Contrastive harness composition decision (rollup).** The engine composes the adopted harness for one task from the probed candidates. A caller presents two to eight candidate component versions, the identical probe conditions and the measured contrasts. The engine adopts a candidate only when its measured delta shows improvement. It abstains and keeps the current harness when no candidate improves. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.
requirementEG-DECISION-ENGINEVERIFIED7cb7f367c849
f52d12235269
crates/eg-types/src/decision/harness_contrast.rs:578
crates/eg-types/src/decision/harness_contrast.rs:630
crates/eg-types/src/decision/harness_contrast.rs:723
crates/eg-types/src/decision/harness_contrast.rs:945
tests/decide/test_harness_contrast_served.py:257
EG-DECISION-ENGINE-R803.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `HarnessContrastDecision{task_ref, task_class, candidate_version_refs, conditions_digest, probe_trace_ids, deltas, adopted_version_ref, abstain_reason}` in `crates/eg-types/src/decision/harness_contrast.rs`. `deltas` holds one `HarnessContrast` of EG-ORCH-VOCAB-R802.1 per candidate. `abstain_reason` is the closed set `no_improvement`, `trace_mismatch` or `insufficient_evidence`. Planned test: `crates/eg-types/src/decision/harness_contrast.rs::tests::decision_round_trips`. | The serde round trip keeps every field and rejects an open abstain reason.
requirementEG-DECISION-ENGINEVERIFIED7cb7f367c849
crates/eg-types/src/decision/harness_contrast.rs:578
EG-DECISION-ENGINE-R803.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The caller drives the probes under an identical task, seed, model and budget; the candidate count k runs from 2 to 8. The engine reads the probe traces and the contrasts. It adopts a candidate when its `eval_score_delta` is positive and no other candidate beats it, with cost as the tie-break. It abstains with `no_improvement` when every delta is zero or negative. An abstention keeps the current harness and writes only the decision record. Planned test: `crates/eg-types/src/decision/harness_contrast.rs::tests::adoption_requires_positive_delta`. | Unit tests cover adoption, tie-break and abstention.
requirementEG-DECISION-ENGINEVERIFIED7cb7f367c849
crates/eg-types/src/decision/harness_contrast.rs:630
EG-DECISION-ENGINE-R803.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The served `Decide` method accepts the `HARNESS_CONTRAST` question kind through `DecideText`. The answer stores as a `DecisionRecord` through `DecisionCommit` (EG-DECISION-ENGINE-R019, EG-DECISION-ENGINE-R047). The production caller is the harness cycle of AU-HARNESS-CYCLE-R001.5; it adopts the result through the arbora operation ARBORA-OPS-R068.4. Planned test: `tests/decide/test_harness_contrast_served.py::test_contrast_decide_stores_record`. | A served `Decide` call stores one decision record.
requirementEG-DECISION-ENGINEVERIFIED7cb7f367c849
f52d12235269
tests/decide/test_harness_contrast_served.py:257
tests/decide/test_harness_contrast_served.py:258
EG-DECISION-ENGINE-R803.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Four inputs refuse with a typed code and write nothing. The first is a candidate set under two, with `HARNESS_CONTRAST_MIN_CANDIDATES`. The second is a probe trace whose conditions digest differs from the request, with `HARNESS_CONTRAST_TRACE_MISMATCH`. The third is a candidate version reference the graph does not hold, with `HARNESS_COMPONENT_VERSION_UNKNOWN`. The fourth is a candidate count over 8, with `HARNESS_CONTRAST_TOO_MANY_CANDIDATES`. Planned test: `crates/eg-types/src/decision/harness_contrast.rs::tests::contrast_refusals`. | Each case returns its code and stores no record.
requirementEG-DECISION-ENGINEVERIFIED7cb7f367c849
crates/eg-types/src/decision/harness_contrast.rs:723
EG-DECISION-ENGINE-R803.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The record pins the request digest, each candidate version digest, the probe trace ids and the per-candidate deltas. A rerun with the same inputs produces the same record digest. The adopted record cites the superseded adoption of the same agent and task class through EG-ORCH-VOCAB-R802.4. Planned test: `crates/eg-types/src/decision/harness_contrast.rs::tests::record_pins_evidence_and_replays`. | The rerun digest matches, and the supersession citation resolves.
requirementEG-DECISION-ENGINEVERIFIED7cb7f367c849
crates/eg-types/src/decision/harness_contrast.rs:945
EG-DECISION-ENGINE-R803.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` call. The test presents two candidates, one improving and one neutral, and checks the adoption and the abstention. The benchmark decides over 8 candidates with 200 stored contrasts. It stays under 5 ms p99. The benchmark is `crates/eg-numeric/benches/harness_contrast.rs`. Planned test: `tests/decide/test_harness_contrast_served.py::test_contrast_hot_path_served`. | The served test passes, and the benchmark meets the budget.
requirementEG-DECISION-ENGINEVERIFIED7cb7f367c849
f52d12235269
tests/decide/test_harness_contrast_served.py:379
tests/decide/test_harness_contrast_served.py:380
EG-DECISION-ENGINE-R810
Program and prompt optimization job (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Program and prompt optimization job (rollup).** The engine must compile a stored program for one task signature. It must search prompts, demonstrations and rules with a named optimizer. The served job is `ProgramOptimize`. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R810.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `crates/eg-program/src/contracts.rs` holds `SignatureSpec`, `ProgramRevision`, `TrainingCorpus` and `TrainingExample{split, score, trace_ref, feedback_ref}`. `OptimizerKind` at `crates/eg-program/src/optimizer.rs:32` is a closed set of 13 kinds. | `crates/eg-program/tests/native_program.rs` round-trips each contract and lists the 13 kinds.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R810.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** `NativeCompiler::compile_cancellable` at `crates/eg-program/src/optimizer.rs:511` must run one optimizer over the train split. It must score candidates on the dev split only. A cancel must stop the run within one candidate. | `native_program.rs` tests compile each kind on a fixture corpus and cancel one run.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R810.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The served `AnalyticsJob` submit with `JobKind::ProgramOptimize` reaches `submit_job_program_optimize` at `src/server/handlers/jobs/submit.rs:362`. The claim path in `src/server/handlers/jobs/executor_claim.rs` runs `executor_program.rs`. arbora serves it through ARBORA-OPS-R860. | A served test submits the job and reads the finished `ProgramRevision`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R810.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A corpus without a held-out split must refuse with `PROGRAM_HELDOUT_MISSING`. An unknown optimizer must refuse with `PROGRAM_OPTIMIZER_UNKNOWN`. A budget over the job limit must refuse with `PROGRAM_BUDGET_EXCEEDED`. A refusal writes no revision. | A served test submits each invalid request and asserts the code.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R810.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each revision must record the optimizer kind, the corpus digest, the dev score and the parent revision. A rerun with one seed must give one revision digest. | A test reruns one job and compares the digests.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R810.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served job submit. The test compiles one program on a 200-example corpus. The run must stay under 30 s and 512 MiB. The benchmark is `crates/eg-program/benches/program_optimize.rs`. | `tests/test_program_optimize_served.py::test_program_optimize_job_end_to_end` passes, and the benchmark meets the budget.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R811
Policy evolution capture, training and held-out evaluation receipts (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Policy evolution capture, training and held-out evaluation receipts (rollup).** The engine must capture policy traces, run one training job and evaluate it on held-out cases. Each step must leave a receipt. The served method is `PolicyEvolution`. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R811.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** `PolicyEvolutionOp` at `crates/eg-types/src/policy_evolution.rs:174` names capture, training run and held-out evaluation. `records.rs` and `stored.rs` hold the receipts. | `crates/eg-types/src/policy_evolution/tests.rs` round-trips each op and receipt.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R811.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Capture must store a trace only when the capability allows capture. A training run must read captured traces only. An evaluation must read held-out cases only. | `policy_evolution/tests.rs` covers capture denial and split isolation.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R811.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The served `PolicyEvolution` method reaches `src/server/dispatch/policy_evolution/gate.rs`. The gate stores blobs through `blobs.rs` and receipts through `store.rs`. | A served test runs capture, training and evaluation in order.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R811.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Capture without the capability must refuse with `POLICY_CAPTURE_DISABLED`. An evaluation that shares a case with training must refuse with `POLICY_SPLIT_OVERLAP`. A refusal writes no receipt. | `src/server/dispatch/policy_evolution/gate/tests.rs` asserts each code.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R811.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each receipt must name the policy revision, the input digest, the score and the evaluator kind. | A test reads back each receipt and compares the fields.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R811.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `PolicyEvolution` method. The test runs the three steps on 100 traces. The run must stay under 10 s. | `tests/test_policy_evolution_served.py::test_capture_train_evaluate_served` passes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R812
Champion and challenger promotion with rollback (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Champion and challenger promotion with rollback (rollup).** The engine must hold one champion revision per program. A challenger must replace it only when it wins on held-out cases. A rollback must restore the parent champion. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R812.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** The champion is the active revision of `ProgramRevisionIdentity` at `crates/eg-program/src/commit.rs:295`. Its `parent_ref` names the prior champion. `PromotionPolicy` at `crates/eg-program/src/optimizer.rs:221` holds the margin and the minimum case count. | A unit test builds a champion, a challenger and a parent link.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R812.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** A challenger must win when its held-out score beats the champion by the policy margin. The default margin is 0.02. A rollback must re-promote `parent_ref` through the same compare-and-set. A model-judge-only score must never promote, per EG-DECISION-ENGINE-R016. | Unit tests cover win, loss, tie, rollback and the model-judge refusal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R812.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Promotion and rollback commit through `program_promotion_methods` at `src/server/mutation_batch/commit/program.rs:146`. arbora serves both through ARBORA-OPS-R860 behind approval. | A served test promotes one challenger and rolls it back.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R812.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A stale champion pointer must refuse with `PROGRAM_CHAMPION_STALE`. A rollback without a parent must refuse with `PROGRAM_NO_PARENT`. A score set under the minimum case count must refuse with `PROGRAM_EVAL_TOO_SMALL`. | A served test asserts each code and an unchanged champion.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R812.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each promotion and rollback must record the old and new revisions, both scores, the margin and the principal. | A test reads back the promotion record.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R812.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served mutation batch. The test promotes, then rolls back, then reads the champion. The compare-and-set must stay under 5 ms p99. | `tests/test_program_champion_served.py::test_promote_then_rollback` passes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R813
Trace-store scores become evaluation examples (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Trace-store scores become evaluation examples (rollup).** The engine must turn an imported trace score into one `TrainingExample`. The example must carry the grader kind as an evidence class. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R813.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `GraderKind{annotation, model_judge, api}` beside `TrainingExample` in `crates/eg-program/src/contracts.rs`. The example links the `:Score` node and its `:Trace` node. | A unit test round-trips one example per grader kind.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R813.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** A score with an annotation or API grader may train and evaluate. A model-judge score may train but must not decide a promotion. A score without a trace link is skipped and counted. | Unit tests cover each grader kind and the skip.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R813.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The trace-store connector ingests `:Trace` and `:Score` through `SourceIngest`, per CONN-LANGFUSE-AGENT-TRACE-INGEST-R001. A corpus build for EG-DECISION-ENGINE-R810 reads those nodes. | A served test ingests two scores and builds one corpus.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R813.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A score with an unknown grader kind must refuse with `SCORE_GRADER_UNKNOWN`. A score whose value is outside its declared range must refuse with `SCORE_OUT_OF_RANGE`. | A served test asserts each code.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R813.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each example must name the score id, the grader kind, the author and the source trace id. | A test reads back one example.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R813.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `SourceIngest` followed by the served job submit of R810.3. The test ingests 50 scores and compiles one program from them. | `tests/test_trace_scores_to_corpus_served.py::test_scores_build_corpus_and_compile` passes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R036.102
Bind graph participant prepare records to their recovery identity
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Bind graph participant prepare records to their recovery identity.** The existing cross-shard coordinator writes a versioned graph-owner prepare envelope. It binds transaction ID, participant group and a SHA-256 digest of the exact encoded graph slices. Recovery validates these bindings before applying any slice. Unknown versions, owner kinds or changed payloads refuse. Existing array-form graph prepares remain readable without acquiring new authority. This prerequisite does not implement profile grants or heterogeneous-owner admission. | The production encoder and decoder round-trip a graph participant. Tests refuse swapped transaction/group keys, changed payloads and unsupported formats. A legacy graph prepare still decodes. Existing byte, item, slice and method limits remain enforced.
requirementEG-DECISION-ENGINEVERIFIEDcfe7d38376a4
src/raft/cross_shard_txn/prepare_record.rs:112
src/raft/cross_shard_txn/prepare_record.rs:125
src/raft/cross_shard_txn/prepare_record.rs:133
src/raft/cross_shard_txn/prepare_record.rs:150
EG-DECISION-ENGINE-R036.103
Durable RBAC read reservation
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Durable RBAC read reservation.** Reserve the complete authority image under its existing owner. Compare revision and all identity state in one admitted write. Ordinary authority writes refuse while reserved. Reopen retains pending reservations. Only the matching durable coordinator decision resolves them. Fence old writers through the owner manifest and explicit offline upgrade. This child grants no profile access and admits no task. | Real-file tests cover competing saves, reopen, missing decisions, terminal replay and session-state digest changes. Coordinator tests apply graph phase two before releasing the reservation. Offline upgrade tests preserve existing rows. Native execution remains pending.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R036.104
Agent Library durable admission participant
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Agent Library durable admission participant.** Reserve exact ModelProfile and routed component revision/head and visibility predicates in AgentLibraryOwner, with the proposed decision-record body/component write key. Persist sealed transaction-bound intent and fence all conflicting writers through recovery. Consume prepare atomically with decision rows and receipt; no timeout release or historical-record admission proof. No authority grant is conferred. | Planned native store tests prove reopen, current-head/withdrawal refusal, blocked conflicting writes, exact-intent retry, changed-intent refusal, commit/abort replay and atomic record visibility. Source-only tests do not qualify cross-owner admission.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R036.105
Persist a request-bound coordinator decision certificate
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Persist a request-bound coordinator decision certificate.** The native local coordinator stores an immutable certificate beside its terminal outcome in one owner transaction. It binds transaction, tenant, coordinator scope, complete request digest and authority deadline. The storage writer chooses decision time. A COMMIT at or after the deadline refuses without a terminal write. Recovery reads the retained certificate through its owner. Legacy terminal rows never become certified evidence. | Real-store tests cover exact replay, changed intent, expiry, cleanup, reopen and legacy refusal. Structural decode stays bounded. Cross-owner consumers must match every binding field; native qualification remains pending.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R036.106
Durable profile-use grant records
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Durable profile-use grant records.** The RBAC owner records, reads and revokes profile-use grants in a registered durable table. An inspected offline upgrade moves both earlier RBAC layouts to the current one. It preserves authority and reservation rows and creates an empty grant table. An ordinary open refuses a predecessor layout. | An upgrade test reopens a store from each predecessor layout with every row preserved. A changed source refuses. Each layout digest matches its frozen value.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R804
Evaluation sets and the program optimizer loop (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evaluation sets and the program optimizer loop (rollup).** The engine must hold versioned evaluation sets and optimize a program or harness component against them. This row binds the existing `crates/eg-program` code to its served job. It adds the grader-kind evidence class for trace-store scores. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R804.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Bind `SignatureSpec` at `crates/eg-program/src/contracts.rs:106`, `TrainingExample` at `:271` and `TrainingCorpus` at `:333` as the evaluation-set records. Add `grader_kind` to `TrainingExample` as a closed set: `independent`, `human`, `model_judge`, `trace_metric`. | `crates/eg-program/tests/native_program.rs::all_modalities_compile_and_require_evidence_before_promotion` passes with the new field.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R804.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** The 13 `OptimizerKind` values at `crates/eg-program/src/optimizer.rs:32` compile a candidate revision against the train split. `PromotionPolicy` at `:221` scores it on the validation and test splits. A seeded run is deterministic. | `crates/eg-program/tests/native_program.rs::random_search_is_deterministic` passes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R804.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** The served `AnalyticsJob` arm `JobKind::ProgramOptimize` at `src/server/handlers/jobs/submit.rs:419` dispatches to `src/server/handlers/jobs/executor_program.rs`. A trace-store score enters a corpus through the SDK source ingest as a `TrainingExample` with its `grader_kind`. | `tests/decide/test_program_optimize_served.py::test_optimize_job_returns_candidate` submits a job and reads the candidate revision.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R804.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Under EG-DECISION-ENGINE-R016, a corpus whose test split holds only `model_judge` scores must refuse promotion with `EVAL_SET_NOT_INDEPENDENT`. A corpus with an empty test split must refuse with `EVAL_SET_NO_TEST_SPLIT`. | `tests/decide/test_program_optimize_served.py::test_judge_only_corpus_refuses` asserts both codes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R804.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The job result records the corpus digest, the optimizer kind, the seed and the per-split scores. | `crates/eg-program/tests/native_program.rs::promotion_identity_and_model_trace_bind_to_one_revision` passes with the corpus digest.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R804.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `AnalyticsJob` submit. The test optimizes a 3-example signature with `random_search` and reads the result. It completes in under 10 s on one core. | `tests/decide/test_program_optimize_served.py::test_optimize_hot_path` measures the wall time.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R805
Harness promotion and rollback (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Harness promotion and rollback (rollup).** The engine must promote an adopted harness or program revision through one champion pointer. Rollback re-promotes the parent revision. A post-promotion regression on the evaluation set triggers an automatic rollback decision. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R805.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add `ChampionPointer{agent_ref, task_class, revision_ref, parent_ref, promoted_by_decision}` and `RollbackDecision{pointer, from_ref, to_ref, reason, evidence_refs}` in `crates/eg-types/src/decision/promotion.rs`. | `crates/eg-types/src/decision/promotion.rs::tests::records_round_trip` round-trips both records.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R805.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Promotion compares and swaps the pointer through `commit_program_promotion` at `src/server/mutation_batch/commit/program.rs:64`. Rollback swaps the pointer to `parent_ref` of `ProgramRevisionIdentity`. A regression above 2 points on the test split after 50 runs records a rollback decision. | `crates/eg-types/src/decision/promotion.rs::tests::regression_triggers_rollback` feeds 50 worse outcomes.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R805.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** EG-DECISION-ENGINE-R803 adoptions and R804 candidates both promote through this pointer. arbora serves `harness.promote` and `harness.rollback` through `ARBORA-OPS-R852`. The AU cycle of AU-HARNESS-CYCLE-R001.5 reads the champion. | `tests/decide/test_harness_promotion_served.py::test_promote_then_rollback` promotes, rolls back and reads the pointer.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R805.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** A stale expected revision must refuse with `PROMOTION_CAS_CONFLICT`. A promotion without a passing R804 evaluation must refuse with `PROMOTION_UNEVALUATED`. A rollback with no parent must refuse with `ROLLBACK_NO_PARENT`. | `tests/decide/test_harness_promotion_served.py::test_promotion_refusals` asserts each code.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R805.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Each pointer move records the deciding record, the evaluation digest and the operator approval when present. The pointer history replays to the same head. | `tests/decide/test_harness_promotion_served.py::test_pointer_history_replays` replays the history.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R805.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-numeric/benches/harness_promotion.rs` evaluates the regression rule over 10,000 outcomes. The p99 stays under 1 ms. | `cargo bench -p eg-numeric --bench harness_promotion` fails on a 10 percent regression.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R651.7
Episodic-to-semantic promotion
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Episodic-to-semantic promotion.** Consolidation must promote an episodic pattern to a semantic fact when its support count reaches a threshold. The default threshold is 3 episodes. The fact must link to each supporting episode. The served `Consolidate` route at `src/server/handlers/graph_ops/gateway_graph_routes.rs:274` must run the promotion. | `tests/memory/test_consolidate_served.py::test_episodes_promote_to_semantic_fact` sends three episodes and reads one linked semantic fact.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R651.8
Reinforce and decay share one salience update
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Reinforce and decay share one salience update.** Served `Reinforce` must raise salience by a bounded step. Served `DecayMemories` must apply the half-life of `.2`. Both methods must call one salience function in `crates/eg-epistemic/src/memory.rs`. An entry below the salience floor must become a pruning candidate and must not be deleted. | `tests/memory/test_consolidate_served.py::test_reinforce_and_decay_share_salience` reinforces and decays one entry and checks the salience values.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R700.7
Contradiction records are tracked
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Contradiction records are tracked.** Each detected contradiction must persist as a record with both claim ids, the detected time, the evidence and a status. The status must move through `open`, `proposed` and `resolved` in that order only. UQL `CONTRADICTS` at `crates/eg-plan/src/uql/grammar.rs:180` must read these records. A status move out of order must refuse with `CONTRADICTION_STATUS_ORDER`. | `tests/decision/test_contradiction_records.py::test_detected_contradiction_is_tracked` detects one contradiction, reads it through UQL and refuses an out-of-order move.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.111
Bounded explicit task graphs (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Bounded explicit task graphs (rollup).** The engine validates caller-proposed tasks and derives a canonical bounded DAG. It returns an evaluate-only decision. Children `.1` to `.6` own the model, behavior, wiring, refusal, evidence and performance qualification. Child `.7` owns the published schema. Children `.8` to `.13` own deterministic typed tool steps. They cover the model, static checks, refusals, digest, wiring and proof. The harness runs those steps (`AU-BOUNDARY-R043.6.1` to `AU-BOUNDARY-R043.6.7`). Arbora serves them (`ARBORA-RELEASE-R003.4.6` to `ARBORA-RELEASE-R003.4.10`). Natural-language proposals remain untrusted inputs; semantic skill search remains outside this slice. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.111.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add strict `TaskPlanProposal`, `TaskPlanTask` and `TaskPlan` types. A task names its id, prompt and direct dependencies. A proposal names one output task and positive step and concurrency limits. The result binds the input digest, canonical tasks, total tasks, effective limits and fixed policy revision. | `task_plan_round_trips` preserves every field and rejects unknown fields.
requirementEG-DECISION-ENGINESPECIFIEDcrates/eg-types/src/decision/task_plan/tests.rs:26
tests/test_task_plan_client.py:10
EG-DECISION-ENGINE-R134.111.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** Compute an explicit dependency DAG under `bounded-explicit-dag-v1`. Allow at most 64 tasks, eight active tasks, 16 KiB per prompt and 64 KiB of prompt text in total. Select lexical task-id order among ready tasks and sort direct dependencies. Every task must contribute to the named output sink. Never infer dependencies from prompt text. | `plan_respects_dependencies` returns A and B, then C after B, then the final join. Reordered input produces the same canonical plan digest.
requirementEG-DECISION-ENGINESPECIFIEDcrates/eg-types/src/decision/task_plan/tests.rs:169
crates/eg-types/src/decision/task_plan/tests.rs:43
EG-DECISION-ENGINE-R134.111.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Serve the bounded explicit path through `Method::Decide`, `QuestionKind::TaskPlan`, and one typed `task_plan` parameter. The declared candidate ids must equal the task ids. Return the typed plan on the sealed statistical record. This is evaluate-only. Arbora owns admission and AU owns execution. | `decide_routes_task_plan` enters the existing handler and returns a typed plan. `test_explicit_plan_end_to_end` calls the served wire method.
requirementEG-DECISION-ENGINESPECIFIEDsrc/server/handlers/decide/stat_tests/task_plan_tests.rs:60
tests/decide/test_task_plan_served.py:228
tests/decide/test_task_plan_served.py:350
EG-DECISION-ENGINE-R134.111.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Refuse empty plans, duplicate or invalid ids, and duplicate or missing dependencies. Refuse cycles, disconnected output, invalid limits and excessive text. Return no plan on refusal. Refuse nonordinary questions, model heads, belief slices or candidate facts on this path. | Type and handler tests cover every refusal. A foreign tenant fails the existing authority-bound tenant check.
requirementEG-DECISION-ENGINEVERIFIEDf9bfc0da8ae7
crates/eg-types/src/decision/task_plan/tests.rs:117
crates/eg-types/src/decision/task_plan/tests.rs:195
crates/eg-types/src/decision/task_plan/tests.rs:205
crates/eg-types/src/decision/task_plan/tests.rs:233
crates/eg-types/src/decision/task_plan/tests.rs:82
EG-DECISION-ENGINE-R134.111.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** Bind prompts and dependencies as caller claims, with one premise per task. Record the named fixed policy and its digest as definitions. Bind the plan digest into the record digest. The shared client checks proposal, request, plan and expected raw caller-principal bindings without granting authority. A plan is neither an authorization grant nor a durable publish. Do not accept a plan-bearing statistical record through the unrelated score replay path. | Handler tests verify claim evidence, task and policy premises, digest changes and refusal to log a forged plan-bearing score record.
requirementEG-DECISION-ENGINESPECIFIEDsrc/server/handlers/decide/stat_tests/task_plan_tests.rs:155
src/server/handlers/decide/stat_tests/task_plan_tests.rs:61
tests/decide/test_task_plan_served.py:229
EG-DECISION-ENGINE-R134.111.6
Performance qualification
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Performance qualification.** Measure the pure `plan_explicit_tasks` path at 64 tasks, maximum acyclic edges and 64 KiB of prompt text. Target p99 below 5 ms and transient memory below 8 MiB. | A reproducible `bounded_task_plan` benchmark receipt must identify workload, build profile, hardware and latency/memory measurements. Qualification remains pending; bounded-input functional tests do not establish measured performance.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.111.7
Canonical task-plan feature schema
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Canonical task-plan feature schema.** The engine defines one `FeatureSchemaBody` for `task_plan` requests. `gen_contract` emits it into the Python facade as `epistemic_graph.decision_client.TASK_PLAN_FEATURE_SCHEMA`. The export carries the body, `schema_version`, the body's content digest, the component id and a publish key. A host publishes the body once per tenant under that key. A repeat publish replays the same component revision and `definition_digest`. The host pins that digest in each task-plan Decide. | A Python test confirms that the exported digest is the body's digest under the engine codec. A served test publishes the body twice under the key and gets the same digest. It then routes a task-plan Decide with that pin.
requirementEG-DECISION-ENGINEVERIFIED67dffe78b02d
crates/eg-types/src/decision/task_plan/tests.rs:250
src/server/handlers/decide/stat_tests/task_plan_tests.rs:181
tests/test_decision_stat_client.py:80
EG-DECISION-ENGINE-R134.111.8
Tool step model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Tool step model.** Add an optional `call: TaskPlanCall{server, tool, arguments}` to `TaskPlanTask` in `crates/eg-types/src/decision/task_plan.rs`. `server` and `tool` are non-empty identifiers. `arguments` is a JSON object. Each value is a literal or a binding. A binding is the single-key object `{"$ref": "steps.<task_id>.output.<json.path>"}`. The path is dot-separated object keys and array indexes. A task without `call` is a prompt step and keeps its current form. A task with `call` is a tool step. Its `prompt` stays as the step label. No model runs a tool step. The result plan carries every call and binding in canonical form. Unknown fields are rejected. | `task_plan_round_trips` keeps a tool step, its literals and its bindings. It accepts a mixed plan. It rejects an unknown call field and a `$ref` object with extra keys.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.111.9
Canonical form and static checks
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Canonical form and static checks.** `plan_explicit_tasks` canonicalizes each call. It sorts argument keys, drops whitespace and normalizes each reference to one string form. A reference must name a task in the same task's direct `depends_on`. The path follows the closed grammar. It has at most 16 segments and 256 bytes. Bounds under `bounded-explicit-dag-v1` are 64 tool steps, 32 bindings per call and 16 KiB of canonical arguments per call. Call text counts toward the 64 KiB plan total. A binding adds no dependency edge. The engine never infers `depends_on` from a reference. The engine cannot know a run-time output, so it never checks that a path exists. `AU-BOUNDARY-R043.6.2` checks that at run time. | `binding_canonicalization_is_order_independent` yields one plan digest for reordered argument keys. `binding_bounds` accepts each ceiling and refuses one value past it.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.111.10
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** The decision refuses with a stable typed reason and returns no plan. `binding_unknown_task`: the reference names a task that is not in the plan. `binding_not_dependency`: the task is not in this task's direct `depends_on`. `binding_bad_path`: the path breaks the grammar or its bounds. `binding_cycle`: a binding edge closes a cycle, including a reference to the task itself. `call_invalid`: `server` or `tool` is malformed, or `arguments` is not an object. `call_bounds`: a count or byte bound of R134.111.9 is exceeded. A plain `depends_on` cycle still refuses with `plan_cycle`. Each refusal names the task id and the argument pointer. | `refuses_each_binding_defect` returns the reason, task id and argument pointer for all six reasons. A binding to a non-dependency refuses with `binding_not_dependency` and returns no plan.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.111.11
Digest and evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Digest and evidence.** The plan digest covers every call. That means `server`, `tool`, each literal and each binding. A change to any of them changes the digest. Key order does not. The fixed policy revision of `bounded-explicit-dag-v1` changes with this extension. The record holds one caller-claim premise per tool step. It names `server`, `tool` and the binding references. It holds one premise per binding that names the source task. Arguments are caller claims, so the record grants no authority to invoke a tool. `verify_task_plan_receipt` checks calls and bindings against the proposal. | `digest_covers_calls_and_bindings` changes the digest for a changed tool, literal, reference or server. `premises_name_calls_and_bindings` lists the premises. The receipt check refuses a receipt whose call differs from the proposal.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.111.12
Wiring and schema
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring and schema.** Calls attach in `plan_explicit_tasks` (`crates/eg-types/src/decision/task_plan.rs:215`). `handle_decide` reaches it through `super::stat_task_plan::task_plan` (`src/server/handlers/decide/stat_decide.rs:114`) and `outcome` (`stat_decide.rs:140`). The `TASK_PLAN_FEATURE_SCHEMA` body of `EG-DECISION-ENGINE-R134.111.7` grows to describe a call and a binding. Its content digest changes. The consumer rows are `AU-BOUNDARY-R043.6.1` for the harness and `ARBORA-RELEASE-R003.4.6` for served acceptance. Arbora re-pins the digest through `ARBORA-RELEASE-R003.4.4`. | `decide_routes_task_plan_with_calls` enters `handle_decide` and returns the typed plan with calls. The Python test checks that the exported digest equals the new body's digest.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R134.111.13
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide` wire method with a `TaskPlan` question. The plan mixes a prompt step with a tool step that has a binding. The test publishes the schema and submits the proposal. It reads the plan back. Calls and bindings round trip, and the digest binds them. It then submits a reference to a non-dependency. It requires the typed refusal and no plan. | `tests/decide/test_task_plan_served.py::test_tool_step_bindings_end_to_end`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R814
Connector prompts are system-prompt candidates that agent assembly selects (rollup)
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Connector prompts are system-prompt candidates that agent assembly selects (rollup).** Each packaged prompt with role `system` (`SDK-CONNECTOR-CONTROL-R074.2`) becomes a `system_prompt` harness component of `EG-ORCH-VOCAB-R801`. It links to its connector, its capabilities and its ontology classes. `AgentAssemble` (`EG-DECISION-ENGINE-R036`) and capability coverage (`EG-DECISION-ENGINE-R126`) select one candidate per agent slot for the task. The job load set (`EG-DECISION-ENGINE-R176`, `EG-CQ-ORCH-R011.1`) returns the prompt with its premise. Children `.1` to `.7` deliver it. | See each child.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R814.1
Model
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Model.** Add the candidate relation `:systemPromptFor` from a `system_prompt` component to a task class or capability. Add `PromptCandidate{component_id, connector, role, serves, digest}` in `crates/eg-types/src/decision/`. Task and template prompts register as components of kind `tool_guidance`. They are not system-prompt candidates. | `crates/eg-types/tests/prompt_candidate.rs::candidate_round_trips_and_kind_follows_role`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R814.2
Behavior
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Behavior.** arbora onboarding (`ARBORA-FLEET-R041.15`) writes one `PromptCandidate` node per `system` prompt into the tenant graph. It is the one producer of candidate nodes. The node has `:systemPromptFor` edges to the class and capability IRIs the prompt declares, and a `cp:ofConnector` edge. `AgentAssemble` fills an agent slot's system prompt from the candidates that cover the slot's task. It scores them by capability match and the confidence of `EG-ORCH-VOCAB-R801`. It abstains and names the uncovered capability when no candidate covers the task. It never invents a prompt. | `crates/eg-core/tests/prompt_candidate.rs::assemble_selects_covering_candidate_and_abstains_without_one`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R814.3
Wiring
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Wiring.** Candidates arrive in the onboarding triple batch of `EG-TYPED-PACKS-R106.3`. EG has no candidate projection of its own. `handle_agent_assemble` (`src/server/handlers/decide/assemble.rs:22`) reads them with a graph query over `:systemPromptFor`. The query runs in the Agent Library scope that already feeds tool components. The coverage query beside it (`src/server/handlers/decide/coverage.rs`) counts them. A caller lists candidates with served UQL or SPARQL. No served candidate read method exists. | `tests/decision/test_prompt_candidates_served.py::test_assemble_reads_candidates_from_imported_pack`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R814.4
Refusal
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Refusal.** Import refuses a `system` prompt that names no class or capability with `PROMPT_UNBOUND`. A candidate whose connector failed ontology admission is invisible to `AgentAssemble`. The decision names the excluded candidates. | `crates/eg-core/tests/prompt_candidate.rs::unbound_prompt_refuses_and_rejected_connector_is_excluded`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R814.5
Evidence
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Evidence.** The `Solved` record names each chosen system prompt, its connector, its digest and the capability it covered. The load-set row for the prompt cites the same component id. | `tests/decision/test_prompt_candidates_served.py::test_record_names_prompt_connector_digest_and_capability`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R814.6
Hot-path proof
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Hot-path proof.** The entry point is the served triple write of two onboarding batches, then served `AgentAssemble`. Each batch catalogs a connector that ships a system prompt. It assembles an agent for a task of one connector. It reads that connector's prompt in the committed agent graph. | `tests/decision/test_prompt_candidates_served.py::test_dynamic_agent_gets_the_matching_connector_system_prompt`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-DECISION-ENGINE-R814.7
Competency query
Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source
**Competency query.** "Which prompts can be the system prompt for task Y" is one graph query. It returns each `PromptCandidate` whose `:systemPromptFor` names task Y or a task that requires a capability task Y requires. Each row names the connector and the digest. It runs through served SPARQL and through its UQL equivalent. The query string is the test vector in the test specification. | `tests/decision/test_prompt_candidates_served.py::test_system_prompt_query_lists_candidates_for_a_task`.
requirementEG-DECISION-ENGINESPECIFIEDNo recorded commit/test evidence
EG-SDLC
EG-SDLC — Graph-driven development lifecycle
specNoneSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R001
Lifecycle record vocabulary and derived edges (rollup)
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Lifecycle record vocabulary and derived edges (rollup).** The engine must hold the nine lifecycle record kinds and the closed edge set of plan.md. Named rules derive the edges from the changeset log and the code graph. Children `.1` to `.6` deliver it. | See each child.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R001.1
Model
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Model.** Add `:Release`, `:Deployment` and `:Defect` and the edges `changes`, `citesRequirement`, `implements`, `verifiedBy`, `exercises`, `judges`, `producedBy`, `affects`, `introducedBy`, `fixedBy`, `contains`, `deploys`, `observedIn` and `raises` to `crates/eg-core/ontology/sdd-v1.ttl`. Add one SHACL shape per edge with its domain and range. | `crates/eg-core/tests/lifecycle_vocab.rs::edge_set_is_closed_and_shaped` loads the ontology and validates one fixture per edge.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R001.2
Behavior
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Behavior.** Add `derive_lifecycle_edges(changeset, code_graph) -> Vec<DerivedEdge>` in `crates/eg-core/src/lifecycle/derive.rs`. It applies the eight named rules of plan.md. Each `DerivedEdge` carries the rule name, the rule version and the input digests. The function is deterministic. | `crates/eg-core/tests/lifecycle_derive.rs::rules_emit_expected_edges` applies each rule to a fixture and compares the output.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R001.3
Wiring
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Wiring.** The EG-SCM-R006 re-index hook calls `derive_lifecycle_edges` after each accepted changeset. `IndexRepository` at `src/server/dispatch/router/source_ingest.rs:24` calls it for each ingested git commit. No other caller writes these edges. | `tests/test_sdlc_derive_served.py::test_accept_writes_derived_edges` submits a changeset and reads the derived edges back.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R001.4
Refusal
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Refusal.** A direct write of a derived edge kind must refuse with `LIFECYCLE_EDGE_DERIVED_ONLY`. A derived edge with an absent endpoint must refuse with `LIFECYCLE_ENDPOINT_UNKNOWN`. A refusal writes nothing. | `crates/eg-core/tests/lifecycle_derive.rs::manual_edge_write_is_refused` asserts both codes and an unchanged graph.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R001.5
Evidence
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Evidence.** A rebuild replays every rule over the changeset log. The rebuilt edge set must equal the incremental edge set byte for byte. | `crates/eg-core/tests/lifecycle_derive.rs::rebuild_equals_incremental` applies 200 changesets incrementally and compares a rebuild.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R001.6
Hot-path proof
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `SubmitChangeset`. The benchmark `benches/lifecycle_derive.rs` derives edges for a 50-path changeset over a 1M-symbol graph. The p99 stays under 5 ms. Peak memory stays under 64 MiB. | `cargo bench --bench lifecycle_derive` against the stored baseline fails on a 10 percent regression.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R002
Release and deployment records (rollup)
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Release and deployment records (rollup).** The engine must store releases and deployments. It links each deployment to a release by artifact digest. Children `.1` to `.6` deliver it. | See each child.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R002.1
Model
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Model.** Add `Release{repo, version, git_ref, changeset_head, artifact_digests, published_at}` and `Deployment{environment, workload, image_digest, release_ref, started_at, finished_at, outcome}` in `crates/eg-types/src/lifecycle.rs`. `outcome` is a closed set: `succeeded`, `failed`, `rolled_back`, `unattributed`. | `crates/eg-types/tests/lifecycle_records.rs::records_round_trip` round-trips both records and refuses an unknown outcome.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R002.2
Behavior
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Behavior.** `RecordDeployment` resolves the release by image digest. A digest that no release names sets `outcome` to `unattributed` and `release_ref` to none. The `contains.release_range` rule links a release to the changesets after the previous release head. | `crates/eg-types/tests/lifecycle_records.rs::unknown_digest_stays_unattributed` records a deployment with an unknown digest.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R002.3
Wiring
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Wiring.** Add the served methods `RecordRelease` and `RecordDeployment` in `src/server/handlers/lifecycle.rs`. The release workflow of `PIPE-RELEASE-R009` calls `RecordRelease`. The deploy operations of `ARBORA-OPS-R853` call `RecordDeployment`. | `tests/test_sdlc_release_served.py::test_release_then_deployment_links` records both and reads the link back.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R002.4
Refusal
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Refusal.** A release whose changeset head is absent from the repository chain must refuse with `RELEASE_HEAD_UNKNOWN`. A second release with the same repository and version must refuse with `RELEASE_VERSION_TAKEN`. | `tests/test_sdlc_release_served.py::test_release_refusals` asserts both codes.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R002.5
Evidence
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Evidence.** Each release record is sealed under the EG-DURABLE-KERNEL-R057 create-only guard. A readback must equal the written bytes. | `tests/test_sdlc_release_served.py::test_release_is_sealed` attempts an overwrite and reads the original back.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R002.6
Hot-path proof
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `RecordDeployment`. The test records 1,000 deployments over 50 releases. Each record stays under 2 ms at p99. | `tests/test_sdlc_release_served.py::test_deployment_record_latency` measures the p99.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R003
Defect records and intake (rollup)
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Defect records and intake (rollup).** The engine must store defects and accept them from five intake paths. It removes duplicates by a signature digest. Children `.1` to `.6` deliver it. | See each child.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R003.1
Model
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Model.** Add `Defect{id, repo, title, intake, signature_digest, severity, status, symptoms, created_at}` in `crates/eg-types/src/lifecycle.rs`. `intake` is a closed set: `gate_failure`, `run_failure`, `incident`, `connector_issue`, `direct`. `status` is a closed set: `new`, `triaged`, `fixing`, `fixed`, `verified`, `closed`, `rejected`. | `crates/eg-types/tests/lifecycle_records.rs::defect_round_trips` round-trips a defect and refuses an unknown status.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R003.2
Behavior
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Behavior.** `FileDefect` normalizes the symptom: it strips addresses, line numbers and temporary paths. It hashes the result to the signature digest. An open defect with the same signature absorbs the symptom. A closed defect with the same signature reopens. | `crates/eg-core/tests/defect_intake.rs::same_signature_reuses_open_defect` files two equal symptoms and observes one defect.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R003.3
Wiring
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Wiring.** `RecordGateVerdict` of EG-SCM-R008 calls `FileDefect` on a fail verdict. The run-trace writer of EG-ORCH-VOCAB-R009 calls it on a failed run outcome. `incident.correlate` of EG-UNIFIED-DATA-PLANE-R760 calls it when an incident names a code symbol. | `tests/test_sdlc_defect_served.py::test_failed_gate_opens_defect` records a fail verdict and reads the defect back.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R003.4
Refusal
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Refusal.** A status move that skips a state must refuse with `DEFECT_TRANSITION_ILLEGAL`. A move to `verified` must refuse with `DEFECT_UNVERIFIED` unless a bound test passes on the fix changeset. | `tests/test_sdlc_defect_served.py::test_illegal_transitions_refuse` asserts both codes.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R003.5
Evidence
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Evidence.** Each defect lists its symptoms with the intake path, the source record id and the time. A readback through a separate principal must equal the stored list. | `tests/test_sdlc_defect_served.py::test_symptom_evidence_reads_back` compares every field.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R003.6
Hot-path proof
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `RecordGateVerdict`. The benchmark `benches/defect_intake.rs` files 100,000 symptoms over 1,000 signatures. The p99 per symptom stays under 1 ms. | `cargo bench --bench defect_intake` against the stored baseline fails on a 10 percent regression.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R004
Defect triage decision (rollup)
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Defect triage decision (rollup).** The engine must decide the triage of a defect. The decision names severity, suspected symbols, an owner and a duplicate link. It abstains with a typed reason when evidence is insufficient. Children `.1` to `.6` deliver it. | See each child.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R004.1
Model
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Model.** Add `TriageDecision{defect_id, severity, suspected_symbols, owner_principal, duplicate_of, abstain_reason, evidence_refs}` in `crates/eg-types/src/decision/defect_triage.rs`. `abstain_reason` is a closed set: `no_symbol_match`, `no_owner`, `insufficient_evidence`. | `crates/eg-types/src/decision/defect_triage.rs::tests::decision_round_trips` round-trips the record.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R004.2
Behavior
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Behavior.** The engine maps symptom frames to symbols through the code graph. It ranks suspects by blame recency and the EG-SCM-R009 culprit. It picks the owner from path ownership records, then recent authors. It sets the `affects` and `introducedBy` edges from the result. | `crates/eg-types/src/decision/defect_triage.rs::tests::culprit_outranks_blame` seeds a culprit and asserts the rank.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R004.3
Wiring
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Wiring.** The served `Decide` accepts the `DEFECT_TRIAGE` question kind. The answer stores as a `DecisionRecord` through `DecisionCommit` of EG-DECISION-ENGINE-R019. `TriageDefect` calls it. | `tests/decide/test_defect_triage_served.py::test_triage_records_decision` triages a seeded defect and reads the record back.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R004.4
Refusal
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Refusal.** A triage of an absent defect must refuse with `DEFECT_UNKNOWN`. A triage of a closed defect must refuse with `DEFECT_CLOSED`. Neither writes a decision. | `tests/decide/test_defect_triage_served.py::test_triage_refusals` asserts both codes.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R004.5
Evidence
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Evidence.** The decision pins the symptom digests, the blame inputs and the culprit id. A replay with equal inputs must produce an equal record digest. | `tests/decide/test_defect_triage_served.py::test_triage_replays` replays the record and compares digests.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R004.6
Hot-path proof
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Decide`. The benchmark `crates/eg-numeric/benches/defect_triage.rs` triages over a 1M-symbol graph with 20 frames. The p99 stays under 10 ms. | `cargo bench -p eg-numeric --bench defect_triage` fails on a 10 percent regression.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R005
Requirement state derived from the graph (rollup)
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Requirement state derived from the graph (rollup).** The engine must derive each requirement state from the changeset log and the bound tests. The answer must equal the shared status generator on the same revision. Children `.1` to `.6` deliver it. | See each child.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R005.1
Model
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Model.** Add `SpecStatusAnswer{repo, rev, rows}` with `SpecRowState{id, state, landed_by, verified_by, withdrawn}` in `crates/eg-types/src/lifecycle.rs`. `state` is the closed set `SPECIFIED`, `LANDED`, `VERIFIED`. | `crates/eg-types/tests/lifecycle_records.rs::status_answer_round_trips` round-trips the answer.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R005.2
Behavior
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Behavior.** Add `derive_spec_status` in `crates/eg-core/src/lifecycle/status.rs`. It applies the state rules of plan.md. A rollup takes the lowest child state. A `Spec-Withdraw` trailer removes the binding evidence for its IDs. | `crates/eg-core/tests/spec_status_derive.rs::rules_match_the_standard` covers each state, a rollup and a withdrawal.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R005.3
Wiring
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Wiring.** Add the served method `SpecStatus` in `src/server/handlers/lifecycle.rs`. It reads `:Requirement` nodes of EG-ORCH-VOCAB-R012.9 and the derived edges of R001. `PIPE-CONNSPEC-R009` reads it. | `tests/test_sdlc_spec_status_served.py::test_served_status_reads_graph` reads the state of a fixture repository.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R005.4
Refusal
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Refusal.** A revision absent from the repository chain must refuse with `SPEC_STATUS_REV_UNKNOWN`. A repository with no ingested spec tree must refuse with `SPEC_TREE_ABSENT`. | `tests/test_sdlc_spec_status_served.py::test_status_refusals` asserts both codes.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R005.5
Evidence
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Evidence.** Each landed row names its changeset ids. Each verified row names its test ids. A differential test compares the served answer with the shared status generator output for the same revision. | `tests/test_sdlc_spec_status_served.py::test_matches_shared_generator` compares both outputs on this repository.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R005.6
Hot-path proof
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `SpecStatus`. The test derives the state of 2,000 rows. The p99 stays under 50 ms. | `tests/test_sdlc_spec_status_served.py::test_status_latency` measures the p99.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R006
Lifecycle competency queries (rollup)
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Lifecycle competency queries (rollup).** UQL must answer the lifecycle questions of plan.md over the derived edges. The served `LifecycleTrace` returns the records reachable from one anchor. Children `.1` to `.6` deliver it. | See each child.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R006.1
Model
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Model.** Add `LifecycleTraceRequest{anchor, depth, kinds}` and `LifecycleTraceAnswer{records, edges, truncated}` in `crates/eg-types/src/lifecycle.rs`. `depth` ranges from 1 to 8. | `crates/eg-types/tests/lifecycle_records.rs::trace_request_bounds` refuses depth 9.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R006.2
Behavior
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Behavior.** The trace walks the edge set breadth first to the depth bound. It filters by record kind. It reports `truncated` when the node budget of 10,000 stops the walk. | `crates/eg-core/tests/lifecycle_trace.rs::trace_respects_depth_and_budget` asserts both bounds.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R006.3
Wiring
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Wiring.** Add the served method `LifecycleTrace` in `src/server/handlers/lifecycle.rs`. Publish four UQL competency fixtures in `tests/fixtures/lifecycle_cq/`. | `tests/test_sdlc_trace_served.py::test_competency_questions_answer` runs the four fixtures.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R006.4
Refusal
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Refusal.** An anchor outside the caller tenant must return an empty answer, not an error. An unknown record kind must refuse with `LIFECYCLE_KIND_UNKNOWN`. | `tests/test_sdlc_trace_served.py::test_trace_refusals` asserts both cases.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R006.5
Evidence
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Evidence.** Each returned edge names its derivation rule and version. | `tests/test_sdlc_trace_served.py::test_edges_name_rules` reads the rule names back.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-SDLC-R006.6
Hot-path proof
Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/lifecycle_trace.rs` walks depth 4 from a requirement over 1M symbols and 100,000 changesets. The p99 stays under 20 ms. | `cargo bench --bench lifecycle_trace` fails on a 10 percent regression.
requirementEG-SDLCSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL
EG-DURABLE-KERNEL — Durable graph kernel
specNoneSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R001
Outbox head-only attempt accounting and rewind
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Outbox head-only attempt accounting and rewind.** The outbox increments retry attempts only for the row currently at the head of a stream, so a failing head cannot exhaust the attempt budget of healthy successor rows. Consumers can declare an explicit reject that dead-letters the head immediately and reports the transition, and an administrator can list head status and dead letters and issue a rewind to replay from an earlier position. | Verified by outbox tests covering a failing head never dead-lettering a healthy successor, repeated head releases dead-lettering only the head, consumer reject dead-lettering immediately, and rewind replay.
requirementEG-DURABLE-KERNELVERIFIED1813f2b5190d
a676823d2b54
afc33c3cde5c
b43f33569dd4
crates/eg-transaction/src/tests/outbox.rs:1577
crates/eg-transaction/src/tests/outbox.rs:1721
crates/eg-transaction/src/tests/outbox.rs:1893
crates/eg-transaction/src/tests/outbox.rs:2034
EG-DURABLE-KERNEL-R002
Outbox consumers get per-class topics and reject-driven rebuild
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Outbox consumers get per-class topics and reject-driven rebuild.** Outbox consumers publish to semantically distinct topics per message class. A reasoning-projection consumer that rejects a message triggers a rebuild rather than silently acknowledging a skipped projection. `MutationOutbox` exposes an administrative method for inspecting and managing consumer state. The outbox reports metrics on attempts, rejects, dead letters, and rebuilds. | Verified by outbox integration tests asserting per-class topic routing, reject-triggered rebuild of a reasoning projection, and exported outbox metrics.
requirementEG-DURABLE-KERNELVERIFIED03670fc1f33c
a1bb9fb9503e
a676823d2b54
crates/eg-transaction/src/tests/outbox.rs:2309
EG-DURABLE-KERNEL-R003
Owner-store layout lineage registry with typed upgrade refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Owner-store layout lineage registry with typed upgrade refusal.** The owner-store layout maintains a lineage registry that recognizes every supported on-disk format and refuses an unsupported layout with a named `{LAYOUT}_FORMAT_UPGRADE_REQUIRED` error rather than reinterpreting it silently. A generated document records the steps required to remove a retired layout from the registry. | Verified by a golden lineage test that loads each supported manifest format and checks the typed refusal for unsupported ones.
requirementEG-DURABLE-KERNELVERIFIEDa1bb9fb9503e
a676823d2b54
afc33c3cde5c
crates/eg-storage/src/owner/lineage_fixture_tests.rs:46
EG-DURABLE-KERNEL-R004
Outbox attempt accounting is scoped to the head row
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Outbox attempt accounting is scoped to the head row.** Re-leasing an outbox row increments the attempt count only for the row at the head of its stream. Healthy successor rows staged behind it never gain an attempt. A failing head cannot dead-letter its successors. This accounting is implemented in `crates/eg-transaction/src/outbox/claim.rs`. | One test asserts a failing head never dead-letters a healthy successor. Another test asserts sixteen re-leases of the head dead-letter only the head.
requirementEG-DURABLE-KERNELVERIFIEDa676823d2b54
afc33c3cde5c
b43f33569dd4
crates/eg-transaction/src/tests/outbox.rs:1578
crates/eg-transaction/src/tests/outbox.rs:1894
EG-DURABLE-KERNEL-R005
Outbox delivery state remains local to the owning node
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Outbox delivery state remains local to the owning node.** The local store owner writes outbox delivery-side rows. The multi-group raft layer does not replicate them. Delivery progress stays node-local and outside the replicated log. | Confirmed by an integration test checking that outbox delivery rows are not present in replicated state on non-owning cluster members.
requirementEG-DURABLE-KERNELVERIFIED03670fc1f33c
48abc77ce72e
87a17d4fa2a4
a676823d2b54
e2e2514203b7
crates/eg-transaction/src/outbox/rows.rs:325
EG-DURABLE-KERNEL-R006
Engine startup does not block on one store's lazy open
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Engine startup does not block on one store's lazy open.** Engine startup must not refuse entirely when the agent-library store fails to open. That store opens lazily. A failure to open it affects only the operations that depend on it, not overall startup. | A startup test forces the agent-library store to fail its open. The test asserts that the engine still starts and serves unrelated operations.
requirementEG-DURABLE-KERNELVERIFIED03670fc1f33c
8dbb5bd9de53
a676823d2b54
src/raft/harness/resource_acceptance_test.rs:2570
EG-DURABLE-KERNEL-R007
Host binary exposes a storage inspect and upgrade command
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Host binary exposes a storage inspect and upgrade command.** The host binary provides administrative `storage inspect` and `storage upgrade` commands. They examine and migrate on-disk layout state outside normal server startup. | Verified by a CLI integration test exercising `storage inspect` and `storage upgrade` against a sample data directory.
requirementEG-DURABLE-KERNELVERIFIED0ce0383a5599
a676823d2b54
tests/operator_command_store_upgrade_cli.rs:35
tests/operator_command_store_upgrade_cli.rs:60
tests/operator_command_store_upgrade_cli.rs:81
EG-DURABLE-KERNEL-R008
Raft unit tests pass under cluster features and run in CI
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Raft unit tests pass under cluster features and run in CI.** All `raft::*` unit tests and `txn_reconcile_ack_lost_retry` pass when compiled with cluster features enabled, without recursion-depth failures, and a continuous-integration job compiles and runs the raft test suite on every change. | Verified by a green continuous-integration job that builds with cluster features and executes the raft test suite, including `txn_reconcile_ack_lost_retry`.
requirementEG-DURABLE-KERNELVERIFIED624e1e3076e6
a1bb9fb9503e
a676823d2b54
tests/test_raft_cluster_ci_gate.py:31
tests/test_raft_cluster_ci_gate.py:39
tests/test_raft_cluster_ci_gate.py:57
EG-DURABLE-KERNEL-R009
Native raft commands are sealed as their bare method
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Native raft commands are sealed as their bare method.** Native consensus commands are sealed and opened as the bare method they represent in `src/raft/command/native/sealed.rs` (`SealedNativeMethod::seal_value`/`open_value`), so a native raft command payload is never rejected as invalid due to a mismatched envelope. | Verified by a follower catch-up test that replays a create-graph-then-write sequence and by unit tests on `SealedNativeMethod` sealing and opening.
requirementEG-DURABLE-KERNELVERIFIEDa676823d2b54
b43f33569dd4
src/raft/command/native/tests.rs:180
EG-DURABLE-KERNEL-R010
jscpd clone gate runs on every commit
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**jscpd clone gate runs on every commit.** The jscpd structural-clone gate runs in the per-commit check suite. The gate flags each new duplicate code pair that an extraction introduces. | The per-commit hook configuration invokes the jscpd gate. The gate catches a deliberately duplicated extraction.
requirementEG-DURABLE-KERNELVERIFIED624e1e3076e6
a1bb9fb9503e
a676823d2b54
tests/test_jscpd_per_commit_gate.py:30
tests/test_jscpd_per_commit_gate.py:40
EG-DURABLE-KERNEL-R011
Clippy and targeted tests cover the full and all-features builds
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Clippy and targeted tests cover the full and all-features builds.** CI must run full-feature clippy without raft and all-feature clippy with Kafka dependencies. CI must execute the raft, backup, and persistence modules before accepting a change. `.github/workflows/release.yml` owns these gates. This parent rolls up R011.1 through R011.5. Declaration validation alone does not prove runtime acceptance. | Exact-head CI logs must prove both clippy profiles and all three runtime categories passed before merge.
requirementEG-DURABLE-KERNELSPECIFIED1c6b4c961a40
7c046280f19e
9794030f6459
a676823d2b54
tests/test_release_feature_matrix.py:217
EG-DURABLE-KERNEL-R011.1
`RequiredTestModuleCategory`/`RequiredTestModule` are a typed category and a validated declaration, refusing an unrecognized category name or an unselectable declaration
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`RequiredTestModuleCategory`/`RequiredTestModule` are a typed category and a validated declaration, refusing an unrecognized category name or an unselectable declaration.** `crates/eg-types/src/pre_merge_test_module.rs` parses the `raft`/`backup`/`persistence` category names. It requires a non-empty crate name and `cargo test` filter. It refuses declarations that cannot select and run a module. | Unit tests cover all three categories and valid declarations. They refuse unknown categories, missing crate names, and missing test filters.
requirementEG-DURABLE-KERNELVERIFIED9794030f6459
crates/eg-types/src/pre_merge_test_module.rs:164
crates/eg-types/src/pre_merge_test_module.rs:181
crates/eg-types/src/pre_merge_test_module.rs:190
crates/eg-types/src/pre_merge_test_module.rs:202
crates/eg-types/src/pre_merge_test_module.rs:217
EG-DURABLE-KERNEL-R011.2
Concrete required-module manifest
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Concrete required-module manifest.** `crates/eg-types/src/pre_merge_test_module.rs` must declare real crate names and test filters for all three categories. The manifest selects `epistemic-graph` `raft::` with `cluster`, `eg-transaction` `tests::backup_replay::` with no features, and `epistemic-graph` `server::persistence::` with `full`. All commands disable default features and target library tests. Empty discovered selections are refused. Runtime execution belongs to R011.3. | Unit tests in `crates/eg-types/src/pre_merge_test_module.rs`: `required_manifest_covers_runtime_categories` and `required_manifest_rejects_empty_selection`.
requirementEG-DURABLE-KERNELVERIFIED85ce2ac73a96
a430c82b18b2
crates/eg-types/src/pre_merge_test_module.rs:232
crates/eg-types/src/pre_merge_test_module.rs:279
crates/eg-types/src/pre_merge_test_module.rs:295
scripts/tests/test_public_spec_inventory.py:102
EG-DURABLE-KERNEL-R011.3
Pre-merge runtime execution
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Pre-merge runtime execution.** `.github/workflows/ci.yml` must execute the R011.2 manifest on pull requests. The gate must fail on test failures or zero selected tests. | Planned tests in `tests/test_required_runtime_gate.py`: `test_pull_request_executes_required_categories` and `test_failed_or_empty_category_blocks_acceptance`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R011.4
Exact-head CI acceptance receipts
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Exact-head CI acceptance receipts.** `specs/durable-graph-kernel/test-spec.md` must record passing pre-merge runtime and clippy evidence at one published revision. `.github/workflows/release.yml` must retain both clippy profiles and Kafka dependencies. | CI receipts must name `published-full`, `workspace-all-features`, and every selected runtime test. R011.2 and R011.3 test names define the gate checks.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R011.5
Required Clippy profile declarations
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Required Clippy profile declarations.** `tests/test_release_feature_matrix.py` must check both required profile flags, their executable command, and Kafka build headers. This child covers configuration only. R011.3 and R011.4 retain runtime and exact-head receipt acceptance. | `test_required_clippy_profiles_and_command_are_declared` checks current configuration. `test_required_clippy_declaration_drift_is_refused` rejects missing profiles, changed flags, disabled commands, and missing headers.
requirementEG-DURABLE-KERNELVERIFIED7c046280f19e
c73eeb01d917
tests/test_release_feature_matrix.py:218
tests/test_release_feature_matrix.py:257
EG-DURABLE-KERNEL-R012
Raft native command sealing and placement routing are correct
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Raft native command sealing and placement routing are correct.** Native consensus commands are sealed and opened consistently so they are never rejected as invalid, and placement administration correctly routes data movement across a multi-node raft cluster. | Verified by a follower catch-up replay test and a placement-admin test that moves data across a real three-node cluster.
requirementEG-DURABLE-KERNELVERIFIED6067fad789bb
a676823d2b54
b43f33569dd4
src/raft/harness/catchup_test.rs:57
src/raft/tests.rs:1017
EG-DURABLE-KERNEL-R013
Raft cluster test failures capture a causal trace automatically
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Raft cluster test failures capture a causal trace automatically.** A failing multi-node raft test captures a bounded ring-buffer trace of raft and heartbeat events. The trace filters to the consensus targets. A panic hook dumps it. The code lives in `src/raft/harness/trace_capture.rs`. The causal chain of a failure is available without manual tracing. | Unit tests cover the ring buffer, including eviction of the oldest entry when over capacity. A test covers the panic-hook dump path.
requirementEG-DURABLE-KERNELVERIFIED624e1e3076e6
a676823d2b54
b43f33569dd4
src/raft/harness/trace_capture.rs:482
src/raft/harness/trace_capture.rs:562
EG-DURABLE-KERNEL-R014
Raft cluster tests pass reliably under load
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Raft cluster tests pass reliably under load.** The leader-rebalance and three-node placement-admin tests must reach their expected cluster states under CPU load. R015 transport timing or ordering gaps must not cause flaky failures. `src/raft/tests.rs` owns both tests. This parent rolls up R014.1 through R014.5. Retry-budget validation alone does not prove loaded execution. | Repeated loaded runs must pass without flaky failures. `src/raft/harness/trace_capture.rs` must capture each failure trace.
requirementEG-DURABLE-KERNELSPECIFIED3a14159c3768
a676823d2b54
EG-DURABLE-KERNEL-R014.1
A typed flake-budget / retry-policy model bounds how a load-test run retries past a transient failure
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**A typed flake-budget / retry-policy model bounds how a load-test run retries past a transient failure.** `src/raft/flake_budget.rs`'s `FlakeBudget` names `max_retries`, `backoff_ms`, and `max_backoff_ms`, refusing a zero-retry, zero-backoff, or inverted-cap budget at construction, and refusing `backoff_for` on a retry attempt beyond `max_retries`, rather than looping forever or silently giving up. Code root: `src/raft`. No load-test harness is driven yet. | Verified by unit tests covering a well-formed budget, each malformed-budget refusal, a retry attempt beyond `max_retries` being refused, and exponential backoff growth capped at `max_backoff_ms`.
requirementEG-DURABLE-KERNELVERIFIED3a14159c3768
src/raft/flake_budget.rs:105
src/raft/flake_budget.rs:112
src/raft/flake_budget.rs:120
src/raft/flake_budget.rs:128
src/raft/flake_budget.rs:85
EG-DURABLE-KERNEL-R014.2
Bounded representative CPU load
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Bounded representative CPU load.** `scripts/validate-raft-cluster.sh` must provide CPU workers while cluster tests run. The generator must record worker count and elapsed duration. It must reject zero workers and stop every worker on exit. | Process tests in `tests/test_validate_raft_cluster.py`: `test_cpu_load_runs_during_cluster_test`, `test_zero_load_workers_refused`, and `test_load_workers_stop_on_failure`.
requirementEG-DURABLE-KERNELVERIFIED1cf93eec4282
85ce2ac73a96
86913890006d
tests/test_check_registry_test_ownership_completeness.py:31
tests/test_validate_raft_cluster.py:15
EG-DURABLE-KERNEL-R014.3
Repeated loaded-test harness
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Repeated loaded-test harness.** `scripts/validate-raft-cluster.sh` must repeat both named cluster tests under R014.2 load. It must preserve every attempt result and failure trace. `src/raft/flake_budget.rs` must bound any diagnostic retry. A retry success must not erase a flaky first failure. | Planned tests in `tests/test_validate_raft_cluster.py`: `test_repeats_both_cluster_tests`, `test_retry_budget_is_bounded`, and `test_retry_preserves_failure_and_trace`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R014.3.1
Repeated fail-closed loaded execution
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Repeated fail-closed loaded execution.** The existing shell entry point accepts a bounded repeat count and runs both exact named cluster tests under R014.2 load. Each invocation keeps its own output trace and result in a fresh run directory. Any failed or empty selection keeps the overall run failed even when later repetitions pass. No diagnostic retries are performed by this leaf. | Process tests in `tests/test_validate_raft_cluster.py`: `test_repeats_both_cluster_tests`, `test_repetition_preserves_failure_and_trace`, `test_empty_selection_refused`, and `test_invalid_repeat_count_refused`.
requirementEG-DURABLE-KERNELVERIFIEDe0efe89bdedf
tests/test_validate_raft_cluster.py:221
tests/test_validate_raft_cluster.py:242
tests/test_validate_raft_cluster.py:264
tests/test_validate_raft_cluster.py:276
tests/test_validate_raft_cluster.py:289
EG-DURABLE-KERNEL-R014.3.2
Bounded diagnostic retry integration
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Bounded diagnostic retry integration.** Drive optional diagnostic retries through `src/raft/flake_budget.rs`, preserving failed attempts and refusing retries beyond its budget. R014.3 rolls up this child and R014.3.1. | Planned `test_retry_budget_is_bounded` and `test_retry_preserves_failure_and_trace`; Rust retry integration remains pending.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R014.4
Loaded leader-rebalance acceptance
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Loaded leader-rebalance acceptance.** `specs/durable-graph-kernel/test-spec.md` must record repeated loaded runs of `src/raft/tests.rs::multi_node_group_join_then_leader_rebalance`. The record must include revision, command, hardware, CPU-worker count, repeat count, results, and trace locations. | `src/raft/tests.rs::multi_node_group_join_then_leader_rebalance` must pass every recorded loaded repetition without flaky failures. The record must include at least two repetitions.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R014.5
Loaded three-node placement acceptance
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Loaded three-node placement acceptance.** `specs/durable-graph-kernel/test-spec.md` must record repeated loaded runs of the three-node placement-admin test in `src/raft/tests.rs`. The record must include revision, command, hardware, CPU-worker count, repeat count, results, and trace locations. | `src/raft/tests.rs::placement_admin_wire_rpc::placement_admin_wire_rpcs_move_data_across_a_real_three_node_cluster` must pass every recorded loaded repetition without flaky failures. The record must include at least two repetitions.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R015
Raft heartbeat flush and batch dispatch avoid head-of-line blocking
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Raft heartbeat flush and batch dispatch avoid head-of-line blocking.** Each peer flushes its heartbeats independently. Per-group batch dispatch runs concurrently and does not wait behind one in-flight write. One slow peer or group does not stall the others. | A benchmark measures the worst-case heartbeat processing time under load. A documented single-graph-per-group configuration bounds any remaining head-of-line risk.
requirementEG-DURABLE-KERNELVERIFIEDa595f3a182c3
a676823d2b54
src/raft/tests.rs:2087
EG-DURABLE-KERNEL-R016
Raft durability writes are batched to reduce commit latency
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Raft durability writes are batched to reduce commit latency.** Raft log append and commit batches multiple entries using durability batching and coalescing rather than issuing one redb write transaction per entry, reducing commit latency that otherwise runs on the order of a second per transaction regardless of cross-group contention. | Verified by a focused raft durability test and by commit-latency measurements comparing per-entry commits against batched commits.
requirementEG-DURABLE-KERNELVERIFIED92943a9ed1bb
a676823d2b54
src/server/persistence/redb_backend/raft_linger_tests.rs:12
EG-DURABLE-KERNEL-R017
Correctness-gated benchmark compares EG against HelixDB
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Correctness-gated benchmark compares EG against HelixDB.** A pinned, correctness-gated benchmark suite measures point-get, multi-hop traversal, transactional batch, text/vector prefilter, and mixed graph/vector workloads against HelixDB, reporting latency, throughput, CPU, resident memory, and storage amplification for each. | Verified by a benchmark report that records exact configuration, hardware class, code revision, and measured results, with no superiority claim accepted without it.
requirementEG-DURABLE-KERNELVERIFIED28295e96e0a3
a676823d2b54
d2a5aa6460df
tests/test_bench_helix_compare.py:113
tests/test_bench_helix_compare.py:144
tests/test_bench_helix_compare.py:177
tests/test_bench_helix_compare.py:56
EG-DURABLE-KERNEL-R018
UDF registry and response-dedup cache are tenant-scoped
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**UDF registry and response-dedup cache are tenant-scoped.** The UDF registry is keyed and scoped by tenant and actor through a single authorization chokepoint. A tenant cannot invoke or shadow another tenant's UDF. This follows the foreign-source scoping in EG-FEDERATED-QUERY-R013. The in-memory mutation response-dedup cache keys its entries by tenant and caller. It never replays one tenant's cached response to another. | Cross-tenant negative tests assert that UDF invoke and shadow attempts are denied. They also assert that the response-dedup cache never replays another tenant's cached response.
requirementEG-DURABLE-KERNELVERIFIED745bf5943743
a1bb9fb9503e
a676823d2b54
src/server/mutation/context.rs:567
src/server/udf_catalog.rs:126
EG-DURABLE-KERNEL-R019
Graph lifecycle idempotency keys are tenant-scoped
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Graph lifecycle idempotency keys are tenant-scoped.** The lifecycle batch identifier used for `CreateGraph` and `DeleteGraph` idempotency includes tenant in addition to the verified agent identity and graph name, so two tenants using the same agent identity, idempotency key, and graph name never receive each other's replayed result or reveal cross-tenant graph existence. | Verified by a test creating the same idempotency key, agent identity, and graph name under two different tenants and asserting each gets its own independent outcome.
requirementEG-DURABLE-KERNELVERIFIED745bf5943743
a1bb9fb9503e
a676823d2b54
src/server/mutation_batch/lifecycle_tests.rs:411
EG-DURABLE-KERNEL-R020
Bounded background scrub detects node corruption between restarts
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Bounded background scrub detects node corruption between restarts.** A background content scrub reads nodes using a read transaction with no write lock, resumes from a stored key cursor, runs at a bounded rate, and surfaces typed corruption findings on status and metrics, rather than relying on detection only at read time or the next restart. Unseal failures return a typed error instead of an untyped string. | Verified by a test that corrupts a persisted node, runs the scrub, and asserts a typed finding is reported and the cursor resumes correctly after restart.
requirementEG-DURABLE-KERNELVERIFIED461f8c84eb44
745bf5943743
a676823d2b54
src/server/persistence/redb_backend/scrub_api_tests.rs:80
EG-DURABLE-KERNEL-R021
Store-authority binding validates once per write transaction
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Store-authority binding validates once per write transaction.** `binding_for_write` in `crates/eg-storage/src/physical/binding.rs` validates owner-store authority and scope once per write transaction and caches the result for that transaction's duration, rather than repeating the full manifest and table check on every member access, while still failing closed at the transaction boundary. | Verified by a commit-latency benchmark showing per-commit validation overhead drop to a small constant cost instead of repeating per-member checks.
requirementEG-DURABLE-KERNELVERIFIEDa1d6b2bd5e03
a5e7b2983a04
a676823d2b54
crates/eg-transaction/src/tests/write_authority.rs:19
EG-DURABLE-KERNEL-R022
Just-in-time RBAC elevation requires two-person approval
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Just-in-time RBAC elevation requires two-person approval.** A dedicated `rbac.elevation` control lease is consulted by the access-check path to grant temporary elevated access, requires approval from two distinct principals, carries a hard expiry, is audited, and is never issued automatically by a learning or inference process. | Verified by tests asserting elevation is denied without two distinct approvers, denied after expiry, and always produces an audit record.
requirementEG-DURABLE-KERNELVERIFIED2f37015096de
a1d6b2bd5e03
a676823d2b54
crates/eg-core/src/isolation/elevation_tests.rs:158
crates/eg-core/src/isolation/elevation_tests.rs:192
crates/eg-core/src/isolation/elevation_tests.rs:85
EG-DURABLE-KERNEL-R023
UQL enforces a read-only guarantee at compile time and by test
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**UQL enforces a read-only guarantee at compile time and by test.** `UnifiedQuery`, `UnifiedQueryText`, and `Uql` operations never perform a mutation or touch a durable domain, are idempotent, and execute against a `Snapshot`; a compile-time pin ensures operation dispatch takes the snapshot by shared reference so a mutable path cannot be introduced without a build failure. | Verified by an eg-capabilities invariant test asserting the read-only, idempotent, snapshot-based contract for all three query types.
requirementEG-DURABLE-KERNELVERIFIEDa676823d2b54
e1ca1b8fd167
crates/eg-capabilities/tests/invariants.rs:504
EG-DURABLE-KERNEL-R024
External graph and database backends become EG federation sources
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**External graph and database backends become EG federation sources.** The fan-out backend, PostgreSQL/AGE backend, Cypher transpiler, mirror target, outbox-based mirror, brain-guarded backend, Trino backend, and Spark job backends are implemented in this repository as ForeignSourceSpec federation sources and mirror targets rather than remaining external, undeleted components. One child per named backend (`.1` AGE, `.2` fan-out, `.3` Cypher transpiler, `.4` mirror target, `.5` outbox-based mirror, `.6` brain-guarded, `.7` Trino, `.8` Spark); each net-new child is further split producer-first by the typed-model/entry-point rule. Rollup: LANDED only once every child is. | Verified by integration tests that register each backend as a ForeignSourceSpec or MirrorTargetSpec and exercise a representative query or mirror operation through it.
requirementEG-DURABLE-KERNELLANDED35f12e9cc56f
3a14159c3768
3ddc77c97ef8
42a0b101b111
4746fbcf1601
EG-DURABLE-KERNEL-R024.1
PostgreSQL/AGE backend becomes a ForeignSourceSpec source
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**PostgreSQL/AGE backend becomes a ForeignSourceSpec source.** A `ForeignSourceSpec::Cypher { backend: Age, .. }` wire spec is bound, under an explicit registration, to a read-only PostgreSQL credential in `crates/eg-plan/src/federation_age.rs`; the binding is refused unless the credential's endpoint matches the declared endpoint, and every fetch reuses the existing guarded SQL federation transport (read-only transaction, timeout, cardinality bound), so AGE mutation clauses cannot commit. Code root: `crates/eg-plan`. | Verified by tests covering a successful bound registration and probe, a mismatched-binding refusal that also proves the unbound wire spec still errors, and a Cypher-text injection guard on the generated dollar-quote delimiter.
requirementEG-DURABLE-KERNELVERIFIED42a0b101b111
7b7d4a0fb10f
a1d6b2bd5e03
c2dd4c98fe60
crates/eg-plan/src/federation_age.rs:231
crates/eg-plan/src/federation_age.rs:261
crates/eg-plan/src/federation_age.rs:279
EG-DURABLE-KERNEL-R024.2
The fan-out backend becomes a `MirrorTargetSpec` federation mirror target
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**The fan-out backend becomes a `MirrorTargetSpec` federation mirror target.** No fan-out-shaped mirror target existed on main (net-new); split producer-first: `.1` is the typed `FanOut` spec plus validation and registration refusal, `.2` is the dispatch entry point that drives a bound driver through it. | Verified per child; `.1` by unit tests on the spec's validation and unbound-refusal behavior.
requirementEG-DURABLE-KERNELVERIFIED3ddc77c97ef8
42a0b101b111
7a8f87ca8484
9a7674d1bae5
crates/eg-plan/src/mirror_target.rs:138
crates/eg-plan/src/mirror_target.rs:148
crates/eg-plan/src/mirror_target.rs:159
crates/eg-plan/src/mirror_target.rs:169
crates/eg-plan/src/mirror_target.rs:180
EG-DURABLE-KERNEL-R024.3
Cypher transpiler becomes a ForeignSourceSpec source
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Cypher transpiler becomes a ForeignSourceSpec source.** The existing external Cypher transpiler becomes a `ForeignSourceSpec` federation source in this repository. It extends the AGE binding from `EG-DURABLE-KERNEL-R024.1` to other Cypher backends. Code root: `crates/eg-plan`. | An integration test registers a non-AGE Cypher backend as a `ForeignSourceSpec` and runs a representative query.
requirementEG-DURABLE-KERNELLANDED4746fbcf1601
47a33ca58bb6
48abc77ce72e
9d6110b74214
EG-DURABLE-KERNEL-R024.4
Mirror target becomes a ForeignSourceSpec mirror target
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Mirror target becomes a ForeignSourceSpec mirror target.** The existing external mirror-target backend is implemented as a `ForeignSourceSpec` mirror target in this repository rather than remaining external. Code root: `crates/eg-plan`. | Verified by an integration test that registers the mirror target and exercises a representative mirror operation through it.
requirementEG-DURABLE-KERNELLANDED4746fbcf1601
48abc77ce72e
9d6110b74214
b1310a7964f2
EG-DURABLE-KERNEL-R024.5
Outbox-based mirror becomes a `MirrorTargetSpec` mirror target
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Outbox-based mirror becomes a `MirrorTargetSpec` mirror target.** `MirrorTargetSpec::Outbox { consumer }` names the outbox consumer this mirror reads committed rows as, reusing the outbox contract `EG-DURABLE-KERNEL-R001`/`R002`/`R052` already gives (committed-only delivery, a stable per-consumer cursor, idempotent replay after outage) instead of a separate ad hoc mirror loop; `crates/eg-plan/src/mirror_target.rs`'s `target_for` validates the spec (refusing an empty or padded consumer name) and returns the same unbound refusal as `FanOut`/`Named` until a driver that actually drains the consumer's cursor registers. Code root: `crates/eg-plan` (wire type in `crates/eg-types`). | Verified by unit tests: the spec round-trips over the wire, an empty or padded consumer name is refused before any binding is attempted, and a valid-but-unbound outbox target fails closed on `send` without reaching any target.
requirementEG-DURABLE-KERNELVERIFIED3a14159c3768
42a0b101b111
crates/eg-plan/src/mirror_target.rs:264
crates/eg-plan/src/mirror_target.rs:274
crates/eg-plan/src/mirror_target.rs:285
crates/eg-plan/src/mirror_target.rs:295
EG-DURABLE-KERNEL-R024.6
Brain-guarded backend becomes a ForeignSourceSpec source
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Brain-guarded backend becomes a ForeignSourceSpec source.** `ForeignSourceSpec::BrainGuarded { endpoint, guard_policy, query, id_field, score_field }` is PURE serde; `crates/eg-plan/src/federation_brain_guarded.rs` validates its shape then explicitly REFUSES with a named reason, since no bound guard-policy evaluation driver exists yet -- a well-formed spec is never run unguarded. Code root: `crates/eg-plan` (wire type in `crates/eg-types`). | Verified by unit tests: a well-formed spec is refused (not silently run unguarded), an empty guard policy is rejected before reaching that refusal, a score field matching the id field is rejected, and the wrong spec variant is rejected.
requirementEG-DURABLE-KERNELVERIFIED3a14159c3768
42a0b101b111
crates/eg-plan/src/federation_brain_guarded.rs:103
crates/eg-plan/src/federation_brain_guarded.rs:115
crates/eg-plan/src/federation_brain_guarded.rs:132
crates/eg-plan/src/federation_brain_guarded.rs:95
EG-DURABLE-KERNEL-R024.7
Trino backend becomes a ForeignSourceSpec source
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Trino backend becomes a ForeignSourceSpec source.** This repository implements the external Trino backend as a `ForeignSourceSpec` federation source. It reuses the guarded SQL federation transport that `EG-DURABLE-KERNEL-R024.1` binds for PostgreSQL/AGE. An unmerged prior attempt is a starting point: `crates/eg-plan/src/federation_trino.rs` in the ancestry of commit `bfa1cabd8494accef2ae87892bdd63d8358eec93`. Re-verify it against current main before landing. Code root: `crates/eg-plan`. | Verified by an integration test that registers the Trino backend as a `ForeignSourceSpec` and exercises a representative query through it.
requirementEG-DURABLE-KERNELVERIFIED42a0b101b111
7b7d4a0fb10f
c2dd4c98fe60
crates/eg-plan/src/federation_trino.rs:369
EG-DURABLE-KERNEL-R024.8
Spark job backend becomes a ForeignSourceSpec source
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Spark job backend becomes a ForeignSourceSpec source.** `ForeignSourceSpec::SparkBatch` already names a sealed, registered batch artifact. `crates/eg-plan/src/federation_spark.rs` adds the explicit per-registration half. The counterpart `federation_age`/`federation_trino` modules give their own backend. The registration requires `artifact_ref` to carry the `artifact://` scheme that a registration surface issues, never a caller-provided path. It then refuses explicitly, because no bound artifact-store driver exists yet. `federation::source_for`'s generic dispatch already refuses an inline `SparkBatch` spec through `Oq2Unbound`. Code root: `crates/eg-plan`. | Verified by unit tests: a well-formed spec is refused (not silently accepted), a caller-provided path lacking the `artifact://` scheme is rejected, an empty artifact id after the scheme is rejected, a score field matching the id field is rejected, and the wrong spec variant is rejected.
requirementEG-DURABLE-KERNELVERIFIED3a14159c3768
42a0b101b111
crates/eg-plan/src/federation_spark.rs:100
crates/eg-plan/src/federation_spark.rs:112
crates/eg-plan/src/federation_spark.rs:124
crates/eg-plan/src/federation_spark.rs:141
crates/eg-plan/src/federation_spark.rs:92
EG-DURABLE-KERNEL-R024.2.1
`MirrorTargetSpec::FanOut` is a typed, validated spec with registration refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`MirrorTargetSpec::FanOut` is a typed, validated spec with registration refusal.** `crates/eg-types/src/wire_query_modalities.rs` adds `MirrorTargetSpec::FanOut { targets }`, refusing an empty or duplicate-target spec; `crates/eg-plan/src/mirror_target.rs` adds the `MirrorTarget` trait and a `target_for` builder that validates the spec and returns an unbound refusal (no driver bound yet), mirroring `federation::source_for`'s `Oq2Unbound` pattern for Trino/Cypher/SparkBatch before their dedicated backends existed. | Verified by unit tests: the spec round-trips over the wire, an empty or duplicate-target fan-out is refused before any binding is attempted, and a valid-but-unbound fan-out fails closed on `send` without reaching any target.
requirementEG-DURABLE-KERNELVERIFIED3ddc77c97ef8
42a0b101b111
crates/eg-plan/src/mirror_target.rs:138
crates/eg-plan/src/mirror_target.rs:148
crates/eg-plan/src/mirror_target.rs:159
crates/eg-plan/src/mirror_target.rs:169
EG-DURABLE-KERNEL-R024.2.2
`MirrorTargetRegistry` is the one entry point a mirror-sink driver registers under and the outbox fan-out path resolves a name through
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`MirrorTargetRegistry` is the one entry point a mirror-sink driver registers under and the outbox fan-out path resolves a name through.** `crates/eg-plan/src/mirror_target.rs` adds `MirrorTargetRegistry` (`register`/`send_to`), mirroring `federation::ForeignSourceRegistry::register_spec`/`resolve`: an invalid spec is refused at registration time, a registered name resolves through the real `target_for` validate-and-dispatch path, and an unregistered name is a distinct clean error. | Verified by unit tests: an invalid spec is refused at registration (nothing is stored), a registered fan-out's `send_to` reaches the real unbound-driver refusal through the registry, and an unknown name reports a distinct "not registered" error.
requirementEG-DURABLE-KERNELVERIFIED7a8f87ca8484
9a7674d1bae5
crates/eg-plan/src/mirror_target.rs:180
crates/eg-plan/src/mirror_target.rs:189
crates/eg-plan/src/mirror_target.rs:207
EG-DURABLE-KERNEL-R025
Raft admin follows the current leader and traces are leader-agnostic
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Raft admin follows the current leader and traces are leader-agnostic.** A member-add administrative request follows the current leader to completion instead of returning a forward-to-leader response, the causal trace ring captures events across all nodes rather than only the calling thread so an election on another node is still traceable, and raft cluster tests tolerate a legal leader election instead of assuming a fixed leader. | Verified by a member-add test against a cluster undergoing an election and by raft tests that pass regardless of which node holds leadership.
requirementEG-DURABLE-KERNELVERIFIED05bf09d8eee4
a676823d2b54
src/raft/tests.rs:2794
EG-DURABLE-KERNEL-R026
Auth modes share one principal and RBAC evaluation path
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Auth modes share one principal and RBAC evaluation path.** The none, local, and external authentication modes all resolve through a single principal and RBAC evaluation path. The local mode provides a native user store with registration, login, password management, an administrative UI, and backing SQL tables, while external mode supports OIDC, SAML, LDAP, Active Directory, and SCIM authorities. | Verified by the auth-modes test scenario asserting all three modes resolve to the same internal principal and RBAC evaluator, with mode-specific negative cases denied.
requirementEG-DURABLE-KERNELVERIFIED48abc77ce72e
a676823d2b54
crates/eg-types/src/identity/tests/auth.rs:255
EG-DURABLE-KERNEL-R027
Schema repair uses a reserved two-person approval lease (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Schema repair uses a reserved two-person approval lease (rollup).** Split into EG-DURABLE-KERNEL-R027.1 (model types), EG-DURABLE-KERNEL-R027.2 (dispatch wiring) and EG-DURABLE-KERNEL-R027.3 (raft catalog registration); landed when all three are landed. | Verified by each child requirement's own verification.
requirementEG-DURABLE-KERNELVERIFIED2a4982e949a3
3c618dd255ba
42a0b101b111
6e52c9bcfb57
a676823d2b54
crates/eg-types/src/control_lease/tests.rs:174
crates/eg-types/src/governed_change/tests.rs:110
crates/eg-types/src/governed_change/tests.rs:148
crates/eg-types/src/governed_change/tests.rs:54
crates/eg-types/src/governed_change/tests.rs:77
EG-DURABLE-KERNEL-R027.1
Governed-change model types
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Governed-change model types.** `eg-types` defines the two-person governed-change ledger: `GovernedChange`, `GovernedLedger`, `GovernedActor` and the propose/approve/revoke/consume state machine. It reserves the `governed.` control-lease prefix against the generic lease path. | eg-types unit tests verify five refusals. Self-approval is denied and a delegated approver is refused. A generic control lease of a governed kind is refused. An altered digest is rejected. A consumed or revoked change cannot be reused.
requirementEG-DURABLE-KERNELVERIFIED3c618dd255ba
42a0b101b111
6e52c9bcfb57
d768ee483940
crates/eg-types/src/control_lease/tests.rs:174
crates/eg-types/src/governed_change/tests.rs:110
crates/eg-types/src/governed_change/tests.rs:148
crates/eg-types/src/governed_change/tests.rs:54
crates/eg-types/src/governed_change/tests.rs:77
EG-DURABLE-KERNEL-R027.2
Governed-change dispatch wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Governed-change dispatch wiring.** Depends on EG-DURABLE-KERNEL-R027.1. The wire protocol, capability policy and isolation layers serve propose/approve/revoke/get/list through the request boundary, with the acting identity server-stamped from the verified request context rather than trusted from the request body. | Verified by dispatch tests sent through the real request boundary, covering self-approval refusal, a delegated approver refusal, and a forged actor in the request body being overwritten.
requirementEG-DURABLE-KERNELVERIFIED2a4982e949a3
3c618dd255ba
42a0b101b111
cd899a5c8c20
src/server/dispatch/governed/tests.rs:109
src/server/dispatch/governed/tests.rs:59
EG-DURABLE-KERNEL-R027.3
Governed-change raft catalog registration
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Governed-change raft catalog registration.** Depends on EG-DURABLE-KERNEL-R027.2. The native raft method catalog records `GovernedChange` in the `Identity` domain, the same replication class as `RbacAdmin`/`RbacElevation`/`Identity`; without this record `NativeMutationCommand::from_public_method` refuses the method outright instead of sealing it into a native consensus command. | Verified by a round-trip test sealing a `GovernedChange` method into a native command and opening it back, asserting it resolves to the `Identity` domain.
requirementEG-DURABLE-KERNELVERIFIED3c618dd255ba
42a0b101b111
cd899a5c8c20
src/raft/command/native/tests.rs:280
EG-DURABLE-KERNEL-R028
WorkItem lifecycle test uses a consistent verified tenant
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**WorkItem lifecycle test uses a consistent verified tenant.** The work-item metadata CAS lifecycle test signs its request as the same tenant it names in the work-item body, and the tenant guard in ClaimWorkItem denies a request naming a foreign tenant rather than allowing a mismatched signer and body tenant to pass. | Verified by the focused work-item lifecycle test surviving a restart under the corrected tenant fixture and by a negative case proving a foreign-tenant claim is denied.
requirementEG-DURABLE-KERNELSPECIFIED15451958704f
a676823d2b54
EG-DURABLE-KERNEL-R029
Universal read-RLS gate checks the current TsScan dispatch path
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Universal read-RLS gate checks the current TsScan dispatch path.** scripts/check_universal_read_rls.py verifies tenant scoping on the series executor's actual dispatch path through exec/dispatch.rs into exec/tsscan.rs, confirming SeriesKey::new(tenant, graph, series) and range-scoped access, rather than checking a superseded code path. | Verified by running the universal read-RLS gate against the current executor layout and confirming it detects the scoped SeriesKey and range-scoped call.
requirementEG-DURABLE-KERNELLANDED0447684dce7b
a676823d2b54
EG-DURABLE-KERNEL-R030
Reserved RBAC elevation lease kind cannot be issued generically
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Reserved RBAC elevation lease kind cannot be issued generically.** An unrestricted principal can issue any non-reserved control lease kind, but the rbac.elevation kind remains globally reserved for the dedicated two-person elevation flow and cannot be issued through the generic lease path by any principal, including an unrestricted one. | Verified by a per-principal kind-policy test asserting unrestricted principals can issue non-reserved kinds while an attempt to issue rbac.elevation generically is denied.
requirementEG-DURABLE-KERNELSPECIFIED3157bcbb4ac2
a676823d2b54
EG-DURABLE-KERNEL-R031
Audit append supports tenant-scoped idempotent reservation
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Audit append supports tenant-scoped idempotent reservation.** AuditAppend provides a tenant-scoped, idempotent reservation in a pending state, followed by a linked terminal outcome and reconciliation if the outcome is interrupted. It rejects a request with a missing audit class or when the durable audit writer is unavailable, and binds to verified service-level claims of the caller. | Verified by tests covering duplicate reservation requests, writer-unavailable rejection, missing-class rejection, and reconciliation after a crash between reservation and outcome.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
2cc878fb8938
5c83a1967042
8628416b1736
8e288da667fc
src/redb_store/operation_audit_tests.rs:278
src/server/dispatch/graph_pipeline/dispatch_helpers.rs:687
src/server/mutation_batch/tests.rs:1394
EG-DURABLE-KERNEL-R031.1
The audit append accounts the serving write version
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**The audit append accounts the serving write version.** After an audit append, the serving write version equals the authoritative scope version. Each attempt commits one maintenance batch under a unique attempt id. The kernel advances the authoritative version by one per committed batch, maintenance included. The served append accounts that commit in the serving projection. A governed ingest stamps its graph version expectation from the serving version. That write commits after the append. It never meets the +1 skew the kernel refuses as `STALE_VERSION`. | One test exercises the served append. It performs one audit append, then the write stamped from the serving version. It asserts the serving and authoritative versions agree. It asserts the stamped write commits through the kernel version check. It asserts a replayed append advances the serving version by exactly one. After that, the two agree again.
requirementEG-DURABLE-KERNELVERIFIED92f13033b00a
src/server/dispatch/graph_pipeline/dispatch_helpers.rs:687
EG-DURABLE-KERNEL-R031.2
Writes are stamped from the authoritative scope version
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Writes are stamped from the authoritative scope version.** A durable commit can advance a graph's mutation scope without the serving projection accounting it. The authoritative version read then raises the serving write version to the durable one, once, before anything stamps a version from it. SourceIngest stamps its batch from that read. A fresh single-writer ingest after such a commit therefore commits. It never meets the kernel's `STALE_VERSION` refusal. A serving version ahead of its authority is still refused. | Test `the_authoritative_version_accounts_a_durable_write_the_projection_missed` in `src/server/mutation_batch/tests.rs` puts the projection two versions behind the durable scope. The read returns the durable version and the projection equals it. A projection ahead of its authority refuses.
requirementEG-DURABLE-KERNELVERIFIED5c83a1967042
aeb9c998476a
src/server/mutation_batch/tests.rs:1394
EG-DURABLE-KERNEL-R032
Native primary-key fast path bypasses the SQL planner
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Native primary-key fast path bypasses the SQL planner.** Primary-key point operations on the pgwire, MySQL and MSSQL listeners run through a native fast path. The fast path skips DataFusion query planning. It applies the same authorization and audit checks as the planned path. A hybrid storage provider unions a hot redb tier with a cold eg-lake tier under compaction. It relies on the write-latency reduction in EG-DURABLE-KERNEL-R016. The net-new rule splits this row, and `.1` is the typed model. The rollup is LANDED only when every child is. | A differential test compares fast-path and planned-path results for primary-key operations. A compaction test runs over the hot/cold union provider.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
49c43fca68d0
crates/eg-types/src/fast_path.rs:109
crates/eg-types/src/fast_path.rs:118
crates/eg-types/src/fast_path.rs:81
crates/eg-types/src/fast_path.rs:97
EG-DURABLE-KERNEL-R032.1
PrimaryKeyOperation and FastPathDecision are typed, and routing refuses rather than silently bypassing checks
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**PrimaryKeyOperation and FastPathDecision are typed, and routing refuses rather than silently bypassing checks.** `crates/eg-types/src/fast_path.rs` defines a closed `PrimaryKeyOperation` enum and a `route` decision function whose `Ok` result always carries authorization-checked and audit-checked as true, and which refuses (not downgrades) an unauthorized operation. | Verified by unit tests: operation round-trips through its wire name, an authorized operation routes with both checks true, and an unauthorized operation is refused for every operation variant.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
49c43fca68d0
crates/eg-types/src/fast_path.rs:109
crates/eg-types/src/fast_path.rs:118
crates/eg-types/src/fast_path.rs:81
crates/eg-types/src/fast_path.rs:97
EG-DURABLE-KERNEL-R033
Hot-store engine choice is evaluated against captured workloads
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-store engine choice is evaluated against captured workloads.** An evaluation compares redb, fjall and RocksDB behind the existing storage interface. It uses captured traffic from representative application workloads and a finance workload. An architecture decision record keeps the outcome. Split per the net-new rule (no engine-comparison type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A benchmark report compares the three engines on the same captured workloads. The architecture decision record is published.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
be3fad3f9840
crates/eg-types/src/hot_store_engine.rs:125
crates/eg-types/src/hot_store_engine.rs:140
crates/eg-types/src/hot_store_engine.rs:157
crates/eg-types/src/hot_store_engine.rs:168
crates/eg-types/src/hot_store_engine.rs:190
EG-DURABLE-KERNEL-R033.1
HotStoreEngine, WorkloadProfile, and BenchmarkResult are typed. Winner selection refuses rather than silently defaulting
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**HotStoreEngine, WorkloadProfile, and BenchmarkResult are typed. Winner selection refuses rather than silently defaulting.** `crates/eg-types/src/hot_store_engine.rs` defines closed engine/workload enums and a validated `BenchmarkResult`. Its `select_winner` decision refuses when no captured result matches the requested workload. | Unit tests verify wire-name round trips and refusal of non-positive throughput. They verify highest-throughput selection for a workload and refusal when no result matches.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
be3fad3f9840
crates/eg-types/src/hot_store_engine.rs:125
crates/eg-types/src/hot_store_engine.rs:140
crates/eg-types/src/hot_store_engine.rs:157
crates/eg-types/src/hot_store_engine.rs:168
crates/eg-types/src/hot_store_engine.rs:190
EG-DURABLE-KERNEL-R034
Cross-store atomicity is proven and scoped to mixed transactions
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Cross-store atomicity is proven and scoped to mixed transactions.** Cross-store atomicity has an architecture decision record and an implementation such that traffic confined to a single store never enters the cross-store commit path, and the mechanism survives a hard process kill without partial application. Split per the net-new rule (no transaction-scope type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by a crash-consistency test that kills the process mid-commit and a concurrency anomaly corpus exercising the cross-store path.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
5dc0a601b2cf
crates/eg-types/src/cross_store_scope.rs:65
crates/eg-types/src/cross_store_scope.rs:79
crates/eg-types/src/cross_store_scope.rs:85
crates/eg-types/src/cross_store_scope.rs:94
EG-DURABLE-KERNEL-R034.1
TransactionScope and CommitPath are typed, and a single-store scope structurally can never map to the cross-store commit path
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**TransactionScope and CommitPath are typed, and a single-store scope structurally can never map to the cross-store commit path.** `crates/eg-types/src/cross_store_scope.rs` defines a closed `TransactionScope` enum, a classifier that refuses an empty (zero-store) transaction, and a pure, total `commit_path_for` mapping where `SingleStore` always yields `Direct` and `CrossStore` always yields `CrossStoreCoordinated`. | Verified by unit tests: scope variants round-trip through their wire name, classifying zero stores is refused, one store classifies as single-store and more than one as cross-store, and the commit-path mapping is deterministic per scope.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
5dc0a601b2cf
crates/eg-types/src/cross_store_scope.rs:65
crates/eg-types/src/cross_store_scope.rs:79
crates/eg-types/src/cross_store_scope.rs:85
crates/eg-types/src/cross_store_scope.rs:94
EG-DURABLE-KERNEL-R035
PostgreSQL wire protocol reaches operational and dump/restore parity
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**PostgreSQL wire protocol reaches operational and dump/restore parity.** The PostgreSQL-compatible wire surface supports pg_dump and pg_restore, exposes a replication protocol, and provides operational parity including pg_stat views, pg_locks, EXPLAIN, query cancellation, and pooler transaction mode. Split per the net-new rule (no operational-surface tracking type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by a compatibility test suite running pg_dump and pg_restore round trips and exercising each operational surface against the PostgreSQL wire listener.
requirementEG-DURABLE-KERNELSPECIFIED1ef84395fa69
de5f096bc0fd
EG-DURABLE-KERNEL-R036
Mirror sinks reach fan-out parity and include Postgres table mirroring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Mirror sinks reach fan-out parity and include Postgres table mirroring.** EG mirror sinks reach parity with the existing fan-out mirror backend. They provide a durable per-mirror cursor, replay after outage, reconciliation and a non-empty-default guard. They also mirror SQL user tables to a real PostgreSQL target. Every mirror target registers in the attached-source registry. Split per the net-new rule, because main had no sink-side cursor type. `.1` is the typed model. This rollup is LANDED only once every child is. | Verified by outage/replay/reconcile tests against a mirror sink. A PostgreSQL-target mirroring test confirms registration in the attached-source registry.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
d833c1d987a6
crates/eg-types/src/mirror_sink.rs:111
crates/eg-types/src/mirror_sink.rs:121
crates/eg-types/src/mirror_sink.rs:130
crates/eg-types/src/mirror_sink.rs:138
crates/eg-types/src/mirror_sink.rs:147
EG-DURABLE-KERNEL-R036.1
MirrorSinkKind and MirrorCursor are typed, and the cursor refuses an empty-string position
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**MirrorSinkKind and MirrorCursor are typed, and the cursor refuses an empty-string position.** `crates/eg-types/src/mirror_sink.rs` defines the closed fan-out/postgres sink kind and a cursor whose constructor and advance method both refuse an empty position, so a mirror cursor can never silently start or resume from the default/empty string. | Verified by unit tests: sink-kind variants round-trip through their wire name, cursor construction refuses an empty position for both kinds, advancing refuses an empty next-position, and a refused advance leaves the cursor's prior position unchanged.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
d833c1d987a6
crates/eg-types/src/mirror_sink.rs:111
crates/eg-types/src/mirror_sink.rs:121
crates/eg-types/src/mirror_sink.rs:130
crates/eg-types/src/mirror_sink.rs:138
crates/eg-types/src/mirror_sink.rs:147
EG-DURABLE-KERNEL-R035.1
PgOperationalSurface and a fail-closed PgCompatibilityMatrix are typed
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**PgOperationalSurface and a fail-closed PgCompatibilityMatrix are typed.** `crates/eg-types/src/pg_operational_surface.rs` defines the closed set of required PostgreSQL operational surfaces (pg_dump, pg_restore, replication, pg_stat views, pg_locks, EXPLAIN, query cancellation, pooler transaction mode) and a matrix that starts fail-closed and refuses a parity check naming any surface not explicitly declared supported. | Verified by unit tests: every surface round-trips through its wire name, a fresh matrix reports every surface unsupported, a parity check is refused and names exactly the missing surfaces, and the check succeeds once every surface is declared.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
de5f096bc0fd
crates/eg-types/src/pg_operational_surface.rs:105
crates/eg-types/src/pg_operational_surface.rs:131
crates/eg-types/src/pg_operational_surface.rs:140
crates/eg-types/src/pg_operational_surface.rs:153
EG-DURABLE-KERNEL-R035.2
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define conditional-write intent through separate authorized MutationBatch graph endpoint. | Typed test shows conditional-write request/response structure and MutationBatch routing.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R035.3
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Link schema mapping and read compatibility with write authorization. | Served test maps external-app relational schema to graph edges and proves read consistency.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R035.4
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Route external-app mutations to authorized graph MutationBatch, never to projection tables. | Served test routing proves projections are never writable even with grants.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R035.5
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Deny projection writes and accept only graph MutationBatch paths. | Test shows write to projection table is refused even when caller has write grant.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R035.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** External app submits MutationBatch; authorized graph mutation is reflected immediately on projection read. | Integration test proves write-through: external app commits through MutationBatch, projection read shows the change, subsequent relational reads return consistent view.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R037
Workload classifier routes point operations around the SQL planner
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Workload classifier routes point operations around the SQL planner.** A workload classifier at every wire listener, including native, RESP, pgwire, MySQL, and MSSQL, routes point and data-structure operations to the native KvStore/GraphCore path without allocating a DataFusion session, while SQL statements route to the planner; the classification is cached per prepared statement. Split per the net-new rule (no classifier type existed on main): `.1` is the typed model. Rollup: LANDED only once every child is. | Verified by a route test confirming no DataFusion session is created for classified point/structure operations and a cache test confirming classification is reused for a repeated prepared statement.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
4ed831ced92f
add3fe5b1d67
crates/eg-types/src/workload_class.rs:110
crates/eg-types/src/workload_class.rs:117
crates/eg-types/src/workload_class.rs:126
crates/eg-types/src/workload_class.rs:136
crates/eg-types/src/workload_class.rs:144
EG-DURABLE-KERNEL-R038
KV namespaces declare an explicit, enforced durability class
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**KV namespaces declare an explicit, enforced durability class.** Each KV namespace or table declares a durability class of ephemeral, meaning in-memory with TTL and no durable log; async, meaning group commit with a measured loss window of at most 100 milliseconds; or sync, the default, meaning commit before acknowledgment. The declared class is visible and never silently downgraded, the measured loss window is exported, and authorization plus HMAC-protected keyspace isolation apply in every class. Split per the net-new rule (no `DurabilityClass` type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by kill-point tests per class and a measurement test confirming the exported async loss window stays within the declared bound.
requirementEG-DURABLE-KERNELSPECIFIED1ef84395fa69
2146c76bc6f8
EG-DURABLE-KERNEL-R038.1
`DurabilityClass` is a typed enum with a declared loss-window bound and a refusal for an unrecognized name
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`DurabilityClass` is a typed enum with a declared loss-window bound and a refusal for an unrecognized name.** `crates/eg-types/src/durability_class.rs` defines `ephemeral`/`async`/`sync` as a closed enum (`sync` the default), exposes `Async`'s 100 ms loss-window ceiling, and parses a namespace's declared class name without ever silently downgrading an unrecognized one to a default. | Verified by unit tests: each class round-trips through its lowercase wire name, `sync` is the default, an unrecognized class name is refused (not downgraded), and a measured async loss window is accepted at/under 100 ms and refused over it.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
2146c76bc6f8
crates/eg-types/src/durability_class.rs:183
crates/eg-types/src/durability_class.rs:199
crates/eg-types/src/durability_class.rs:205
crates/eg-types/src/durability_class.rs:214
crates/eg-types/src/durability_class.rs:225
EG-DURABLE-KERNEL-R038.2
The write path's durability selection: `write_plan`/`refuse_if_durable_log_write` are the one entry point a write admission calls
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**The write path's durability selection: `write_plan`/`refuse_if_durable_log_write` are the one entry point a write admission calls.** `DurabilityClass::write_plan` decides whether a write waits for its own durable commit and how wide a group-commit batch window it admits; `refuse_if_durable_log_write` refuses a durable (redb) log append on behalf of an `ephemeral` namespace, which declares none. The real storage-kernel write-admission call site threading these in is further work. | Verified by unit tests: `sync`'s plan waits with no batch window, `async`'s plan does not wait and batches within its declared loss window, `ephemeral`'s plan neither waits nor batches, an ephemeral durable-log append is refused, and sync/async durable-log appends are allowed.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1a1ef47cb448
crates/eg-types/src/durability_class.rs:251
crates/eg-types/src/durability_class.rs:259
crates/eg-types/src/durability_class.rs:267
crates/eg-types/src/durability_class.rs:275
crates/eg-types/src/durability_class.rs:284
EG-DURABLE-KERNEL-R037.1
`WorkloadClass` is a typed classifier with a refusal for an unrecognized operation kind
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`WorkloadClass` is a typed classifier with a refusal for an unrecognized operation kind.** `crates/eg-types/src/workload_class.rs` defines `Point`/`Structure`/`Sql`, a `bypasses_sql_planner` predicate, and `classify` over a wire listener's declared operation-kind name, refusing any name no rule recognizes rather than defaulting it to either path. | Verified by unit tests: point and structure operation kinds classify and report they bypass the SQL planner, `sql` classifies and reports it does not, and an unrecognized operation-kind name is refused.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
4ed831ced92f
crates/eg-types/src/workload_class.rs:110
crates/eg-types/src/workload_class.rs:117
crates/eg-types/src/workload_class.rs:97
EG-DURABLE-KERNEL-R037.2
`route` is the one dispatch entry point a wire listener calls to decide whether to allocate a DataFusion session
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`route` is the one dispatch entry point a wire listener calls to decide whether to allocate a DataFusion session.** `route(operation_kind)` classifies the operation and returns a `DispatchRoute` whose `allocate_datafusion_session` field is the dispatcher's one gate — never re-derived per listener by comparing against `WorkloadClass::Sql` directly. Splicing this call into each of the five listeners' real dispatch loops is further work. | Verified by unit tests: point/structure operations route with no session allocation, `sql` routes with session allocation, and an unrecognized operation kind's classifier refusal propagates through `route`.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
add3fe5b1d67
crates/eg-types/src/workload_class.rs:126
crates/eg-types/src/workload_class.rs:136
crates/eg-types/src/workload_class.rs:144
EG-DURABLE-KERNEL-R039
In-memory data structures rebuild from the redb durability log
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**In-memory data structures rebuild from the redb durability log.** Hash, sorted-set, list, and set structures are held in memory as working state for ephemeral and async namespaces, with redb as the sole durability log; native atomic primitives include INCRBY with expiry, SET NX EX, CAS-based leases, a token bucket, a bounded counter, and a work-claim operation. On recovery, the in-memory tier rebuilds entirely from the redb log, which remains the only durability authority. Split per the net-new rule (no structure/primitive durability-declaration type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by a concurrent linearizability test on the atomic primitives and a recovery test that rebuilds the in-memory tier from the redb log after restart.
requirementEG-DURABLE-KERNELSPECIFIED1ef84395fa69
a7372171174e
EG-DURABLE-KERNEL-R039.1
Every in-memory structure and atomic primitive is typed and structurally declares redb as its sole durability authority
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Every in-memory structure and atomic primitive is typed and structurally declares redb as its sole durability authority.** `crates/eg-types/src/atomic_primitive.rs` defines the closed data-structure and atomic-primitive kinds and a `DurabilityDeclaration` whose `redb_is_sole_authority` flag is always true by construction (not caller-settable), with `declare_all` enumerating every structure and primitive for a namespace. | Verified by unit tests: every kind round-trips through its wire name, a declaration always reports redb as sole authority regardless of subject or namespace, and `declare_all` covers every structure and primitive exactly once per namespace with no duplicates.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
a7372171174e
crates/eg-types/src/atomic_primitive.rs:120
crates/eg-types/src/atomic_primitive.rs:161
crates/eg-types/src/atomic_primitive.rs:176
EG-DURABLE-KERNEL-R039.2
Native control-lease consumption checks expiry inside its durable transaction
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Native control-lease consumption checks expiry inside its durable transaction.** Reuse the native record applier and its engine-owned mutation timestamp, sampled after the graph lock and preserved for replay. This does not claim a wall-clock check at physical commit. An active lease may become consumed only strictly before both expiry timestamps. At or after either deadline, return the existing conflict outcome without changing the row or revision. Revocation and explicit expiry remain legal after a deadline. The engine uses its mutation time and existing lease store. | The native-record dispatch test covers live consumption, exact and elapsed expiry, and unchanged rows on refusal. Row-applier tests cover single use and revocation after expiry.
requirementEG-DURABLE-KERNELSPECIFIEDsrc/redb_store/work_item/control_lease/tests.rs:246
EG-DURABLE-KERNEL-R039.3
Atomic pending-call envelope storage and consumption
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Atomic pending-call envelope storage and consumption.** A reserved control lease binds an immutable envelope to one claimed WorkItem. Registration checks native claim provenance, revision, live worker fence and metadata preimage. It writes a protected pending lease reference in the same transaction. Consumption checks native claim provenance, the exact envelope, the pending reference and the current WorkItem revision and metadata. It then consumes the lease and clears the reference atomically. The served pending kind also requires existing WorkItem-write authority; lease-write alone cannot mutate a WorkItem. A missing transition target refuses at the served precheck before dispatch, so concurrent registration cannot bypass kind authorization. Existing-row ordinary leases retain their behavior. Parent/child references are immutable caller provenance, not authenticated hierarchy. This storage primitive proves neither human approval nor permission to execute. | Native tests cover registration, single consumption, changed preimages, wrong tenant, stale fence, expiry and replay without partial row writes. Generated contracts expose the typed optional fields.
requirementEG-DURABLE-KERNELSPECIFIEDcrates/eg-types/src/control_lease/tests.rs:191
crates/eg-types/src/control_lease/tests.rs:225
src/redb_store/work_item/control_lease/tests.rs:424
src/redb_store/work_item/control_lease/tests.rs:452
src/redb_store/work_item/control_lease/tests.rs:477
EG-DURABLE-KERNEL-R039.4
Atomic plan-bound pending consumption
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Atomic plan-bound pending consumption.** Registration may bind an exact plan lease preimage immutably to the pending envelope. The plan must be active, belong to the same tenant, and cover the pending lifetime. Its kind is deployment-configured. Consumption must present the identical registered pair; omission or substitution refuses. The native transaction checks plan revision, kind, grant and expiry before consuming both leases and clearing the WorkItem reference. Paired requests remain unavailable through the served handler until Arbora provides authority composition. This row owns storage only. Existing bounds limit each grant or metadata preimage to 64 KiB and each identifier or kind to 512 bytes. Pending lifetime cannot exceed 24 hours. Consumption changes exactly three rows in one transaction. The owner benchmark is `benches/redb_write_latency_bench.rs`; its paired-consumption scenario and measurements remain pending. Existing commit-path results do not prove paired-call performance. Unpaired records retain their storage behavior. No human approval or execution authority is implied. | Native tests cover three-row consumption, omitted or changed preimages, expiry, revocation and replay. Every refusal preserves all three rows.
requirementEG-DURABLE-KERNELSPECIFIED9cff8714dbf0
e4ca61b2ecc0
crates/eg-types/src/control_lease/tests.rs:237
src/redb_store/work_item/control_lease/tests/plan_consumption.rs:119
src/redb_store/work_item/control_lease/tests/plan_consumption.rs:154
src/redb_store/work_item/control_lease/tests/plan_consumption.rs:175
src/redb_store/work_item/control_lease/tests/plan_consumption.rs:229
EG-DURABLE-KERNEL-R039.4.1
Functional plan-bound pending storage
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Functional plan-bound pending storage.** Implement the parent's immutable same-tenant plan preimage, bounded lifetime, exact registered-pair comparison and atomic three-row consumption. Preserve unchanged rows on omission, substitution, expiry, revocation or replay refusal. Preserve unpaired behavior. Paired served requests remain unavailable until Arbora authority composition exists. This child establishes no human approval, execution authority or performance result. | Native transaction tests and the served-entry refusal test pass. Generated contracts and codec artifacts match. Tests retain the parent's existing preimage and lifetime bounds.
requirementEG-DURABLE-KERNELSPECIFIEDcrates/eg-types/src/control_lease/tests.rs:237
src/redb_store/work_item/control_lease/tests/plan_consumption.rs:119
src/redb_store/work_item/control_lease/tests/plan_consumption.rs:154
src/redb_store/work_item/control_lease/tests/plan_consumption.rs:175
src/redb_store/work_item/control_lease/tests/plan_consumption.rs:229
EG-DURABLE-KERNEL-R039.4.2
Paired-consumption performance qualification
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Paired-consumption performance qualification.** Extend `benches/redb_write_latency_bench.rs` with the parent's paired-consumption scenario. Measure the existing 64 KiB preimage, 512-byte identifier, 24-hour lifetime and three-row transaction bounds through the actual durable path. Report the benchmark configuration and measured commit-phase latency. This child remains pending; existing generic commit-path measurements do not establish paired-call performance. | The paired benchmark scenario and its reproducible measurement receipt exist. No latency threshold or measurement is asserted before that evidence.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R040
Pipelined requests commit as a single batch
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Pipelined requests commit as a single batch.** A RESP pipeline or a pgwire extended-protocol batch is admitted once and committed as a single group commit, returning the same number of ordered replies as requests in the batch. Split per the net-new rule (no batch-admission type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by a test sending a pipelined batch and confirming one admission decision, one commit, and correctly ordered per-request replies.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
726ee0a3eadf
crates/eg-types/src/pipeline_batch.rs:101
crates/eg-types/src/pipeline_batch.rs:112
crates/eg-types/src/pipeline_batch.rs:78
crates/eg-types/src/pipeline_batch.rs:92
EG-DURABLE-KERNEL-R041
SQL plan cache keyed by statement digest and schema version
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**SQL plan cache keyed by statement digest and schema version.** The engine caches repeated parameterized SQL execution plans keyed by statement digest and schema version, and invalidates cached plans using the existing dependency clock rather than introducing a separate cache mechanism. Split per the net-new rule (no plan-cache type existed on main): `.1` is the typed model. Rollup: LANDED only once every child is. | Route and invalidation tests for the native plan cache (KG-14) confirm cache hits are deterministic to the digest and schema version and invalidate correctly when the dependency clock advances.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
88496b615981
aaf7113fe427
crates/eg-types/src/plan_cache_key.rs:142
crates/eg-types/src/plan_cache_key.rs:150
crates/eg-types/src/plan_cache_key.rs:157
crates/eg-types/src/plan_cache_key.rs:170
crates/eg-types/src/plan_cache_key.rs:178
EG-DURABLE-KERNEL-R041.1
`PlanCacheKey`/`PlanCacheLookup` are a typed key and a pure lookup decision, refusing to reuse a plan whose schema version has gone stale
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`PlanCacheKey`/`PlanCacheLookup` are a typed key and a pure lookup decision, refusing to reuse a plan whose schema version has gone stale.** `crates/eg-types/src/plan_cache_key.rs` defines `PlanCacheKey { statement_digest: Digest256, schema_version: u64 }` and a `lookup` function returning `Hit`/`Miss`/`StaleSchema`, never silently reusing a candidate compiled for a different statement or an earlier schema version. | Verified by unit tests: a repeated statement under the same schema version hits, nothing cached misses, a schema-version advance reports `StaleSchema` with the cached version, a candidate for a different statement digest is treated as a miss, and the key is deterministic across separate digest computations of the same statement.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
aaf7113fe427
crates/eg-types/src/plan_cache_key.rs:142
crates/eg-types/src/plan_cache_key.rs:150
crates/eg-types/src/plan_cache_key.rs:157
crates/eg-types/src/plan_cache_key.rs:170
crates/eg-types/src/plan_cache_key.rs:178
EG-DURABLE-KERNEL-R041.2
`PlanCache::prepare` is the one entry point a SQL statement handler calls at prepare time
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`PlanCache::prepare` is the one entry point a SQL statement handler calls at prepare time.** Generic over the compiled plan type, `prepare` reuses a cached plan on `Hit` without invoking the caller's compile closure, and compiles (then caches, replacing any stale entry) on `Miss`/`StaleSchema`. Splicing a call to it into the real pgwire/MySQL/MSSQL prepare handlers, and keying `schema_version` to the engine's existing dependency clock, is further work. | Verified by unit tests: a repeated `prepare` for the same digest and schema version does not invoke the compile closure a second time, and a schema-version advance invokes it again and replaces the stale cached plan rather than keeping both.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
88496b615981
crates/eg-types/src/plan_cache_key.rs:185
crates/eg-types/src/plan_cache_key.rs:207
EG-DURABLE-KERNEL-R040.1
PipelineBatch and BatchCommitDecision are typed, proving one admission maps to exactly one commit with order-preserving replies
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**PipelineBatch and BatchCommitDecision are typed, proving one admission maps to exactly one commit with order-preserving replies.** `crates/eg-types/src/pipeline_batch.rs` defines a closed `PipelineProtocol` (RESP/pgwire-extended), a batch constructor that refuses an empty request list, and an `admit` function whose result always reports the exact request count and the replies in the exact original order. | Verified by unit tests: protocol variants round-trip through their wire name, constructing an empty batch is refused for both protocols, a non-empty batch constructs successfully, and admitting a multi-request batch reports the exact count with replies in the original order.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
726ee0a3eadf
crates/eg-types/src/pipeline_batch.rs:101
crates/eg-types/src/pipeline_batch.rs:112
crates/eg-types/src/pipeline_batch.rs:78
crates/eg-types/src/pipeline_batch.rs:92
EG-DURABLE-KERNEL-R042
Benchmark gate defines and proves performance superiority claims
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Benchmark gate defines and proves performance superiority claims.** A published benchmark suite must define each performance claim and publish its configuration. The suite covers the YCSB workloads A to F, TPC-C and LDBC SNB Interactive. It also covers one converged graph, vector, SQL and time-series workload. `.1` is the typed model. `.100` binds complete measured input-token throughput, per-query cost and startup exclusion to the benchmark claim. Children `.2` to `.6` define the cross-modal, KV-cache tiering, ingest and wire protocol benchmarks. Rollup: LANDED only once every child is. | The gate accepts a superiority claim only with its published configuration and a passing measured result. `.100` requires reproducible served arithmetic and refuses missing or incomparable measurements.
requirementEG-DURABLE-KERNELSPECIFIED1ef84395fa69
9eac21608e67
EG-DURABLE-KERNEL-R042.1
`BenchmarkClaim` is a typed report record that is only accepted as a superiority claim when published with its configuration and a passing result
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`BenchmarkClaim` is a typed report record that is only accepted as a superiority claim when published with its configuration and a passing result.** `crates/eg-types/src/benchmark_claim.rs` names the five required comparisons, defines `BenchmarkClaim { comparison, configuration, measured_result, passed }`, and `accept_as_superiority_claim` refuses a missing configuration, a missing measured result, or a non-passing result — never accepting an incomplete or failing report as a claim. | Verified by unit tests: a published passing report is accepted; a missing configuration, a missing measured result, and a non-passing result are each refused with the specific reason.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
9eac21608e67
crates/eg-types/src/benchmark_claim.rs:101
crates/eg-types/src/benchmark_claim.rs:109
crates/eg-types/src/benchmark_claim.rs:118
crates/eg-types/src/benchmark_claim.rs:127
EG-DURABLE-KERNEL-R043
MutationBatch is the sole persistent write envelope across stores
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**MutationBatch is the sole persistent write envelope across stores.** Every store member, including graph, table, KV and time series state, adopts MutationBatch as its persistent write envelope, using the owner manifest for a single admission decision and one idempotent terminal outcome instead of a store-specific write path. The read-only downstream graph change feed is specified by .100 and cannot introduce a second write path. | Restart/replay and mixed-member tests (KG-01) confirm every store member commits through the shared MutationBatch path with an idempotent terminal outcome. `.100` also proves feed events derive only from committed envelopes.
requirementEG-DURABLE-KERNELSPECIFIED1d83cf4b704f
1ef84395fa69
EG-DURABLE-KERNEL-R044
Upload cursor identifiers are never reused after a restart
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Upload cursor identifiers are never reused after a restart.** Upload cursor identifiers in src/server/blob/mod.rs are never reused across a restart, because the blob store persists a high-water mark that recovery reads before issuing any new cursor. | A restart test in src/server/blob/store/tests.rs proves the upload cursor high-water mark survives a restart and cursor ids remain monotonic afterward.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
b43f33569dd4
src/server/blob/store/tests.rs:643
EG-DURABLE-KERNEL-R045
A single owner-manifest lineage check governs format upgrades
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**A single owner-manifest lineage check governs format upgrades.** Format upgrades for durable storage layouts route through the one versioned owner-manifest lineage check and typed upgrade-refusal path; the SQL store no longer maintains its own separate offline upgrade routine outside that path. | Lineage golden fixtures and stale-binding negative tests (KG-03) confirm a format upgrade is accepted or refused only through the shared lineage check.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
94edcf341758
df476f0df010
crates/eg-storage/src/owner/sql_checkpoint_upgrade/tests.rs:192
EG-DURABLE-KERNEL-R046
Polygon interior/touch predicates are correct for shared boundaries
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Polygon interior/touch predicates are correct for shared boundaries.** eg-geo's polys_interiors_meet in crates/eg-geo/src/predicates.rs correctly classifies touches, contains and within for identical polygons and polygons sharing only boundary edges, so boundary-only contact is never reported as interior overlap and identical polygons are reported as mutually containing rather than merely touching. | Unit tests in crates/eg-geo/src/predicates.rs cover identical polygons, coincident edges with a shared interior, and shared boundaries with interiors on opposite sides.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
b43f33569dd4
crates/eg-geo/src/predicates.rs:802
crates/eg-geo/src/predicates.rs:815
crates/eg-geo/src/predicates.rs:868
EG-DURABLE-KERNEL-R047
Ring-buffer eviction test matches whole entry identifiers
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Ring-buffer eviction test matches whole entry identifiers.** The ring-buffer capacity test verifies that the oldest entry is evicted once the buffer exceeds capacity by matching each entry's full anchored identifier, including its trailing delimiter, instead of an unanchored substring that could also match unrelated surviving entries sharing a numeric prefix. | ring_buffer_evicts_oldest_when_over_capacity asserts on the anchored identifier and fails if a wrongly retained or wrongly evicted entry is present.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
a1bb9fb9503e
src/raft/harness/trace_capture.rs:481
EG-DURABLE-KERNEL-R048
Dispatch-ordering guard test reliably locates its target function
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Dispatch-ordering guard test reliably locates its target function.** The dispatch-ordering guard in tests/sql_catalog_sharing.rs locates dispatch_graph_op_inner regardless of its visibility modifier, and fails loudly with a distinct diagnostic when it finds zero matching definitions or more than one ambiguous match, instead of silently passing on an unmatched search. | check_graph_access_precedes_query_and_rdf_try_handle_in_dispatch exercises the zero-match and ambiguous-match failure paths and its real ordering assertion against the current dispatch pipeline.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
cfb0a1279595
tests/sql_catalog_sharing.rs:413
EG-DURABLE-KERNEL-R049
Idempotent retry of CreateGraph and DeleteGraph succeeds
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Idempotent retry of CreateGraph and DeleteGraph succeeds.** A retried CreateGraph or DeleteGraph that was already committed is recognized as idempotent by replaying its stored receipt, rather than being refused as already-exists or not-found; deleting a graph purges receipts from any prior incarnation of that name so a later retry cannot replay a stale outcome. | Idempotent replay tests for CreateGraph and DeleteGraph (KG-01) confirm a repeated commit returns the original outcome instead of a conflicting error. `delete_purges_receipts_of_a_prior_incarnation` checks recreation and replay across restart. `control_maintenance_reused_label_admits_at_the_current_version` checks control claims against their in-transaction version.
requirementEG-DURABLE-KERNELVERIFIED1c6b4c961a40
1ef84395fa69
3c481565fe1c
94edcf341758
ceec54145720
src/server/mutation_batch/lifecycle_tests.rs:243
EG-DURABLE-KERNEL-R050
Blob garbage collection enforces a grace period before deletion
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Blob garbage collection enforces a grace period before deletion.** Blob garbage collection in src/server/blob/store.rs deletes a committed, unreferenced blob only after it has aged past a configured grace period, rather than deleting it immediately once it becomes unreferenced. | Grace-period sweep tests in src/server/blob/store/tests.rs prove a blob is retained until the grace period elapses and deleted only afterward.
requirementEG-DURABLE-KERNELVERIFIED19da6ec1bc9b
1ef84395fa69
b43f33569dd4
src/server/blob/store/tests.rs:370
EG-DURABLE-KERNEL-R051
BlobRef and BlobUnref are holder-scoped and idempotent
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**BlobRef and BlobUnref are holder-scoped and idempotent.** BlobRef and BlobUnref in src/server/blob/store/holders.rs track reference counts per named holder and are idempotent, so repeating the same acquire or release operation for a holder does not change the count beyond its first effect. | A test proving a named holder's acquire and release are idempotent across distinct operations covers this behavior.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
b43f33569dd4
src/server/blob/store/tests.rs:677
EG-DURABLE-KERNEL-R052
Outbox delivery is organized by semantic class topics
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Outbox delivery is organized by semantic class topics.** Outbox delivery publishes semantically distinct event classes on their own topics, consistent with the outbox's per-consumer cursor and attempt-accounting contract, so a consumer for one event class is not blocked or confused by unrelated classes sharing a stream. | Failing-head and successor replay tests (KG-05) confirm per-class topic separation does not change attempt accounting or replay correctness.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
94edcf341758
9871859d4e0c
d2e4cff47c86
crates/eg-transaction/src/tests/outbox.rs:2308
EG-DURABLE-KERNEL-R053
AVX2 kernel paths are exercised on AVX2-capable hardware
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**AVX2 kernel paths are exercised on AVX2-capable hardware.** The downsampling kernel's AVX2 code path is executed and its output compared against the scalar reference on hardware that actually supports AVX2 instructions, rather than relying solely on golden values captured on hardware without AVX2. | A correctness run on AVX2-capable hardware compares AVX2 kernel output against the scalar reference within tolerance.
requirementEG-DURABLE-KERNELLANDED1ef84395fa69
a1bb9fb9503e
EG-DURABLE-KERNEL-R054
Placement and consensus routing tests pass after command sealing changes
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Placement and consensus routing tests pass after command sealing changes.** Raft placement-catalog state-machine routing binds plan identity and replay nonce correctly, and three-node cluster placement admin wire RPCs correctly move data across the cluster, unaffected by native command sealing changes elsewhere in dispatch. | placement_state_machine_binds_plan_identity_and_replay_nonce and placement_admin_wire_rpcs_move_data_across_a_real_three_node_cluster (KG-10) pass against a live multi-node cluster.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
b43f33569dd4
src/raft/placement_harness.rs:149
src/raft/tests.rs:1016
EG-DURABLE-KERNEL-R055
Durable-store registry classifies every .redb literal in the codebase
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Durable-store registry classifies every .redb literal in the codebase.** server::persistence::durable_stores maintains an exhaustive classification of every .redb string literal in the workspace as either a real durable store or a non-persisting test fixture, so no on-disk store can go unregistered. | registry_covers_every_redb_store statically scans the workspace sources for .redb literals and fails if any literal is unclassified.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
c143146d7855
src/server/persistence/durable_stores.rs:627
EG-DURABLE-KERNEL-R056
Mutation durability classification is correct under every feature build
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Mutation durability classification is correct under every feature build.** is_durable_mutation in src/mutation_apply.rs classifies which mutations are durable consistently whether the server is compiled with the full or slim feature profile, so a durability classifier never answers differently depending on which features are compiled in. | test-mutation-apply-full and test-mutation-apply-slim both exercise is_durable_mutation under each feature profile and must pass identically.
requirementEG-DURABLE-KERNELVERIFIED00a38629d214
1ef84395fa69
5bf5b719de7e
src/mutation_apply.rs:206
EG-DURABLE-KERNEL-R057
Sealed record classes are protected by a create-only write guard
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Sealed record classes are protected by a create-only write guard.** Sealed, content-addressed record classes such as AnalysisSnapshot are protected by an engine-enforced write guard that permits creation but refuses any overwrite of an existing sealed record except through its owning operation, so a generic graph-node write cannot silently replace a sealed record. | A negative test proves a generic write is refused against an existing sealed record, and a positive test proves the owning operation can still update it.
requirementEG-DURABLE-KERNELSPECIFIED00a38629d214
1ef84395fa69
5c2ab50088c4
src/sealed_guard/tests.rs:56
tests/sealed_record_guard.rs:210
EG-DURABLE-KERNEL-R057.1
Order-snapshot lifecycle with immutable-history and derivation-link acceptance
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Order-snapshot lifecycle with immutable-history and derivation-link acceptance.** Define order-snapshot lifecycle and promotion admission using existing sealed-record and transactional authorities. Add immutable-history tracking, derivation-link binding and veto/no-effects acceptance for promotion flow. Keep provider order submission in SDK governed writeback and host confirmation routed through GraphOS. | Verified by integration tests covering snapshot creation, atomic promotion, immutable history after promotion, derivation links and veto refusal. Test replay after restart.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R058
Source-batch publication waiter cancellation is deterministic
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Source-batch publication waiter cancellation is deterministic.** cancelling_publication_waiter_does_not_cancel_owned_commit in server::handlers::source_batch synchronizes explicitly rather than relying on sleeps or wall-clock deadlines, so its outcome does not depend on disk or scheduling latency. | The test passes repeatedly both in isolation and under heavy concurrent disk fsync contention.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
480766675bd1
src/server/handlers/source_batch/tests.rs:176
EG-DURABLE-KERNEL-R059
Garbage collection preserves chunks shared with a direct reference
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Garbage collection preserves chunks shared with a direct reference.** Blob garbage collection's live-chunk set in src/server/blob/store/gc.rs includes chunks reachable through a direct reference, not only chunks named by a live upload manifest, so a chunk shared between a dead upload and a direct reference is never deleted. | Sweep tests in src/server/blob/store/tests.rs confirm a racing refcount sweep never deletes a live chunk and a chunk shared with a direct reference survives the manifest that named it.
requirementEG-DURABLE-KERNELVERIFIED1ef84395fa69
b43f33569dd4
src/server/blob/store/tests.rs:420
EG-DURABLE-KERNEL-R060
Unsupported legacy graph-data layouts are not silently migrated
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Unsupported legacy graph-data layouts are not silently migrated.** An on-disk graph-data directory in a format version the engine no longer supports is not required to be read or migrated; the engine fails closed with a typed upgrade-required error instead of silently reinterpreting it, and recovery proceeds by starting a fresh store and re-ingesting source data. | A negative test feeds an unsupported on-disk layout and confirms the engine refuses with the named upgrade-required error rather than attempting an implicit migration.
requirementEG-DURABLE-KERNELVERIFIED00a38629d214
1ef84395fa69
9bc78efe95b3
crates/eg-storage/src/owner/lineage_tests.rs:109
EG-DURABLE-KERNEL-R061
Test threading avoids unbounded channels and dead-time joins
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Test threading avoids unbounded channels and dead-time joins.** source_batch's test helpers use bounded rendezvous channels and a bounded join with a deadline instead of an unbounded std::sync::mpsc::channel or an indefinite JoinHandle::join, consistent with this repository's disallowed-methods lint, and a condition that can only ever be true is checked as a compile-time constant assertion rather than a runtime assertion on constants. | clippy across the workspace with all features and targets enabled passes with zero violations of the disallowed-methods and assertions-on-constants lints in this module.
requirementEG-DURABLE-KERNELLANDEDc143146d7855
EG-DURABLE-KERNEL-R062
Abandoned uploads are reclaimed after an idle TTL
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Abandoned uploads are reclaimed after an idle TTL.** Blob garbage collection in src/server/blob/store/gc.rs reclaims uploads that have been idle past a configured default TTL defined in src/server/blob/store/policy.rs, rather than leaving abandoned uploads unreclaimed indefinitely. | The GC sweep test suite exercises the abandoned-upload TTL split and asserts the uploads-expired counter increments correctly.
requirementEG-DURABLE-KERNELVERIFIED00a38629d214
b43f33569dd4
src/server/blob/store/tests.rs:549
EG-DURABLE-KERNEL-R063
Version-2 control-state rows are lifted losslessly on read (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Version-2 control-state rows are lifted losslessly on read (rollup).** When an existing graph shard still stores version-2 control-state rows, the engine reads and lifts them to the current representation losslessly in place, rather than requiring an offline migration or dropping any of their fields. Split (2026-10-09): `.1` the schema-version plumbing that exists today, `.2` the missing lift-on-read behavior. | Lineage golden fixtures (KG-03) cover reading a version-2 control-state row and confirm the lifted representation is lossless against the original fields.
requirementEG-DURABLE-KERNELSPECIFIEDf17f47ab300f
EG-DURABLE-KERNEL-R063.1
Schema-version fields exist and mismatches are refused, not lifted
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Schema-version fields exist and mismatches are refused, not lifted.** `eg-storage` carries `schema_version`/`store_schema_version` fields (e.g. `DIRECT_STATE_SCHEMA_VERSION` in `crates/eg-storage/src/direct_state/journal/mod.rs`, `STORAGE_KERNEL_SCHEMA_VERSION` checks in `crates/eg-storage/src/recovery/validate.rs`) that compare the stored version against the current one by strict equality and refuse a mismatch; there is no version-2-specific control-state row type and no lift-on-read code. The landed_in SHA previously recorded against this row (`f17f47ab300f`) is an unrelated schema-authority commit, not this feature. | Existing unit tests in `crates/eg-storage/src/direct_state/journal/mod.rs` and `crates/eg-storage/src/recovery/validate.rs` cover the strict-equality version check (refusal), not lifting.
requirementEG-DURABLE-KERNELVERIFIEDac32740601a8
crates/eg-storage/src/direct_state/tests/contract.rs:82
EG-DURABLE-KERNEL-R063.2
Remaining scope: lossless lift-on-read for version-2 control-state rows
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Remaining scope: lossless lift-on-read for version-2 control-state rows.** Add a version-2 control-state row representation plus read-path code that, on encountering `schema_version == 2`, lifts the row to the current representation in place (preserving every original field) instead of refusing the mismatch as `recovery/validate.rs` does today — no offline migration step. | Lineage golden fixtures (KG-03) cover reading a version-2 control-state row and confirm the lifted representation is lossless against the original fields (the original R063 acceptance test, now bound to this child).
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R064
Compiled shape memoization is benchmarked against parsing per write
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Compiled shape memoization is benchmarked against parsing per write.** Memoizing the compiled validation-shapes union is evaluated against re-parsing shapes on every write, with a measured benchmark naming the workload and hardware, before the memoized path is adopted as a performance improvement. | A benchmark comparing memoized versus parse-per-write shape compilation reports a measured latency difference under the same methodology required for other performance claims.
requirementEG-DURABLE-KERNELLANDEDbee3dd02e6ed
EG-DURABLE-KERNEL-R065
Signed dispatch commit recovers correctly after an ack-lost fault window
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Signed dispatch commit recovers correctly after an ack-lost fault window.** signed_dispatch_commit_fault_windows_recover_parent_once confirms that when an acknowledgment is lost during a fault window, transaction reconciliation recovers the parent operation exactly once rather than duplicating or dropping it. | The full facade test suite, including tests/txn_reconcile_ack_lost_retry.rs::signed_dispatch_commit_fault_windows_recover_parent_once, passes deterministically.
requirementEG-DURABLE-KERNELVERIFIED57a12eb06632
c3daf5c4438c
src/server/mutation_batch/commit/internal.rs:611
tests/txn_reconcile_ack_lost_retry.rs:573
EG-DURABLE-KERNEL-R065.1
The transaction coordinator lane is disjoint from graph lanes
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**The transaction coordinator lane is disjoint from graph lanes.** A Commit serializes on its parent receipt id and then takes its graph lane. The engine keeps coordinator lanes in their own lock table, so the order is always coordinator, then graph. A parent id that hashes to its own graph's stripe can no longer re-enter one mutex and hang the Commit. | A unit test picks a parent id on the same stripe as `__commons__`. It acquires that coordinator lane while the `__commons__` graph lane is held. Repeated full-parallel facade runs of the server test suite finish with no hung test.
requirementEG-DURABLE-KERNELVERIFIEDc3daf5c4438c
src/server/mutation_batch/commit/internal.rs:611
EG-DURABLE-KERNEL-R066
Published contract metadata matches BlobRef/BlobUnref idempotent behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Published contract metadata matches BlobRef/BlobUnref idempotent behavior.** The published method contract marks BlobRef and BlobUnref as idempotent, matching their actual holder-scoped idempotent implementation, so the contract metadata and runtime behavior do not disagree. | A contract-conformance check compares the declared idempotent metadata for BlobRef and BlobUnref against the holder-scoped idempotent behavior proven in their own tests.
requirementEG-DURABLE-KERNELLANDEDb8814b4560d1
EG-DURABLE-KERNEL-R067
Trace capture isolates each test's events from concurrent noise
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Trace capture isolates each test's events from concurrent noise.** Causal trace capture for Raft failure diagnosis is scoped per thread rather than kept in a single shared global ring buffer, so a failing cluster test's captured trace contains only its own events and is not evicted by unrelated concurrent tests' activity. | Raft trace-capture tests confirm a failing cluster's trigger event remains present in its own per-thread trace buffer under concurrent load.
requirementEG-DURABLE-KERNELVERIFIED1813f2b5190d
57a12eb06632
src/raft/harness/trace_capture.rs:601
EG-DURABLE-KERNEL-R068
Channel-group leave returns its own result, not a replayed join result
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Channel-group leave returns its own result, not a replayed join result.** The admin saga handler in src/server/handlers/admin/saga.rs decodes a durable ResultPayload using its tagged representation rather than treating it as a plain JSON string, so a leave operation on a channel group returns its own outcome instead of incorrectly replaying a stored join result. | A join-then-leave-then-rejoin regression test for channel groups confirms each operation returns its own correct result.
requirementEG-DURABLE-KERNELLANDEDcee22e5290b1
EG-DURABLE-KERNEL-R069
Scrub cursor fixture reliably tests the no-key encryption state
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Scrub cursor fixture reliably tests the no-key encryption state.** The scrub-cursor-survives-reopen test saves and restores the shared encryption environment under its write lock and forces the no-key condition for its own fixture, so its expected sealed-without-key finding does not depend on whether an earlier test in the same run already provisioned the process-wide encryption key. | scrub_cursor_survives_reopen_and_the_walk_skips_nothing passes both in isolation and as part of the full combined test suite regardless of run order.
requirementEG-DURABLE-KERNELVERIFIEDbe291021dfdc
src/server/persistence/redb_backend/scrub_api_tests.rs:81
EG-DURABLE-KERNEL-R070
Operator command inspects and applies registered offline store upgrades
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Operator command inspects and applies registered offline store upgrades.** The server binary has one operator command with two verbs over a data directory. `inspect` reads the format of every store and writes nothing. Its exit status says one of four things. Nothing needs doing, or an upgrade is available. A store may be in a format this build neither opens nor upgrades. A store may also be unreadable. `apply` requires an explicit confirmation flag and refuses while an engine holds the directory. It runs each registered offline upgrade in place and keeps the existing rows. It stops at the first failure and leaves that store in its previous layout. It never writes a store it does not upgrade. A second run reports nothing to do. The upgrades come from one registry in the storage kernel, so a new upgrade is one entry. With automatic migration off (`EG-DURABLE-KERNEL-R070.1`), the engine refuses to start on a store that a registered upgrade applies to. The refusal carries the named format error of that store and the exact command to run. No other store state refuses startup this way. Any other failure of a lazily opened store stays local to that store. | Command tests run on disposable stores. Inspect on current stores reports nothing to do and writes nothing. Inspect on a registered predecessor reports an available upgrade. Apply upgrades graph-shard, Agent Library and SQL catalog predecessors and keeps the exact row bytes. A second apply is a no-op. Both verbs refuse while the engine lock of the directory is held. Apply without confirmation opens nothing. An undeclared or non-upgradable format is reported and stays byte-identical. A failed upgrade stops the run and leaves later stores untouched. Apply still upgrades a predecessor that an unclean shutdown left. The startup check and the ordinary store opens refuse a predecessor with the named error and the command. Storage-kernel tests prove that every registry entry is a declared predecessor. They also prove that each entry reaches the current layout exactly once.
requirementEG-DURABLE-KERNELVERIFIED2d6a22cb9bb4
4dfe8b2f33e0
8dbb5bd9de53
c3827ffe4f44
d44e49b9d67c
src/server/persistence/store_upgrade/auto_migrate_tests.rs:107
src/server/persistence/store_upgrade/auto_migrate_tests.rs:129
src/server/persistence/store_upgrade/auto_migrate_tests.rs:170
src/server/persistence/store_upgrade/auto_migrate_tests.rs:197
src/server/persistence/store_upgrade/auto_migrate_tests.rs:223
EG-DURABLE-KERNEL-R070.1
The engine migrates an older supported store when it opens it
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**The engine migrates an older supported store when it opens it.** `src/server/persistence/store_upgrade/auto_migrate.rs` runs the registered upgrades of `EG-DURABLE-KERNEL-R070` through `apply_store`. `src/server_startup.rs:155` calls it right after the engine takes its exclusive directory lock, before any store opens. The function takes the held lock as a parameter. It writes a journal under `<data-dir>/.store-upgrade-staging` before the first upgrade and replaces it atomically after each one. Each upgrade is one atomic commit, so an interrupted run leaves every store in one layout. The next open finds the journal, classifies every store again and resumes. A second run on current stores writes nothing. Each step is logged and counted in `epistemic_graph_store_migration_steps_total{step,outcome}`. A declared predecessor with no upgrade is refused as `STORE_FORMAT_TOO_OLD`. A layout outside the lineage is refused as `STORE_FORMAT_TOO_NEW`. The engine writes neither of them. A graph shard in either state stops startup; another store keeps its own lazy-open refusal. `EPISTEMIC_GRAPH_STORE_AUTO_MIGRATE` is on by default. `false` turns migration off, and an unknown value is refused as `STORE_AUTO_MIGRATE_INVALID_SWITCH`. | `src/server/persistence/store_upgrade/auto_migrate_tests.rs` tests disposable predecessor stores. Migration under the held lock keeps the row bytes and clears the journal. A second run writes nothing. A run stopped after one store leaves the journal, and the next open resumes it. With the switch off, the old named refusal and command stay. A too-new shard and a too-old blob store are refused by code and stay byte-identical. The metric samples render.
requirementEG-DURABLE-KERNELVERIFIED4dfe8b2f33e0
c3827ffe4f44
d44e49b9d67c
src/server/persistence/store_upgrade/auto_migrate_tests.rs:107
src/server/persistence/store_upgrade/auto_migrate_tests.rs:129
src/server/persistence/store_upgrade/auto_migrate_tests.rs:170
src/server/persistence/store_upgrade/auto_migrate_tests.rs:197
src/server/persistence/store_upgrade/auto_migrate_tests.rs:223
EG-DURABLE-KERNEL-R070.2
Hot-path proof: a previous-patch store migrates and serves at open
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof: a previous-patch store migrates and serves at open.** A previous-patch engine writes a store in place. This build opens it with no offline step and serves it. `ListGraphs` returns the commons and tenant graphs for the System identity. A second restart finds nothing to migrate. With the switch off, the engine exits with `GRAPH_SHARD_FORMAT_UPGRADE_REQUIRED` and the command, and `store-upgrade apply` still works. | `tests/test_store_auto_migrate.py` runs the served engine. The previous-patch leg runs when `EPISTEMIC_GRAPH_PREVIOUS_PATCH_BINARY` names that engine.
requirementEG-DURABLE-KERNELVERIFIED2d6a22cb9bb4
c3827ffe4f44
d44e49b9d67c
tests/test_store_auto_migrate.py:39
EG-DURABLE-KERNEL-R071
Typed durable task-queue model (enqueue/claim/ack) with refusal tests
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Typed durable task-queue model (enqueue/claim/ack) with refusal tests.** `eg-types` defines `TaskEnqueue`, `TaskClaim` and `TaskAck` for the served durable task queue that replaces AU's Postgres and Kafka queue backends. A blank queue name, zero lease, ack of an unclaimed or expired lease, and a duplicate idempotency key each resolve to a typed refusal. Unblocks AU-SEMANTIC-R011.3 and AU-SEMANTIC-R011.4. | Unit tests wire-round-trip each type and assert each listed refusal.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R072
Served task-queue RPC over the durable outbox
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served task-queue RPC over the durable outbox.** One served RPC pair, `TaskQueueEnqueue`/`TaskQueueClaim`/`TaskQueueAck`, persists tasks in the durable outbox so an unacked claim redelivers after lease expiry and survives restart. Unblocks AU-SEMANTIC-R011.3 and AU-SEMANTIC-R011.4. | One integration test enqueues, claims, lets the lease lapse, reopens the store and re-claims the same task.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R073
Generated client method for the task queue
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Generated client method for the task queue.** The generated Python client exposes `task_queue_enqueue`, `task_queue_claim` and `task_queue_ack` from the Rust schema source. Unblocks AU-SEMANTIC-R011.3 and AU-SEMANTIC-R011.4. | A generated-client test calls each method against the served RPC and a generation check shows no hand-written drift.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R074
Served worker registry (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served worker registry (rollup).** Split into R074.1 (pure producer) and R074.2 (served integration); both are required. The engine serves a worker registry with register, heartbeat and expiry of typed `WorkerRecord`s. Unblocks AU-SEMANTIC-R011.5.1 (AU `worker_scheduler.py`). | One test registers a worker, lets the heartbeat lapse and asserts it is expired.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R074.1
Typed worker registry producer and pure lifecycle
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Typed worker registry producer and pure lifecycle.** `eg-types::worker_registry` owns capacity-bearing WorkerRegistration/WorkerRecord and deterministic register, heartbeat, live lookup and expiry transitions. Refuse invalid capacity, empty identity/lanes, zero or overflowing TTL, duplicate live registration, unknown/expired heartbeat and clock regression without mutation. No served surface claimed. | Native tests cover register/heartbeat/expiry at the exact deadline, serde capacity round trip, every refusal and re-registration after expiry.
requirementEG-DURABLE-KERNELVERIFIEDe7b0f9f670c9
crates/eg-types/src/worker_registry.rs:191
crates/eg-types/src/worker_registry.rs:212
crates/eg-types/src/worker_registry.rs:257
crates/eg-types/src/worker_registry.rs:277
EG-DURABLE-KERNEL-R074.2
Served worker registry integration
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served worker registry integration.** Depends on R074.1. Wire register, heartbeat and expiry through authenticated engine dispatch using the producer. Generate the wire/client contract and enforce tenant/principal ownership. | Served dispatch test registers capacity, heartbeats, advances the clock to expiry and verifies disappearance. Unknown, expired and cross-owner requests refuse.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R075
Reserved-worker admission decision
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Reserved-worker admission decision.** A served `AdmitWorkerTask` decision returns admit or a typed refusal, keeping reserved workers free for their lane. Unblocks AU-SEMANTIC-R011.5.1. | One test shows a non-reserved task refused when only reserved capacity remains.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R076
Scheduler config and lane floors (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Scheduler config and lane floors (rollup).** `SchedulerConfig` with per-lane minimum worker floors is a typed served setting; a floor sum above total workers is refused. Split producer-first per SPEC-SIZING into R076.1 (pure contract) and R076.2 (served integration); both must be delivered. Unblocks AU-SEMANTIC-R011.5.1 only after R076.2. | Pure-model tests plus served setting/admission tests; R076.1 alone does not satisfy this parent.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R076.1
Authoritative scheduler config model and refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Authoritative scheduler config model and refusal.** `eg_types::scheduler_config::SchedulerConfig` carries explicit `total_workers`, `max_queue_depth`, per-lane floors, `cores_per_mille` default 360 and `memory_per_worker_bytes` default 3 GiB (EG-PLACEMENT-R002.2). Validation refuses over-subscribed floors without integer overflow, blank lanes, CPU shares above 1000 and zero memory per worker. Zero workers, CPU share or queue depth explicitly disables that resource. | Native tests round-trip real serde defaults/overrides; cover exact/over-subscribed floors, overflow, bounds and malformed wire fields.
requirementEG-DURABLE-KERNELVERIFIED57050996421e
crates/eg-types/src/scheduler_config.rs:112
crates/eg-types/src/scheduler_config.rs:127
crates/eg-types/src/scheduler_config.rs:142
crates/eg-types/src/scheduler_config.rs:155
crates/eg-types/src/scheduler_config.rs:169
EG-DURABLE-KERNEL-R076.2
Serve and consume validated scheduler settings
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Serve and consume validated scheduler settings.** Expose R076.1 through the authoritative engine setting path, validate configured lane membership against the engine lane registry, and use it for admission and queue limits without worker-local policy. Preserve scope and refusal behavior. Depends on R076.1 and the served registry/admission surfaces R074/R075. | Served read/update and claim tests prove rejected settings have no effect and accepted floors/limits govern admission; remains unimplemented by the pure model.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R077
Shard-writer width served by the scheduler surface
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Shard-writer width served by the scheduler surface.** The engine serves the current shard-writer width as a typed read that the scheduler uses to size write lanes. Unblocks AU-SEMANTIC-R011.5.1. | One test reads the width for a multi-shard tenant and asserts it matches the configured writers.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R078
Bitemporal stamping served method
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Bitemporal stamping served method.** A served method stamps valid-time and transaction-time on a written fact and refuses an inverted valid interval. Replaces AU `knowledge_graph/core/bitemporal.py`; unblocks AU-SEMANTIC-R011.8.1. | Unit test asserts both stamps and the inverted-interval refusal.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R079
Served as-of filtering
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served as-of filtering.** A served as-of read returns only facts valid and recorded at the requested instants. Unblocks AU-SEMANTIC-R011.8.2. | One test writes superseded versions and asserts as-of returns the right version at two instants.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R080
Served supersession
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served supersession.** A served supersede method closes the prior fact's interval and links the successor atomically; superseding an already-closed fact is refused. Split into `.1` (atomic refusal for missing successor endpoints) and `.2` (already-closed-fact refusal and served integration coverage). The parent remains open until both children are verified. Unblocks AU-SEMANTIC-R011.8.3. | One test supersedes twice and asserts the refusal and the closed interval.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R080.1
Supersession refuses a missing successor endpoint without closing the prior fact
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Supersession refuses a missing successor endpoint without closing the prior fact.** The existing served `SupersedeEdge` path validates both successor endpoints under its topology write guard before changing the prior validity or transaction interval. This is the atomic-refusal child of R080; already-closed-fact refusal and served end-to-end verification remain open. | A GraphCore regression exercises missing source and missing target, verifies byte-identical prior properties and no successor on refusal, then creates the missing endpoint and proves retry closes both prior intervals and inserts the successor.
requirementEG-DURABLE-KERNELVERIFIED35cab6a7f65f
crates/eg-core/tests/edge_supersession.rs:21
EG-DURABLE-KERNEL-R080.2
Served supersession refuses an already-closed fact and proves the atomic history transition
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served supersession refuses an already-closed fact and proves the atomic history transition.** Complete the existing `SupersedeEdge` handler's prior-fact lifecycle guard and successor provenance contract, preserving the original intervals and refusing repeated supersession without inserting another successor. | A served-RPC integration test supersedes a fact, verifies both closed prior intervals and the linked successor, then supersedes the closed fact again and asserts refusal with unchanged history.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R081
Generated client methods for bitemporal operations
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Generated client methods for bitemporal operations.** The generated client exposes stamp, as-of and supersede methods. Unblocks AU-SEMANTIC-R011.8.4. | A generated-client test exercises each method end to end.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R082
Analytics worker parity: association-rule mining jobs run on the engine's own durable job plane
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Analytics worker parity: association-rule mining jobs run on the engine's own durable job plane.** Rollup over `EG-DURABLE-KERNEL-R082.1`+. Replaces agent-utilities `analytics_worker.py` (commit 92974bae8, AU-SEMANTIC-R011.10), the `graph-os-analytics-worker` console script. That worker claimed `MineAssociate` jobs from the existing `eg-jobs` plane, mined association rules in Python, staged a typed result and asked the engine to publish it. The engine already provides every part except the verification that its colocated executor matches the old worker's governed behaviour: `src/server/handlers/jobs/executor_loop.rs` runs a bounded in-process worker pool that claims `mining.association` jobs, and `crates/eg-jobs` and the generated `JobsClient` already carry claim, renew, checkpoint, stage, publish, fail and cancel. The generic task queue in `EG-DURABLE-KERNEL-R071` to `R077` is a separate surface and is not a prerequisite for this path. Ownership: the engine owns execution through its colocated pool, so no separate worker process is needed for mining; see the architecture section 'Analytics worker carry-over'. | Each child below has its own named test; the rollup is verified when all children are verified.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R082.1
A submitted `MineAssociate` job is claimed and published by the colocated executor with no external worker
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**A submitted `MineAssociate` job is claimed and published by the colocated executor with no external worker.** `src/server/handlers/jobs/executor_loop.rs` already starts `EG_ANALYTICS_WORKERS` slots (default 1, capped at 32) that claim `mining.association` and `pool:default`. This row adds the missing end-to-end proof: submit, run, observe `Succeeded`. Replaces the old worker's claim and publish loop. | One server integration test in `src/server/handlers/jobs/graph_tests.rs` submits a `MineAssociate` job with a small transaction set and asserts the job reaches `Succeeded` with a non-empty result and no external worker connected.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R082.2
`MineAssociate` submission refuses a payload outside the governed schema
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`MineAssociate` submission refuses a payload outside the governed schema.** The old worker failed a job with reason `invalid_payload` for: transactions not a list of lists of strings, `min_support` or `min_confidence` non-finite or outside 0 to 1, or an algorithm outside apriori, fpgrowth (also fp-growth, fp_growth) and eclat. Defaults were support 0.1, confidence 0.5, algorithm fpgrowth. `src/server/handlers/jobs/submit.rs` validates at submit; this row verifies parity and fixes any gap. | A table-driven test in `src/server/handlers/jobs/graph_tests.rs` submits one payload per refusal listed above and asserts a typed refusal each, plus one accepted payload using the defaults.
requirementEG-DURABLE-KERNELVERIFIED839c2e0d1ee2
src/server/handlers/jobs/graph_tests.rs:145
src/server/handlers/jobs/graph_tests.rs:170
src/server/handlers/jobs/graph_tests.rs:245
EG-DURABLE-KERNEL-R082.3
Distinct-item cap and opaque-reference rule are decided and enforced at submit
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Distinct-item cap and opaque-reference rule are decided and enforced at submit.** The old worker required every item to be an opaque reference starting with `eg:` and refused more than 31 distinct items, which bounded subset enumeration. It was not determinable from the source whether the engine kernel needs the same cap. This row records the decision in `src/server/handlers/jobs/submit.rs` as a named constant and enforces it. | A test submits a payload with a non-opaque item and a payload over the cap and asserts a typed refusal for each; a payload at the cap is accepted.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R082.4
Association-rule identity is byte-identical to the old worker's
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Association-rule identity is byte-identical to the old worker's.** The id is `eg:rule:` followed by the sha256 of the prefix `eg-jobs.association-rule.v1` and a zero byte, then for antecedent and consequent a little-endian u64 count and length-prefixed utf-8 items, then little-endian f64 support, confidence and lift. Row ids must not change across the carry-over, because published claims are keyed by them. Code root: `src/server/handlers/jobs/results_association.rs`. | A golden-vector test hashes one fixed rule and asserts the digest recorded in the test, taken from the deleted Python implementation.
requirementEG-DURABLE-KERNELVERIFIED63d041e21850
src/server/handlers/jobs/results_association.rs:101
EG-DURABLE-KERNEL-R082.5
The staged result has the 11-column knowledge-batch shape
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**The staged result has the 11-column knowledge-batch shape.** Columns: id, kind, confidence, evidence_refs, source_refs, proof_ids, contradiction_ids, antecedent, consequent, support, lift. Each row's evidence and source refs are the input dataset ref. The result dataset ref is `eg:knowledge_batch:` plus a sha256 over the schema and rows. Uncertainty is the mean of one minus confidence, calibration is the min and max of support times confidence, and the reproducibility block carries the input digest, snapshot version, algorithm ref, params digest, code and environment versions and policy fingerprint. Code root: `src/server/handlers/jobs/results_association.rs` and `native_validation.rs`. | A test runs one job and asserts the column list, the evidence refs, the digest recomputed from the rows, and each reproducibility field.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R082.6
Rules are ordered and thresholded exactly as before
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Rules are ordered and thresholded exactly as before.** Minimum count is ceil(min_support times transaction count), at least 1. A rule is kept when confidence is at least min_confidence within 1e-12. Lift is confidence over consequent support, 0 when that is 0. Rules sort by confidence, lift, support descending, then first-seen interned antecedent and consequent IDs ascending. Code root: `crates/eg-compute/src/mining`. | A fixture test mines a fixed 6-transaction set and asserts the ordered rule list equals the list recorded from the deleted implementation.
requirementEG-DURABLE-KERNELVERIFIED157e0a8e97a3
a35b312dbd40
crates/eg-compute/src/mining/association/parity_tests.rs:4
crates/eg-compute/src/mining/association/parity_tests.rs:47
EG-DURABLE-KERNEL-R082.7
A running mining job observes cancellation, deadline and CPU budget
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**A running mining job observes cancellation, deadline and CPU budget.** The old worker polled job status every min(5 s, lease over 3) and cancelled the kernel with reason `kernel_cancelled` (acknowledged as cancelled), `deadline_exceeded` or `cpu_budget_exceeded` (both failed), renewing the lease otherwise. Verify the native executor stops cooperatively for all three. Code root: `src/server/handlers/jobs/executor_claim.rs`. | Three tests with a long-running synthetic kernel: cancel request, past deadline and tiny cpu budget each end in the matching terminal state, and no lease renewal happens after the stop.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R082.8
Failure codes and retry follow the durable retry policy
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Failure codes and retry follow the durable retry policy.** The old worker reported only the bounded codes `invalid_payload` and `kernel_failure` (plus the stop reasons above) and never logged payloads, endpoints or identity; retry and backoff were the server's `RetryPolicy` (`max_attempts`, `backoff_ms`). Verify the native executor uses `worker_execution_failed`-style bounded codes only and that a failed attempt becomes eligible again only after its backoff. Code root: `src/server/handlers/jobs/executor_loop.rs`. | A test fails a kernel twice, asserts the attempt count, that the retry is not claimable before the backoff elapses, and that no failure record contains payload text.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R082.9
Colocated pool lease and poll interval are configurable
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Colocated pool lease and poll interval are configurable.** The old worker took slots 1 to 64, lease 5000 to 300000 ms (default 60000) and poll 0.05 to 30 s (default 0.25) from `EG_ANALYTICS_WORKER_SLOTS`, `EG_ANALYTICS_WORKER_LEASE_MS` and `EG_ANALYTICS_WORKER_POLL_SECONDS`. The native pool fixes the lease at 60000 ms and the poll at 250 ms and caps slots at 32. This row adds validated `EG_ANALYTICS_LEASE_MS` and `EG_ANALYTICS_POLL_MS` with the old ranges, refusing out-of-range values at startup. Depends on EG-DURABLE-KERNEL-R076 for the shared scheduler configuration shape. Code root: `src/server/handlers/jobs/executor_loop.rs`. | A config test accepts values at both range ends and refuses one below and one above each range.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R082.10
Remote workers remain supported through the existing coordinator operations
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Remote workers remain supported through the existing coordinator operations.** `EG_ANALYTICS_WORKERS=0` leaves execution to authenticated remote workers using claim, renew, checkpoint, stage, publish, fail and cancel, claimed by capability (the old default set was `mining.association` and `pool:default`, at most 64 capabilities of at most 128 characters, no control characters). Service principal requires scope `analytics:worker`, already listed in `crates/eg-capabilities/src/scopes.rs`. This row proves the path without the deleted worker using the generated `JobsClient`. | A test with the colocated pool at zero drives the full worker sequence through `JobsClient`, and a worker without scope `analytics:worker` is refused.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R082.11
Cross-repo: graph-os hosts any remote worker process; agent-utilities does not
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Cross-repo: graph-os hosts any remote worker process; agent-utilities does not.** Owner repository: graph-os. Only if a deployment needs mining capacity beyond the engine pods, graph-os deploys a thin entry point that loops `JobsClient.worker_claim` and executes a kernel it ships; it must not embed a second copy of the mining kernel unless R082.6 golden tests run against it too. agent-utilities keeps no worker, console script or kernel. This row is a dependency marker, not engine work, and has no engine deliverable. | Recorded as satisfied by the engine rows above; graph-os links this row by ID if it ever adds the entry point.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R083
Shared versioned KV-cache tier (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Shared versioned KV-cache tier (rollup).** The engine's `eg-kvcache` tier must serve model KV-cache blocks to parallel consumers under content-addressed, model-versioned keys. A capacity budget must evict by recency and graph importance. A model-version mismatch must refuse the block. Children `.5` to `.8` cover the tier ladder, graph-guided paging, long-context coherence and tier refusals. | Tests prove two consumers share one block, a version mismatch refuses, and an over-budget insert evicts the coldest block.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R083.1
`KvBlockKey` typed model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**`KvBlockKey` typed model.** `crates/eg-kvcache/src/version.rs` must define `KvBlockKey` from model id, model version and token-prefix hash. | Unit test shows equal prefixes give equal keys and a different model version gives a different key.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R083.2
Version-mismatch refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Version-mismatch refusal.** `crates/eg-kvcache/src/shared.rs` must refuse a read whose model version differs from the stored block version, returning a typed error. | Unit test stores under version 1 and refuses a version 2 read.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R083.3
Budgeted eviction by importance
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Budgeted eviction by importance.** `crates/eg-kvcache/src/tiered.rs` must evict the lowest recency-and-importance block when the byte budget is exceeded, using `graph_importance.rs`. | Unit test inserts three blocks over budget and asserts the coldest is evicted.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R083.4
Locate and wire the served KV operation
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Locate and wire the served KV operation.** The first step must locate the served cache operations and expose get and put for `KvBlockKey`. Inference-side injection is an agent-utilities handoff. | Served-op test puts a block from one client and gets it from another.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R084
Version-checked concurrent writes with a typed conflict (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Version-checked concurrent writes with a typed conflict (rollup).** EG must serialize concurrent writers to one graph state by a version check. A losing writer must receive a typed conflict or a configured merge. Last-write-wins must never happen silently. | Tests prove a stale writer is refused, a merge strategy resolves a declared conflict, and the loss is never silent.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R084.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** `crates/eg-types/src/write_conflict.rs` must define `WriteConflict{expected, actual, scope}` and the closed `MergeStrategy` set `Refuse`, `PreferNewer`, `FieldUnion`. The default must be `Refuse`. | Unit test round-trips both types and asserts the default.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R084.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** `resolve_conflict(conflict, strategy, base, incoming)` must return a merged value or the conflict. The strategy must come from scope configuration. | Unit test resolves one conflict under each strategy.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R084.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** The version check built at `crates/eg-jobs/src/store.rs:2537` must call `resolve_conflict` when the stored version differs. Its production caller is the served `ApplyMutation` wire method. | Test writes with a stale version and asserts the resolver ran.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R084.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** With `Refuse`, the write must return `WRITE_CONFLICT` carrying expected and actual versions. No state may change. | Test asserts the refusal code and an unchanged readback.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R084.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Every resolved or refused conflict must emit `conflict_scope`, `strategy` and `winner` in the mutation trace. | Test reads the trace after one refusal and one merge.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R084.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `ApplyMutation` wire method. Two clients write against the same version and exactly one commit must win. | Integration test `tests/write_conflict_two_writers.rs` asserts one commit, one typed conflict and no silent overwrite.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085
Versioned memory synchronization (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Versioned memory synchronization (rollup).** EG owns memory content, versions, conflict decisions and synchronization evidence. GraphOS owns hosted file materialization. AU consumes EG decisions. This contract supports versioned documents without assigning filesystem authority to EG. | All eight children require their planned evidence.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define bounded memory snapshot, list cursor, sync request and outcome types. Use the exact fields and validation rules in the R085 design. Reuse Digest256, verified Request context and MutationScopeIdentity. Use tagged outcomes: authorized head-bearing results and a redacted refusal without head fields. New wire names are proposals until generated and served. | Planned: tests/memory_sync_contract.rs::bounded_contract_round_trips_and_refuses_invalid_fields.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.2
Versioned reads and listing
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Versioned reads and listing.** Read one authorized revision or list a stable snapshot with bounded pagination. Bind cursors to tenant, graph incarnation, principal, policy and filters. Never reveal hidden identifiers, counts or hashes. Expired cursors require an explicit restart. | Planned: tests/memory_sync_served.rs::authorized_read_list_and_cursor_isolation.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.3
Sync decisions and compare-and-set
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Sync decisions and compare-and-set.** Evaluate observe_file, submit, resolve and acknowledge actions against the durable document head. Atomically accept one matching-base candidate. Preserve both versions for an authorized stale submission without changing the accepted head. Resolve only against the current head and retained conflict. Repeated request identities return the original outcome. | Planned: tests/memory_sync_served.rs::competing_saves_retain_both_and_resolve_once.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.4
Production wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Production wiring.** Add the proposed read/list methods to authenticated graph dispatch. Route sync mutations through the existing gateway and canonical MutationBatch compiler. Commit content references, head, conflict receipt and outbox evidence together. Regenerate public method, result and client contracts. No direct GraphCore write may bypass durable admission. | Planned: tests/memory_sync_served.rs::wire_methods_reach_durable_gateway.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.5
Authority and refusals
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Authority and refusals.** Derive tenant, principal, graph and policy from verified request context. Check authority before lookup, cursor use, materialization acknowledgment or retention changes. Reject cross-scope references, malformed versions, digest mismatch and unavailable storage before effects. Unauthorized calls leave all durable records and holders unchanged. Denied existing and absent documents have indistinguishable results, including creation attempts. Refused creation needs no head metadata. | Planned: tests/memory_sync_served.rs::denied_and_malformed_requests_have_no_effects.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.6
Provenance and synchronization evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Provenance and synchronization evidence.** Persist the verified actor, policy, request identity, parent revision, content digest and committed outcome. Separate accepted content from a host materialization acknowledgment. EG reports in_sync only after an authorized acknowledgment matches the current revision, digest and observation generation. Pending edits and unresolved conflicts prevent in_sync. Missing evidence yields unavailable. | Planned: tests/memory_sync_served.rs::provenance_and_materialization_ack_survive_restart.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.7
Retention
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Retention.** Retain accepted and submitted conflict contents with their digests and provenance across restart. Use existing named blob holders and garbage-collection rules. Unresolved conflicts cannot expire automatically. Refuse before effects when configured retention capacity is exhausted. Release resolved history only through authorized policy after its retention deadline. | Planned: tests/memory_sync_served.rs::conflicts_survive_gc_and_retention_refusal.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.8
Real served acceptance
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Real served acceptance.** Start a real authenticated engine with disposable durable storage and two independent clients. Prove read/list, competing saves, conflict retention, resolution and materialization acknowledgment. Restart and read the durable records independently. Include cross-tenant, wrong-graph, stale-cursor, denied-writer and replay negatives. Do not mock transport, dispatch, authorization or persistence. | Planned: tests/memory_sync_served.rs::complete_memory_sync_journey.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086
Safe eviction and durable read-through (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Safe eviction and durable read-through (rollup).** Define the existing node-residency contract without changing storage, APIs or dependency direction. Preserve R039 recovery acceptance. All nine children require evidence; a resident read or index reopen alone cannot close this rollup. | Planned: tests/safe_eviction_read_through.rs::served_safe_eviction_read_through_journey.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Describe resident properties, durable presence, genuine absence and unavailable durability through existing GraphCore, ReadThrough and PersistenceBackend contracts. Bind observations to graph and node identity. Distinguish backend `Result<Option<Vec<u8>>>` from adapter `Option<Vec<u8>>`; None alone does not prove durable absence. | Planned: tests/safe_eviction_read_through.rs::read_through_model_outcomes.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086.2
Behavior: memory-only eviction
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior: memory-only eviction.** At GraphCore::evict_resident_nodes, remove only selected resident projections. Preserve durable node bytes and logical records. The primitive does not prove durability; its production callers own that guard. Retaining unconfirmed nodes may leave residency above the requested cap. | Planned: tests/safe_eviction_read_through.rs::selected_residents_leave_durable_rows_unchanged.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086.3
Behavior: cache-miss read
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior: cache-miss read.** GraphCore::get_node_properties serves resident bytes first, then consults its installed read-through on a miss. Release the seam lock before storage access. Serve durable bytes without repopulating RAM. A Bloom negative may suppress storage access only after the durable identity set is complete. | Planned: tests/safe_eviction_read_through.rs::evicted_blob_reads_without_resident_growth.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086.4
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Reuse src/main.rs:1547 and crates/eg-core/src/registry.rs:553 to install the facade factory for recovered and future graphs. Follow src/server/persistence/read_through.rs:38 to the existing scoped redb read. Verify the production eviction callers listed in the plan; introduce no second persistence path or lower-layer dependency. | Planned: tests/safe_eviction_read_through.rs::startup_attaches_graph_scoped_read_through.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086.5
Scoped reads
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Scoped reads.** At src/server/handlers/graph_ops/nodes.rs:85, preserve graph authority and row visibility when the filtered projection falls back to the raw core. At src/redb_store/store_read.rs:336, read the graph-scoped NODES table. Equal node IDs in separate graphs must not cross scopes; hidden rows must not leak through the fallback. | Planned: tests/safe_eviction_read_through.rs::served_evicted_reads_preserve_scope.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086.6
Refusal: unsafe eviction
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal: unsafe eviction.** Existing eviction callers retain candidates when persistence is absent, a presence lookup errors, or its positional result has the wrong length. A false entry retains that candidate. Do not treat an unconfirmed node as durable or report a cap as reached when nodes remain. | Planned: tests/safe_eviction_read_through.rs::production_eviction_retains_unconfirmed_candidates.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086.7
Refusal: unavailable reads
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal: unavailable reads.** Record current adapter behavior: a backend error produces a warning and None, without fabricated bytes. Distinguish this from a successful backend absence lookup in evidence. This definition creates no typed public error and does not credit a logged miss as successful recovery. | Planned: tests/safe_eviction_read_through.rs::backend_failure_is_not_absence_evidence.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086.8
Restart
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Restart.** After acknowledged writes and actual eviction, restart the real engine on the same durable directory. Use normal startup wiring and request authority. Prove a fresh nonresident lookup and compare exact committed properties. Eager recovery into RAM alone cannot prove post-restart read-through. | Planned: tests/safe_eviction_read_through.rs::restarted_engine_reads_an_evicted_node.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R086.9
Evidence and hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence and hot-path proof.** Enter through authenticated EvictLRU and GetNodeProperties. Observe src/server/handlers/graph_ops/gateway_graph.rs:111 and src/server/handlers/graph_ops/nodes.rs:85, then the real durable lookup. Retain source and binary identity, scope, write acknowledgment, residency, backend outcome and restart observations. Mocks, source inspection and unrelated receipts cannot close this rollup. | Planned: tests/safe_eviction_read_through.rs::served_safe_eviction_read_through_journey.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R087
Semantic changeset review with evidence-backed findings
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Semantic changeset review with evidence-backed findings.** (rollup) Define semantic changeset review across injection, auth bypass, data exposure, cryptography and business logic. Specify five flaw classes, impact/filter policy, finding-to-code evidence, and exact route from probe scorer to GraphOS changeset-review endpoint. Name authenticated producer/consumer edge and positive/negative served acceptance. R138.3 plans ProbeVerdict through served Decide/handle_decide and AgentLibraryStore. This rollup separates that from probe-score selection. | Verified by split `.1` (model definition) and `.2` (served integration) children. Each covers its scope without conflating probe selection with changeset review.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R087.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** `crates/eg-types/src/changeset_review.rs` defines the five flaw classes, impact/filter policy and finding-to-code evidence types. A changeset request names graph mutation and reviewer scope. A finding binds flaw class, severity, evidence reference and location. | Unit tests round-trip types and assert each flaw class.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R087.2
Served integration
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served integration.** Route served `ChangesetReview` request through authenticated producer to EG review handler and back to GraphOS consumer endpoint. Regenerate public method and client contracts. Serve both accept and reject outcomes with typed evidence. | Served test exercises all five flaw classes, verifies positive/negative acceptance, and traces output to code locations.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R088
Behavioral rule correction lifecycle with versioned approval
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavioral rule correction lifecycle with versioned approval.** (rollup) Extend rule proposal/promotion authority with exact correction/output lineage, approved version and replacement/revocation binding. Reuse existing EG-DECISION-ENGINE-R129 promotion authority and AU-DECISIONS rule storage. Do not equate invariant compliance with approval. | Verified by split `.1` (model definition) and `.2` (served integration) children.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R088.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** `crates/eg-types/src/rule_correction.rs` defines correction with original output reference, approved version and replacement/revocation binding. A correction binds rule ID, input pattern and expected output. An approval names two distinct principals and carries an approval timestamp. | Unit tests assert two-principal requirement and replacement/revocation states.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R088.2
Served integration
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served integration.** Wire correction submission and approval through existing rule authority. Check both principals before applying replacement or revocation. Return typed refusal if one principal is repeated. Preserve original invariant checking separate from approval flow. | Served test covers two-principal approval, replacement application, revocation blocking and audit trail.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R089
Step verification verdict with proof binding
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Step verification verdict with proof binding.** (rollup) Define a step verification verdict with uncertainty/proof binding. Consumer must refuse failed dependent conclusions. Link EG evidence authority to AU execution. Establish verification contracts for every reasoning step. | Verified by split `.1` (typed verdict) and `.2` (consumer refusal) children.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R089.1
Typed verdict
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Typed verdict.** `crates/eg-types/src/step_verdict.rs` defines VerificationVerdict with success/failure state, uncertainty bound and proof reference. Bind step identity and reasoning output hash. | Unit tests cover both states, bounds validation and proof reference round-trip.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R089.2
Consumer refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Consumer refusal.** Serving AU execution path checks verdict state before accepting conclusion derived from that step. A failed step refuses all dependent forward-chained conclusions. Preserve existing AU harness integration with EG evidence. | Served test writes one failed step and verifies dependent conclusion refusal. Verify halt of forward chains at failure.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R090
Operator-selected schema import with digest provenance
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Operator-selected schema import with digest provenance.** (rollup) Link GraphOS deployment selection to approved EG schema import and served digest readback. Define duplicate/drift refusal. External triple-store projections remain read-only and trace to EG revision. | Verified by split `.1` (import selection), `.2` (digest binding) and `.3` (read-only projection) children.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R090.1
Import path
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Import path.** `crates/eg-typed-packs` schema registration accepts GraphOS deployment selection and routes through EG schema admission with typed refusal for unknown candidate. Bind selected schema to its revision and digest. | Unit tests assert refusal for unknown/invalid candidates and successful binding for approved ones.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R090.2
Digest readback
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Digest readback.** Served read of selected schema returns exact digest hash enabling client verification. Mismatch with deployment expectation is reported with typed refusal. | Served test verifies digest accuracy and readback consistency after restart.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R090.3
Read-only projection
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Read-only projection.** Any external triple-store projection defined through R090 remains read-only for queries. Mutations are refused with explicit error. External projections trace to EG revision and schema version. | Negative test proves write attempt refused. Trace test verifies lineage to EG source.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R091
Versioned reviewed normative source coexists with EG active policy
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Versioned reviewed normative source coexists with EG active policy.** Policy source revision and digest bind to activated EG policy node. No autonomous source overwrite occurs. Requested source changes route through approved SDK writeback. | Served tests prove rejected/stale review leaves both file and active policy unchanged. R091 child tests verify binding, no-overwrite and governance routing.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R091.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define policy source revision, digest and activation binding to EG policy node. | Unit test round-trips source identity, revision and digest; activation binding confirms match.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R091.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Accept reviewed source revision and activate matching EG policy. | Served test receives reviewed policy source and confirms EG policy reflects it.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R091.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Bind source revision to active policy through durable metadata. | Served metadata readback confirms source revision, digest and active policy match.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R091.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Refuse source overwrite and require SDK writeback for mutations. | Test proves autonomous source mutation is refused; SDK writeback path is accepted.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R091.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Activation event includes source revision and approval authority. | Trace confirms reviewer identity and source version in activation record.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R091.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** GraphOS approved engine policy port receives versioned repository source binding from SDK. | Integration test submits reviewed policy source, confirms EG activation, rejects stale review, restarts and verifies durability.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R092
Multi-step Markov state-probability forecast with calibration refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Multi-step Markov state-probability forecast with calibration refusal.** Regime HMM feeds transition/state horizon probabilities to sizing analysis. Low-confidence refusal prevents invalid positions. Shared forecast/sizing carrier remains specified. | Child tests cover transition matrix oracle, horizon sums, refusal and served sizing dependency. R092 preserves R002 original kernels.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R092.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define transition/state horizon probabilities and sizing consumer binding. | Unit test shows transition matrix, horizon sums and confidence bounds.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R092.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Compute multi-step probabilities from seeded transition matrix. | Test proves probability sequence matches seeded oracle across horizon.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R092.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Link HMM output to sizing analysis through shared carrier. | Served test feeds forecast to sizing and observes position recommendation.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R092.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Refuse low-confidence forecasts for position sizing. | Test shows position refused when confidence below configured threshold.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R092.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Sizing decision includes forecast confidence and refusal reason. | Trace records probability, confidence and refusal reason.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R092.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** Served sizing endpoint consumes HMM forecast with confidence refusal. | Integration test proves seeded transition matrix drives positioning, low-confidence refusal blocks sizing, original kernels remain unmodified.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R093
Probabilistic financial-series provider with sampling controls and batch semantics
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Probabilistic financial-series provider with sampling controls and batch semantics.** AU finance role invokes typed forecast-provider with temperature, nucleus top-p, sample count. Per-series results bind to input series. Model execution stays in dedicated service. | Child tests cover controls, batch identity, refusal and served invocation. AU owns invocation only; SDK transport explicit non-ownership.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R093.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define provider capability with ordered series IDs, temperature, top-p, sample count, model revision. | Unit test round-trips request; all controls validated.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R093.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Invoke dedicated provider with exact control values. | Served test submits request with controls and receives corresponding results.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R093.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** SDK transports request; provider returns per-series results. | Served test matches response series IDs to request order.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R093.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Reject unsupported controls, invalid bounds, missing series and stale identities. | Test proves refusal for out-of-range temperature, unavailable provider.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R093.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Store calibrated/uncalibrated evidence through EG; do not treat sampled output as deterministic math. | Trace marks forecast as probabilistic; readback preserves sample-evidence flag.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R093.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** AU invokes provider through SDK; seeded reproducibility matches declared tolerance. | Integration test submits forecast request with seed, confirms result reproducibility, stores evidence in EG, refuses deterministic-math interpretation.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R094
Hierarchical concept-ID syntax and cross-repository authority
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hierarchical concept-ID syntax and cross-repository authority.** Shared path identity and collision/contradictory-path contract enforced across repositories. | Child tests cover grammar, collision refusal and producer/EG admission authority.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R094.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define concept-ID grammar and path-consistency contract. | Unit test shows valid/invalid ID formats; path collision detected.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R094.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Accept hierarchical concept identifiers and validate path uniqueness. | Served test submits IDs; duplicate paths are refused.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R094.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** EG vocabulary validation owns the admission gate. | Served test routes submission through EG; invalid paths are rejected.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R094.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Refuse duplicate, contradictory or malformed identifiers. | Test proves refusal for conflicting paths and invalid grammar.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R094.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Accepted ID includes repository source and admission timestamp. | Readback confirms authoritative source and acceptance record.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R094.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** Repository producers submit IDs through EG validation; cross-repository path collision is refused. | Integration test submits concept IDs from two repositories, proves collision detection and authority isolation.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095
GraphOS inter-session inbox operation with sender/recipient authorization
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**GraphOS inter-session inbox operation with sender/recipient authorization.** Authenticated inbox operation binds and authenticates sender/recipient before durable enqueue. Read isolation and delivery authorization establish binding. | Child tests cover sender/recipient bindings, authorization refusal and durable delivery.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define inter-session inbox operation with sender/recipient identity binding. | Unit test shows operation round-trips and binds both identities.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Authenticate sender and recipient session. | Served test confirms both sessions are verified before enqueue.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Route inbox operation through session-authenticated gateway. | Served test receives operation through verified request context.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Refuse unknown/unauthorized target session before durable enqueue. | Test proves unknown session and unauthorized recipient are refused.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Durable append includes sender/recipient with delivery binding. | Readback confirms both identities in durable record.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** GraphOS session port sends inbox operation; authorization validates before enqueue; scoped inbox read succeeds. | Integration test proves authenticated sender sends to authenticated recipient, durable append occurs, recipient reads inbox without authorization bypass.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.1000
Model: served agent bus
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model: served agent bus.** `eg-durable` defines `BusParticipant{session_ref, tenant, host_ref, capabilities, last_seen_ms}` and `HubPeer{hub_ref, url_ref, scope}`. Topic messages reuse the inbox entry of this row. Arbora deleted its own bus tool and calls the served methods instead. | Planned: model round-trip tests in `crates/eg-durable/tests/agent_bus.rs`
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.1001
Behavior: served agent bus
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior: served agent bus.** Registration and heartbeat update one participant row in O(1). A roster read scans the tenant's participants in O(n). Dispatch hands one objective to the work queue. Federation forwards one message group to a peer hub. | Planned: behavior tests in `crates/eg-durable/tests/agent_bus.rs`
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.1002
Wiring: served agent bus
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring: served agent bus.** The served methods are `bus.register`, `bus.heartbeat`, `bus.roster`, `bus.send`, `bus.receive`, `bus.dispatch` and `bus.federate`. Each method takes the verified request context. Arbora reaches each one through its generated `eg.<domain>.<Method>` operation. | Planned: a contract test checks that the manifest lists every method.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.1003
Refusal: served agent bus
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal: served agent bus.** The engine refuses a call without the tenant scope. It refuses a message to a participant of another tenant. It refuses a federation peer whose scope is wider than the caller's scope. | Planned: refusal tests in `crates/eg-durable/tests/agent_bus.rs`
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.1004
Evidence: served agent bus
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence: served agent bus.** Tests assert one row per session and a stable message order per topic. A restart keeps every participant and message. | Planned: restart test in `crates/eg-durable/tests/agent_bus.rs`
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R095.1005
Hot-path proof: served agent bus
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof: served agent bus.** Criterion benchmark `bus_send` sends 10,000 messages over 64 concurrent topics. A send has a p50 under 150 microseconds and a p99 under 900 microseconds, under 32 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress by more than 10 percent.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R096
AU search-result persistence with authorized readback completion gate
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**AU search-result persistence with authorized readback completion gate.** EG durable write/read service owned by AU. Search-result receipt and AU readback success gate complete run. Failed/mismatched readback refuses completion. | Child tests cover write binding, readback receipt and completion refusal.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R096.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define search-result write/readback receipt and completion gate. | Unit test shows receipt structure and refusal conditions.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R096.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Accept search result and store durably. | Served test writes search result through EG durable path.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R096.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** EG stores result; AU triggers readback and verifies match. | Served test AU component writes, then reads back and confirms identity.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R096.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Refuse completion when readback fails or mismatches write. | Test proves mismatched readback leaves completion gate open.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R096.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Completion record includes write receipt and readback verification. | Trace confirms both operations and match.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R096.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** AU execution writes search result to EG; readback gate blocks until match verified. | Integration test submits search result, proves readback succeeds only on match, completion gate fires.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R028.1
Run checkpoint and memory binding. Owner decisions remain open
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Run checkpoint and memory binding. Owner decisions remain open.** The EG storage boundary is the existing versioned memory contract in `EG-DURABLE-KERNEL-R085`. A run checkpoint is an immutable `active_context` snapshot. Its canonical UTF-8 content binds `run_id`, `work_item_id`, lease epoch/fencing token, checkpoint revision and payload digest. It also binds separate short-term and long-term memory document references. Each reference carries document ID, revision and digest. The authenticated request establishes tenant and graph authority. Body scope cannot override it. A checkpoint update must be fenced against the live WorkItem lease epoch and fencing token. Current EG surfaces lack an atomic operation that updates an R085 snapshot and binds the WorkItem checkpoint pointer and fence. `CasWorkItemMetadata` is scheduling metadata, not a checkpoint transaction. The exact transaction/recovery contract remains held. No snapshot/pointer atomicity is claimed. A retry must use the same request identity and body. A stale expected revision, mismatched graph/tenant, or expired/superseded WorkItem fence refuses. Digest mismatch or unavailable durable storage also refuses without advancing the checkpoint head. Reads return the exact accepted snapshot revision and digest. `SyncMemorySnapshot`/`ReadMemorySnapshot` are the proposed attachment points. They reuse R085’s existing MutationBatch and R039’s sole redb durability authority. This child does not claim AU resume or host streaming implementation. Source objective: production runs checkpoint across processes, separate short-/long-term memory, isolate tenants, and stream output. Preserve `EG-DURABLE-KERNEL-R028`, `EG-IDENTITY-R006`, `ARBORA-A2A-R001`, `ARBORA-A2A-R001.1`, `ARBORA-OPS-R001`. Source SHA-256: `d89bb9c69e2fdef6a5c3fd428ede3f91868539056c2b949700867d8d8087d1e7`. **Definition hold:** owners have not chosen short-/long-term retention bounds or release authority. They have not defined the AU resume request’s atomic binding to the current WorkItem fence. The host stream ID/cursor authority and replay semantics remain undefined. Keep SPECIFIED until those contracts are reviewed. Do not infer cross-process resume from WorkItem lifecycle or R085 memory sync. | Planned owner acceptance: commit a checkpoint and both memory references through the R085 durable path, then restart. Read back identical revision/digests under the same verified tenant and graph. Refuse wrong tenant/graph, stale revision or stale WorkItem fence. Refuse wrong digest, changed-body replay identity or storage failure without advancing the head. Companion AU/GraphOS tests must resume the exact run and fence. They must continue the existing stream from its exact host-issued cursor without duplicate or skipped output. Those tests are blocked on the listed owner decisions. No runtime evidence or receipt is claimed.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.9
Versioned search state is retained as a complete R085 memory snapshot
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Versioned search state is retained as a complete R085 memory snapshot.** A search-state document is an `active_context` `MemorySnapshot` keyed by stable search-run document ID. Its exact UTF-8 JSON body requires a nonempty `search_run_id` and a positive integer `state_revision` equal to the snapshot revision. It also requires `transcript`, `evidence`, `constraints`, and `open_claims` arrays; each may be empty. EG validates the envelope and hashes the exact stored bytes; AU owns item schemas and source identity within those arrays. The document carries R085’s graph incarnation, snapshot revision, parent revision, content digest, provenance, and retention metadata. The outer verified request is authoritative for tenant, graph, principal, and policy. Write with the current expected head through `SyncMemorySnapshot`. Read the exact revision through `ReadMemorySnapshot` after context eviction. R085’s one-MiB content bound, digest verification, compare-and-set, conflict retention, authorization-before-lookup, and durable MutationBatch path apply. A stale revision preserves the accepted head and returns the R085 conflict outcome. Malformed/oversized content, unauthorized scope, digest mismatch, expired graph incarnation, or unavailable storage refuses without changing the head. EG stores state and returns it; AU owns serialization, compaction policy, and continuation. Preserve `AU-HARNESS-R013.13`, `AU-HARNESS-R020.1`, `EG-DURABLE-KERNEL-R085.1`, `EG-DURABLE-KERNEL-R085.4`, `EG-DURABLE-KERNEL-R085.7`. Source SHA-256: `8c76fa1637e0cc2082a1cce16b9d637f12b310ae96d1fe9a50ec9c64f8e23944`. **Definition hold:** AU has not specified per-entry schemas or source identity fields for the four arrays. AU also has not specified the continuation request/receipt field that binds a resumed search to this exact memory revision. Do not treat the listed required fields alone as an AU continuation contract. | Planned owner acceptance: persist all four required state fields. Evict context and restart or create an independent client. Read back byte-identical canonical content at the bound revision. Refuse oversize, malformed/missing required fields or stale expected revision. Refuse changed graph/tenant, digest mismatch or unavailable storage without changing the head. The AU continuation test must prove it passes the returned document ID/revision. It must restore all four fields before any compacted summary is used. Pending AU schema/receipt decision. No implementation or served receipt is claimed.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R085.10
Prior-session notes use the existing authorized memory authority. Capture and reuse remain AU-owned
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Prior-session notes use the existing authorized memory authority. Capture and reuse remain AU-owned.** EG persists a note only as a versioned R085 `MemorySnapshot`. It includes a stable note ID, source run/task references and captured source revision. It also includes canonical UTF-8 content and digest, provenance, graph incarnation, parent revision and current revision. It also records existing authorization/retention evidence. Reads and lists use `ReadMemorySnapshot`/`ListMemorySnapshots`. Writes use `SyncMemorySnapshot` through the canonical gateway and R039 sole redb authority. R085 controls stale-write conflicts. It retains an authorized candidate without replacing the accepted head. It never reports in-sync when host evidence is absent or stale. EG returns only currently authorized revisions and their explicit conflict/sync state. It does not auto-inject notes into a prompt or choose relevance. Preserve `AU-HARNESS-R022.3`, `EG-DURABLE-KERNEL-R085.2`, `EG-DURABLE-KERNEL-R085.5`, `EG-DURABLE-KERNEL-R085.7`. Source SHA-256: `2362fd76bf40223aeb813866392670b65eae13d02a725b1af9a2e6711542dd12`. **Definition hold:** AU has not defined session/research capture events or the note-kind mapping. Relevance score/threshold and staleness rule also remain undefined. AU has also not defined how conflicting notes are surfaced and selected. These are required before automatic capture and transparent reuse can be claimed. EG’s storage contract does not decide them. | Planned owner acceptance: authorized note write/read survives restart with source revision, digest and provenance intact. Cross-tenant and revoked-authority reads are redacted. Stale submissions return retained conflict without replacing the accepted head. Retention exhaustion refuses before effects. AU acceptance must demonstrate its decided capture trigger and relevance/staleness behavior. It must also show conflict presentation without implicit use of unresolved content. Acceptance remains blocked on the listed AU decisions. No runtime evidence or receipt is claimed.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R084.7
Definition hold: no cross-backend transaction contract is authorized
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Definition hold: no cross-backend transaction contract is authorized.** The defined write boundary remains one graph through served `ApplyMutation`, expected-version arbitration. R039 remains the single redb durability authority. `EG-DURABLE-KERNEL-R024.1` is read-only; R036 defines mirror replay/cursors, not a distributed transaction coordinator. Neither federation reads nor asynchronous mirror targets establish atomic multi-backend writes or tenant-wide ordering. Do not extend R084’s one-graph guarantee to external backends, and do not add writes to read-only sources. Preserve `EG-DURABLE-KERNEL-R084.1` through `.6` and R039 unchanged. Source SHA-256: `96c3079859b0e63ec3e1174e25e7a4ab107b23ef6863ae9b54ff0e921a88e4b0`. **Unresolved owner decisions:** which registered backend kinds, if any, are writable projections. Name the owner for the target registry and coordinator. Whether ordering is per graph or tenant. Whether the contract promises atomic commit or eventual mirror replay. How partial target failure, retry/idempotency, and authoritative receipts are represented. Until owners make those decisions, R084.7 remains an explicit hold and makes no cross-backend write promise. | Existing acceptance remains the two-client, one-graph `ApplyMutation` test with one commit and one typed stale-writer conflict. Cross-backend tests cannot be specified as positive behavior until the target set, ordering and failure semantics above are decided. After owners decide, tests must cover two tenants, two declared targets, concurrent writes and target failure/replay. They must prove R039 remains sole authority, with no silent partial authoritative commit. This row is not closed by the existing one-graph test.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R084.8
Deterministic tenant-scoped ordering across backends
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Deterministic tenant-scoped ordering across backends.** Define which registered backend kinds are writable projections or mirrors and name the owner responsible for the target registry and coordination. Establish whether ordering is enforced per graph or across tenant, and whether the contract provides atomic commit or eventual mirror replay. Define handling for partial target failure, with explicit idempotency, retry and receipt binding. Preserve R084.1-.6 and R039 sole durability authority. | Verified by integration tests covering two tenants, multiple declared targets, concurrent writes to different backends and failure/replay cases. Tests must prove R039 remains sole authority with no silent partial authoritative effect. Include refused uncoordinatable writes.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R038.100
Embedded and served deployment profiles preserve durability classes
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Embedded and served deployment profiles preserve durability classes.** Define an explicit deployment profile with `embedded` (in-process operation requiring no external service) and `served` (configured service endpoint) modes. Profile selection controls transport/startup only. It does not silently change the existing persistent-namespace durability default or sync/redb acknowledgment authority. Ephemeral in-memory namespaces require an explicit `ephemeral` declaration and retain no durable log. Persistent namespaces retain their declared `sync` or `async` class. Do not adopt the source request’s universal in-memory default. Preserve existing parent obligations: `EG-DURABLE-KERNEL-R038`. Source record `EG:60` SHA-256 `b36ed0f40742d2f455b4eae67f2fb64edfb7a6ea87b93cbb8ac0046970728458`. | Start a fresh embedded profile without an external service and read/write an explicitly ephemeral namespace. Verify no persistent namespace is silently downgraded. Start served mode against its configured endpoint and verify its declared sync/async class and acknowledgment boundary. Refuse an unknown profile and an ephemeral-to-durable class mismatch. Read back profile and namespace declarations.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R043.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Link existing vocabulary and mapping IDs for organizations, roles, data assets, permissions and time-series facts per category. | Served schema round-trip confirms vocabulary bindings for all five categories.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R043.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Define scoped query plan from approved source mappings through logical view to agent consumer. | Served tests execute queries under two distinct tenants with differing clearances without duplicating attached source data.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R043.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Accept source-context view configuration and bind it to the durable query planner. | Served test configures one logical view from two approved sources and executes a query.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R043.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Refuse unapproved source or out-of-scope category binding. | Test proves a binding to an unknown source or foreign category is refused before execution.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R043.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Served query response includes source provenance and category path. | Readback verifies provenance covers requested categories and follows the bound mapping.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R043.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** Served GetTenantContext returns scoped bindings; query planner executes through the view without duplication. | Integration test with two tenants and two clearance levels proves query completeness and scope isolation.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R043.7
Attested envelope text admits `@` and `\` and refuses only host identity
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Attested envelope text admits `@` and `\` and refuses only host identity.** `ChangeEnvelope::validate` in `crates/eg-types/src/change_envelope.rs` screens caller-attested material values with the attested rule. These values are graph operation properties, compare-and-set conditions and updates, outbox payloads, evidence loci and feature values. The attested rule is in `crates/eg-types/src/change_envelope/material.rs`. The rule SHALL admit ordinary document text that contains `@` or `\`. Examples are decorators, handles, version pins, LaTeX, escapes and Windows program paths. The rule SHALL refuse a host path that starts anywhere in the text. The host-path prefixes are the home, users, mnt and root prefixes in `HOST_PATH_PREFIXES`. The rule SHALL also refuse a local file URI, a Windows profile path (`<drive>:\Users\`) and an e-mail address. Property keys and envelope identifiers keep the strict character rule. Repository-snapshot material keeps its own rule. | Unit tests in `material.rs`: `attested_material_admits_ordinary_document_text` and `attested_material_still_refuses_host_identity`. The served test `server::tests::test_served_change_envelope_admits_document_text_and_codes_refusals` commits document text with `@` and `\`. It sends `ApplyChangeEnvelopeDraft`, which continues as `ApplyChangeEnvelope`.
requirementEG-DURABLE-KERNELVERIFIED8040b672e582
crates/eg-types/src/change_envelope/material.rs:161
crates/eg-types/src/change_envelope/material.rs:181
src/server/mod.rs:2163
EG-DURABLE-KERNEL-R043.8
Envelope admission refusals carry a declared code and a safe diagnostic
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Envelope admission refusals carry a declared code and a safe diagnostic.** Every refusal that `ChangeEnvelope::validate` returns SHALL carry a declared error code. Host-identity refusals and the strict identifier rule emit `INVALID_ARGUMENT`. The detail names the shape found (host path, file URI or e-mail address) and the material class. The detail SHALL NOT echo the refused value. `contract::classify_refusal` classifies any other free-text refusal as `INVALID_ARGUMENT`. The served path never reports it as `INTERNAL: unclassified engine refusal`. `Response::err` in `crates/eg-types/src/protocol/support_04.rs` SHALL log dropped text at debug level. | The unit test is `host_identity_refusals_are_coded_and_do_not_echo_the_value` in `material.rs`. The served test above asserts `error == INVALID_ARGUMENT` and a privacy detail that names the e-mail shape. It also asserts that the detail does not echo the address.
requirementEG-DURABLE-KERNELVERIFIED690f4389a87e
8040b672e582
crates/eg-types/src/change_envelope/material.rs:198
src/server/mod.rs:2163
EG-DURABLE-KERNEL-R043.100
Committed graph changes publish an ordered, revocable cursor feed
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Committed graph changes publish an ordered, revocable cursor feed.** Add public read operations `Method::OpenGraphSnapshot` (`OpenGraphSnapshotV1`) and `Method::ReadGraphChanges` (`ReadGraphChangesV1`) downstream of the existing `ApplyChangeEnvelope` commit path in `src/server/dispatch/change_envelope.rs`; `GetChangeEnvelope` remains a keyed read, not a feed. Snapshot and events bind graph incarnation, committed revision, snapshot digest, visibility revision and caller authority. Event identity is `(commit_id, event_ordinal)` and ordering is `(graph_incarnation, committed_revision, event_ordinal)`. Tombstones name deleted node/edge ids and deletion revision but are filtered under current authorization. The snapshot response returns the exact high-water cursor from the same consistent read. This cursor prevents gaps in subsequent pages. Cursors are opaque and bind tenant, graph, incarnation, authorization revision and last event. Event replay is at-least-once with stable ids for client deduplication. Page size is 1..256 and retention is 24 hours. An expired cursor returns `CURSOR_EXPIRED` plus a safe current snapshot watermark, never a silent skip. A permission change returns `AUTHORIZATION_CHANGED` after reauthorization and reveals no protected counts or edges. Every event carries `committed_at_ms`, `visible_at_ms`, `latency_profile_revision` and derived `commit_to_visible_ms`. The served p95 target is ≤1000 ms from durable commit acknowledgement to first authorized feed read. The feed is read-only and cannot create a second persistence/write envelope; R043's MutationBatch authority remains mandatory. The EG latency measurement ends at first authorized feed read only. GraphOS/WebUI must separately define a versioned browser commit-to-visible p95. They must also set numeric readable-layout limits, including visible-node/edge budget and interaction target/label bounds. Those values and served receipts are explicit companion prerequisites, not inferred from the EG feed metric. Consumer: `WEBUI-APPS-R030.8` GraphView. Source objective WEBUI:5: “Connected client views reflect graph changes immediately without page refresh. And the graph layout stays readable under concurrent edits from concurrent users.” Source record SHA-256 `0b416b47d85530fb35cf44bf5dc79e04e1b9746481027d0b0687b66579dc9844`. | Use two authenticated served GraphView clients. Take one snapshot. Commit concurrent node/edge edits through `ApplyChangeEnvelope`. Read events on the other client without refresh. Reconnect from the returned cursor. Prove ordered/deduplicable events and independent durable readback. Exercise deletion, expired cursor, stale graph incarnation, and revoked permission. Each returns its typed recovery/refusal without leaking denied graph data. Measure EG commit-to-visible p95 only through first authorized feed read. GraphOS/WebUI separately prove browser commit-to-visible p95 and their versioned numeric readable-layout/interaction limits under concurrent edits. Do not count the EG read bound as that end-to-end evidence. No runtime or owner receipt is claimed.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R042.100
Comparable full-input-token throughput and per-query cost measurements
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Comparable full-input-token throughput and per-query cost measurements.** Extend the existing `BenchmarkClaim.measured_result` with `BenchmarkMeasurementV1`. Bind benchmark case/configuration and dataset/query digests, plus release commit. Bind model, provider and tokenizer revisions. Bind hardware/profile/settings digest. Record request start/end and model-ready timestamps. Record full input-token count from the named tokenizer and inference elapsed milliseconds measured after readiness. Pin the price-table revision. Compute input-token throughput as `full_input_tokens * 1000 / inference_elapsed_ms`. Compute per-query cost using the bound token quantities, price-table currency and currency minor-unit exponent, with explicit rounding. Startup time is reported separately and excluded from both inference elapsed time and throughput. Claims are comparable only when the named benchmark/workload/profile fields match. Missing full input tokens, tokenizer or price revision refuses claim admission. Nonpositive elapsed time, zero denominator, invalid currency exponent or incomparable profile also refuses admission. Preserve existing superiority pass/fail and publication requirements. Producer/consumer: benchmark runner returns measurements; EG binds and validates them in the existing typed claim. No new benchmark executor is introduced. Source objective EG:63 SHA-256 `78016644588199c94f30e549cda44e35667f0447e1ae15a2524a4710bdf92e00`. | Served acceptance recomputes throughput and currency-rounded per-query cost from read-back measurements for multiple releases. It must prove startup is excluded and complete tokenizer input tokens are used. Refuse zero/negative inference elapsed time or missing tokenizer/input-token count/price table. Refuse invalid currency exponent, stale profile or mismatched benchmark inputs. Existing benchmark superiority acceptance remains required. No performance result is claimed by this definition.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R097
Temporal extracted-fact forward chaining and durable per-fact provenance
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Temporal extracted-fact forward chaining and durable per-fact provenance.** A forward-chaining reasoner produces and persists extracted facts with linked temporal rule semantics and durable sentence/axiom origin. Rollup: LANDED only once every child is landed. | Verified by each child requirement's own verification.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R097.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define temporal rule semantics with fact timeline and origin linkage. | Typed test round-trips temporal rule and origin bindings through wire.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R097.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Forward chaining produces facts in time-order and chains derivations. | Served test applies rules sequentially and confirms fact derivation order.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R097.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Fact admission and readback bind origin sentence and axiom references. | Served test retrieves fact with linked provenance from persistence.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R097.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Reject rules with missing temporal bounds or malformed axioms. | Test proves invalid temporal range and unknown axiom are refused.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R097.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Durable fact store preserves origin chain and temporal rule instance. | Durability test shows fact origin persists across restart.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R097.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** Fact production API returns origin chain; integration test traces derived fact to source axiom. | Served API call shows temporal rule fired and returned origin.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R098
Ordered n-ary prediction with unseen-entity behavior and hypothesis-only evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Ordered n-ary prediction with unseen-entity behavior and hypothesis-only evidence.** A public hyperedge predictor accepts ordered arguments, routes unseen entities through hypothesis paths, and admits hypothesis-only evidence classes to output. Rollup: LANDED only once every child is landed. | Verified by each child requirement's own verification.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R098.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Define ordered argument list and hypothesis-class evidence enum. | Typed test round-trips ordered arguments and hypothesis class through wire.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R098.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Unseen entities route through inductive hypothesis path and bind response. | Served test invokes predict with unknown entity and observes hypothesis response.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R098.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Hypothesis evidence class is accepted and binds to public hyperedge predictor. | Served test configures predictor with hypothesis class and invokes it.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R098.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Reject hypotheses with empty argument list and non-hypothesis evidence claims. | Test proves empty arguments and asserting evidence are refused.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R098.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Hypothesis output never claims assertion and carries prediction confidence. | Readback shows hypothesis response lacks assertion flag.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R098.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** Prediction endpoint accepts ordered arguments and routes unseen entity to hypothesis response. | Served test calls predict with (known, unknown) arguments and observes hypothesis reply.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R099
Cross-graph writes fan out across shard writers (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Cross-graph writes fan out across shard writers (rollup).** A multi-graph write must commit each graph's sub-batch on that graph's shard writer. Sub-batches on distinct shards must commit in parallel. The response must prove the fan-out. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R099.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Add `ShardFanoutReport{graph, shard_index, queued_us, commit_us, outcome}` in `crates/eg-types/src/mutation_batch/fanout.rs`. A request holds at most 256 sub-batches. Proving test: `fanout.rs::tests::report_round_trips`. | A serde round trip keeps every field.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R099.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** The engine groups sub-batches by `shard_index(graph, k)` from `src/server/persistence/redb_backend/shard_writer.rs:29`. Each group goes to its writer channel at once. Distinct shards commit in parallel. Graphs on one shard commit in request order. Routing cost is O(b) in sub-batch count. | A unit test with four graphs on four shards observes overlapping commit windows.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R099.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** `multi_graph_batch_update` at `src/server/dispatch/change_envelope/multi_graph.rs:19` is the attach point. Its caller is the served `MultiGraphBatchUpdate` arm at `src/server/dispatch/router/data_plane.rs:770`. It resolves writers through `shard_for` at `src/server/persistence/redb_backend/backend_shard_routes.rs:12`. The writer width comes from `EG-DURABLE-KERNEL-R077`. | A dispatch test asserts one report per sub-batch from the served arm.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R099.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** More than 256 sub-batches must return `INVALID_ARGUMENT` before any commit. A failed sub-batch must return its own typed code in its report. This row adds no cross-graph atomicity. `EG-DURABLE-KERNEL-R084.7` holds that decision. | Tests cover the size refusal and one failed sub-batch beside committed ones.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R099.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** The response must carry one `ShardFanoutReport` per sub-batch. The engine must export `eg_shard_writer_inflight{shard}` and `eg_shard_writer_commit_seconds{shard}`. | A test reads the reports and scrapes the two metrics.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R099.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `MultiGraphBatchUpdate` method. The test `tests/shard_write_fanout.rs::cross_graph_writes_fan_across_shard_writers` writes eight graphs that hash to eight shards with `k = 8`. It must observe eight distinct shard indexes with overlapping commit windows. Wall time must stay under 1.5 times the slowest single-graph commit. The benchmark `benches/multi_graph_fanout.rs` records p50 and p99. | The served test passes, and the benchmark receipt meets the budget.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R100
Native property-graph mirror sinks (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Native property-graph mirror sinks (rollup).** The engine must mirror committed graph changes to three external property-graph sink kinds. The kinds are a Bolt-protocol openCypher server, a RESP-protocol graph server and an embedded columnar graph file. Each sink reuses the `EG-DURABLE-KERNEL-R036` cursor and the `EG-DURABLE-KERNEL-R024.2.2` registry. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R100.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Extend `MirrorSinkKind` at `crates/eg-types/src/mirror_sink.rs:24` with `BoltCypher`, `RespGraph` and `ColumnarGraphFile`. Each variant carries a target locator, a database or graph name, a secret reference and a TLS profile reference. A spec must never carry an inline credential. Proving test: `mirror_sink.rs::tests::graph_sink_kinds_round_trip`. | A serde round trip keeps every field. An inline credential is rejected.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R100.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Add drivers in `crates/eg-plan/src/mirror_sinks/{bolt.rs,resp_graph.rs,columnar_file.rs}` that implement `MirrorTarget` from `crates/eg-plan/src/mirror_target.rs`. Each driver turns committed outbox rows into idempotent `MERGE` upserts in batches of 1,000. The Bolt and RESP clients are pure Rust. The file sink writes Parquet node and relationship tables through `eg-lake` plus a load manifest. The cursor advances only after the target acknowledges a batch. | Unit tests replay one batch twice and observe one target state.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R100.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** The drivers register through `MirrorTargetRegistry::register` in `crates/eg-plan/src/mirror_target.rs`. The outbox consumer path of `EG-DURABLE-KERNEL-R024.5` drives them. Registration enters through the served `MutationOutbox` administrative method. | A served test registers each kind and observes outbox delivery.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R100.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** A plaintext connection to a non-loopback target must refuse with `MIRROR_TRANSPORT_INSECURE`. A non-empty target without explicit adoption must refuse with `MIRROR_TARGET_NOT_EMPTY`. The generated error contract must declare both codes. A refusal must not move the cursor. | Tests cover both refusals and an unchanged cursor.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R100.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Each batch must emit a receipt with sink kind, target locator, cursor start and end, and row count. A reconcile pass must compare source and target digests before the sink reports caught up. | A test reads the receipts and one digest comparison.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R100.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `MutationOutbox` method plus a served `ApplyMutation` write. The test `tests/mirror_graph_sinks_served.rs::each_sink_replays_after_outage` runs a real target for each kind. It stops the target, writes 10,000 nodes, restarts the target and observes equal digests. The benchmark `benches/mirror_graph_sinks.rs` must show at least 20,000 rows per second per sink and p99 batch acknowledgement under 250 ms. | The served test passes against real targets, and the benchmark receipt meets the budget.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R028.2
Read the committed terminal event through the existing WorkItem outcome read
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Read the committed terminal event through the existing WorkItem outcome read.** `GetWorkItemOutcome` retains `work:read`, verified tenant and graph authorization. The fenced terminal CAS binds the engine-derived outbox batch and stored event byte digest to the WorkItem. One snapshot resolves that binding to the exact committed run-event row and exposes its scope, commit sequence, ordinal and safe result references. Legacy rows return explicit `legacy_unbound` unavailability; a missing or corrupt bound event refuses. No lease authority is projected. This point read excludes status/step history and lifecycle streaming. | Commit a real terminal extension, read its event, reopen storage and read the identical identity. Foreign tenants see nothing. Corrupt/missing bound events refuse. Legacy rows report unavailability. Generic writes cannot forge the native binding.
requirementEG-DURABLE-KERNELVERIFIED6aa2533a8865
src/redb_store.rs:6294
src/redb_store/work_item/read/tests.rs:130
src/redb_store/work_item/read/tests.rs:182
src/redb_store/work_item/read/tests.rs:221
src/redb_store/work_item/read/tests.rs:246
EG-DURABLE-KERNEL-R028.3
Fenced metadata CAS requires a live worker lease
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Fenced metadata CAS requires a live worker lease.** When the request includes `expected_lease`, compare stored lease expiry with the engine mutation timestamp inside the row transaction. Refuse at or after expiry, or when expiry is absent, without changing the row. Caller time cannot extend the fence. Preserve unfenced metadata CAS behavior. This does not implement checkpoint atomicity under R028.1. | Planned native row tests cover before, exact and after expiry, absent expiry, unchanged rows on refusal, caller clock independence and unfenced compatibility. Native validation remains pending.
requirementEG-DURABLE-KERNELSPECIFIEDsrc/redb_store/work_item/lease/tests.rs:31
EG-DURABLE-KERNEL-R101
Downtime work is an ontology that drives the engine scheduler (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Downtime work is an ontology that drives the engine scheduler (rollup).** The downtime ontology declares job types, priorities, budgets, windows and preconditions. The scheduler reads the ontology and runs eligible downtime jobs in each window. Foreground work preempts downtime work. Children `.1` to `.6` deliver it. | See each child.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R101.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** Add `crates/eg-core/ontology/downtime_work-v1.ttl` and its shapes file under prefix `dw:`. It declares `dw:JobType`, `dw:Window`, `dw:Budget`, `dw:Precondition` and `dw:priority`. Add `DowntimeJobType{iri, priority, budget, preconditions, window}` and `DowntimeWindow{kind, start, end}` in `crates/eg-jobs/src/downtime.rs`. `budget` reuses `ResourceBudget` (`crates/eg-jobs/src/model.rs:57`). Closed window kinds are `idle` and `declared`. Proving test: `crates/eg-jobs/src/downtime.rs::tests::job_type_round_trips`. | A serde round trip keeps every field, and the shape refuses a job type without a budget.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R101.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** An idle window opens when the foreground queue is empty and requests stay under one per second for 60 s. A declared window opens at its start time. The named default `priority_then_budget_fit` orders eligible types by priority, then by oldest last run. It selects types while their budgets fit the window. The default window budget is 25% CPU and 2 GiB memory. A precondition is a SPARQL ASK; a false answer skips the type. Proving test: `crates/eg-jobs/src/downtime.rs::tests::priority_then_budget_fit`. | Three job types run in priority order, and one with a false precondition is skipped.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R101.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Selection runs on the scheduler tick of `SchedulerConfig` (`crates/eg-types/src/scheduler_config.rs:30`), served by `EG-DURABLE-KERNEL-R076`. Each selected type enqueues an `eg-jobs` job under a background capacity lease. The ontology loads as core schema source `core:downtime-work@1`. Proving test: `crates/eg-jobs/src/downtime.rs::tests::tick_enqueues_leased_jobs`. | A served tick enqueues the selected jobs under background leases.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R101.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** A job type without a budget must refuse with `DOWNTIME_BUDGET_REQUIRED`. A budget sum over the lane floors must refuse as `SchedulerConfig` over-subscription. A job over its budget must stop at its next checkpoint with `DOWNTIME_BUDGET_EXHAUSTED`. Downtime work must not run on reserved foreground lanes. Proving test: `crates/eg-jobs/src/downtime.rs::tests::downtime_refusals`. | Each case returns its code, and no foreground lane runs downtime work.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R101.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Each tick must record `DowntimeSelection{window, candidates, chosen, skipped}` with one reason per skipped type. Each job must record the budget it used. Proving test: `crates/eg-jobs/src/downtime.rs::tests::selection_recorded`. | A served read finds the selection and the budget use of each job.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R101.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** The entry point is the served engine with three declared job types. The test idles for 60 s and observes the run order. It then sends a foreground query. Running downtime jobs must pause within 250 ms. Proving test: `tests/scheduler/test_downtime_scheduler_served.py::test_idle_window_runs_priority_jobs_and_preempts`. | Jobs run in priority order, and the foreground query preempts them within 250 ms.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R102
The engine serves its key-value modality as the memory read and save methods (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**The engine serves its key-value modality as the memory read and save methods (rollup).** `KvGet`, `KvPut`, `KvDelete`, `KvScan` and `KvCas` are stable, wire-callable methods of the generated client contract. Each has request and result schemas and the `kv:read` or `kv:write` scope. GraphOS binds `memory.read` and `memory.write` (`ARBORA-OPS-R024.4`) to them. The served graph-memory methods cover the rest: `Consolidate`, `Reinforce`, `DecayMemories`, `SummariesAtLevel` and trajectories. `EG-DURABLE-KERNEL-R085` still owns versioned document sync with retained conflicts. This row adds no second memory model. Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DURABLE-KERNELVERIFIED34d9e78dbe3c
48284711e3db
5430f4d714ee
70d7b722668b
74f3436402b8
src/server/kv/dispatch_tests.rs:158
src/server/kv/dispatch_tests.rs:159
src/server/kv/dispatch_tests.rs:160
src/server/kv/dispatch_tests.rs:232
src/server/kv/dispatch_tests.rs:261
EG-DURABLE-KERNEL-R102.1
Served contract
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served contract.** The five KV methods are `Stable` and carry the Python consumer profile. The generated contract therefore marks them `is_wire_callable: true`, and the Python client binds them. `KvGet` answers `Option<KvEntry{value, version}>`. `KvPut` answers `KvWriteReceipt{version}`. `KvDelete` answers whether the key existed. `KvScan` answers `KvScanPage{entries, next_cursor}`. `KvCas` answers `KvCasOutcome{swapped, version}`. | `src/server/kv/dispatch_tests.rs::kv_dispatch_put_get_scan_delete_cas` round-trips every method through the real dispatch. The generated contract lists all five as wire-callable.
requirementEG-DURABLE-KERNELVERIFIED34d9e78dbe3c
5430f4d714ee
74f3436402b8
src/server/kv/dispatch_tests.rs:159
EG-DURABLE-KERNEL-R102.2
Scope and authorization
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Scope and authorization.** A private key's store namespace is an opaque digest of tenant, principal, request graph and namespace. All four come from the verified request; no body field widens them. No Redis, S3 or KV-cache adapter namespace can alias a served one. Reads require `kv:read` or the coarse `kg:read`. Writes require `kv:write` or the coarse `kg:write`. The request boundary refuses a missing scope before any row is read. | `src/server/kv/dispatch_tests.rs::kv_keys_are_scoped_by_graph_and_writes_need_kv_write`: the same key in another graph is absent. A `kv:read`-only caller reads, and its write is refused with the row unchanged.
requirementEG-DURABLE-KERNELVERIFIED34d9e78dbe3c
74f3436402b8
src/server/kv/dispatch_tests.rs:261
EG-DURABLE-KERNEL-R102.3
Versioned compare-and-swap and bounded paginated scan
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Versioned compare-and-swap and bounded paginated scan.** Every served write stamps the namespace's mutation-kernel commit version. That version never repeats, even after a delete and re-create. `KvCas` swaps only when the stored version equals `expected_version`; `0` means absent. A refused `KvCas` reports the current version. `KvScan` returns at most 1000 rows (default 100) and 4 MiB per page, in key order. Its exclusive-start cursor must lie inside the prefix. | `src/server/kv/dispatch_tests.rs::kv_dispatch_put_get_scan_delete_cas` covers stale-version refusal, create-if-absent and no A-B-A after delete. `::kv_scan_pages_are_bounded_and_resume_from_the_cursor` reads 25 keys in three pages and refuses a foreign cursor. `src/server/kv/wire.rs::tests::versions_never_repeat_across_delete_and_recreate` covers the row codec.
requirementEG-DURABLE-KERNELVERIFIED34d9e78dbe3c
5430f4d714ee
src/server/kv/dispatch_tests.rs:160
src/server/kv/dispatch_tests.rs:232
src/server/kv/wire.rs:339
EG-DURABLE-KERNEL-R102.4
Durable, audited, replayable mutations
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Durable, audited, replayable mutations.** `KvPut`, `KvDelete` and `KvCas` each commit as one native MutationBatch in `kv.redb`. Their durability domain is `KvRedb`, and they commit before they acknowledge. One transaction holds the row, ledger, fence, idempotency record and outbox. They are `audited`: a digest-only `KV_PUT`, `KV_DELETE` or `KV_CAS` line plus the durable batch ledger. They emit no graph CDC, because native outbox rows are the projection authority. `KvDelete` is idempotent; `KvPut` and `KvCas` are not. All three replay by `OperationIdentity`. A fresh nonce with the same operation key returns the stored verdict without a second write. | `src/server/kv/dispatch_tests.rs::kv_fresh_nonce_replays_stable_operation_without_duplicate_write`; `crates/eg-capabilities/tests/consistency` `audited_matches_audit_rs_exactly`.
requirementEG-DURABLE-KERNELVERIFIED34d9e78dbe3c
5430f4d714ee
src/server/kv/dispatch_tests.rs:314
EG-DURABLE-KERNEL-R102.5
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** The entry point is the served, authenticated dispatch against a durable `kv.redb`. The test sends 400 sequential `KvPut`/`KvGet` pairs of 256-byte values. `KvGet` must finish within 5 ms at p50 and 20 ms at p99. `KvPut` must finish within 25 ms at p50 and 500 ms at p99. Both include envelope verification. `KvPut` also includes the durable commit. On R820 in a debug build, `KvGet` measured 1012 µs at p50 and 1731 µs at p99. There `KvPut` measured 3931 µs at p50 and 7006 µs at p99. On a hosted CI runner, `KvGet` measured 530 µs at p50 and 905 µs at p99. There `KvPut` measured 2151 µs at p50 and 110589 µs at p99. | `src/server/kv/dispatch_tests.rs::kv_served_hot_path_meets_latency_budgets` prints and asserts the measured p50 and p99.
requirementEG-DURABLE-KERNELVERIFIED34d9e78dbe3c
48284711e3db
src/server/kv/dispatch_tests.rs:371
EG-DURABLE-KERNEL-R102.6
Opt-in shared namespace
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Opt-in shared namespace.** Every KV method takes `shared`, which defaults to `false`. A private key stays scoped to the verified tenant, principal, request graph and namespace. `shared: true` drops only the principal. Every principal of the verified tenant and request graph then sees one row. The tenant owns its kernel scope, so writers from different principals advance one version sequence. A shared `KvPut`, `KvDelete` or `KvCas` needs the separate `kv:shared:write` action or `kg:admin`. The coarse `kg:write` and `kv:write` grants are refused. A shared read needs `kv:read`. | `src/server/kv/dispatch_tests.rs::kv_shared_namespace_spans_principals_and_needs_kv_shared_write`: one principal's private key is absent for another. A second principal reads a shared write, which is not the writer's private row. A coarse-write principal is refused.
requirementEG-DURABLE-KERNELVERIFIEDb714af935390
src/server/kv/dispatch_tests.rs:441
EG-DURABLE-KERNEL-R609
Versioned mutations, bitemporal validity and epistemic result rows are engine primitives (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Versioned mutations, bitemporal validity and epistemic result rows are engine primitives (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R609.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** `crates/eg-types/src/versioning.rs` defines KgTransaction, KgCommit, KgDiff, BitemporalStamp, EpistemicRow, KnowledgeBatch. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R609.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** A transaction collects node and edge mutations and applies atomically with rollback; a diff compares two versions. Every write carries storage time, event time and a validity interval; later event time wins a contradiction and supersedes. Query results carry score, confidence, validity window, evidence and policy labels per row, and a bulk columnar stream returns them in batches. | Unit tests cover each rule with positive and boundary cases.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R609.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Built on MutationBatch of EG-DURABLE-KERNEL-R043; the stamp is applied at the single write chokepoint. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R609.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** An interval whose end precedes its start is refused. The stable code is `VALIDITY_INVERTED`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R609.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Per commit: version, mutation count, diff size. | Test reads the trace or metrics after one success and one refusal.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R609.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** commit of 10k mutations: p50 under 40 ms, p99 under 120 ms; as-of filter adds under 5 percent to scan time. The benchmark is `benches/r609_durable_graph_kernel.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R071.600
Lane-aware claim on the durable task queue
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Lane-aware claim on the durable task queue.** `claim` accepts a lane and queue class and rotates across lanes before priority buckets, as `EG-INGEST-WORKER-R604` defines; one queue serves every lane and no second queue backend exists. Claim p99 stays under 1 ms at 64 workers. | Integration test claims across three lanes and asserts rotation and per-lane depth.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R750
Durable agent dispatch queue, turn claims and cooperative cancellation (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Durable agent dispatch queue, turn claims and cooperative cancellation (rollup).** Rust-native in `crates/eg-durable/src/dispatch`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R750.750
Model: Durable agent dispatch queue, turn claims and cooperative cancellation
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model: Durable agent dispatch queue, turn claims and cooperative cancellation.** The engine enqueues agent turns on the durable task queue with a signed carrier. A worker claims a turn under a fenced session lock, so one worker owns a session turn at a time. The worker heartbeats the claim. Cancellation is cooperative, and the queue worker owns the lifetime. Types: `AgentTurnEnvelope`, `DispatchCarrier`, `SessionLock`, `ClaimGuard`, `CancelToken`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R750.751
Behavior: Durable agent dispatch queue, turn claims and cooperative cancellation
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior: Durable agent dispatch queue, turn claims and cooperative cancellation.** Enqueue is bounded and returns a typed full result under backpressure. Claim and ack are idempotent by execution key. Cancellation is requested by soft timeout and enforced by the worker. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R750.752
Refusal: Durable agent dispatch queue, turn claims and cooperative cancellation
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal: Durable agent dispatch queue, turn claims and cooperative cancellation.** The engine refuses a carrier whose secret is unavailable. It refuses a second claim of a held session. It refuses an enqueue beyond the bound. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R750.753
Hot-path proof: Durable agent dispatch queue, turn claims and cooperative cancellation
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof: Durable agent dispatch queue, turn claims and cooperative cancellation.** Criterion benchmark `dispatch_claim` at 50k claims per second per shard. The p50 is under 100 microseconds and the p99 is under 500 microseconds. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R751
Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions (rollup).** Rust-native in `crates/eg-durable/src/run_state`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R751.750
Model: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions.** Resumable execution persists a checkpoint per step. Sessions and chat history are durable records with bounded retention. Fenced shared resource leases admit distributed capacity. Engine change subscriptions drive reactions with a budget and an append-only ledger. Types: `ExecutionCheckpoint`, `SessionRecord`, `ChatRecord`, `ResourceLease`, `LeaseFence`, `ReactiveSubscription`, `ReactionLedger`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R751.751
Behavior: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions.** Resume replays from the last checkpoint with idempotent steps. A lease carries scope, epoch and fence and is granted or denied atomically. A reaction fires at most once per event id within its budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R751.752
Refusal: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions.** The engine refuses five cases with typed errors. They are a stale fence, an expired lease, a scope mismatch, an idempotency conflict and a reaction beyond its budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R751.753
Hot-path proof: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions.** Criterion benchmark `lease_acquire` runs at 10k leases. The p50 is under 80 microseconds and the p99 is under 400 microseconds. Memory stays under 8 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R752
Repository work items and operation payloads (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Repository work items and operation payloads (rollup).** Rust-native in `crates/eg-durable/src/work_item`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R752.750
Model: Repository work items and operation payloads
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model: Repository work items and operation payloads.** Repository work items are durable records. Each record holds a bounded typed operation payload, never a command envelope. It also holds the execution context, artifact promotion candidates and outcomes. Its lifecycle uses fenced transitions. Types: `WorkItem`, `OperationPayload`, `WorkItemContext`, `ArtifactPromotion`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R752.751
Behavior: Repository work items and operation payloads
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior: Repository work items and operation payloads.** Transitions are compare-and-set on the item revision. A promotion is evaluated against stored evidence before it is committed. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R752.752
Refusal: Repository work items and operation payloads
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal: Repository work items and operation payloads.** A payload larger than its bound, an untyped operation and a transition from a stale revision are refused. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R752.753
Hot-path proof: Repository work items and operation payloads
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof: Repository work items and operation payloads.** Criterion benchmark `work_item_transition`. The p50 is under 120 microseconds and the p99 is under 600 microseconds. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R820
Uncertain effects and effect receipts on work items (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Uncertain effects and effect receipts on work items (rollup).** Extends `EG-DURABLE-KERNEL-R752`. A work item whose effect started and has no proven outcome stays open until an effect receipt resolves it. Rust-native in `src/redb_store/work_item/` and `crates/eg-types`. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R820.1
Model: Uncertain effects and effect receipts on work items
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model: Uncertain effects and effect receipts on work items.** A work item can record an effect that started and has no proven outcome. Add `EffectState{Unstarted, Started, Resolved}` to the work-item row in `src/redb_store/work_item/`. Add `EffectReceipt{job_id, request_ref, principal_ref, outcome, receipt_ref, committed_at}` in `crates/eg-types/src/work_item_read.rs`. Add `AdmittedRequest{request_ref, tenant, session_ref, payload_digest, bytes}` as an immutable content-addressed record. `request_ref` is the SHA-256 digest of the canonical request. One receipt exists for each job ID. | A serde round trip keeps every field. A golden vector fixes the `request_ref` digest of one canonical request.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R820.2
Behavior: Uncertain effects and effect receipts on work items
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior: Uncertain effects and effect receipts on work items.** `MarkWorkItemEffectStarted` sets `Started` under the live claim before the first effect. A lease expiry on a `Started` item returns the item to `ready` with its attempt count unchanged. Retry exhaustion never moves a `Started` item to `dead_letter`. The item stays open until a receipt resolves it. `RecordEffectReceipt` writes the receipt once per job ID in the same transaction as the terminal commit. A replay of the same receipt returns the stored receipt. `GetEffectReceipt` reads it by job ID. `GetAdmittedRequest` reads a request by reference within the caller tenant and session. Writes are compare-and-set on the item revision, O(1) per call. | Unit tests cover each transition, the unchanged attempt count, the blocked dead letter and the idempotent replay.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R820.3
Wiring: Uncertain effects and effect receipts on work items
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring: Uncertain effects and effect receipts on work items.** Serve `MarkWorkItemEffectStarted`, `RecordEffectReceipt`, `GetEffectReceipt`, `SubmitAdmittedRequest` and `GetAdmittedRequest` as coordination methods in the public contract. Use the existing `work:write` and `work:read` scopes. The claim path in `src/redb_store/work_item/claim.rs` reads `EffectState` before it retires an item. The commit path in `src/redb_store/work_item/commit.rs` writes the receipt in its terminal batch. arbora binds these methods as `eg.coordination.*` operations; its tool-task worker (ARBORA-A2A-R002.2.2) consumes them. | A served test reaches each method through the wire contract, not through a unit entry point.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R820.4
Refusal: Uncertain effects and effect receipts on work items
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal: Uncertain effects and effect receipts on work items.** A receipt whose job ID, request reference or principal differs from the work item refuses with `EFFECT_RECEIPT_MISMATCH`. A second, different receipt for one job ID refuses with `EFFECT_RECEIPT_CONFLICT`. A start mark without a live claim refuses with `WORK_ITEM_CLAIM_STALE`. A request read from another tenant or session returns not found. An admitted request whose bytes do not match its reference refuses with `ADMITTED_REQUEST_DIGEST_MISMATCH`. | Negative tests assert each code and that durable state is unchanged.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R820.5
Evidence: Uncertain effects and effect receipts on work items
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence: Uncertain effects and effect receipts on work items.** Each start mark, receipt and blocked retirement records the job ID, item revision, outcome and timing in the work-item audit. The audit holds no parameters or credentials. Export the counter `eg_work_item_uncertain_effects_total` and the gauge `eg_work_item_uncertain_open`. | A served read finds the audit entries, and the metrics change after one uncertain run.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R820.6
Hot-path proof: Uncertain effects and effect receipts on work items
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof: Uncertain effects and effect receipts on work items.** The served test `tests/durable/test_uncertain_effect_served.py::test_started_item_never_dead_letters` claims an item, marks its effect started, lets the lease expire past the attempt ceiling and observes the item open. It then records a receipt and observes a terminal item. Criterion benchmark `benches/work_item_effect_receipt.rs` runs at 10k items with 32 writers. The p50 is under 150 microseconds and the p99 is under 700 microseconds per receipt. Memory stays under 16 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R700
Retention cleanup removes aged documents and orphans (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Retention cleanup removes aged documents and orphans (rollup).** Retention policy removes documents past their age limit. It also removes nodes left without any edge or owner. It works in bounded batches. A batch never removes a node held by a live reference or a legal hold. Implemented in eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R700.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** `RetentionPolicy { age, batch, holds }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R700.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Candidates are scanned in id order with a cursor; each batch is one `MutationBatch`. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R700.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** Runs on the maintenance lane and respects blob grace periods (R050). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R700.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** The engine never removes a node with a live reference or hold. It refuses a policy without a hold check at registration. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R700.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Each batch records counts and the cursor. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R700.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/durable/test_retention_cleanup_served.py::test_held_and_referenced_nodes_survive` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/retention_scan.rs` must show p50 under 8 ms and p99 under 50 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R710
Backend-agnostic graph copy and persisted-index migration catalogue: model and behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Backend-agnostic graph copy and persisted-index migration catalogue: model and behavior.** Extends `EG-DURABLE-KERNEL-R070`. `crates/eg-core` copies a graph between stores by streaming typed batches. Each batch has a verified count and digest. The crate also keeps one catalogue of one-time persisted-index migrations. Each migration has a spec, a run function and an idempotency marker. Copy is O(nodes + edges) with bounded memory. The migration catalogue runs in declared order. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R711
Backend-agnostic graph copy and persisted-index migration catalogue: refusal, evidence and hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Backend-agnostic graph copy and persisted-index migration catalogue: refusal, evidence and hot-path proof.** Extends `EG-DURABLE-KERNEL-R070`. The engine refuses a copy whose destination digest differs. It leaves the destination empty. It refuses a migration without a marker. Test `tests/durable/test_graph_copy_served.py::test_digest_mismatch_leaves_destination_empty`. Benchmark `benches/graph_copy.rs` has p50 under 400 ms and p99 under 1500 ms per 100,000 elements. Memory stays under 128 MiB. Copies of different graphs run in parallel. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R100.700
Mirror target naming and a lossless per-mirror outbox: model and behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Mirror target naming and a lossless per-mirror outbox: model and behavior.** Mirror sinks accept only validated target graph names. They refuse an unconfigured or reserved target. They deliver through one durable outbox per mirror with head-only attempt accounting (R001). One slow mirror never blocks the authority or another mirror. The authority commits first. A mirror hand-off after an authority commit is a typed retry, never a rollback. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R100.701
Mirror target naming and a lossless per-mirror outbox: refusal, evidence and hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Mirror target naming and a lossless per-mirror outbox: refusal, evidence and hot-path proof.** A reserved target name is refused; an authority-committed hand-off failure is retried from the outbox. Test `tests/durable/test_mirror_outbox_served.py::test_slow_mirror_does_not_block_authority`; benchmark `benches/mirror_outbox.rs` p50 under 1 ms and p99 under 6 ms added to the authority commit, memory under 64 MiB for 1,000,000 queued entries. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R094.700
Unified identifier registry across stores: model and behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Unified identifier registry across stores: model and behavior.** Identifier generation yields one hierarchical concept identifier per entity. A registry owned by the engine resolves it identically in document, graph and vector stores. Allocation is collision-free under concurrent writers. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R094.701
Unified identifier registry across stores: refusal, evidence and hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Unified identifier registry across stores: refusal, evidence and hot-path proof.** An identifier outside the grammar is refused; a collision is refused with both owners. Test `tests/durable/test_identifier_registry_served.py::test_concurrent_allocation_is_collision_free`; benchmark `benches/identifier_alloc.rs` p50 under 0.05 ms and p99 under 0.5 ms, memory under 16 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R800
Cache tier admission, rebuild-cost eviction and answer-cache freshness (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Cache tier admission, rebuild-cost eviction and answer-cache freshness (rollup).** `crates/eg-kvcache` decides which prompt-prefix and answer entries are worth caching in each tier. It uses reuse rate and rebuild cost. It evicts by value density. It serves a semantic answer cache. Its entries expire by the volatility class of the facts they depend on. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R800.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** `CacheEntryMeta{key_digest, tier, bytes, hits, rebuild_cost_ms, deps:[GenerationRef]}` and `TierPolicy{max_bytes, min_worth}` in `crates/eg-kvcache/src/policy.rs`. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::low_worth_entry_is_not_admitted`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R800.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** `worth = hits * rebuild_cost_ms / bytes`. Admission needs worth at or above `min_worth`. Eviction removes the lowest worth first from a heap in O(log N). An answer entry is invalid once any dependency generation advances. It is also invalid once its volatility window passes. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::lowest_worth_is_evicted_first`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R800.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** The policy attaches inside the existing versioned KV tier of R083 through R086, and invalidation reuses the dependency generations of EG-FEDERATED-QUERY-R017 and R018. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::dependency_advance_invalidates_answer`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R800.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** Three inputs return a miss with no content. The first is an entry larger than the tier. The second is a dependency list that names an unknown generation. The third is a read for another tenant's key. The engine never returns a stale hit. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::oversize_entry_is_refused`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R800.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Evidence is a counter set (admitted, evicted, invalidated, hit ratio). The metrics method exposes it, together with a replayable trace of decisions. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::foreign_tenant_key_misses`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R800.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** Hot-path proof: a Criterion benchmark of 1 million admit and lookup operations reports lookup p50 under 5 microseconds. The lookup p99 stays under 50 microseconds. Admission overhead stays under 10 percent. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::admit_lookup_bench_within_budget`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R850
Durable topic message log with cursor reads
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Durable topic message log with cursor reads.** The engine stores topic messages in an append-only log. Each topic has a total order. A reader reads the messages after its cursor and gets the next cursor. The engine redacts private fields before it stores a message. Rollup: LANDED only when every child is landed. | Each child requirement has its own verification.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R850.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** `eg-durable` defines `TopicEntry{topic, seq: u64, sender, body_ref, redaction_digest, appended_at}` and a `TopicCursor(u64)`. One ordered key-value table keys entries by `(topic, seq)`. Append is O(log n). A read of k entries is O(log n + k). | A unit test round-trips one entry and one cursor through the wire codec.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R850.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Append gives each entry the next `seq` of its topic. Concurrent appends to one topic serialize on one per-topic lock. Appends to different topics run in parallel. A read returns at most the requested count, in `seq` order, and the next cursor. | A test runs 8 concurrent writers on one topic and finds no gap and no repeated `seq`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R850.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** The served operations `topic.append` and `topic.read` take the verified request context. The engine checks the caller's topic scope before it touches the log. | A served test appends and reads through the verified request context.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R850.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** The engine refuses an append without topic scope with `TOPIC_SCOPE_REQUIRED`. It refuses a cursor past the topic head with `TOPIC_CURSOR_AHEAD`. It refuses a body over 1 MiB with `TOPIC_BODY_TOO_LARGE`. It stores nothing for a refused append. | A test proves each code and an unchanged log after each refusal.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R850.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Each entry keeps the sender and the redaction digest. A restart keeps every entry and its order. | A durability test restarts the engine and reads the same entries and digests.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R850.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** An append must finish within 1 ms at p50 and within 5 ms at p99. A read of 100 entries must finish within 3 ms at p99. The index must use no more than 256 bytes for each entry. The benchmark `crates/eg-durable/benches/topic_log.rs` appends 100 000 entries over 16 topics. Then it reads them back. | The benchmark reports the latency percentiles and the index memory within the budgets.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R851
Agent peer records
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Agent peer records.** The engine stores one record for each remote agent peer that the platform can call. A record holds the peer name, the endpoint, the agent card digest, the skill list and a credential reference. It never holds a credential value. Rollup: LANDED only when every child is landed. | Each child requirement has its own verification.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R851.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** `eg-types` defines `AgentPeer{name, endpoint, card_digest, skills: Vec<SkillRef>, credential_ref, refreshed_at}`. The engine keys peers by `name` in one table. Lookup is O(1) on average. | A unit test round-trips one peer through the wire codec.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R851.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Register replaces the record with the same name. Delete removes it. List returns peers in name order. A refresh that changes the card digest records a new revision. | A test registers, refreshes, lists and deletes a peer and reads each revision.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R851.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** The served operations `peer.register`, `peer.delete` and `peer.list` take the verified request context. The A2A routing decision (`EG-DECISION-ENGINE-R044`) reads the peer table. | A served test registers a peer and finds it in the routing registry.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R851.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** The engine refuses a record that holds a credential value with `PEER_CREDENTIAL_VALUE`. It refuses an endpoint without `https` outside loopback with `PEER_ENDPOINT_INSECURE`. | A test proves each code and no stored record.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R851.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Each revision keeps the caller, the card digest and the time. | A served read returns the revision history of one peer.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R851.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** With 10 000 peers, a peer lookup must finish within 200 µs at p99. The table uses at most 2 KiB per peer. Benchmark: `crates/eg-durable/benches/agent_peers.rs`. | The benchmark reports the lookup p99 and the memory within the budgets.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R852
Incident and health-anomaly records with correlation
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Incident and health-anomaly records with correlation.** The engine stores health anomalies and incidents. It groups anomalies that share a resource and a time window into one incident. An incident moves through `open`, `acknowledged`, `resolved` and `closed`. Rollup: LANDED only when every child is landed. | Each child requirement has its own verification.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R852.1
Model
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Model.** `eg-types` defines `HealthAnomaly{resource, signal, value, baseline, observed_at}` and `Incident{id, resources, anomalies: Vec<AnomalyRef>, status, opened_at, route}`. | A unit test round-trips both records through the wire codec.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R852.2
Behavior
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Behavior.** Ingest attaches a new anomaly to the open incident of its resource when the anomaly is inside the correlation window. Otherwise ingest opens a new incident. The default window is 15 minutes. The engine decision sets the window value. Status changes follow the state order only. | A test ingests three anomalies on one resource and one on another and finds two incidents.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R852.3
Wiring
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring.** The served operations `incident.ingest_anomaly`, `incident.set_status` and `incident.list` take the verified request context. Graph OS calls them from its health and alert intake. | A served test ingests an anomaly through the verified request context.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R852.4
Refusal
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Refusal.** The engine refuses a status change out of state order with `INCIDENT_STATUS_ORDER`. It refuses an anomaly without a resource with `ANOMALY_RESOURCE_REQUIRED`. | A test proves each code and an unchanged incident.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R852.5
Evidence
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Evidence.** Each incident keeps every anomaly reference and every status change with its caller. | A served read returns the anomaly list and the status history.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R852.6
Hot-path proof
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof.** With 1 000 open incidents, an anomaly ingest must finish within 2 ms at p99. Correlation is O(log n) in the open incidents of one resource. Benchmark: `crates/eg-durable/benches/incident_correlation.rs`. | The benchmark reports the ingest p99 within the budget.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R028.4
Bind run ownership during native admission
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Bind run ownership during native admission.** Optional single-run admission captures verified caller attribution in the new WorkItem transaction. Graph, tenant and run select a deterministic WorkItem ID; caller-selected IDs and batch run admission refuse. Existing bindings cannot be attached, replaced or forged through generic writes. Existing replay authority remains mandatory. | Native tests prove admission, duplicate refusal, caller attribution and generic-write refusal. Publication remains separate.
requirementEG-DURABLE-KERNELSPECIFIEDsrc/redb_store/work_item/row_guard.rs:266
tests/adopt_workitem_authenticated_replay.rs:459
tests/test_work_item_retry_identity.py:128
tests/test_work_item_retry_identity.py:274
EG-DURABLE-KERNEL-R028.4.1
Recover immutable run submission records
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Recover immutable run submission records.** `GetRunWorkItem` reads the WorkItem and original submission from one durable snapshot. Graph, tenant, run and verified owner select the record. Missing and foreign records return null. Missing or malformed historical evidence returns non-retryable `RUN_ADMISSION_UNAVAILABLE`. Completion, lease expiry and restart preserve the original submission. Generic writes cannot plant, replace or remove it. Reading grants no execution authority. | Storage tests cover restart, owner isolation, invalid evidence and immutable retry records. Served tests cover authenticated dispatch. Point lookup costs O(log N + B) time and O(B) memory for B bounded submission bytes.
requirementEG-DURABLE-KERNELVERIFIED62374ef41f37
924601ce5495
fc65d45d509d
src/redb_store/work_item/row_guard.rs:316
src/redb_store/work_item/run_owner/tests.rs:115
src/redb_store/work_item/run_owner/tests.rs:147
src/redb_store/work_item/run_owner/tests.rs:446
src/redb_store/work_item/run_owner/tests.rs:48
EG-DURABLE-KERNEL-R028.4.2
Qualify recovery performance
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Qualify recovery performance.** Owner-bound recovery targets p99 below 10 ms for a bounded original submission. | A dedicated reproducible recovery benchmark must record workload, hardware, build profile and latency. Functional tests do not establish this acceptance.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R028.5
Native current-plan publication and readback
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Native current-plan publication and readback.** Apply the owner admission amendment's publication/read transaction: immutable verified owner, active exact live fence, initial empty revision zero, strictly increasing later revisions, unchanged expiry on replay, and one authoritative snapshot read. Reuse WorkItem MutationBatch receipts and scoped stable retry identity. | Native tests cover ordered publication, owner/fence/expiry/revision refusal and durable readback; authenticated replay tests prove no extra effect. Target p99 point publication/read under 10 ms for at most 1024 items and 1 MiB payload; benchmark `current_plan_publication_readback` remains required before performance acceptance.
requirementEG-DURABLE-KERNELSPECIFIED88fc4a5577c7
f9bfc0da8ae7
crates/eg-storage/src/owner/agent_library_upgrade/tests.rs:293
crates/eg-types/src/current_plan/tests.rs:110
crates/eg-types/src/current_plan/tests.rs:3
src/redb_store/work_item/current_plan/tests.rs:135
src/redb_store/work_item/current_plan/tests.rs:66
EG-DURABLE-KERNEL-R030.1
Issuer-bound host-start record
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Issuer-bound host-start record.** `IssueHostStartGrant` requires dedicated service scope `host:issue-start`; generic control-lease issuance rejects reserved kind `host.start`. Reuse the protected ControlLease row and MutationBatch. Engine time bounds expiry to the asserted session expiry and existing 24-hour limit. Persist immutable beneficiary, session, workspace, configuration, interface and policy assertions and storage-owned issuer provenance from the authenticated batch actor, outside grant JSON. Legacy rows lack provenance and do not qualify. Generic consumption refuses; CAS revoke/expire only remove availability. Arbora owns current session/issuer policy and actual connector execution, not this record. No cross-store atomic session admission or external-effect reservation is claimed. Maximum grant 64 KiB, reference 512 bytes, one inserted row. Benchmark: `redb_write_latency_bench`; host-start latency measurement remains pending. | Typed tests cover bounds and forged provenance; native storage tests cover issuer stamping, collisions, legacy absence, revocation and consumption refusal. Served scope tests reject lease-only callers. Generated contract and native qualification are required before release.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R083.5
Tier ladder from accelerator memory to durable storage
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Tier ladder from accelerator memory to durable storage.** The inference connector `epistemic_graph/kvcache/connector.py:221` must offload a block from accelerator memory to the engine. `crates/eg-kvcache/src/tiered.rs:319` must place the block in the hot host-memory tier. Byte pressure must demote the lowest-scored block one rung: hot, compressed warm, then durable cold. The durable cold tier must use the redb store of `crates/eg-kvcache/src/cold.rs`. A hit must promote the block to hot. A demotion must move the bytes and must not drop them. | `crates/eg-kvcache/tests/tier_ladder.rs::demote_then_promote_keeps_bytes` fills each tier past its budget and reads every block back byte-identical.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R083.6
Graph-guided paging policy
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Graph-guided paging policy.** `apply_importance_scores` at `crates/eg-kvcache/src/tiered.rs:289` must take block importance from the graph centrality of `crates/eg-kvcache/src/graph_importance.rs:35`. The demotion score must combine recency and importance with the weight of `tiered.rs:263`. A hit must prefetch the cold blocks whose graph neighbors the same request reads. | `crates/eg-kvcache/tests/graph_paging.rs::central_blocks_stay_hot_and_neighbors_prefetch` shows a central block outlives a peripheral block and a neighbor block pages in early.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R083.7
Long-context coherence across tiers
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Long-context coherence across tiers.** A context of 10 000 000 tokens must stay coherent across all tiers. Coherent means that each paged-in block digest equals its digest at first write. The tier must not serve a block under a different model version or token-prefix hash. | `crates/eg-kvcache/tests/long_context.rs::ten_million_token_context_pages_in_coherent` writes the context over a 25 percent host budget and finds zero digest mismatches.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R083.8
Tier refusals
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Tier refusals.** A failed durable cold write must keep the block in the warm tier and return `KV_COLD_WRITE_FAILED`. A page-in with a digest mismatch must refuse with `KV_BLOCK_DIGEST_MISMATCH` and must drop the block. | `crates/eg-kvcache/tests/tier_ladder.rs::cold_write_failure_and_digest_mismatch_refuse` asserts each code and an unchanged tier state.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R042.2
Cross-modal query latency benchmark
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Cross-modal query latency benchmark.** The harness `crates/eg-plan/benches/hybrid_queries.rs` must run the `EG-CQ-XSRC-R009` program on a fixed corpus. The corpus holds 1 000 000 claims, 10 000 000 edges and 1 000 000 vectors of 384 dimensions. The starting target is 150 ms at p50 and 500 ms at p99. A measurement on this platform replaces the starting target. | The harness writes a `BenchmarkClaim` receipt with the configuration, the corpus digest, p50 and p99.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R042.3
KV-cache tiering benchmark
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**KV-cache tiering benchmark.** The harness `crates/eg-kvcache/benches/tiering.rs` must replay a multi-turn trace with a host-memory budget of 25 percent of the working set. The starting hit-rate target is at least 0.90 over all tiers. The starting cold page-in target is 5 ms at p99 for a 2 MiB block. It must also run a 10 000 000-token context with zero digest mismatches. | The harness writes a `BenchmarkClaim` receipt with the hit rate per tier, the page-in p99 and the mismatch count.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R042.4
Ingest throughput benchmark
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Ingest throughput benchmark.** The harness `benches/ingest_throughput.rs` must run the native admission path for 10 minutes. Each batch must hold 1 000 records. The starting targets are 50 000 records per second sustained and a commit p99 of 50 ms or less. A restart after the run must find every acknowledged record. | The harness writes a `BenchmarkClaim` receipt with the sustained rate, the commit p99 and the post-restart record count.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R042.5
Wire protocol benchmark
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wire protocol benchmark.** The harness `benches/wire_protocols.rs` must drive each listener of `EG-DURABLE-KERNEL-R860` with a standard client of its protocol. Each listener must carry 64 concurrent sessions. The starting point-read targets at p99 are 2 ms for PostgreSQL wire, 3 ms for Bolt and 1 ms for RESP. The starting target for an S3-compatible GET of 1 MiB is 10 ms at p99. | The harness writes one `BenchmarkClaim` receipt per protocol with p50, p99 and the session count.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R042.6
Benchmark publication and regression gate
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Benchmark publication and regression gate.** Each harness of `.2` to `.5` must publish its result as a `BenchmarkClaim` of `.1`. The claim must carry the configuration and the hardware identity. CI must fail when a measured value regresses more than 10 percent from the last published receipt. | `tests/test_benchmark_receipts.py::test_regression_over_ten_percent_fails` feeds a regressed receipt and asserts the gate fails.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R860
Served wire protocol listeners (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Served wire protocol listeners (rollup).** The engine must serve four wire protocols over its one store. The protocols are PostgreSQL wire, Bolt, RESP and an S3-compatible object API. Each listener must use the authenticated admission path of the served methods. `EG-DURABLE-KERNEL-R035` owns PostgreSQL operational parity beyond `.1`. Children `.1` to `.6` deliver it. | Each child requirement has its own verification.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R860.1
PostgreSQL wire listener
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**PostgreSQL wire listener.** `src/main.rs:1154` must start the listener of `src/server/pgwire` when its address is set. Simple and extended query must run SQL on the engine planner. | `tests/pgwire_roundtrip.rs` runs a simple and an extended query through a standard client.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R860.2
Bolt listener
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Bolt listener.** `spawn_bolt_listener` at `src/main.rs:1367` must start the listener of `src/server/bolt_wire`. A `RUN` message must run its openCypher text on the engine graph query engine. | `tests/bolt_roundtrip.rs::run_returns_records` runs a match through a standard Bolt client and reads the records.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R860.3
RESP listener
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**RESP listener.** `src/main.rs:1391` must start the RESP listener of `src/server/redis_wire`. RESP key commands must map to the served KV methods of `EG-DURABLE-KERNEL-R102`. | `tests/resp_roundtrip.rs::set_get_maps_to_kv_methods` writes with `SET` and reads the value back through `KvGet`.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R860.4
S3-compatible object API
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**S3-compatible object API.** `src/main.rs:1461` must start the object API of `src/server/s3` over the selected blob store. Object put, get, list and delete must map to content-addressed blobs. | `tests/s3_roundtrip.rs::put_get_list_delete` drives each operation through a standard S3-compatible client.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R860.5
Listener refusals
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Listener refusals.** Each listener must refuse an unauthenticated session with the error form of its protocol. A listener must not bind a non-loopback address without a configured credential. | `tests/wire_listeners_one_store.rs::unauthenticated_sessions_refuse` asserts the refusal on each protocol and no state change.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R860.6
Hot-path proof: one store behind four protocols
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof: one store behind four protocols.** The test must start the server binary with all four listeners. A standard client must write a record through one protocol. Standard clients of the other protocols must read the same record. | `tests/wire_listeners_one_store.rs::write_one_protocol_read_all` passes through the real listeners.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R028.5.1
Typed executable attachment
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Typed executable attachment.** `CurrentPlanSnapshot.task_plan` optionally contains the canonical `EG-DECISION-ENGINE-R134.111` TaskPlan. Explicit attachments require `PublishCurrentPlanRequest.task_plan_proposal`. EG recomputes the entire plan from that original proposal and requires exact equality. An unpaired proposal or plan refuses. Legacy requests omit both fields. | `current_plan_task_plan_validation_and_legacy_roundtrip` and `current_plan_task_plan_rejects_unpaired_or_changed_content` cover compatibility and malformed attachments. The existing 64-task, 64-KiB prompt and eight-worker bounds apply. Validation uses O(T(T + D) log T + P) time and O(T + D + P) memory.
requirementEG-DURABLE-KERNELSPECIFIEDcrates/eg-types/src/current_plan/tests.rs:20
crates/eg-types/src/current_plan/tests.rs:56
EG-DURABLE-KERNEL-R028.5.2
Immutable fenced attachment
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Immutable fenced attachment.** `current_plan::publish` binds the first TaskPlan through the existing owner transaction. An initial empty revision zero may attach a plan. A later increasing revision may attach one if absent. Omitted attachments preserve the bound plan; different plans refuse. The effective payload digest includes retained attachments. | `current_plan_attachment_is_immutable_and_scaffold_updates_preserve_it` and `current_plan_attachment_refusals_preserve_rows` verify atomic storage and unchanged refused rows. Existing owner, native claim, fence, lifetime and revision checks remain mandatory.
requirementEG-DURABLE-KERNELSPECIFIEDsrc/redb_store/work_item/current_plan/tests/attachment.rs:13
src/redb_store/work_item/current_plan/tests/attachment.rs:139
src/redb_store/work_item/current_plan/tests/attachment.rs:61
EG-DURABLE-KERNEL-R028.5.3
Attachment replay and recovery
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Attachment replay and recovery.** Existing MutationBatch identity binds the request, not its transport attempt. Exact replay returns the original receipt without writes or refreshed availability. Changed-plan replay refuses. `GetCurrentPlan` returns the bound TaskPlan from the same authoritative owner and lease snapshot. | `current_plan_native_publish_read_and_receipt_replay` verifies authenticated attachment, conflict, receipt replay and restart readback. `publication_attachment_changes_content_not_retry_identity` checks identity separation. Functional acceptance does not establish the performance budget in `EG-DURABLE-KERNEL-R028.5.4`.
requirementEG-DURABLE-KERNELSPECIFIEDsrc/server/mutation_batch/digest.rs:319
tests/adopt_workitem_authenticated_replay.rs:588
tests/decide/test_task_plan_served.py:230
tests/decide/test_task_plan_served.py:351
EG-DURABLE-KERNEL-R028.5.4
Attachment performance qualification
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Attachment performance qualification.** Measure native publication and readback with 64 tasks under the parent 10-ms p99 budget and at most 8 MiB transient payload memory. | A reproducible `current_plan_publication_readback` benchmark receipt must include workload, build profile, hardware and latency/memory measurements. This performance qualification remains pending; functional tests are not a substitute.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R028.6
Commit ordinary run completion and observed usage atomically
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Commit ordinary run completion and observed usage atomically.** A terminal WorkItem commit may carry `RunCompletionInput` for its original admitted run. The native transaction checks the live worker fence and immutable owner binding. Ordinary completion uses the engine commit clock for expiry and its terminal timestamp, not caller time. It commits the terminal row, receipt and one digest-bound outbox event together. Counters contain only observed nonnegative exact integers; omitted usage stays unknown, not zero. Failed or cancelled runs cannot publish an answer reference. Owner-bound recovery reads the exact receipt from one snapshot. Terminal replay preserves the first receipt. Ordinary completion and delegated outcome extensions are exclusive. | Native tests cover success, failure and unknown usage, live-fence refusal, owner/scope mismatch, replay, corruption and reopen. Generic writes cannot forge or remove bindings. Generated contracts expose the typed input and receipt. New-head native and served validation remain required; historical receipts do not prove this revision.
requirementEG-DURABLE-KERNELVERIFIED42376299456f
701e8e498e07
870424b46d0b
8b5cbc59e851
b286edc1b3bf
src/redb_store/work_item/run_owner/tests.rs:200
src/redb_store/work_item/run_owner/tests.rs:225
src/redb_store/work_item/run_owner/tests.rs:249
src/redb_store/work_item/run_owner/tests.rs:325
src/redb_store/work_item/run_owner/tests.rs:446
EG-DURABLE-KERNEL-R861
Graph lifecycle replay and graph listing survive a patch upgrade (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Graph lifecycle replay and graph listing survive a patch upgrade (rollup).** A store that the previous patch release wrote keeps working after an engine upgrade. Children `.1` and `.2` deliver it. | Each child requirement has its own verification.
requirementEG-DURABLE-KERNELVERIFIED9d5b6a58de75
eec3e5ffbf2d
f3b89fbc5e09
fcb8d033061e
src/server/mutation_batch/lifecycle_tests.rs:480
tests/test_upgrade_store_listing.py:39
EG-DURABLE-KERNEL-R861.1
Lifecycle replay compares the stored identity
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Lifecycle replay compares the stored identity.** The engine answers a `CreateGraph` or `DeleteGraph` retry from the stored lifecycle receipt. It compares the receipt's retained identity: graph, graph type, principal, tenant scope and idempotency key. It never recompiles the batch to compare digests. So a receipt that the previous patch release wrote replays instead of conflicting. A receipt with a different identity stays an idempotency conflict. The engine refuses an attempt that re-presents the nonce its receipt consumed as REPLAY_NONCE_CONSUMED, before any identity check. Only a fresh attempt under the same idempotency key replays. | A unit test shows that a stored receipt with the same identity and different bytes counts as committed. The same test shows that a different graph type, principal or key is a conflict. It also shows that the engine refuses the consumed nonce and replays a fresh one. The served test t05 confirms that the engine refuses an identical signed envelope as REPLAY_NONCE_CONSUMED.
requirementEG-DURABLE-KERNELVERIFIED9d5b6a58de75
f3b89fbc5e09
fcb8d033061e
src/server/mutation_batch/lifecycle_tests.rs:480
EG-DURABLE-KERNEL-R861.2
Graph listing survives a restart and a patch upgrade
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Graph listing survives a restart and a patch upgrade.** `ListGraphs` decides each graph from its catalog record, which keeps the graph type and owner. So a graph that is still catalog-only after a restart gets the same access decision as a resident graph. The stored policy decides: the engine lists a graph only for a principal that the policy lets read it. When `ListGraphs` filters out a graph, the engine logs the refusal reason without secrets. After an upgrade, the engine still lists the commons and tenant graphs of a previous-patch store. | A served test reopens a store and checks that the engine lists both graphs for the System identity. It also checks that the engine lists neither graph for a registered identity with no grants or for an unregistered principal. This build writes the store, and the previous patch's published engine also writes one when the test gets that engine.
requirementEG-DURABLE-KERNELVERIFIEDeec3e5ffbf2d
tests/test_upgrade_store_listing.py:39
EG-DURABLE-KERNEL-R862
A copied store or bundle restores onto new files (rollup)
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**A copied store or bundle restores onto new files (rollup).** Each store binds to the device and inode of its files. So a copied data directory refuses to open with `mutation store root incarnation mismatch`. Offline `restore` also refuses a copied bundle, because it opens bundle sources through `Shard::open`. Children `.1` to `.3` deliver an explicit, verified re-binding. The ordinary open keeps refusing a copied file. | Each child requirement has its own verification.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R862.1
Restore reads bundle sources by content, not by physical identity
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Restore reads bundle sources by content, not by physical identity.** `src/server/persistence/shard_migrate.rs::open_source_shards` opens each bundle file read-only. It checks the bundle manifest digests and the source owner manifest instead of the root incarnation. Restore then writes every destination store fresh, bound to its own new files. A digest mismatch refuses the restore and writes no destination file. | A unit test restores a bundle copied to new inodes and reads every row back. A test with one changed byte refuses the restore and leaves the destination empty.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R862.2
Wiring: an explicit command re-binds a copied data directory
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Wiring: an explicit command re-binds a copied data directory.** `epistemic-graph-server store-upgrade rebind <data-dir> --confirm` holds the engine lock. It verifies the content digests of each store. Then it binds the root incarnation of each store to its current files. Each store changes in one atomic commit. Without `--confirm` the command writes nothing. The ordinary open still refuses a copied store. | Command tests copy a store and show that the ordinary open refuses it. Then they run `rebind` and reopen the store with its rows kept. A second run reports nothing to do.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R862.3
Hot-path proof: a copied bundle restores and serves
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Hot-path proof: a copied bundle restores and serves.** A served test takes a backup bundle and copies it with `cp -a`. It restores the copy into a new data directory. Then it starts the engine on that directory. The engine lists the backed-up graphs and reads their nodes. | `tests/test_store_copy_restore.py` runs the served engine over a copied bundle and a re-bound copied data directory.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-DURABLE-KERNEL-R028.4.3
Reserve ordered conversation turns with native run admission
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Reserve ordered conversation turns with native run admission.** Optional version-one `ConversationTurnAdmission` binds a context ID, expected head revision and exact preceding run. The existing `SubmitWorkItem` transaction stores a protected head in the graph-incarnation-scoped NODES table with the new WorkItem and immutable original request. Revision zero creates a head. A later reservation checks the same tenant, verified owner, context and preceding run in that write snapshot. Only a successful preceding run may advance the head. Active, failed, cancelled, dead-letter, missing or unknown predecessors refuse. Stale revisions conflict; no branch or implicit queue is created. Generic writers cannot create, replace or remove a head. Existing contexts with a head refuse metadata-only admission. Ordinary requests omit the new field without changing their serialized form. | Source tests cover admission order, same-head contenders, refusal rollback, owner isolation, reopen, unknown state, legacy codec and generic-write guards. Actual MutationBatch replay, changed-body conflict, graph-incarnation isolation, generated contracts and native execution remain required. A successful WorkItem is not a completed-history receipt. The host must validate the exact completed checkpoint before execution. This child does not deliver transcript paging or served continuation.
requirementEG-DURABLE-KERNELVERIFIED1c6664149612
2df788ead124
74bd0bcf3899
a1874ae34e29
src/redb_store/work_item/conversation/tests.rs:138
src/redb_store/work_item/conversation/tests.rs:159
src/redb_store/work_item/conversation/tests.rs:175
src/redb_store/work_item/conversation/tests.rs:215
src/redb_store/work_item/conversation/tests.rs:235
EG-DURABLE-KERNEL-R028.4.4
Replay a repeated run admission from its retained owner receipt
Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source
**Replay a repeated run admission from its retained owner receipt.** A retry of a native run admission carries the same run, key and command. Its request context may carry fresh clocks or correlation values. The engine reads the native receipt of the original committed admission. It checks the actor, tenant, single operation, result and immutable WorkItem owner binding. It then rebuilds that exact retained operation and recompiles it through the normal ledger. The retry carries fresh outer authentication and a fresh nonce. The retry returns the original receipt and writes nothing. Canonical digest rules and historical receipts stay unchanged. Metadata alone is never admission evidence. A changed policy, input or command refuses. Missing or corrupt retained evidence refuses with non-retryable `RUN_ADMISSION_UNAVAILABLE`. | Authenticated replay tests send a refreshed context. They require the original receipt, outbox and version, also after a restart. They require refusal for a changed policy, input or command and for missing or corrupt retained evidence. An upgrade test opens a store written by the server before this change and replays an admission it recorded.
requirementEG-DURABLE-KERNELSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY
EG-IDENTITY — Engine identity, mode and scope authority
specNoneSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R001
Multi-issuer OIDC trust list with per-issuer kind limits
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Multi-issuer OIDC trust list with per-issuer kind limits.** EG's primary OIDC verifier (src/server/oidc.rs, src/server/auth.rs) maintains an explicit, ordered multi-issuer trust list of issuer, JWKS source, audience, and allowed-principal-kind entries, accepts an overlapping rotated key only during a declared window, and restricts principal kind per issuer so a Keycloak-backed issuer can authenticate service principals only. | A negative test asserts an unknown, ambiguous, or disallowed-kind issuer fails verification before method dispatch, and a positive test confirms a rotated key is accepted only within its declared overlap window.
requirementEG-IDENTITYVERIFIED8fed7c656140
bb5db1746a16
src/server/issuer_trust.rs:112
src/server/issuer_trust.rs:120
src/server/issuer_trust.rs:128
EG-IDENTITY-R002
Identity and RBAC writes recompute roles and audit atomically
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Identity and RBAC writes recompute roles and audit atomically.** Every identity or RBAC mutation in EG (security.rs, identity_admin.rs) recomputes the complete effective role set within the same durable transaction as the write, and src/audit.rs records an allow or denial entry naming the actor, tenant, operation, target, and authorization digest change, including a bounded sample of denied attempts. | A restart/fault test confirms a failed persistence rolls back the role change and its audit entry together, and a tamper-detection check catches a reordered or altered identity audit record.
requirementEG-IDENTITYVERIFIED8fed7c656140
f9a69bfe8a9c
crates/eg-core/src/isolation/identity_store_tests/tenant_and_audit.rs:139
crates/eg-core/src/isolation/identity_store_tests/tenant_and_audit.rs:190
EG-IDENTITY-R003
Identity mode is a durable singleton with CAS transition
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Identity mode is a durable singleton with CAS transition.** EG stores identity mode (none, local, or external) as a durable singleton with a monotonic epoch, transitions it only via compare-and-set once a new identity_config component validates the documented preconditions for that transition, and invalidates every active authentication token and rotates issuer material after the commit while retaining accounts, links, grants, and data. | A fault-injection test confirms a stale epoch, missing surviving admin, or unmet precondition returns a typed refusal with no mode or data change, and an integration test confirms tokens are invalidated only after the transition commits.
requirementEG-IDENTITYSPECIFIED8fed7c656140
f9a69bfe8a9c
crates/eg-types/src/identity/tests/modes.rs:111
crates/eg-types/src/identity/tests/modes.rs:182
EG-IDENTITY-R003.1
Explicit isolated anonymous store authority (native TCP qualification)
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Explicit isolated anonymous store authority (native TCP qualification).** EG consumes Arbora's explicit local `none` admission through `--auth-mode none` / `GRAPH_SERVICE_AUTH_MODE=none`. This mode requires no secret and either private UDS or literal loopback native TCP. It rejects auxiliary listeners and cluster configuration. The durable store must be fresh or already anonymous-marked. Default authenticated startup remains unchanged and refuses anonymous stores. A distinct server-owned origin supplies anonymous authority. It fixes principal `anonymous`, tenant `local` and policy `no-auth`, without credentials or signed request envelopes. Caller claims cannot substitute identity. The engine refuses mismatched embedded authority with the existing typed `ACCESS_DENIED` code. Existing ACL and mutation machinery grants local-owner access within the isolated anonymous store. This mode neither changes authenticated stores nor grants external identities. This child does not implement mode conversion. | Real served tests cover create, write, read and restart. Negative tests cover missing default credentials, mixed credentials, remote listeners, alternate transports, store reuse and mode mismatch. This receipt qualifies native TCP only. R003.3 retains private UDS and exhaustive feature-matrix qualification. R003.2 retains performance measurement. The parent row retains mode conversion.
requirementEG-IDENTITYVERIFIED5918e6017779
844fec51e35a
tests/test_native_no_auth_served.py:15
EG-IDENTITY-R003.2
Measured anonymous admission budget (pending)
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Measured anonymous admission budget (pending).** Measure the bounded anonymous authority decoder separately from graph operations; target p99 <100 us and <8 KiB per authority allocation. | Pending a dedicated benchmark implementation and reproducible receipt. Functional tests for R003.1 do not verify this row.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R003.3
Additional isolated-mode runtime qualification (pending)
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Additional isolated-mode runtime qualification (pending).** Qualify the implemented private-UDS transport on a host that permits Unix sockets and the default feature matrix, including AST repository enrichment. The same origin/store/loopback boundaries must hold. | Pending real UDS and full-feature runtime receipts. Native TCP tests and static mode-aware background branches do not verify this row.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R004
Generated scope registry classifies every capability scope
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Generated scope registry classifies every capability scope.** EG publishes a single generated, versioned scope registry from crates/eg-capabilities capability declarations, classifying each scope as user, domain, service-only, approver, or admin, with the generated package catalog and server checks sharing the same digest. GraphOS owns `decide:commit` (service-only) and `policy:read`, `security:read`, `swarm:read`, `telemetry:read`, `usage:read` (user); registration grants no access and consumers retain exact-scope and verified-tenant enforcement. | A generation check confirms the published scope registry digest matches the server's own classification for every declared scope, and a negative test confirms an unclassified or wildcard scope fails generation.
requirementEG-IDENTITYVERIFIED15acf1a959e5
63488a50eefc
6c11520aebfc
8503b23fdddd
a2cbfc473ba2
crates/eg-capabilities/src/scopes/tests.rs:140
crates/eg-capabilities/src/scopes/tests.rs:200
crates/eg-capabilities/src/scopes/tests.rs:38
crates/eg-capabilities/src/scopes/tests.rs:51
crates/eg-capabilities/src/scopes/tests.rs:65
EG-IDENTITY-R005
Semantic workers use one identity across queue classes
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Semantic workers use one identity across queue classes.** A production semantic worker presents a single verified identity consistently across every queue class it processes, rather than switching principals per class, so authorization and audit records for its work remain attributable to one principal. | `dispatch_attributes_every_queue_class_to_the_one_verified_principal` verifies principal attribution. `semantic_owner_registry_is_scoped_to_persistence_root` checks root isolation and canonical alias reuse in `src/server/semantic_index.rs`.
requirementEG-IDENTITYVERIFIED1c6b4c961a40
62bec8a1ae94
6c11520aebfc
src/server/semantic_index/dispatch_pipeline_tests.rs:600
EG-IDENTITY-R006
Tenant roles read the shared commons graph
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Tenant roles read the shared commons graph.** `IsolationLayer::provision_tenant_graph_access` (crates/eg-core/src/isolation/policy_admin.rs) grants the `tenant:<slug>` role Read on the exact `__commons__` graph, beside its tenant-pattern Read and Write grants. | A unit test confirms a tenant member reads `__commons__`, cannot write it, and cannot read another tenant's graph. The idempotence test confirms three grants after repeated provisioning.
requirementEG-IDENTITYVERIFIED0374378eb9db
7622e4b24455
dfb2367561d1
crates/eg-core/src/isolation.rs:1756
EG-IDENTITY-R007
Scopes `identity:admin`, `loops:read` and `loops:control` are registered in the engine contract
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Scopes `identity:admin`, `loops:read` and `loops:control` are registered in the engine contract.** `contract/scopes.json` (and its `epistemic_graph/contract` mirror) registers `identity:admin` (class admin), `loops:read` (user) and `loops:control` (domain), generated from `crates/eg-capabilities/src/scopes.rs`. Unblocks graph-os ARBORA-OPS-R014 identity operations and ARBORA-OPS-R022.2.1. | The R004 generation check passes with the three scopes present and a negative test shows an unregistered scope still fails generation.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R008
Run scope comes from a durable policy node, never from plan text (rollup)
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Run scope comes from a durable policy node, never from plan text (rollup).** The engine must bound a run's tool and data scope by a stored policy node. A model-written plan must never widen that bound. | Test: `crates/eg-core/tests/scope_bound.rs::plan_cannot_widen_policy_bound`
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R008.1
Locate and wire the attach point
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Locate and wire the attach point.** The implementer must find where a plan's tool set is admitted beside `crates/eg-core/src/isolation/policy_admin.rs` and record `file:line` in `plan.md`. | Test: `crates/eg-core/tests/scope_bound.rs::attach_point_is_reached`
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R008.2
Typed `ScopeBound`
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Typed `ScopeBound`.** Add `ScopeBound { policy_iri, allowed_tools, allowed_graphs }` to `crates/eg-core/src/isolation/scope_bound.rs`. The type must reject an empty `policy_iri`. | Test: `crates/eg-core/src/isolation/scope_bound.rs::tests::empty_policy_iri_is_refused`
requirementEG-IDENTITYVERIFIED3c61dc94a9ed
92de9f434e0b
crates/eg-core/src/isolation/scope_bound.rs:107
crates/eg-core/src/isolation/scope_bound.rs:144
EG-IDENTITY-R008.3
Pure subset check
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Pure subset check.** Add `scope_within_bound(plan_tools, bound)` to `scope_bound.rs`. It must return the first out-of-bound tool IRI, not a boolean. | Test: `crates/eg-core/src/isolation/scope_bound.rs::tests::first_excess_tool_is_named`
requirementEG-IDENTITYVERIFIED92de9f434e0b
crates/eg-core/src/isolation/scope_bound.rs:123
crates/eg-core/src/isolation/scope_bound.rs:164
EG-IDENTITY-R008.4
Bound is read from the stored policy node
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Bound is read from the stored policy node.** The loader must read `ScopeBound` from the principal's policy node in the graph. It must ignore any scope field carried in the plan body. | Test: `crates/eg-core/tests/scope_bound.rs::plan_scope_field_is_ignored`
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R008.5
Typed refusal `ScopeExceedsPolicy`
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Typed refusal `ScopeExceedsPolicy`.** The admission path must refuse an out-of-bound plan with `ScopeExceedsPolicy` naming the tool IRI and policy IRI. It must write an audit record. | Test: `crates/eg-core/tests/scope_bound.rs::excess_plan_is_refused_and_audited`
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R008.6
End-to-end proof over the wire
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**End-to-end proof over the wire.** A served test must submit a plan that names a tool outside the principal's policy and assert `ScopeExceedsPolicy`. A second plan inside the bound must pass. | Test: `tests/identity/test_scope_bound_served.py::test_plan_scope_is_bounded_by_policy`
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023
Principal-scoped knowledge segments with explicit sharing (rollup)
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Principal-scoped knowledge segments with explicit sharing (rollup).** The engine segments stored chats, code and memories per principal. Sharing needs an explicit scope. Retrieval returns only the current version of permitted units. Children `.1` through `.12` cover segmentation and typed principal metadata. | See each child.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.1
Model
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Model.** Add `KnowledgeUnit{id, owner, version, supersedes, access_labels, share_scope}` in `crates/eg-types/src/identity/segment.rs`. Closed `share_scope` values are `private`, `placement` and `tenant`. Proving test: `crates/eg-types/src/identity/segment.rs::tests::unit_round_trips`. | A serde round trip keeps every field and rejects an unknown scope.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.2
Behavior
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Behavior.** Add `visible_units(principal, units)` returning owned units and units a matching scope shares. It keeps only the highest version of each lineage. Each rule is a named replaceable default. Proving test: `crates/eg-types/src/identity/segment.rs::tests::superseded_and_foreign_units_hidden`. | A superseded unit and an unshared foreign unit are absent from the result.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.3
Wiring
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Wiring.** The behavior attaches in the served content-read handler, before the hits leave the retrieval function. It reuses the visibility pattern at `crates/eg-types/src/rbac_elevation/ledger.rs:268`. This row creates the call site in the served content-read handler that invokes `retrieve`. Proving test: `tests/identity/test_segment_retrieval_served.py::test_retrieve_filters_by_principal`. | A served read as principal B never returns principal A's private unit.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.4
Refusal
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Refusal.** A read naming a unit outside the principal's scope must return `OutOfScope` naming the unit id. It must not reveal the unit's content. Proving test: `crates/eg-types/src/identity/segment.rs::tests::out_of_scope_names_id_only`. | The refusal carries the id and no content field.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.5
Evidence
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Evidence.** Each read must append an audit entry. The entry lists the principal and the returned unit ids. It also counts units hidden by scope or version. Proving test: `crates/eg-types/src/identity/tests/segment_audit.rs::read_audit_counts_hidden`. | The audit entry shows returned ids and the hidden count.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.6
Hot-path proof
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served content-read wire method. The test `tests/identity/test_segment_retrieval_served.py::test_shared_unit_visible_only_in_scope` writes a private and a shared unit. It passes through the wired retrieval call and observes that only the permitted current version returns. | The served read returns the shared current unit and hides the private one.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.7
Model
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Model.** Define bounded Preference, ClientMetadata and InteractionNetwork variants in the proposed identity/segment.rs model. Resolve principal references through the canonical identity store. Graph metadata grants no authority. | Planned: tests/identity/test_typed_metadata_served.py::typed_metadata_variants_round_trip.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.8
Behavior
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Behavior.** Persist these variants as versioned graph nodes with typed links. Require the managed metadata schema before every write. File imports create validated graph records; files never become shadow authority. | Planned: tests/identity/test_typed_metadata_served.py::typed_metadata_persists_without_file_authority.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.9
Wiring
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Wiring.** Attach admission before mutation compilation at src/server/mutation_batch/compile.rs:126. Reuse gateway.rs:72, composed graph schema validation and authorized node reads. Cover structural, batch, query and RDF write routes. | Planned: tests/identity/test_typed_metadata_served.py::all_metadata_write_routes_reach_admission.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.10
Refusal
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Refusal.** Refuse untyped metadata, malformed identity references, invalid schema and unauthorized scope before durable mutation. Refusals reveal no hidden identity or graph metadata. A caller-supplied owner never replaces verified authority. | Planned: tests/identity/test_typed_metadata_served.py::invalid_metadata_has_no_durable_effect.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.11
Evidence
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Evidence.** Commit source digest, mapping version, verified actor, schema digest and parent revision with each accepted record. Preserve import provenance and idempotent replay. Refused imports leave graph and receipts unchanged. | Planned: tests/identity/test_typed_metadata_served.py::metadata_import_provenance_survives_restart.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.12
Hot-path proof
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Hot-path proof.** Use authenticated served graph writes and reads against real durable storage. Prove all variants survive restart within scope. Denied and malformed writes must leave independently read durable state unchanged. | Planned: tests/identity/test_typed_metadata_served.py::typed_metadata_served_journey.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.13
Served share grant and revoke persist across restart (rollup)
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Served share grant and revoke persist across restart (rollup).** The engine must own node sharing. An owner or a graph administrator grants or revokes a share scope through one served operation. The change must commit through durable storage. A revoke must hold after an engine restart. Children `.1` to `.6` deliver it. | See each child.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.13.1
Model
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Model.** `crates/eg-types/src/acl.rs` must add `RbacAdminOp::ShareGrant{node_id, scope, grantees}` and `RbacAdminOp::ShareRevoke{node_id}`. Closed `scope` values are `private`, `org` and `commons`. `grantees` holds at most 64 interned principal ids. Proving test: `crates/eg-types/src/acl.rs::tests::share_ops_round_trip`. | A serde round trip keeps every field. It rejects an unknown scope and a 65-entry grantee list.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.13.2
Behavior
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Behavior.** Add the pure function `share_transition(current, op, actor)` in `crates/eg-core/src/isolation/share.rs`. It returns the next `_shared_scope` and `_grants` values. Only the owner or a `kg:admin` holder may change a scope. A revoke clears the grantee set and sets `private`. A commons promotion copies one node to the commons graph in the same commit. Cost is O(g) in grantee count, with no graph scan. Proving test: `share.rs::tests::revoke_clears_grants`. | Unit tests cover grant, revoke, commons promotion and a non-owner attempt.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.13.3
Wiring
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Wiring.** The `RbacAdmin` arm at `src/server/dispatch/router/identity_access.rs:47` must call `share_transition`. It commits through the mutation gateway that `ApplyMutation` uses. `row_visibility` at `crates/eg-core/src/isolation.rs:157` reads the committed keys. No second visibility store may exist. The commit holds only the graph's shard writer. Reads stay on the off-lock snapshot. | A dispatch test asserts the gateway commit and an unchanged read path.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.13.4
Refusal
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Refusal.** A caller without owner or `kg:admin` authority must receive `ACCESS_DENIED`. A node in another tenant must return `AUTH_TENANT_MISMATCH`. An absent node or an invalid scope must return `INVALID_ARGUMENT`. A refusal must change no state. | Each case returns its code. An independent readback shows unchanged properties.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.13.5
Evidence
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Evidence.** Each grant or revoke must append one audit event. The event holds actor, node id, prior scope, new scope, grantee digest and commit revision. `AuditReadEvent` must return the event. | A test reads the audit event after one grant and one revoke.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.13.6
Hot-path proof
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `RbacAdmin` method. The test `tests/identity/test_share_restart_served.py::test_org_share_revocation_persists_across_restart` writes a node, shares it to the org and revokes the share. It stops the engine with SIGTERM and restarts it on the same data directory. A second principal must not see the node after restart. The benchmark `benches/share_transition.rs` must show p50 under 2 ms and p99 under 10 ms per operation on a 1,000,000-node graph. | The served test passes against a restarted engine, and the benchmark receipt meets the budget.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R610
Tenant sharing, parent chains, secured reads and ownership claims are enforced in the engine (rollup)
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Tenant sharing, parent chains, secured reads and ownership claims are enforced in the engine (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R610.1
Model
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Model.** `crates/eg-types/src/tenancy.rs` defines TenantParent, AccessibleGraphs, Marking, ReadAudit, OwnershipClaim, ClaimPreview. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R610.2
Behavior
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Behavior.** Each tenant sees its own graph, its ancestors' shared graphs in precedence order, and the commons. Sharing is private by default and explicit. Reads are filtered by marking and tenant before results leave, and every read is audited. An admin can preview then apply a claim over unowned nodes, which stamps owner and classification and is itself audited. Queries are scoped by injecting a tenant predicate on the first bound node variable; an unscopable query is refused. | Unit tests cover each rule with positive and boundary cases.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R610.3
Wiring
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Wiring.** Extends EG-IDENTITY-R023 and R006; the scope predicate is applied in the UQL planner. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R610.4
Refusal
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Refusal.** A read query with no bindable node variable is refused rather than run unscoped. The stable code is `QUERY_UNSCOPABLE`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R610.5
Evidence
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Evidence.** Audit line per read and per claim with actor, tenant, count. | Test reads the trace or metrics after one success and one refusal.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R610.6
Hot-path proof
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Hot-path proof.** scope injection plus marking filter: p50 under 80 us per query, p99 under 400 us. The benchmark is `benches/r610_engine_identity_and_scope.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R023.600
Hierarchical tenant chains and audited reads
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Hierarchical tenant chains and audited reads.** Segment visibility follows the parent chain in precedence order and every read emits an audit line, as `EG-IDENTITY-R610` defines. | Test builds a three-level chain and asserts visibility order and one audit line per read.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R700
Graph ownership is inferred from signals and applied as reversible grants (rollup)
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Graph ownership is inferred from signals and applied as reversible grants (rollup).** The engine recommends an owner and role grants for each graph from ownership signals (naming hints, creators, activity). It produces a grant plan. It applies the plan through RBAC admin with a rollback record. It refuses to widen access without approval. Implemented in eg-identity. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R700.1
Model
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Model.** `GraphOwnershipSignals`, `OwnershipDisposition`, `GrantPlanEntry` and `RollbackEntry` in `crates/eg-identity`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R700.2
Behavior
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Behavior.** Signals are read once per graph. The plan is deterministic. Apply is transactional per graph. Rollback restores exactly the prior role set. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R700.3
Wiring
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Wiring.** Apply uses `RbacAdmin`; because registering identity replaces the role set, the plan carries the full intended set. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R700.4
Refusal
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Refusal.** A plan that removes the last admin or widens a graph beyond its tenant is refused. Apply without a rollback record is refused. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R700.5
Evidence
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Evidence.** Every applied grant stores actor, plan digest and rollback entry. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-IDENTITY-R700.6
Hot-path proof
Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/identity/test_graph_ownership_served.py::test_apply_then_rollback_restores_prior_roles` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/ownership_plan.rs` must show p50 under 4 ms and p99 under 25 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-IDENTITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY
EG-ENGINE-PARITY — Relational engine parity inside one library
specNoneSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R001
Single committer with group commit and batched fsync (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Single committer with group commit and batched fsync (rollup).** The engine must keep one committer per store file. The committer must batch concurrent write requests into one transaction and one fsync. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R001.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `GroupCommitter{max_batch, max_wait_us}` in `crates/eg-storage/src/group_commit.rs`. Requests queue on a bounded channel. The committer drains up to `max_batch` requests or waits up to `max_wait_us`. One redb write transaction and one fsync cover the batch. Each request receives its own result. | `crates/eg-storage/tests/group_commit.rs::batch_shares_one_fsync` sends 64 requests and counts fsync calls.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R001.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** Every durable write path calls the committer, beside the existing durability batching of EG-DURABLE-KERNEL-R016 and R040. A failed request in a batch refuses alone with its typed error. The other requests commit. A full queue refuses with `COMMIT_QUEUE_FULL`. | `crates/eg-storage/tests/group_commit.rs::one_failure_does_not_fail_batch` mixes one invalid request into a batch.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R001.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-storage/benches/group_commit.rs` commits 64 concurrent single-row writes. Throughput reaches at least 20,000 commits per second on the soak host. The p99 stays under 5 ms. | `cargo bench -p eg-storage --bench group_commit` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R002
Optimistic concurrency with read and write sets (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Optimistic concurrency with read and write sets (rollup).** A transaction must read from an MVCC snapshot and record its read set and write set. The committer validates both at commit. A conflict refuses with a typed error. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R002.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `TxnFootprint{snapshot_seq, reads, writes}` in `crates/eg-transaction/src/occ.rs`. Keys are table and key ranges. Validation fails when a key in `reads` or `writes` changed after `snapshot_seq`. | `crates/eg-transaction/tests/occ.rs::write_skew_is_detected` runs two transactions over one invariant.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R002.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** SQL, UQL and native mutation paths build the footprint. The group committer of R001 validates it. A conflict refuses with `TXN_CONFLICT{keys}` and writes nothing. It extends the version-checked writes of EG-DURABLE-KERNEL-R084. | `crates/eg-transaction/tests/occ.rs::conflict_refuses_and_writes_nothing` asserts the code and an unchanged store.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R002.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-transaction/benches/occ.rs` validates footprints of 100 keys. The added p99 per commit stays under 50 microseconds. | `cargo bench -p eg-transaction --bench occ` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R003
Partitioned store files for parallel writers (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Partitioned store files for parallel writers (rollup).** The engine must place each tenant, or each declared partition, in its own store file with its own committer. Writers to different files commit in parallel. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R003.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `PartitionMap{key_rule, files}` in `crates/eg-storage/src/partition.rs`. The rule is `tenant` by default or a declared key prefix. One committer of R001 runs per file. | `crates/eg-storage/tests/partition.rs::two_partitions_commit_in_parallel` measures overlap of two writers.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R003.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** The store registry of EG-DURABLE-KERNEL-R055 lists every partition file. A batch over two partitions uses the cross-store path of EG-DURABLE-KERNEL-R034 or refuses with `CROSS_PARTITION_BATCH`. | `crates/eg-storage/tests/partition.rs::cross_partition_batch_refuses_or_coordinates` submits one mixed batch.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R003.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-storage/benches/partition.rs` runs 8 tenants with 8 writers each. Total throughput reaches at least 6 times the single-file throughput of R001. | `cargo bench -p eg-storage --bench partition` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R004
Lock-free acceptance for disjoint keys (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Lock-free acceptance for disjoint keys (rollup).** Concurrent transactions whose footprints do not overlap must all commit with no global lock. This generalizes the disjoint-path acceptance of EG-SCM-R003 to every key space. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R004.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `disjoint(a, b) -> bool` over `TxnFootprint` in `crates/eg-transaction/src/occ.rs`. Disjoint footprints validate without a wait. | `crates/eg-transaction/tests/occ.rs::disjoint_footprints_never_wait` runs 32 disjoint writers.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R004.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** EG-SCM-R003 calls the same function for path sets. A repeated conflict on the same keys refuses after 3 retries with `TXN_RETRY_EXHAUSTED`. | `crates/eg-transaction/tests/occ.rs::retry_bound_refuses` forces 4 conflicts.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R004.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-transaction/benches/disjoint.rs` runs 32 disjoint writers. No writer waits on another at p99. | `cargo bench -p eg-transaction --bench disjoint` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R005
Write throughput benchmark and targets (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Write throughput benchmark and targets (rollup).** The engine must hold one write benchmark suite with stated targets. A change that lowers a target fails the benchmark gate of EG-DURABLE-KERNEL-R042. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R005.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `benches/engine_writes.rs` with five workloads: single-row commit, 64 concurrent writers, 8 partitions, bulk load and conflict-heavy. plan.md states the target for each. | `benches/engine_writes.rs` prints one record per workload.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R005.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** The benchmark gate of EG-DURABLE-KERNEL-R042 reads the records. A missing workload fails the gate with `BENCH_WORKLOAD_MISSING`. | `tests/test_engine_bench_gate.py::test_missing_workload_fails` drops one workload.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R005.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** The suite runs on the soak host on each release candidate. Each result carries host, revision and data digest. | `cargo bench --bench engine_writes` against the stored baseline.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R006
PostgreSQL wire protocol front end (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**PostgreSQL wire protocol front end (rollup).** The engine must serve the PostgreSQL frontend and backend protocol for outside SQL tools. It covers startup, simple query, extended query, prepared statements, COPY in and out, cancellation and TLS. EG-DURABLE-KERNEL-R035 owns the operational surfaces. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R006.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Extend `src/server/pgwire/mod.rs`. The extended-query path binds typed parameters through EG-FEDERATED-QUERY-R025. COPY uses the existing `CopyState`. TLS uses the existing startup policy. | `tests/pgwire_roundtrip.rs::extended_query_prepared_and_copy` runs a standard PostgreSQL client through each message flow.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R006.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** Every statement passes the SQL classifier and the plan cache of EG-DURABLE-KERNEL-R041. An unsupported message refuses with SQLSTATE `0A000`. A non-loopback listener without TLS refuses to start. | `tests/pgwire_roundtrip.rs::unsupported_message_and_plaintext_refuse` asserts both refusals.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R006.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** A standard client runs 10,000 prepared point reads. The p99 stays under 1 ms on loopback. | `tests/pgwire_roundtrip.rs::prepared_point_read_latency` measures the p99.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R007
Wire authentication mapped to engine principals and row security (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wire authentication mapped to engine principals and row security (rollup).** A wire login must resolve to one engine principal. Every wire statement must pass the same tenant and row-level security as a native call. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R007.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** `src/server/pgwire/auth.rs` maps password, certificate and token logins to the principal resolution of `src/server/sql_wire_auth.rs`. Issued outside identities come from `ARBORA-OPS-R858`. | `tests/pgwire_roundtrip.rs::login_maps_to_principal` logs in three ways and reads the principal.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R007.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** Wire reads pass the R078 predicates of EG-FEDERATED-QUERY and the masking of EG-FEDERATED-QUERY-R706. An unknown login refuses with SQLSTATE `28000`. | `tests/pgwire_roundtrip.rs::wire_rls_equals_native_rls` reads one table as three principals through both paths.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R007.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** Login and principal resolution stay under 5 ms at p99. | `tests/pgwire_roundtrip.rs::login_latency` measures the p99.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R008
Catalog views for outside tools (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Catalog views for outside tools (rollup).** The engine must serve `pg_catalog` and `information_schema` views that outside tools read at connect. The views derive from the engine catalog through the columnar engine. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R008.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `crates/eg-query/src/sql/pg_catalog.rs`. It registers table providers for `pg_class`, `pg_namespace`, `pg_attribute`, `pg_type`, `pg_index`, `pg_constraint`, `pg_proc`, `pg_settings` and the `information_schema` tables, columns, views and constraints. | `crates/eg-query/tests/pg_catalog.rs::views_list_engine_tables` creates two tables and reads both views.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R008.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** The views filter by the caller principal. A tool introspection query that reads an absent view returns an empty set, never an error. | `tests/pgwire_roundtrip.rs::bi_tool_introspection_queries_pass` replays a fixture of 40 recorded introspection queries.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R008.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** The introspection fixture runs under 200 ms in total. | `tests/pgwire_roundtrip.rs::introspection_latency` measures the total.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R009
SQL dialect compatibility matrix (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**SQL dialect compatibility matrix (rollup).** The engine must publish one compatibility matrix for its PostgreSQL-dialect SQL. Each statement form and function is `supported`, `partial` or `refused`. A refused form returns a typed error. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R009.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `contract/sql_compat.json`. It lists statement forms, functions, operators and types with their state. `crates/eg-query/src/sql/compat.rs` loads it. | `crates/eg-query/tests/compat.rs::matrix_loads_and_is_closed` loads the matrix.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R009.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** The classifier refuses a `refused` form with SQLSTATE `0A000` and the matrix entry name. A matrix entry without a test fails the contract gate. | `crates/eg-query/tests/compat.rs::every_supported_entry_has_a_test` checks test coverage.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R009.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** A conformance run tests every `supported` entry against the engine. The pass rate is 100 percent. | `tests/test_sql_compat_conformance.py::test_supported_entries_pass` runs the matrix.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R010
Secondary, partial and expression indexes (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Secondary, partial and expression indexes (rollup).** User tables must support declared secondary indexes, partial indexes with a predicate and expression indexes. The planner uses them for point and range probes. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R010.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `IndexSpec{table, columns_or_exprs, unique, predicate}` in `crates/eg-query/src/tables/index.rs`. The index is a redb table maintained in the same write transaction as the row. | `crates/eg-query/tests/index.rs::partial_index_holds_only_matching_rows` inserts rows inside and outside the predicate.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R010.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** `CREATE INDEX` through SQL and the wire front end creates the spec. The planner chooses an index scan when the predicate implies the index predicate. An expression that is not deterministic refuses with `INDEX_EXPR_NONDETERMINISTIC`. | `crates/eg-query/tests/index.rs::planner_uses_partial_index` reads the plan.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R010.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-query/benches/index.rs` probes a non-key column over 10M rows. The p99 stays under 2 ms. Index upkeep adds under 20 percent to insert cost. | `cargo bench -p eg-query --bench index` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R011
Constraints: unique, foreign key, check and shapes (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Constraints: unique, foreign key, check and shapes (rollup).** User tables must enforce unique, foreign-key and check constraints at commit. Graph data keeps SHACL shapes. One refusal form covers both. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R011.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `ConstraintSpec` in `crates/eg-query/src/tables/constraint.rs` with kinds `unique`, `foreign_key`, `check` and `not_null`. Unique uses an R010 index. A foreign key may be deferred to commit. | `crates/eg-query/tests/constraint.rs::deferred_foreign_key_checks_at_commit` inserts a child before its parent in one transaction.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R011.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** The committer of R001 runs constraint checks inside the batch. A violation refuses with SQLSTATE `23505`, `23503` or `23514` and the constraint name. SHACL violations map to `23514` on the wire. | `tests/pgwire_roundtrip.rs::constraint_violations_return_sqlstate` violates each kind.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R011.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** Constraint checks add under 15 percent to the R005 single-row commit. | `cargo bench --bench engine_writes` compares runs with and without constraints.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R012
Triggers as reactive rules (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Triggers as reactive rules (rollup).** A table may declare row triggers before and after insert, update and delete. A trigger is a reactive rule on the statechart engine. It runs inside the same transaction. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R012.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `TriggerSpec{table, timing, events, rule_ref}` in `crates/eg-query/src/tables/trigger.rs`. The rule is a statechart transition of `crates/eg-statechart` with typed row inputs. | `crates/eg-query/tests/trigger.rs::before_insert_rewrites_row` sets a default through a trigger.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R012.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** The committer calls triggers in declared order. A trigger chain deeper than 16 refuses with `TRIGGER_DEPTH`. A trigger that fails refuses the whole statement. | `crates/eg-query/tests/trigger.rs::depth_bound_refuses` builds a recursive trigger.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R012.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** One after-insert trigger adds under 30 microseconds at p99 per row. | `cargo bench -p eg-query --bench trigger` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R013
Sequences (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Sequences (rollup).** The engine must serve named sequences with `nextval`, `currval` and `setval`. Values never repeat after a crash. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R013.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `Sequence{name, start, increment, cache}` in `crates/eg-query/src/tables/sequence.rs`. The committer reserves a block of `cache` values per durable write. | `crates/eg-query/tests/sequence.rs::values_never_repeat_after_crash` crashes after a reservation.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R013.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** Serial and identity columns use sequences. A `setval` below the reserved high mark refuses with `SEQUENCE_REWIND`. | `tests/pgwire_roundtrip.rs::serial_column_uses_sequence` inserts through the wire front end.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R013.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** `nextval` stays under 2 microseconds at p99 inside a cached block. | `cargo bench -p eg-query --bench sequence` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R014
Views and materialized views as derived series (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Views and materialized views as derived series (rollup).** The engine must serve SQL views and materialized views. A materialized view is a derived series of EG-REPO-INGEST-R004 with lineage to its inputs. It refreshes on demand or on change. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R014.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** `CREATE MATERIALIZED VIEW` stores the plan and a derived series under the existing `matview` feature. Lineage edges link the view to each input table. | `crates/eg-query/tests/matview.rs::refresh_on_change_tracks_lineage` changes an input and reads the view and its lineage.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R014.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** `REFRESH MATERIALIZED VIEW` recomputes in one transaction. The dependency tracker of EG-FEDERATED-QUERY-R017 marks a view stale. A view over a masked column keeps the mask of EG-FEDERATED-QUERY-R706. | `tests/pgwire_roundtrip.rs::view_and_matview_over_wire` reads both through the wire front end.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R014.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** A materialized view of 1M rows refreshes under 2 s. A read of it stays under 3 ms at p99. | `cargo bench -p eg-query --bench matview` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R015
Change data capture by logical decoding (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Change data capture by logical decoding (rollup).** The committed log of the engine must be the change stream. Subscribers read decoded row and graph changes from a durable cursor. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R015.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `ChangeRecord{commit_seq, table_or_graph, op, key, before, after}` in `crates/eg-types/src/change_record.rs`. A decoder in `crates/eg-storage/src/decode.rs` reads the committed log. | `crates/eg-storage/tests/decode.rs::decode_matches_commits` commits 1,000 changes and decodes them.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R015.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** Add the served method `ChangeSubscribe{from_seq, filter}`. The wire front end serves the same stream through the replication protocol of EG-DURABLE-KERNEL-R035. A cursor below the retained log refuses with `CHANGE_CURSOR_EXPIRED`. | `tests/test_change_subscribe_served.py::test_subscriber_resumes_from_cursor` stops and resumes a subscriber.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R015.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** Decoding keeps up with 20,000 commits per second with lag under 100 ms at p99. | `cargo bench -p eg-storage --bench decode` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R016
Point-in-time recovery from snapshots and the log (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Point-in-time recovery from snapshots and the log (rollup).** The engine must restore any store to a chosen commit sequence or time. Restore combines the nearest snapshot with a replay of the archived log. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R016.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `RecoveryTarget{seq_or_time}` and `ArchivePolicy{segment_bytes, retain_s}` in `crates/eg-storage/src/archive.rs`. Log segments archive to the object storage backend of EG-OBJECT-STORAGE-BACKEND. | `crates/eg-storage/tests/archive.rs::restore_reaches_target_seq` restores to a mid-run sequence and compares digests.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R016.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** The storage command of EG-DURABLE-KERNEL-R007 gains `archive` and `restore --to`. A target past the archived log refuses with `RECOVERY_TARGET_UNAVAILABLE`. | `tests/test_pitr_served.py::test_restore_to_time` restores and reads the expected rows.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R016.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** A restore drill of a 10 GiB store finishes under 15 minutes with zero lost committed sequences. | `tests/test_pitr_served.py::test_restore_drill_budget` measures the drill on the soak host.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R017
Read replicas that follow the log (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Read replicas that follow the log (rollup).** A read replica must apply the committed log and serve reads at a stated lag. It never accepts a write. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R017.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add replica mode in `crates/eg-storage/src/replica.rs`. It reads the R015 stream and applies it in commit order. It reports `applied_seq`. | `crates/eg-storage/tests/replica.rs::replica_equals_primary_digest` compares digests after 10,000 commits.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R017.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** A read with a consistency token waits for `applied_seq` up to 2,000 ms, then refuses with `REPLICA_BEHIND`. A write to a replica refuses with SQLSTATE `25006`. | `tests/test_replica_served.py::test_token_read_and_write_refusal` checks both behaviors.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R017.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** Replica lag stays under 200 ms at p99 under the R005 64-writer workload. | `tests/test_replica_served.py::test_replica_lag_budget` measures the lag.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R018
Columnar materialization of hot record classes (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Columnar materialization of hot record classes (rollup).** The engine must keep columnar copies of declared hot record classes as Arrow batches and Parquet files. A cache policy bounds memory and freshness. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R018.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `ColumnarPolicy{record_class, format, max_mib, max_staleness_s}` in `crates/eg-query/src/columnar_cache.rs`. The copy rebuilds from the committed log of R015, never from a second writer. | `crates/eg-query/tests/columnar_cache.rs::copy_tracks_log_within_staleness` writes and reads the copy.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R018.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** The planner reads the copy for scans when it is within `max_staleness_s`. Otherwise it reads the primary store. Eviction follows the cache tier of EG-DURABLE-KERNEL-R800. | `crates/eg-query/tests/columnar_cache.rs::stale_copy_falls_back` ages the copy past the bound.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R018.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** A 100M-row aggregate over the columnar copy runs at least 5 times faster than over the primary store. | `cargo bench -p eg-query --bench columnar_cache` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R019
Outside PostgreSQL databases are sources only (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Outside PostgreSQL databases are sources only (rollup).** An outside PostgreSQL database must reach the engine only as an attached source through EG-UNIFIED-DATA-PLANE-R013 and R007. The engine never writes its authoritative data into an outside database. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R019.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** The storage provider set is closed in `crates/eg-storage/src/provider.rs`: the embedded store and the object storage backend. An outside database appears only as a table provider. | `crates/eg-storage/tests/provider.rs::provider_set_is_closed` lists the providers.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R019.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** Write-back to an outside source follows EG-UNIFIED-DATA-PLANE-R012 only. A request to place an engine record class in an outside database refuses with `EXTERNAL_PLACEMENT_FORBIDDEN`. | `tests/test_external_source_boundary.py::test_engine_data_never_syncs_out` attaches a source and checks that no engine write reaches it.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R019.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** A federated join of 1M engine rows with a 10,000-row outside table stays under 400 ms at p99 with pushdown. | `cargo bench --bench external_source_join` fails on a 10 percent regression.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R020
Demand gate, capability report and parity benchmark suite (rollup)
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Demand gate, capability report and parity benchmark suite (rollup).** Each row of this spec must name a consumer before work starts. The engine must report its relational capabilities. One benchmark suite must cover the budgets of plan.md. Children `.1` to `.3` deliver it. | See each child.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R020.1
Model and behavior
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Model and behavior.** Add `EngineCapabilities{wire_features, index_kinds, constraint_kinds, compat_matrix_digest, replication, pitr}` in `crates/eg-types/src/engine_capabilities.rs`. tasks.md names the consumer of each row. | `crates/eg-types/tests/engine_capabilities.rs::report_round_trips` round-trips the report.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R020.2
Wiring and refusal
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Wiring and refusal.** Add the served method `EngineCapabilities`. The wire front end reports `server_version` and parameters from it. A row without a named consumer stays out of the work queue. | `tests/test_engine_capabilities_served.py::test_report_matches_features` compares the report with the compiled features.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-ENGINE-PARITY-R020.3
Hot-path proof
Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source
**Hot-path proof.** `benches/engine_parity.rs` runs every workload of the plan.md budget table. | `cargo bench --bench engine_parity` against the stored baseline.
requirementEG-ENGINE-PARITYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY
EG-FEDERATED-QUERY — Federated query, search, and reasoning
specNoneSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R001
Bounded derivation steps in EL+/RL and tableau reasoning
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Bounded derivation steps in EL+/RL and tableau reasoning.** The EL+/RL and tableau reasoners enforce a derivation-step budget while checking consistency and classifying the schema, and fail closed with a typed VALIDATION_BUDGET_EXCEEDED error instead of running without bound. Consistency checking reports no unsatisfiable classes on the shipped ontology corpus. | A unit test exercises budget exhaustion to confirm the typed refusal, and an integration test checks consistency across the full corpus.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
1ac87735b5a3
57a12eb06632
c3b87d31ac11
crates/eg-rdf/src/owl/budget.rs:141
crates/eg-rdf/src/owl/budget.rs:143
crates/eg-rdf/src/tableau/abox.rs:481
src/server/graph_schema/world_model_tests.rs:116
EG-FEDERATED-QUERY-R002
Rejection reasons stay out of the core kernel row schema
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Rejection reasons stay out of the core kernel row schema.** When a query or validation is rejected, the engine reports the rejection reason through the caller's log, metric, or domain-specific error channel rather than adding it as a field on the core kernel row structure. The kernel row format remains format-neutral and unchanged by the content of any given rejection reason. | A contract test confirms the kernel row schema carries no rejection-reason field, and a negative test confirms the reason is still observable through logs or returned error metadata.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
2b3e2738b5ff
crates/eg-types/src/wire_query_core.rs:882
crates/eg-types/src/wire_query_core.rs:914
EG-FEDERATED-QUERY-R003
Derivation-step budget is enforced once, not duplicated per path
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Derivation-step budget is enforced once, not duplicated per path.** The derivation-step budget that bounds EL+/RL and tableau reasoning is implemented a single time and applies to every reasoning entry point, including the path that composes and classifies the schema. This specification defines no separate step-budget enforcement here; that guarantee is owned by the typed-packs-and-catalog specification's schema composition work. | Covered by the step-budget enforcement test defined under the typed-packs-and-catalog specification; this specification requires no additional test for this item.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
1ac87735b5a3
73069c650dcd
80c865971ea8
crates/eg-rdf/src/owl/budget.rs:142
EG-FEDERATED-QUERY-R004
Reasoning projection rebuilds after any skipped event
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Reasoning projection rebuilds after any skipped event.** If the reasoning projection misses or skips an update event, the engine triggers a full rebuild of the projection before serving any further reads from it, rather than serving results derived from an incomplete projection state. | An integration test injects a skipped projection event and confirms the engine rebuilds before serving reads.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
49b749980bf2
80c865971ea8
src/server/reasoning_projection.rs:1786
EG-FEDERATED-QUERY-R005
UQL VALIDATE SHAPE stage
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL VALIDATE SHAPE stage.** UQL includes a VALIDATE SHAPE stage that checks query results or graph data against a declared shape definition and reports conformance or the specific violations found, as part of standard UQL execution. | An integration test runs VALIDATE SHAPE over fixtures with conforming and violating data and checks the reported conformance result.
requirementEG-FEDERATED-QUERYSPECIFIED0265d3a41baf
1ac87735b5a3
80c865971ea8
a1bb9fb9503e
crates/eg-plan/src/uql/tests/shape.rs:44
src/server/handlers/rdf/validation.rs:376
EG-FEDERATED-QUERY-R006
Proof-carrying results for SPARQL and rule-derived queries
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Proof-carrying results for SPARQL and rule-derived queries.** A caller can request a proof alongside SPARQL or rule-derivation query results, and the returned proof states the premises used and the schema or index generation they were checked against, remaining consistent across the Rust server and the generated Python client. | An integration test requests a proof-carrying query, verifies the proof's premises against the serving generation, and confirms the proof survives the client wire format.
requirementEG-FEDERATED-QUERYSPECIFIED0265d3a41baf
8bbe95351da3
crates/eg-rdf/src/rules/tests.rs:348
crates/eg-rdf/src/rules/tests.rs:376
crates/eg-rdf/src/rules/tests.rs:386
EG-FEDERATED-QUERY-R007
Semantic-index reconciliation tombstones only on a complete proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Semantic-index reconciliation tombstones only on a complete proof.** Semantic-index reconciliation marks a source's entries as tombstoned only after an authoritative complete-snapshot proof confirms the source is genuinely missing; an interrupted or partial scan leaves the prior live entries untouched. When reconciliation refuses to proceed, it distinguishes an absent source from one whose proof is unissued or expired so the failure names the actual condition. | A regression test interrupts a source scan before the complete-snapshot proof and confirms no tombstone is created, then replays a complete scan and confirms exactly the absent sources are tombstoned.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
be0f1acb05c6
crates/eg-core/src/compute/semantic_index_service/reconciliation_regression.rs:343
EG-FEDERATED-QUERY-R008
Edge-native text and vector search with stable identity
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Edge-native text and vector search with stable identity.** The engine indexes and retrieves edges directly by text and vector similarity, without requiring edges to be reified into nodes, using a stable identity for parallel edges between the same pair of nodes. Searches apply tenant, purpose and row-level-security prefilters before candidate truncation, update and delete against the index are safe to replay, and the set of indexable targets is defined once and generated consistently into every client. | A correctness oracle compares filtered edge-search results against an unfiltered full scan, a replay test confirms idempotent update/delete behavior, and a generated-contract check confirms the target set matches across clients.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
196ded575c8b
1ac87735b5a3
80c865971ea8
834aca5df713
crates/eg-query/src/edge_index/tests.rs:180
crates/eg-query/src/edge_index/tests.rs:282
crates/eg-query/src/edge_index/tests.rs:431
EG-FEDERATED-QUERY-R009
Durable user-managed graph-index lifecycle
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Durable user-managed graph-index lifecycle.** A caller can create, check the status of, and drop a graph index through one durable, user-managed lifecycle that extends the engine's existing index-manager authority. Backfill is fenced against concurrent writes, activation is atomic, a blocked or partial index state is diagnosable, and the index recovers correctly after a restart, with the query planner falling back safely when a needed generation is unavailable. | An integration test exercises create, backfill, activate and drop plus a restart during backfill, and confirms atomic activation, diagnosable blocked state, and correct planner fallback.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
196ded575c8b
20e0a4ec589a
80c865971ea8
e99a95cc842d
crates/eg-query/src/edge_index/tests.rs:305
crates/eg-query/src/edge_index/tests.rs:365
crates/eg-query/src/edge_index/tests.rs:402
crates/eg-query/src/edge_index/tests/durability.rs:48
crates/eg-query/src/edge_index/tests/durability.rs:9
EG-FEDERATED-QUERY-R010
Tableau reasoning stays bounded on the shipped core schema
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Tableau reasoning stays bounded on the shipped core schema.** Tableau consistency and classification reasoning over the shipped core schema completes within bounded time and memory. Schema-axiom internalization and backtracking cause no exponential blowup or stack overflow. Schema composition and restart replay that depend on this reasoning path complete successfully under normal resource limits. | A performance and fault test composes and classifies the full core schema under a restart-replay scenario and confirms it completes within declared time and memory budgets without overflow.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
196ded575c8b
20e0a4ec589a
57a12eb06632
80c865971ea8
src/server/graph_schema/world_model_tests.rs:117
EG-FEDERATED-QUERY-R011
EL+/RL reasoning is sound against the shipped ontology corpus
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**EL+/RL reasoning is sound against the shipped ontology corpus.** The EL+/RL reasoner derives only sound subsumption and disjointness conclusions, so checking the shipped core ontology corpus reports it as consistent with no unsatisfiable classes, including owl:Nothing and its root class. The EL/RL and tableau reasoning paths agree on consistency and disjointness results over this corpus. | A full-corpus consistency regression test checks the shipped ontology for unsatisfiable classes and confirms the EL/RL and tableau results agree.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
196ded575c8b
20e0a4ec589a
f17f47ab300f
src/server/graph_schema/compose.rs:851
EG-FEDERATED-QUERY-R012
Tableau honors AllDisjointClasses and core disjointness facts
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Tableau honors AllDisjointClasses and core disjointness facts.** Tableau-based reasoning expands owl:AllDisjointClasses declarations the same way the EL path does, so schema-entry full-ABox checking enforces the core disjointness between information-content entities, generically-dependent continuants, processes and temporal regions, and between persons, organizations, servers and events. The corresponding fact that a taxon is never an organism is present and enforced. | An integration test checks that tableau reasoning rejects instances violating these disjointness constraints, including the taxon/organism fact.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
20e0a4ec589a
42aeb6436568
c3b87d31ac11
crates/eg-rdf/src/tableau/abox.rs:537
src/server/graph_schema/world_model_tests.rs:219
EG-FEDERATED-QUERY-R013
Foreign-source resolution is scoped to the owning principal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Foreign-source resolution is scoped to the owning principal.** Registered foreign sources are keyed by owning tenant and actor rather than by name alone, so a caller with general federated-query access cannot name another principal's registered source and have the engine use its stored credentials on their behalf. Resolving a foreign source outside the registering principal's scope is refused with a stable ACCESS_DENIED error, and foreign-source rows are documented as not row-level-security filtered. | A negative integration test registers a foreign source under one principal and confirms a different principal's query naming that source is refused with ACCESS_DENIED.
requirementEG-FEDERATED-QUERYLANDED0265d3a41baf
196ded575c8b
a3e0c9984c67
EG-FEDERATED-QUERY-R014
Explicit grant-based sharing of a registered foreign source
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Explicit grant-based sharing of a registered foreign source.** A principal who owns a registered foreign source can share query access to it with another principal through the engine's existing role-based access-control grant mechanism, rather than through an implicit name lookup. The registering principal retains ownership of the source, and access can be granted and later revoked. | An integration test grants another principal access to a foreign source, confirms it can query through the grant, then revokes the grant and confirms the query is refused.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
a1bb9fb9503e
c3b87d31ac11
src/server/foreign_share.rs:178
EG-FEDERATED-QUERY-R015
Read-only enforcement at the shared SQL execution path
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Read-only enforcement at the shared SQL execution path.** The shared graph-free SQL execution path classifies and refuses DDL, DML, COPY and CREATE EXTERNAL TABLE statements as not read-only, enforced once at that shared path rather than duplicated per caller. Every caller that reaches this path, including observability log search, is subject to the same refusal. | A test sends DDL, DML, COPY and CREATE EXTERNAL TABLE statements through each caller of the shared SQL path, including log search, and confirms each is refused.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
0dea49929b94
196ded575c8b
a1bb9fb9503e
crates/eg-query/src/sql/read_only.rs:52
crates/eg-query/src/sql/read_only.rs:84
src/server/obs/search.rs:362
EG-FEDERATED-QUERY-R016
UQL AS OF uses Unix-second timestamps, not ISO dates
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL AS OF uses Unix-second timestamps, not ISO dates.** UQL's AS OF clause takes a Unix-second timestamp, and query stages chain using the published UQL stage-separator syntax rather than Cypher-shaped text or an ISO-8601 timestamp; text that does not match this grammar is rejected as invalid rather than silently accepted. A conformance test confirms that UQL text emitted by any client parses successfully against the current grammar. | A parser test feeds the correct stage-chained, Unix-second AS OF form and confirms it parses, and a negative test confirms Cypher-shaped or ISO-timestamp text is rejected.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
a3ad18c91bc5
crates/eg-plan/src/uql/tests/legacy.rs:297
EG-FEDERATED-QUERY-R017
Dependency tracking covers edge-type and embedding generations
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Dependency tracking covers edge-type and embedding generations.** Query plans that perform graph traversal or embedding-based ranking register their dependency on the specific edge types and embedding generations they read, so a write that changes an unrelated edge type or generation does not invalidate the plan, while a write touching a real dependency correctly does. | A test performs disjoint writes against unrelated edge types and embedding generations and confirms an existing traversal/rank plan is not invalidated, while a dependent write does invalidate it.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
0dea49929b94
10177f908dd0
crates/eg-core/tests/dependency_scoped_edges.rs:132
crates/eg-core/tests/dependency_scoped_edges.rs:147
crates/eg-core/tests/dependency_scoped_edges.rs:221
EG-FEDERATED-QUERY-R018
Class-level volatility drives invalidation and cache freshness
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Class-level volatility drives invalidation and cache freshness.** Classes and sources declare an eg:volatilityClass, and a per-class invalidation event fires when matching data changes. Foreign-source result caching only serves a cached result when the relevant source watermark is current, consistent with the volatility class declared for that data. | A test changes data in a declared volatility class, confirms the corresponding invalidation event fires, and confirms the foreign-source cache only serves fresh, watermark-current results.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
10177f908dd0
70235bb3b98f
src/server/handlers/query/foreign_watermarks.rs:160
src/server/handlers/query/foreign_watermarks.rs:195
src/server/handlers/query/freshness_feed.rs:115
EG-FEDERATED-QUERY-R019
Per-bar signal-state advancement with revisable trend records
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Per-bar signal-state advancement with revisable trend records.** On each bar finalization, the complex-event-processing layer advances signal state and records a TrendFlip event; a later correction can revise a previously recorded TrendFlip without losing the revision history. A scanner index exposes the latest signal state per series for efficient lookup. | A test finalizes a sequence of bars, confirms signal state advances and TrendFlip records are created, then issues a revision and confirms both the historical and latest-state views are correct.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
0dea49929b94
532418b7e55b
crates/eg-compute/src/finance/market/record_tests.rs:154
crates/eg-compute/src/finance/market/record_tests.rs:50
EG-FEDERATED-QUERY-R020
One query-text method surface, with the legacy method retired
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**One query-text method surface, with the legacy method retired.** The engine serves exactly one query-text method, Method::Uql; the legacy UnifiedQueryText method and its callers, including remote-engine federation and server tests, are migrated to it, and UnifiedQueryText is removed from the codebase with no compatibility alias or deprecation shim. | A contract test confirms UnifiedQueryText no longer exists in the method registry, and an integration test confirms remote-engine federation operates correctly over Method::Uql.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
bd27155934dc
c3b87d31ac11
crates/eg-capabilities/tests/contract_registry.rs:226
EG-FEDERATED-QUERY-R021
Full UQL predicate algebra with SQL-consistent evaluation
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Full UQL predicate algebra with SQL-consistent evaluation.** UQL's predicate algebra supports the comparison operations, AND/OR/NOT with parentheses, IN, BETWEEN, IS [NOT] NULL, typed literals, JSONPath access and spatial predicates. The per-row three-valued evaluator used by UQL agrees with the equivalent SQL evaluation on every supported predicate, including null handling. | A differential test evaluates the same predicate set through SQL and the UQL per-row evaluator across null and non-null fixtures and confirms identical results.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
07988fcb61e4
e93f988eae07
crates/eg-plan/src/pred_eval.rs:310
EG-FEDERATED-QUERY-R022
UQL source clauses are first-class, with typed empty-result cases
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL source clauses are first-class, with typed empty-result cases.** UQL treats MATCH, SPARQL, TSSCAN, SENSOR FUSE/ALIGN, SPATIAL/TENSOR SCAN and FOREIGN SCAN/HTTP as first-class source clauses in its grammar and planner. A head-transform stage that would yield an empty result set emits the UQL_W_HEAD_TRANSFORM_YIELDS_EMPTY warning instead of silently reseeding from the runtime, and runtime empty-set reseeding is no longer part of the documented language. | A parser and planner test exercises each source clause and confirms a head-transform-to-empty case emits the warning rather than reseeding.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
629101277687
6fb1c534abec
8040b672e582
8451d7eecf02
crates/eg-plan/src/exec.rs:2661
src/server/mod.rs:2099
EG-FEDERATED-QUERY-R022.1
A label Scan matches the engine's label set
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**A label Scan matches the engine's label set.** The plan executor's label source is `scan_label` in `crates/eg-plan/src/exec.rs`. It and the layer filters of the stream, time-series, spatial and tensor sources SHALL select a node by its label. The label can be under `type`, `node_type` or `label`, or in the `labels` array. This is the same set that the engine's label index files (`eg_core::graph::node_carries_label`). That function shares `NODE_LABEL_KEYS` with `labels_of`. Writers store `node_type`, so a Scan that read only `type` returned no rows for them. | The unit test is `scan_matches_every_label_field_writers_store` in `crates/eg-plan/src/exec.rs`. The served test `server::tests::test_served_scan_reads_node_type_labels` returns `node_type` nodes. It uses both `Method::Uql` (`MATCH (:Paper)`) and `Method::UnifiedQuery` (`Op::Scan`).
requirementEG-FEDERATED-QUERYVERIFIED629101277687
6fb1c534abec
8040b672e582
crates/eg-plan/src/exec.rs:2661
src/server/mod.rs:2099
EG-FEDERATED-QUERY-R023
Every query modality has a published UQL spelling
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Every query modality has a published UQL spelling.** UQL provides a syntax for every supported query modality: SPARQL/VAR, user-defined functions, FOREIGN SCAN/HTTP with any credential-bearing inline source specification refused, spatial functions including BUFFER, INTERSECTION and DIFFERENCE plus REPROJECT, tensor SLICE/REDUCE/ADD and related tensor functions, complex-event patterns such as SEQ/WITHIN/ABSENCE over SLIDING/TUMBLING windows, SENSOR ALIGN, probabilistic PROB, FUSE K, REASON ONTOLOGY, bounded WINDOW, and VALIDATE SHAPE. | A grammar-exhaustiveness test parses a program covering every listed construct and confirms each round-trips through the canonical printer, and a negative test confirms a credential-bearing FOREIGN SCAN/HTTP specification is refused.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
8451d7eecf02
crates/eg-plan/src/uql/tests/contract.rs:58
EG-FEDERATED-QUERY-R024
Traversal syntax compiles to one canonical Expand encoding
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Traversal syntax compiles to one canonical Expand encoding.** UQL's directional traversal arrows, the wildcard hop syntax and edge predicate filters all compile to the budget-checked, shortest-hop Op::Expand plan node. The common case of an unfiltered, unbounded, outbound single-relationship expansion is always encoded the same way, spelled Traverse, so the planner has one canonical representation rather than multiple equivalent encodings. | A planner test compiles equivalent traversal syntaxes and confirms they produce the identical Op::Expand/Traverse plan node.
requirementEG-FEDERATED-QUERYLANDED0265d3a41baf
e93f988eae07
EG-FEDERATED-QUERY-R025
Typed parameter binding end-to-end through the Python client
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Typed parameter binding end-to-end through the Python client.** UQL's typed $param placeholders bind only in parser-recognized value positions and are type-checked, with unbound, mistyped or unused parameters failing as typed errors. The engine serves this through Method::Uql with text and params fields, and the generated Python client exposes a matching uql(text, params) call; values never pass through text interpolation. | A test sends injection-shaped parameter values through the Python client and confirms they bind as typed values rather than altering the executed query, plus negative tests for unbound, mistyped and unused parameters.
requirementEG-FEDERATED-QUERYLANDED0265d3a41baf
4e0570f079f5
EG-FEDERATED-QUERY-R026
UQL documentation is test-verified with an embedded grammar
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL documentation is test-verified with an embedded grammar.** docs/uql.md documents the current UQL language with every example in a uql code block actually parsing under a dedicated test, and embeds the generated grammar rather than a hand-maintained copy. docs/analytics_in_uql.md clearly separates which analytics run through SQL from which run through UQL stages. | A documentation test parses every uql-tagged code block in docs/uql.md and fails the build if any example does not parse.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
7b9ba5708638
c3b87d31ac11
crates/eg-plan/src/uql/tests/contract.rs:106
crates/eg-plan/src/uql/tests/contract.rs:131
EG-FEDERATED-QUERY-R027
EXPLAIN, PROFILE and RETURN support multi-stage UQL programs
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**EXPLAIN, PROFILE and RETURN support multi-stage UQL programs.** A UQL program that composes named LET/JOIN subplans into a dependency graph supports EXPLAIN and PROFILE output and RETURN channels the same as a single-stage query, rather than refusing with UQL_UNSUPPORTED. | An integration test runs EXPLAIN and PROFILE over a multi-stage LET/JOIN program and confirms per-stage plan and runtime information is returned instead of a refusal.
requirementEG-FEDERATED-QUERYLANDED0265d3a41baf
681de5cb1968
EG-FEDERATED-QUERY-R028
KnowledgeSet is reachable from UQL
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**KnowledgeSet is reachable from UQL.** A UQL query can read a KnowledgeSet, combining epistemic status, FUSE and AS OF semantics within a single query, and produces results equivalent to issuing the corresponding operations through the structured query surface or the previously separate surfaces. | An oracle test runs equivalent epistemic, fuse and as-of queries through UQL, the structured surface and the prior separate surfaces and confirms the results agree.
requirementEG-FEDERATED-QUERYSPECIFIED0265d3a41baf
681de5cb1968
EG-FEDERATED-QUERY-R029
UQL text from graph-exploration clients matches the grammar
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL text from graph-exploration clients matches the grammar.** Any UQL text generated by a graph-exploration client, including a temporal scrubber control, uses the stage-chained syntax and a Unix-second AS OF timestamp defined by the published UQL grammar, not Cypher-shaped text or an ISO-8601 timestamp. Text that does not conform to this grammar is rejected with a typed parse error rather than silently misinterpreted. | A conformance test parses the exact text emitted by the temporal-scrubber control's query template and confirms it succeeds under the current grammar.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
cb0a4dfcf4a5
crates/eg-plan/src/uql/tests/scrubber.rs:16
crates/eg-plan/src/uql/tests/scrubber.rs:38
crates/eg-plan/src/uql/tests/scrubber.rs:53
EG-FEDERATED-QUERY-R030
TSSCAN preserves per-series row identity and full precision
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**TSSCAN preserves per-series row identity and full precision.** The TSSCAN source identifies each time-series row by series@ts and carries its values as f64 channels named v0..vk, so rows from different series at the same timestamp never collide and no value is truncated to f32. This row identity is the basis for series analytics expressed in UQL. | A fixture test scans overlapping multi-series data through TSSCAN and confirms no row collisions, no truncation and correct per-series, per-timestamp identity.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
79fb60a33ee0
crates/eg-plan/src/rowset.rs:219
crates/eg-plan/src/rowset.rs:243
crates/eg-plan/src/tsdb_scan_tests.rs:693
EG-FEDERATED-QUERY-R031
Contribution attribution kernels exposed through UQL ATTRIBUTE
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Contribution attribution kernels exposed through UQL ATTRIBUTE.** The engine computes contribution attribution using linear split, exact Shapley for small coalitions, seeded sampled Shapley with a confidence interval, Owen values over a hierarchy, and multi-factor OLS regression with heteroskedasticity-and-autocorrelation-consistent standard errors. UQL exposes these through an ATTRIBUTE channel VALUE agg SHAPLEY [SAMPLES n SEED s] stage, and a decision-evaluation report can attribute an assembly slate's outcome across its logged sub-slates. | Exact Shapley results are checked against a brute-force oracle, sampled Shapley against seeded-repeatability and confidence-interval-coverage tests, and the ATTRIBUTE UQL stage against an integration test.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
7940beedc463
crates/eg-numeric/src/attribution/tests.rs:133
crates/eg-numeric/src/attribution/tests.rs:83
crates/eg-numeric/src/attribution/tests.rs:93
EG-FEDERATED-QUERY-R032
Probabilistic impact propagation with cone-scoped recomputation
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Probabilistic impact propagation with cone-scoped recomputation.** The engine propagates probabilistic impact across the graph using an exact Noisy-OR model on acyclic structure with a bounded unroll on cycles, and an Independent-Cascade model using seeded Monte Carlo simulation with a confidence interval, following ontology-declared edge transmission. Results report the top-k contributing paths with per-seed attribution, are exposed in UQL as PROPAGATE model edge-pattern HOPS n, and a standing query seeded from Incident, ConformanceViolation or CVE facts recomputes only the affected cone and records ImpactAssessment facts. | A test compares the Noisy-OR result against an exact enumeration on small acyclic graphs and the Independent-Cascade result against seeded-repeatability and confidence-interval checks, plus an integration test for the PROPAGATE stage and standing-query cone recomputation.
requirementEG-FEDERATED-QUERYSPECIFIED0265d3a41baf
c06e903d0def
src/server/impact_watch/tests.rs:112
src/server/impact_watch/tests.rs:135
src/server/impact_watch/tests.rs:157
EG-FEDERATED-QUERY-R033
Barrier-hit and time-to-exhaustion derivations, one shared CDF
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Barrier-hit and time-to-exhaustion derivations, one shared CDF.** The engine computes first-passage probability for a barrier using the arithmetic-Brownian-motion inverse-Gaussian form and the geometric-Brownian-motion log-barrier form, each checked against a terminal-distribution calculation, with maximum-likelihood drift and volatility estimation and a bootstrap confidence interval. These are exposed as DERIVE barrier_hit(...) and DERIVE tte(...), and all normal-tail calculations use one public stats::norm_cdf implementation rather than a separate private copy. | Results are checked against a Monte Carlo simulation and against the analytic limit as volatility approaches zero, which must match the deterministic linear-prediction case.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
a0fbd9c05adf
c98e58397fcc
crates/eg-compute/src/graph_algos/impact/tests.rs:101
crates/eg-compute/src/graph_algos/impact/tests.rs:117
crates/eg-compute/src/graph_algos/impact/tests.rs:87
EG-FEDERATED-QUERY-R034
Motif and discord search over time series, batch and streaming
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Motif and discord search over time series, batch and streaming.** The engine finds motifs and discords in time series using an FFT-accelerated MASS distance computation and a matrix profile, computed anytime for batch data and incrementally for streaming data. UQL exposes MOTIF LIKE $shape LENGTH m TOP k and DISCORD LENGTH m TOP k under the standard query budgets, anomaly mining supports a matrix-profile discord algorithm, and a series shape predicate can emit a stream event consumed by the existing complex-event-processing matcher. | A test compares matrix-profile motif and discord results against a brute-force distance computation on a reference series and confirms the streaming and batch computations agree.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
1625e507f6fc
fa64a5de6cda
crates/eg-numeric/src/series/motif_tests.rs:152
crates/eg-numeric/src/series/motif_tests.rs:84
EG-FEDERATED-QUERY-R035
Filtered text search evaluates within the filtered candidate set
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Filtered text search evaluates within the filtered candidate set.** A text search combined with a filter evaluates its relevance ranking only within the set of rows that satisfy the filter, using a filtered index scan or equivalent pre-filtering, so a filtered query returns up to k relevant results drawn from the full matching set rather than filtering after an unfiltered top-k ranking has already discarded relevant rows. | A correctness oracle compares filtered BM25 search results against an unfiltered full scan intersected with the filter and confirms they agree.
requirementEG-FEDERATED-QUERYVERIFIED0265d3a41baf
4dfe7beb589b
fa64a5de6cda
crates/eg-plan/src/text_tests.rs:309
EG-FEDERATED-QUERY-R036
Bounded, observable graph reopen after a restart
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Bounded, observable graph reopen after a restart.** After a restart, the engine serves reads from stored data immediately and rebuilds or restores its index state either from persisted index state or incrementally in the background, rather than blocking all reads on a full linear index rebuild. While materialization is incomplete, reads are refused with a typed PARTIAL_MATERIALIZATION state, and a readiness signal indicates when the graph is fully queryable. | A restart test measures reopen time and reads against graphs of increasing document counts and confirms the PARTIAL_MATERIALIZATION state and readiness signal behave correctly, with reopen time bounded well under a full rebuild.
requirementEG-FEDERATED-QUERYLANDED62c450561948
bcbbe09c7e76
EG-FEDERATED-QUERY-R037
Rolling window statistics are both O(1) and numerically exact
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Rolling window statistics are both O(1) and numerically exact.** Streaming rolling-window statistics, such as standard deviation and z-score, update in constant time per step and report exactly zero for a window containing constant values, with no floating-point residue accumulating from incremental add/remove updates over long-running windows. | A property test compares the streaming O(1) update against an exact from-scratch recomputation across constant, alternating and large windows and confirms they agree, including an exact zero on constant windows.
requirementEG-FEDERATED-QUERYVERIFIED1ee2319ee506
62c450561948
crates/eg-numeric/src/series/streaming_tests.rs:63
crates/eg-numeric/src/series/streaming_tests.rs:76
crates/eg-numeric/src/series/streaming_tests.rs:87
EG-FEDERATED-QUERY-R038
Federation optimizer: cost-aware pushdown, freshness-aware cache (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Federation optimizer: cost-aware pushdown, freshness-aware cache (rollup).** The query planner models each foreign source's capability, including SQL/OBDA, SPARQL endpoints, HTTP/REST connectors, lake formats and other registered engine kinds, and pushes down projection, filters, LIMIT/ORDER, aggregates, same-source joins and batched key lookups only when that capability proves the work sound. It applies cardinality and cost estimates under a per-query network budget, serves freshness-aware cached results gated by source watermarks, bounds remote parallelism, and EXPLAIN output shows exactly which fragments ran remotely. The child requirements below define the required behavior and acceptance. | A differential test compares optimized execution plans and results against a full-fetch oracle across each supported source capability and confirms correctness, declared pushdown, and accurate EXPLAIN reporting.
requirementEG-FEDERATED-QUERYLANDED212c65869e32
62c450561948
EG-FEDERATED-QUERY-R038.1
Typed foreign-source capability + cost model proves which pushdown kinds are sound
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Typed foreign-source capability + cost model proves which pushdown kinds are sound.** A `ForeignSourceCapability`/cost-model typed struct declares, per source, a cardinality estimate, a network-budget cost, and which pushdown kinds (projection, filter, limit/order, aggregate, same-source join, batched key lookup) that source's declared capability proves sound. The optimizer consults this model before pushing any fragment down and refuses a pushdown kind the capability does not prove sound. | A unit/property test suite validates the typed model's construction and asserts a representative refusal case per pushdown kind: a source whose declared capability does not prove a kind sound is never offered that pushdown.
requirementEG-FEDERATED-QUERYLANDED212c65869e32
EG-FEDERATED-QUERY-R039
Mixed traversal and vector queries return k or a typed shortfall
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Mixed traversal and vector queries return k or a typed shortfall.** A query combining multi-hop graph traversal with vector similarity search continues generating candidates until k results survive the traversal filter, or returns a typed shortfall result naming how many matches were found, rather than silently returning fewer than k results without explanation. | A correctness oracle runs mixed traversal-plus-vector queries against a reference corpus and confirms either exactly k permitted results or an explicit typed shortfall, never a silent undercount.
requirementEG-FEDERATED-QUERYSPECIFIED5c2ab50088c4
62c450561948
EG-FEDERATED-QUERY-R040
Filter-aware index scans for filtered vector and text search
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Filter-aware index scans for filtered vector and text search.** Filtered approximate-nearest-neighbor and BM25 text search plan as filter-aware index scans over pre-filtered candidate sets or bitmap filters, rather than scanning the full unfiltered index and discarding non-matching rows afterward, while preserving the filtered-search correctness guarantee. | A benchmark compares filtered vector and text search latency before and after the filter-aware scan change on a fixed corpus, alongside the correctness oracle confirming results remain correct.
requirementEG-FEDERATED-QUERYSPECIFIED08b2c9d4b567
62c450561948
EG-FEDERATED-QUERY-R041
Federation optimizer core drives pushdown decisions for every query
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Federation optimizer core drives pushdown decisions for every query.** The federation optimizer in eg-plan/src/federation_opt/ models each foreign source's capabilities, builds a RemoteRequest per source, tracks a per-query budget meter, trace and LIMIT hints, maintains learned SourceStats with provenance, and executes bind joins with an adaptive batch sizer and typed refusals; it is bound into the ForeignScan/Foreign plan arms so every served plan uses it. | Federation optimizer unit and integration tests exercise capability-gated pushdown, budget enforcement, bind-join batching and typed refusal paths against the served query path.
requirementEG-FEDERATED-QUERYLANDED62c450561948
d656b605ef0a
EG-FEDERATED-QUERY-R042
OBDA pushes per-predicate scans and semi-join reduction to SQL sources
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**OBDA pushes per-predicate scans and semi-join reduction to SQL sources.** OBDA execution groups scans per predicate, pushes constant-subject key lookups and constant-object equality checks to the external SQL source, and reduces semi-joins to an IN clause rendered as ObdaCompare::In by that source. | OBDA pushdown tests (FQR-06) confirm per-predicate scan grouping, constant lookup/equality pushdown and semi-join IN reduction produce results matching the full-fetch oracle.
requirementEG-FEDERATED-QUERYLANDED62c450561948
d656b605ef0a
EG-FEDERATED-QUERY-R043
SQL foreign-source connections share the one outbound SSRF guard
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**SQL foreign-source connections share the one outbound SSRF guard.** SQL DSN connections for Sql foreign-source specs and OBDA external sources are validated at a single chokepoint against the same outbound allowlist and sensitive-address-range checks used for HTTP foreign sources. | Security negative tests confirm a disallowed SQL DSN target is refused with the same stable typed error as a disallowed HTTP target.
requirementEG-FEDERATED-QUERYLANDED62c450561948
d656b605ef0a
EG-FEDERATED-QUERY-R044
UQL EXPLAIN and PROFILE surface federation trace and budget hints
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL EXPLAIN and PROFILE surface federation trace and budget hints.** UQL's PROFILE and EXPLAIN output include a federation trace describing remote fragments, residual local work and budget usage, and callers can supply budget hints that the planner honors when routing a query through the remote UQL method. | EXPLAIN/PROFILE tests for federated UQL queries confirm the trace reports the remote/residual breakdown and that caller-supplied budget hints are respected.
requirementEG-FEDERATED-QUERYLANDED33c1fd51757d
62c450561948
c98e58397fcc
EG-FEDERATED-QUERY-R045
Foreign rows carry typed columns for filter and projection pushdown
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Foreign rows carry typed columns for filter and projection pushdown.** A foreign source returns ForeignRows with stable column names, types, null semantics and row provenance, and apply_filter/apply_projection classify each operation as Exact, Inexact or Unsupported; only an Exact result removes the local residual, an Inexact result may narrow transfer only to a superset of authorized matching rows, and an Unsupported result fetches the needed columns and evaluates locally without ever dropping a column required by a residual, ORDER BY, authorization or proof channel. | A recording mock verifies every pushed ForeignRows request narrows data transfer without changing answers, and a schema/version mismatch or ambiguous column identity is refused rather than silently bound.
requirementEG-FEDERATED-QUERYVERIFIED62c450561948
6ffff56cecff
crates/eg-plan/src/federation_opt/columns.rs:285
crates/eg-plan/src/federation_opt/columns.rs:311
crates/eg-plan/src/federation_opt/columns.rs:334
EG-FEDERATED-QUERY-R046
OBDA pushes SPARQL LIMIT, ORDER, aggregates and same-source joins
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**OBDA pushes SPARQL LIMIT, ORDER, aggregates and same-source joins.** OBDA translates SPARQL LIMIT, ORDER BY, aggregate and same-source join clauses into the rendered SQL sent to the external source and evaluates the pushed solutions directly, without materializing a transient in-memory graph. | OBDA pushdown tests confirm pushed LIMIT/ORDER/aggregate/join results match the full-fetch oracle and that no transient graph is constructed for the pushed portion.
requirementEG-FEDERATED-QUERYLANDED62c450561948
c98e58397fcc
EG-FEDERATED-QUERY-R047
Federation enforces per-source parallelism caps and rate limits
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Federation enforces per-source parallelism caps and rate limits.** Each foreign source is bounded by a global semaphore keyed to its fingerprint that caps concurrent requests and enforces a rate limit, while bind-join batches to different sources still execute in parallel within those caps. | Concurrency tests confirm request counts to a single source never exceed its configured cap while independent sources execute concurrently.
requirementEG-FEDERATED-QUERYLANDED321aa24de7c0
62c450561948
EG-FEDERATED-QUERY-R048
Join ordering across foreign sources uses learned, provenanced statistics
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Join ordering across foreign sources uses learned, provenanced statistics.** The planner orders joins across multiple foreign sources using learned cardinality statistics persisted as graph facts with their provenance, seeded by registration-time probes such as PostgreSQL table-size statistics, engine-reported statistics and VoID descriptions. (Rollup: delivered incrementally by its `.1`, `.2`, ... children, one per code root — typed model, persistence, per-source-kind probes, planner join-ordering use.) | Join-ordering tests compare planner choices against known cardinalities and confirm learned statistics carry sample count and provenance per FQR-05.
requirementEG-FEDERATED-QUERYVERIFIED62c450561948
6c11520aebfc
f708d6e7728f
crates/eg-plan/src/federation_stats.rs:166
crates/eg-plan/src/federation_stats.rs:174
crates/eg-plan/src/federation_stats.rs:185
crates/eg-plan/src/federation_stats.rs:209
EG-FEDERATED-QUERY-R048.1
Typed join-cardinality-statistic model with provenance
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Typed join-cardinality-statistic model with provenance.** `crates/eg-plan/src/federation_stats.rs` defines `JoinCardinalityStatistic` (estimated cardinality, sample count, a source generation marker) and `StatisticsProvenance` (PostgreSQL table-size stats, engine-reported stats, or a VoID description), constructed only through a fallible constructor that refuses a statistic carrying no provenance. This is the typed-model code root of R048; persistence as graph facts, per-source-kind probes and planner join-ordering use are later `.2`+ children. | A unit test constructs a statistic with each provenance kind and confirms it round-trips its sample count and provenance, and a second test confirms the constructor refuses a statistic given no provenance.
requirementEG-FEDERATED-QUERYVERIFIED6c11520aebfc
f708d6e7728f
crates/eg-plan/src/federation_stats.rs:166
crates/eg-plan/src/federation_stats.rs:174
crates/eg-plan/src/federation_stats.rs:185
crates/eg-plan/src/federation_stats.rs:209
EG-FEDERATED-QUERY-R049
Foreign query fragment cache is freshness-aware and owner-salted
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Foreign query fragment cache is freshness-aware and owner-salted.** Cached results for a foreign query fragment are keyed by source identity, an owner-specific salt, the canonical request and the source's current freshness watermark; a missing or stale watermark disables the cache hit rather than serving stale data. | Cache tests confirm a hit requires a matching fresh watermark and that a stale or absent watermark forces a live fetch.
requirementEG-FEDERATED-QUERYVERIFIED33c1fd51757d
62c450561948
b0124203865d
crates/eg-plan/src/federation_opt/cache.rs:162
crates/eg-plan/src/federation_opt/run.rs:502
EG-FEDERATED-QUERY-R050
SPARQL SERVICE uses bind joins and pushes FILTER/LIMIT
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**SPARQL SERVICE uses bind joins and pushes FILTER/LIMIT.** SPARQL SERVICE clauses execute as VALUES-based bind joins against the remote endpoint and push FILTER and LIMIT into the SERVICE request where sound, validated through the same single outbound SSRF guard used by other foreign sources. | SERVICE bind-join tests confirm multivalued RDF answers are preserved and that a disallowed SERVICE endpoint is refused by the shared SSRF guard.
requirementEG-FEDERATED-QUERYLANDED3d00361f3191
62c450561948
EG-FEDERATED-QUERY-R051
Iceberg scans prune manifests using the final pushed predicates
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Iceberg scans prune manifests using the final pushed predicates.** The Iceberg table scan is assembled only after the query engine has supplied its filters, projection and limit, so manifest pruning reflects the actual pushed predicates instead of an earlier, less-informed scan; documentation describing pruning behavior is corrected to match this. | A partitioned Iceberg fixture test confirms manifest files are pruned according to the final pushed filters, projection and limit.
requirementEG-FEDERATED-QUERYVERIFIED56d3663f4bf8
5dd3f1b33fad
62c450561948
8676a7f3af87
crates/eg-query/tests/iceberg_federation_scan.rs:384
EG-FEDERATED-QUERY-R052
RemoteEngine sources receive pushed key filters and bounded LIMIT
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**RemoteEngine sources receive pushed key filters and bounded LIMIT.** For registered RemoteEngine sources, the planner appends authorized key filters and a bounded LIMIT to the canonical read-only UQL request, preserving ORDER BY, residual filtering, pagination and outer-query limit semantics; a remote lacking the feature or exact push capability falls back to the safe bounded route with local residuals instead of fetching an unbounded result. | A recording mock proves pushed RemoteEngine requests narrow transfer without changing answers, and a capability-lacking remote is verified to fall back safely.
requirementEG-FEDERATED-QUERYVERIFIED62c450561948
70c5421663b9
8676a7f3af87
a854dd78481d
crates/eg-plan/src/federation_opt/engine_peer_tests.rs:277
EG-FEDERATED-QUERY-R053
Trino, Cypher and Spark sources are typed ForeignSourceSpec kinds
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Trino, Cypher and Spark sources are typed ForeignSourceSpec kinds.** Trino, Cypher-speaking stores and Spark are each registered as a distinct ForeignSourceSpec kind with its own declared capability set. Spark is restricted to batch access with no interactive pushdown capability. | Per-kind capability tests confirm each ForeignSourceSpec only advertises and exercises the pushdown operations its declared capability set allows.
requirementEG-FEDERATED-QUERYSPECIFIED09385617b3ae
62c450561948
ec4d3c4ee5a3
EG-FEDERATED-QUERY-R054
SPARQL SERVICE and peer federation share the one outbound SSRF guard
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**SPARQL SERVICE and peer federation share the one outbound SSRF guard.** Outbound requests from SPARQL SERVICE handling and peer federation fan-out both validate their target through the single shared federation guard; no separate, weaker outbound validation remains in either call path. | Security tests confirm a target disallowed by the shared guard is refused identically from both the SPARQL SERVICE and peer fan-out call paths.
requirementEG-FEDERATED-QUERYLANDED62c450561948
70c5421663b9
EG-FEDERATED-QUERY-R055
SPARQL evaluation binds every value of a multi-valued property
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**SPARQL evaluation binds every value of a multi-valued property.** The SPARQL evaluator iterates and binds every value of a repeated predicate on a subject, rather than binding only the first value and silently dropping the remaining matching answers. | A regression test on a graph with two values for the same predicate confirms both values bind, including per-binding FILTER evaluation, per FQR-01's correct-read acceptance.
requirementEG-FEDERATED-QUERYLANDED62c450561948
d656b605ef0a
EG-FEDERATED-QUERY-R056
Causal-impact p-values reuse the shared numeric tail functions
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Causal-impact p-values reuse the shared numeric tail functions.** eg-compute/src/mining/causal_impact.rs computes its p-value using eg-numeric's shared normal survival and cumulative distribution functions instead of a local error-function approximation, avoiding the catastrophic cancellation that approximation produced in the tail. | A tail-probability test against literal reference values at tight relative tolerance confirms the computed p-value matches the exact reference in the tail, per FQR-09.
requirementEG-FEDERATED-QUERYVERIFIED1b55c58d05d5
62c450561948
b6e49c439128
crates/eg-compute/src/mining/causal_impact.rs:179
EG-FEDERATED-QUERY-R057
SQL provider module stays within the repository's file-size limit
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**SQL provider module stays within the repository's file-size limit.** crates/eg-query/src/sql/providers.rs is kept at or under the repository's 900-line file-size limit through semantic extraction that preserves existing provider behavior exactly. | A line-count check confirms the file is at or under 900 lines, and the existing SQL provider test suite passes unchanged after extraction.
requirementEG-FEDERATED-QUERYLANDED3241ec8af9d4
62c450561948
EG-FEDERATED-QUERY-R058
Natural language runs only as disclosed, read-only typed UQL
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Natural language runs only as disclosed, read-only typed UQL.** A natural-language request is never query authority itself: the configured planner translates it to UQL text, the engine parses that text with the same grammar as any caller-written query and runs it through the same read-only pipeline under the caller's verified authority, row visibility and budgets. Every natural-language result carries the exact UQL that was executed, a plan-only mode returns that typed UQL candidate without executing it so a caller can review first, results are never cached on the natural-language text, and natural language cannot reach any mutating or side-effecting operation. Rollup over `EG-FEDERATED-QUERY-R058.1` (typed disclosure model, built), `.2` (wire the dispatch entry point and result contract to it), `.3` (no-cache-on-NL-text + no-mutation-reachable guards). | Tests confirm the executed UQL is returned with the result, plan-only mode returns a candidate without reading data, planner output that fails to parse or exceeds a budget is refused with a typed error, row visibility matches the equivalent direct UQL query, and no mutation is reachable.
requirementEG-FEDERATED-QUERYSPECIFIED3da71fa8e9b7
62c450561948
EG-FEDERATED-QUERY-R058.1
Typed NL→UQL disclosure model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Typed NL→UQL disclosure model.** `eg-plan` exposes an `NlQueryResult` that always carries the exact UQL text alongside any data — `Some(rows)` when executed, `None` (plan-only mode) when not — plus a typed `NlQueryError` with dedicated variants for planner output that fails to parse and output that exceeds a configured `NlQueryBudget`, refused before parsing or execution. `plan_only` produces the candidate without taking any view/`PlanCtx`, so plan-only mode cannot read data even by construction. | Unit tests confirm: an executed result carries the exact UQL that ran; `plan_only` returns a candidate with `rows: None` and reads no data; malformed planner output is refused with `NlQueryError::ParseFailed` (not executed); and over-budget planner output is refused with `NlQueryError::BudgetExceeded` before parse/execute, in both plan-only and executing modes.
requirementEG-FEDERATED-QUERYLANDED3da71fa8e9b7
EG-FEDERATED-QUERY-R058.2
Dispatch handler and result contract disclose the typed NL→UQL model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Dispatch handler and result contract disclose the typed NL→UQL model.** Child slice of `EG-FEDERATED-QUERY-R058` (see tasks.md). Rollup over `EG-FEDERATED-QUERY-R058.2.1` (dispatch-path budget enforcement against the typed model, built) and `EG-FEDERATED-QUERY-R058.2.2` (serve the executed UQL in the result contract and expose a plan-only entry point to callers). | Tests confirm the executed UQL is returned with the result, plan-only mode returns a candidate without reading data, planner output that fails to parse or exceeds a budget is refused with a typed error, row visibility matches the equivalent direct UQL query, and no mutation is reachable
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.2.1
Dispatch handler enforces the typed NL budget before parsing
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Dispatch handler enforces the typed NL budget before parsing.** `Method::NlQuery`'s dispatch handler (`handle_nl_query_plan`) applies the SAME character-count `NlQueryBudget` the typed disclosure model (`EG-FEDERATED-QUERY-R058.1`) defines to the planner's produced UQL text BEFORE it reaches `eg_plan::uql::parse`, refusing an over-budget answer with the typed `UQL_BUDGET_EXCEEDED` code rather than running unbounded planner text into the parser. | A unit test confirms `NlQueryBudget::check` refuses over-budget text with a typed `BudgetExceeded` error and accepts in-budget text, independent of whether that text later parses.
requirementEG-FEDERATED-QUERYVERIFIED8710a3709c47
crates/eg-plan/src/nl.rs:846
EG-FEDERATED-QUERY-R058.2.2
Served NL result carries the executed UQL; plan-only is reachable
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Served NL result carries the executed UQL; plan-only is reachable.** This row holds the remaining scope of `EG-FEDERATED-QUERY-R058.2`. A served method returns the executed UQL text with the rows. A caller can also reach the typed model's `plan_only`. Other clients depend on the `Method::NlQuery` result, so it stays unchanged. A sibling method carries the disclosure. Rollup over `EG-FEDERATED-QUERY-R058.2.2.1` (served `NlQueryExplain`, built) and `EG-FEDERATED-QUERY-R058.2.2.2` (plan-only entry point). | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.2.2.1
Served `NlQueryExplain` returns the executed UQL with the rows
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Served `NlQueryExplain` returns the executed UQL with the rows.** `Method::NlQueryExplain { text, graph }` takes the same request as `Method::NlQuery`. It routes the same way and has the same `query:nl` read policy. An empty `graph` falls back to the request envelope's graph. Both handlers share one run, `run_nl_query` in `src/server/handlers/query/nl.rs`. There, `handle_nl_query_plan` returns the planner's exact UQL text with the parsed plan. The same legs, row-level-security snapshot and off-lock run then produce the rows. The engine answers with `eg_types::nl_query::NlQueryExplainResult`: `{"uql": <UQL text>, "rows": [[node_id, score or null], ...]}`. The engine never caches this result. The `NlQuery` result stays byte-identical. The Python client exposes `QueryClient.nl_query_explain(text, graph=None)`. | Served tests confirm that `uql` equals the planner's output. They confirm that `rows` equal the `NlQuery` rows for the same text. A parse failure (`INVALID_ARGUMENT`) refuses with the same code and detail as `NlQuery`. An over-budget answer (`UQL_BUDGET_EXCEEDED`) does too. A wire test confirms the Python call shape.
requirementEG-FEDERATED-QUERYVERIFIED569b1ab507d6
f9d6d793d946
crates/eg-types/src/nl_query.rs:26
src/server/tests/nl_explain.rs:54
src/server/tests/nl_explain.rs:81
tests/test_pb_clients.py:88
EG-FEDERATED-QUERY-R058.2.2.2
Plan-only NL entry point
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Plan-only NL entry point.** Expose the typed model's `plan_only` as a served read that returns the candidate UQL without reading data. | A test confirms a plan-only call returns the candidate and reads no data. Not yet delivered.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.3
No-cache-on-NL-text and no-mutation-reachable guarantees
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**No-cache-on-NL-text and no-mutation-reachable guarantees.** Child slice of `EG-FEDERATED-QUERY-R058` (see tasks.md). Rollup over `EG-FEDERATED-QUERY-R058.3.1` (no-cache-on-NL-text guard, built) and `EG-FEDERATED-QUERY-R058.3.2` (no-mutation-reachable confirmation). | Tests confirm the executed UQL is returned with the result, plan-only mode returns a candidate without reading data, planner output that fails to parse or exceeds a budget is refused with a typed error, row visibility matches the equivalent direct UQL query, and no mutation is reachable
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.3.1
NL results are never cached on the NL text
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**NL results are never cached on the NL text.** `Method::NlQuery`'s handler answers through the uncached `result_response` path and never references the engine's `ResultCache`, so a non-deterministic planner answer can never be served stale from a prior, differently-planned request; a regression guard pins this structural guarantee. | A test confirms the handler source never references `ResultCache` or the cache-aware `served_response` helper.
requirementEG-FEDERATED-QUERYVERIFIED8710a3709c47
d2cb221aa148
src/server/handlers/query/nl.rs:205
src/server/handlers/query/nl.rs:211
src/server/handlers/query/nl.rs:234
EG-FEDERATED-QUERY-R058.3.2
No mutating operation is reachable from the NL surface
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**No mutating operation is reachable from the NL surface.** Remaining scope of `EG-FEDERATED-QUERY-R058.3`: confirm no NL-planned UQL text can reach a mutating or side-effecting operation. | A negative test confirms an NL-planned mutating statement is refused. Not yet delivered.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R059
Semantic index lifecycle is fenced, durable and restart-safe
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Semantic index lifecycle is fenced, durable and restart-safe.** Semantic and vector index creation, backfill, activation and drop are fenced, durable operations, and an unavailable index generation falls back correctly rather than serving incorrect or partial results after restart. | Restart and fenced-lifecycle tests (FQR-07) confirm index generations activate, drop and recover correctly across a restart.
requirementEG-FEDERATED-QUERYLANDED62c450561948
8fa63622a11f
EG-FEDERATED-QUERY-R060
Leiden community detection supports a Constant Potts Model quality function
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Leiden community detection supports a Constant Potts Model quality function.** LeidenConfig exposes a Constant Potts Model quality function as an alternative to modularity, applying its own delta-quality term inside the existing local-moving and refinement loop, so community detection is not limited to modularity's resolution limit. | Leiden kernel tests and the corresponding query-surface objective-function parameter confirm the Constant Potts Model produces correct communities distinct from the modularity result on the same graph.
requirementEG-FEDERATED-QUERYLANDED2a0d6eae0918
62c450561948
EG-FEDERATED-QUERY-R061
One grammar table drives UQL docs, prompts and error messages
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**One grammar table drives UQL docs, prompts and error messages.** The UQL grammar table is the single source for the generated EBNF documentation block, the natural-language planner's prompt, and the expected-token lists in parser error messages; the dispatch table is checked against the grammar in both directions, and a feature unsupported in the current build fails with one dedicated feature-not-available error. | A generated-docs snapshot test and a dispatch-table-versus-grammar consistency check (FQR-01) both pass, and a feature excluded from compilation is confirmed to fail with the dedicated error.
requirementEG-FEDERATED-QUERYVERIFIED62c450561948
8451d7eecf02
crates/eg-plan/src/uql/tests/contract.rs:46
crates/eg-plan/src/uql/tests/contract.rs:58
EG-FEDERATED-QUERY-R062
Streaming memory test measures only its own allocations
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Streaming memory test measures only its own allocations.** The million-row streaming-scan memory test measures memory allocated by the stream under test using a scoped counting allocator, rather than process-wide memory, so the test cannot fail due to unrelated concurrent work in the same process or host. | The test passes measuring peak allocation for the streamed scan below its declared bound when run both in isolation and alongside concurrent unrelated tests.
requirementEG-FEDERATED-QUERYLANDED62c450561948
645f55e5f0db
EG-FEDERATED-QUERY-R063
Leiden provides stable community naming and a connectivity check
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Leiden provides stable community naming and a connectivity check.** Community detection runs a sweep across multiple resolution values and keeps communities that persist across them, names each stable community by its highest-centrality member rather than by an index that can shuffle between runs, and performs a connectivity post-check on every detected community. | Tests cover the resolution sweep's stability selection, confirm community names stay stable across reruns on the same input, and confirm the connectivity post-check detects any disconnected community.
requirementEG-FEDERATED-QUERYLANDED62c450561948
b5fe3c140c21
EG-FEDERATED-QUERY-R064
UQL lexer supports its full token set and structured diagnostics
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL lexer supports its full token set and structured diagnostics.** The UQL lexer tokenizes comments, scientific notation, Unicode and quoted identifiers, UTF-8 strings, parameter placeholders and JSONPath tokens, enforces bounded nesting, and reports structured diagnostics with an error code, source span, expected-token set, fix hint and a line/column caret. | Lexer tests cover each token class and confirm diagnostic output includes the code, span, expected set and caret position for malformed input.
requirementEG-FEDERATED-QUERYLANDED62c450561948
8451d7eecf02
EG-FEDERATED-QUERY-R065
Named UQL sub-plans compile to an ordered plan DAG
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Named UQL sub-plans compile to an ordered plan DAG.** Named sub-plans referenced by FROM or JOIN compile into a plan DAG ordered by first-reference depth-first traversal, a FUSE operation inlines named sub-plans, and the DAG printer's output can be re-parsed back to an equivalent plan. EXPLAIN and PROFILE are served for a DAG-shaped program, node by node and truthfully: the program is reported as written with one stage per node and its estimate, PROFILE records each node's rows and time, and the result states that such a program is not cost-reordered and not incrementally maintained. | Tests confirm depth-first compile ordering, FUSE inlining correctness via re-parse, and that EXPLAIN and PROFILE on a DAG program return one stage per node with the not-reordered, not-incremental note.
requirementEG-FEDERATED-QUERYLANDED62c450561948
8451d7eecf02
EG-FEDERATED-QUERY-R066
SPARQL evaluator is split into modules within the file-size limit
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**SPARQL evaluator is split into modules within the file-size limit.** crates/eg-rdf/src/sparql.rs is split into cohesive modules so that no resulting file exceeds the repository's 900-line limit, using pure code moves that preserve every existing function and behavior unchanged. | The full eg-rdf all-features test suite passes identically before and after the split, and a function-by-function comparison confirms every original function is preserved.
requirementEG-FEDERATED-QUERYLANDED62c450561948
fbb3b6f0ff6c
EG-FEDERATED-QUERY-R067
UQL RETURN exposes multiple named score channels per row
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL RETURN exposes multiple named score channels per row.** Each scoring stage, such as similarity, belief or window scoring, records its score under its own fixed channel in a side table, so a query can return several distinct named scores for the same row and served results carry every requested channel. | A test returning two or more named score channels in the same query confirms each row carries the correct value for every requested channel.
requirementEG-FEDERATED-QUERYLANDED62c450561948
8451d7eecf02
EG-FEDERATED-QUERY-R068
UQL supports WITH PROOF for proof-carrying results
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL supports WITH PROOF for proof-carrying results.** UQL gains a WITH PROOF clause that returns proof-carrying results consistent with EG-FEDERATED-QUERY-R006's proof contract, binding each returned proof to its premises and source generation. | A test issuing a UQL query WITH PROOF confirms the returned proof matches EG-FEDERATED-QUERY-R006's premise-binding and source/generation requirements.
requirementEG-FEDERATED-QUERYLANDED62c450561948
857e20c63775
EG-FEDERATED-QUERY-R069
SQL pushdown batches key lookups and shares rendering with OBDA
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**SQL pushdown batches key lookups and shares rendering with OBDA.** SQL foreign-source pushdown batches key lookups into a single IN-list subquery and pushes LIMIT into the statement's parsed syntax tree while respecting any existing ORDER BY or LIMIT and skipping FETCH or non-literal limits; both SQL pushdown and OBDA render literals and identifiers through the same shared rendering function. | Pushdown tests confirm batched IN-list queries and pushed LIMIT match the full-fetch oracle, and OBDA's rendered SQL uses the identical shared rendering function.
requirementEG-FEDERATED-QUERYLANDED62c450561948
d656b605ef0a
EG-FEDERATED-QUERY-R070
UQL execution budgets are enforced and reported in EXPLAIN/PROFILE
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL execution budgets are enforced and reported in EXPLAIN/PROFILE.** A query's execution is bounded by a budget on maximum result rows and maximum traversal visits, failing with a dedicated budget-exceeded error when exceeded; EXPLAIN reports the canonical and optimized plan with per-stage estimated rows and an incremental-maintainability reason, and PROFILE reports per-stage observed rows and elapsed time. | Tests confirm a query exceeding its budget fails with the dedicated budget-exceeded error, and EXPLAIN/PROFILE output includes the documented per-stage fields.
requirementEG-FEDERATED-QUERYSPECIFIED62c450561948
e93f988eae07
crates/eg-plan/src/budget.rs:73
EG-FEDERATED-QUERY-R071
HTTP foreign sources support templated pagination and key placeholders
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**HTTP foreign sources support templated pagination and key placeholders.** An HTTP foreign source's URL query part may declare placeholders for keys, limit, offset and page, which the planner fills with percent-encoded values and paginates up to the source's declared page/limit budget; a source requiring keys refuses a full scan that supplies none. | Tests confirm correct percent-encoded substitution for each placeholder, pagination stopping at the declared budget, and a keys-required source refusing a keyless full-scan request.
requirementEG-FEDERATED-QUERYLANDED62c450561948
d656b605ef0a
EG-FEDERATED-QUERY-R072
The ontology selects the sources for a cross-source question
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**The ontology selects the sources for a cross-source question.** A caller sends the ontology classes of a question. EG links those classes through object properties within a hop budget. EG entails subclass relations during that search. For each class on the path, EG names the approved virtual mapping that serves it, or the class itself as uncovered. Every selection carries its premises: label, relation and mapping facts with their source generation. The answer is read-only and plans no execution. Rollup: split into `.1` (below) per SPEC-SIZING §5; further children land the live-ontology/mapping-catalog search. | A fixture with two sources proves the path, the selected mappings, a subclass mapping serving its superclass, an uncovered class and a disconnected pair.
requirementEG-FEDERATED-QUERYVERIFIED62c450561948
6c11520aebfc
f948211fb8c7
crates/eg-rdf/src/source_selection.rs:321
crates/eg-rdf/src/source_selection.rs:343
crates/eg-rdf/src/source_selection.rs:369
crates/eg-rdf/src/source_selection.rs:378
crates/eg-rdf/src/source_selection.rs:388
EG-FEDERATED-QUERY-R072.1
Typed model for cross-source coverage, proved against a fixture
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Typed model for cross-source coverage, proved against a fixture.** `eg-rdf::source_selection` defines `CoverageResult` (`Covered`/`Uncovered`/`Disconnected`), `SourceSelectionHop`, and `Premise` (label/relation/subclass/mapping/source-generation facts), and a fixture-driven `select_sources` that links classes through object properties within a hop budget, entails asserted `subClassOf` facts, and reports read-only coverage with no execution plan attached. | Unit tests over a two-source fixture prove a direct mapping, a subclass mapping serving its superclass, an uncovered reachable class, and a disconnected class.
requirementEG-FEDERATED-QUERYVERIFIED6c11520aebfc
f948211fb8c7
crates/eg-rdf/src/source_selection.rs:321
crates/eg-rdf/src/source_selection.rs:343
crates/eg-rdf/src/source_selection.rs:369
crates/eg-rdf/src/source_selection.rs:378
crates/eg-rdf/src/source_selection.rs:388
EG-FEDERATED-QUERY-R073
Operation-bound virtual mappings federate API, MCP, A2A and GraphQL sources
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Operation-bound virtual mappings federate API, MCP, A2A and GraphQL sources.** These sources register as typed `ForeignSourceSpec` kinds with declared capabilities. A mapped entity reads through its discovered operation. A key filter is pushed only when the source declares that capability. EG always keeps the exact local residual filter. Every request passes the shared outbound guard and the per-query budgets of FQR-04. Rollup: split into `.1` (below) per SPEC-SIZING §5; further children bind the discovered operation and prove the recording-mock equal-rows case. | A recording mock proves pushed and unpushed key filters return equal rows. Budget, outbound-guard and ungranted-source cases refuse with typed errors.
requirementEG-FEDERATED-QUERYSPECIFIED62c450561948
bfd84b2ccbcb
f948211fb8c7
EG-FEDERATED-QUERY-R073.1
Typed model for operation-bound foreign sources, with refusal tests
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Typed model for operation-bound foreign sources, with refusal tests.** `eg-types::wire` adds four `ForeignSourceSpec` variants — `Api`, `Mcp`, `A2a`, `GraphQl` — each carrying its operation reference plus a declared `ForeignOperationCapabilities` (including `key_filter_pushdown`). An unbound spec of any of these kinds resolves to a typed refusal (no verified registration) rather than a silent empty result or a panic. | Unit tests wire-round-trip each new variant and confirm an unbound/ungranted spec and a budget-exceeded fixture both refuse with typed errors; the recording-mock equal-rows proof is deferred to a later child.
requirementEG-FEDERATED-QUERYVERIFIED6c11520aebfc
bfd84b2ccbcb
crates/eg-plan/src/federation.rs:229
crates/eg-plan/src/federation.rs:249
crates/eg-plan/src/federation_opt/budget.rs:156
crates/eg-plan/src/federation_opt/budget.rs:173
EG-FEDERATED-QUERY-R073.2
Connection-protocol pushdown matrix
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Connection-protocol pushdown matrix.** The planner must hold one matrix row per connection protocol. Each row names the paging or streaming form and the usable pushdown capabilities. It also names the contract term in the connector pack. The matrix is the table in `plan.md`. The planner must not push a capability that the row does not list. A stream protocol must push a time range only. The SDK transport per protocol is `SDK-CONNECTOR-CONTROL-R069`. | A unit test fails when a declared protocol lacks a row. It refuses a pushdown kind outside the row.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R074
Served `select_topology` reasoning-policy op
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Served `select_topology` reasoning-policy op.** A served `SelectTopology` operation returns a typed topology choice for a task description under the reasoning policy, refusing an empty task. Unblocks AU-SEMANTIC-R008.2.2. | One test asserts the chosen topology for two task shapes and the empty-task refusal.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R075
Generated client method for `select_topology`
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Generated client method for `select_topology`.** The generated client exposes `select_topology` from the Rust schema source. Unblocks AU-SEMANTIC-R008.2.2. | A generated-client test calls it against the served op.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R076
Canonical ontology hash for a Turtle payload
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Canonical ontology hash for a Turtle payload.** A served method returns a canonical hash of a Turtle payload that is stable under prefix, statement-order and blank-node relabelling. Invalid Turtle is refused. Unblocks AU-SEMANTIC-R006.5.1. | Test asserts equal hashes for two reordered serializations and a refusal for invalid Turtle.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077
Vectorized SQL text columns (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Vectorized SQL text columns (rollup).** EG must bind a text column of a SQL table to an embedding index, so vector search covers that column. Each column must opt in to the binding. A column without a binding stores no vectors. | Tests prove a bound column answers a nearest-neighbour query, an unbound column refuses, and an update re-embeds the changed row.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.1
`ColumnVectorBinding` typed model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**`ColumnVectorBinding` typed model.** `crates/eg-query/src/sql/ann.rs` must define `ColumnVectorBinding` with table, column, embedder reference, dimension and an `bound` flag. | Unit test round-trips a binding and rejects a zero dimension.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.2
Bind and unbind surface
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Bind and unbind surface.** A served SQL operation must bind or unbind a column. Binding a non-text column must be refused with a typed error. | Test binds a text column and refuses an integer column.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.3
Row-write re-embedding hook
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Row-write re-embedding hook.** The SQL write path must queue a re-embed for each changed row of a bound column. Unbound columns must queue nothing. | Test writes one row and asserts exactly one queued embed for a bound column and none for an unbound one.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.4
Vectorization recommendation
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Vectorization recommendation.** A pure function must rank text columns by average length and distinct ratio and return recommendations. It must never create a binding itself. | Unit test ranks three columns and asserts no binding changes.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.5
End-to-end column vector search
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**End-to-end column vector search.** A SQL nearest-neighbour query over a bound column must return the expected rows, with EXPLAIN naming the binding. Agent-webui table explorer consumption is a handoff. | Fixture table with five rows returns the expected nearest row and EXPLAIN names the binding.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R078
Tenant and clearance predicates are part of the query plan (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Tenant and clearance predicates are part of the query plan (rollup).** EG must apply the caller's tenant and access-policy predicates inside the plan, before any retrieval. A query must never read a node, edge or vector hit outside the caller's clearance. | Tests prove an out-of-tenant node, edge and vector hit never appear, and an unverified caller is refused.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R078.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** `crates/eg-query/src/plan_scope.rs` must define `PlanScope` with tenant, clearance labels and a `verified` flag. It must expose `predicate()` as a closed predicate set. | Unit test round-trips a `PlanScope` and rejects an empty tenant.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R078.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** `inject_scope(plan, scope)` must add the tenant predicate to every graph, edge and vector scan node. The default rule `scan_all_leaves` should be replaceable by a named rule. | Unit test plans a three-leaf query and asserts each scan carries the predicate.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R078.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** `handle_uql` at `src/server/handlers/query/uql_statement.rs:17` must call `inject_scope` after planning and before execution. Its production caller is `dispatch_query_family` at `src/server/handlers/query/dispatch.rs:66`. | Test asserts a planned statement reaches execution only with the predicate attached.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R078.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A caller without a verified tenant must receive the typed refusal `PLAN_SCOPE_UNVERIFIED`. The handler must not post-filter results instead. | Test sends a statement with no verified tenant and asserts the refusal and zero reads.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R078.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Each executed plan must record `plan_scope_tenant` and `plan_scope_predicates` in its trace. The explain output must show them. | Test reads the trace and the explain output for one scoped query.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R078.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served UQL statement operation, called through `dispatch_query_family`. It must show that a vector hit in another tenant never returns. | Integration test `tests/plan_scope_tenant.rs` seeds two tenants, queries as one, and asserts only its own rows return.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R079
Iceberg v2 catalog interoperability (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Iceberg v2 catalog interoperability (rollup).** EG must publish an Iceberg REST catalog with add, drop, rename and reorder schema evolution. It must support retained snapshot time travel and read and write Iceberg v2 manifests. Manifest writing means engine-owned publication from committed graph state; external clients receive read-only projections under R080. Children `.1` through `.6` define the complete contract. | Satisfied only when every child is verified through served acceptance; source inspection alone proves no runtime delivery.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R079.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Extend `crates/eg-types/src/lake_catalog.rs::SchemaChangeKind` with `ReorderColumn` and define `ManifestPublication` with tenant, table, committed graph version, source LSN, snapshot ID and schema ID. It also carries format version 2, manifest and manifest-list locations, and artifact digests. Keep field IDs stable across rename and reorder. Classify reorder as compatible and drop as destructive. | Round-trip every field; classify every column change; refuse absent version binding or unsupported format version.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R079.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Extend `LakeTable::evolve_add_column` to add, drop, rename and reorder committed graph schema changes. Reuse `LakeTable::iceberg_manifests` and `build_iceberg_manifests` to write Iceberg v2 Avro manifests and manifest lists, with file paths, counts and sizes. Partition/schema IDs and snapshot/sequence metadata must match the published snapshot. Publish metadata only after referenced artifacts are durable; preserve retained snapshots and their schemas. Support append, compaction and copy-on-write deletion without exposing abandoned artifacts as a committed snapshot. | Decode emitted artifacts, verify referenced files and metadata, and compare old/new snapshot rows and schemas after every supported mutation. Inject publication failure and prove the previous snapshot remains readable.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R079.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The engine publication path is `LakeManager::drain_series` -> `materialize_batch` in `src/server/lake/mod.rs:537` -> `prepare_materialization` and `publish_artifacts` in `src/server/lake/catalog_ops.rs` -> `LakeTable::iceberg_manifests` -> `crates/eg-lake/src/iceberg_avro.rs::build_iceberg_manifests`. Bind committed graph version and schema evolution to this path and expose committed metadata through `src/server/lake/rest/catalog.rs::load_table` and `LakeManager::load_table_as_of`. The writer exists today; the graph-version binding and complete schema-evolution acceptance remain delivery work. REST CommitTable must pass R080 refusal before any mutation; it is not an alternate schema-write authority. | A served authoritative graph mutation reaches the production publisher and an authenticated catalog read resolves the resulting manifest list. A projection CommitTable request never invokes mutation or publication.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R079.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Unapproved destructive authoritative schema changes return `SCHEMA_CHANGE_NOT_APPROVED`; unknown columns return `SCHEMA_COLUMN_UNKNOWN`. A missing graph-version binding or unsupported manifest/schema/partition feature returns `MANIFEST_PUBLICATION_INVALID` with a reason. No new snapshot becomes visible. Projection metadata and data updates return R080's `PROJECTION_READ_ONLY`; a format-compatibility request never grants write authority. | Exercise every refusal with unchanged visible graph/catalog versions; readers must not receive a partially published or falsely compatible snapshot.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R079.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Use the lake operation evidence path. Record tenant, table, committed graph version, source LSN, schema version, change kind and compatibility. Include snapshot ID, format version, manifest/list locations and digests, publication outcome and refusal reason. A time-travel read records its resolved snapshot. Capture external reader name/version and supported feature matrix in acceptance evidence without exporting credentials or raw data logs. | Correlate graph commit, publication and catalog load records; failed publication has no successful snapshot evidence. Every advertised format feature has a reader acceptance result.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R079.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** `tests/lake_catalog_schema_evolution.rs` and `tests/lake_manifest_interoperability.rs` must drive the real served graph mutation entry point and authenticated Iceberg REST listener. A pinned independent Iceberg reader must load emitted v2 manifests and query Parquet data. Cover add/drop/rename/reorder, append, compaction and copy-on-write deletion. Also cover retained snapshot time travel, publication failure and projected write refusal. The test must name the actual graph handler and publisher call chain. Directly invoking the Avro builder or mocking catalog responses is insufficient. | The external reader sees committed rows and stable field IDs at retained and current snapshots. No separate copy job runs. Negative cases leave prior snapshots readable and cannot mutate graph or source systems.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R080
The graph is the only write boundary; table outputs are read-only projections (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**The graph is the only write boundary; table outputs are read-only projections (rollup).** Iceberg and Parquet outputs must serve external engines without a copy pipeline. The engine must refuse any write that arrives through a projection. Split into `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R080.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** `crates/eg-types/src/lake_catalog.rs` must define `ProjectionAccess` with the closed values `ReadOnly` and `Authoritative`. Every catalog table entry (`TableEntry`, `crates/eg-lake/src/catalog.rs:27`) must carry `ReadOnly`. | Unit test round-trips the type and asserts every entry is `ReadOnly`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R080.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** `refuse_projection_write(op, entry)` in `crates/eg-lake/src/catalog.rs` must classify create, data or metadata commit, schema update, rename and drop as writes. It must pass list and load. Unknown mutating operations must fail closed. Internal publication of committed graph snapshots under R079 does not authorize client writes. | Unit test classifies each operation.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R080.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** `refuse_projection_write` must run in the route dispatch in `src/server/lake/rest/mod.rs` before `commit_table` (`src/server/lake/rest/catalog.rs:318`) and `drop_table` (line 349). The caller is the Iceberg listener. The shared SQL path `validate_federated_sql` (`crates/eg-plan/src/federation.rs:933`) already refuses writes to foreign sources. No production caller refuses a projection write today. | Route test sends every write route and asserts the refusal.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R080.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Any data or metadata write through a projection must return `PROJECTION_READ_ONLY` with HTTP 405 and name the table. The graph state must not change. | Test attempts a data commit and asserts the code, status and an unchanged graph version.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R080.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Each refusal must record `table`, `operation` and `principal` in the operation record. Each projection read must record the graph `version` it was materialized at, using `ProjectionCatalog` (`crates/eg-core/src/projection_catalog.rs:75`). | Test reads the record after one refusal and one read.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R080.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the Iceberg REST listener. A graph write must appear in the next projection read. A write through the projection must be refused. An external reader must see the graph write without a copy job. | Integration test `tests/lake_projection_read_only.rs` writes through the graph, reads the projection, then attempts a projected write.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081
Retrieval sufficiency verdict with repair step, fallback policy and round limit (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Retrieval sufficiency verdict with repair step, fallback policy and round limit (rollup).** EG judges whether retrieved evidence suffices to answer, and chooses the repair step and the fallback policy. The harness applies the verdict and runs the next round. Children `.1` to `.6` deliver the base verdict. Rollups `.7` through `.9` extend selection, feedback and hierarchy. Mapped extensions `.100` through `.103` add distinct joint-selection, compression, distillation and viewport-binning contracts. | See each original child and mapped extension. Preserve the base verdict, fallback and tenant/result bounds.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `SufficiencyVerdict{verdict, evidence_count, reason, repair, fallback, round, round_limit}` in `crates/eg-types/src/retrieval_verdict.rs`. The `verdict` set is closed: `sufficient`, `insufficient`. `repair` is `BoostK{k}`, `SwitchMode{mode}` or `Stop`. `fallback` is `Lenient` or `Strict`. No type of this shape exists today. Proving test: `crates/eg-types/src/retrieval_verdict.rs::tests::verdict_round_trips_and_rejects_unknown`. | A serde round trip keeps every field and rejects an unknown verdict value.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Add `judge_sufficiency(rows, rule, call) -> SufficiencyVerdict`. The default `rule` is `min_evidence_count`, a named replaceable value with default 3. The default repair order is `BoostK` (k doubles, capped at 64), then `SwitchMode`, then `Stop`. The call carries `round` and `round_limit`. At `round_limit` the repair must be `Stop`. Proving test: `crates/eg-plan/src/retrieval_verdict.rs::tests::repair_order_ends_at_round_limit`. | Three insufficient rounds yield BoostK, SwitchMode, Stop. A replaced rule changes the count.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** `judge_sufficiency` attaches at the end of `execute` in `crates/eg-plan/src/exec.rs:536`, after `fuse_rrf` at `crates/eg-plan/src/exec.rs:848` returns its `RowSet`. A plan that carries a `SufficiencyRule` gets the verdict beside its rows. The production caller is the served query path: `eg_plan::execute` is called from `crates/eg-graphql/src/crossmodal.rs:429`. This row creates the call site in `execute`. No production caller of a sufficiency check exists today. Proving test: `crates/eg-plan/src/exec.rs::tests::execute_returns_verdict_for_rule_plan`. | A plan with a rule returns rows and a verdict. A plan without a rule returns rows only.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A verdict call without `round_limit` must refuse with `RETRIEVAL_ROUND_LIMIT_REQUIRED`. A `Strict` fallback with an `insufficient` verdict must return `abstain` and no extractive answer. The refusal names the missing field or the fallback. Proving test: `crates/eg-plan/src/retrieval_verdict.rs::tests::strict_insufficient_abstains`. | A missing limit returns the typed code. A strict call never carries an extractive hint.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Each verdict must be recorded as a premise on the retrieval `DecisionRecord` of `EG-DECISION-ENGINE-R100`. The premise lists `verdict`, `evidence_count`, `reason`, `repair`, `fallback` and `round`. Proving test: `crates/eg-plan/src/retrieval_verdict.rs::tests::verdict_premise_lists_all_fields`. | The decision record shows the verdict premise with all six fields.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served cross-modal query operation. The test sends a query that returns two rows against a rule of three. The call passes through `execute` at `crates/eg-plan/src/exec.rs:536`. It observes an `insufficient` verdict, repair `BoostK`, and the premise on the decision record. Proving test: `tests/retrieval/test_sufficiency_served.py::test_insufficient_returns_boost_k`. | The served response carries the verdict and the premise exists.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.7
Adaptive dual-score chunk selection (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Adaptive dual-score chunk selection (rollup).** Extend R081 with children `.1` through `.6`. EG owns retrieval decisions and evidence; applications consume or execute its bounded decisions. | All six children require served positive and negative acceptance. Definition publication claims no runtime delivery.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.7.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Define `ChunkScorePair`, `SelectionPolicy` and `SelectionReceipt` in `crates/eg-types/src/retrieval_verdict.rs`. Bind chunk IDs, corpus revision, embedding and cross-encoder scores, model revisions, normalization, thresholds, fusion weights and maximum count. Carry an activation benchmark digest. | Round-trip every field. Reject non-finite scores, missing model provenance, duplicate chunk IDs and invalid bounds.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.7.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Use already computed embedding and cross-encoder scores to classify four score regions. Retain dual-high candidates; reject dual-low candidates. Rescue low-embedding/high-relevance candidates, including vocabulary-mismatch results. Apply the declared fusion threshold to the remaining region. Compute query-dependent count, capped by `max_chunks`, with stable ID tie-breaking. Selection itself performs no model inference. | Golden score pairs prove rescue, dual-low rejection, variable count and deterministic ties. Empty accepted sets never backfill rejected chunks.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.7.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Add the selection operator to `crates/eg-plan/src/exec.rs:536` after candidate cross-encoder scoring and before final truncation. Retain per-chunk score pairs through `fuse_rrf` at line 848; rank-fusion output alone is insufficient. Its production caller is `crates/eg-graphql/src/crossmodal.rs:429`. Cross-encoder binding and this selector remain missing production work. | The real served cross-modal query reaches the selector with both scores. A disconnected helper or client-side selector cannot close this row.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.7.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Return `RETRIEVAL_SCORE_PAIR_REQUIRED` for missing or stale scores and `RETRIEVAL_NORMALIZATION_INVALID` for undefined normalization. Explicitly define empty and constant-score normalization in the policy. Return `RETRIEVAL_POLICY_UNVERIFIED` when activation lacks the matching benchmark receipt. Reject dual-low chunks even when fewer than the requested count remain. | Invalid inputs and unapproved activation fail before answer assembly. Dual-low-only input returns an empty evidence set and R081 insufficiency.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.7.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record input scores, normalization, region, fused score, selected IDs, exclusions, count and policy digest. Count embedding, reranker and selection inference calls separately. Benchmark against a declared fixed-count baseline using identical candidates, models, corpus and tenant predicates. Activation requires zero extra selection inference and declared quality/cost acceptance. | The benchmark receipt pins data, labels, configuration, acceptance thresholds and measured results. Paper results never substitute for EG measurements.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.7.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: the authenticated served cross-modal query. `tests/retrieval/test_adaptive_selection_served.py` uses a deterministic corpus and pinned production embedding/reranker artifacts. Compare adaptive and fixed-count results through the actual execution path. | Prove low-embedding rescue, dual-low refusal, varying counts and zero additional selection inference. Independently read the trace and verify tenant isolation.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.8
Bounded retrieval feedback and critique (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Bounded retrieval feedback and critique (rollup).** Extend R081 with children `.1` through `.6`. EG owns retrieval decisions and evidence; applications consume or execute its bounded decisions. | All six children require served positive and negative acceptance. Definition publication claims no runtime delivery.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.8.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Extend `crates/eg-types/src/retrieval_verdict.rs` with `RetrievalFeedback`, `PerspectiveQuery`, `TermFeedback` and `RetrievalCritique`. Bind original query, round, corpus/model revisions, document IDs, measured relevance, term weights and critique provenance. Feedback tiers are `Reinforce`, `Missing`, `Suppress`. Carry round, query, term, token and inference budgets. Use R082 `StopContext` and `StopVerdict` for termination; do not add a second stop authority. | Round-trip all tiers, limits and termination fields. Missing evidence IDs, unbounded requests and inconsistent revisions refuse.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.8.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Generate bounded diverse semantic-perspective expansions from the original query. Assess returned documents against that original query, then reinforce useful terms, record missing aspects and suppress misleading terms. Use the latest accepted expansion and revision-bound feedback for the next round. Critique may propose a reformulation but never replace measured relevance. | Fixtures prove useful terms persist, misleading terms lose weight and distinct perspectives remain distinct. Adversarial critique cannot promote rejected evidence.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.8.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Add the feedback operator beside R081 sufficiency evaluation in `crates/eg-plan/src/exec.rs:536`. The caller remains `crates/eg-graphql/src/crossmodal.rs:429`. EG validates continuation evidence and budgets, then applies R082 precedence before dispatching any next query. The harness only executes an authorized bounded continuation. This row creates the missing feedback call site. | Served successive requests carry a validated EG continuation. Terminal verdicts dispatch no retrieval or inference. No independent reformulation or stopping authority appears.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.8.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Return `RETRIEVAL_FEEDBACK_INVALID` for forged documents, incompatible revisions or evidence outside tenant scope. R082 checks round and other budget limits before progress or confidence stops. Exhaustion returns `RETRIEVAL_BUDGET_EXCEEDED` with its terminal verdict and dimension. Valid completed-round evidence can stop with `no_new_evidence` or `quality_saturated` even without calibration. Preserve `ROUND_NOT_CALIBRATED` and never promote such termination to calibrated sufficiency. Reject critiques that alter scope, scores, limits or activation policy. | Invalid feedback and terminal continuations perform no further retrieval or inference. An uncalibrated exhausted or saturated continuation returns the typed terminal reason plus the calibration refusal. A progressing uncalibrated continuation remains bounded.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.8.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record expansion text, semantic perspective, term reinforcement/suppression, document tiers, critique text and applied or rejected proposal. Bind each item to measured relevance, original query, round, policy and corpus revision. Record R082 reason, calibration refusal, exhausted dimension, progress evidence and inference/token costs. Treat critique text as untrusted data. | Independent trace readback connects each next query to its feedback. Terminal trace records retain missing calibration without inventing a margin or claiming enough evidence.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.8.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: the authenticated served cross-modal query with successive EG continuations. `tests/retrieval/test_feedback_served.py` reads a deterministic corpus through production operators and pinned inference artifacts. Its uncalibrated continuation matrix exercises R082 precedence and observes production dispatch counters. | Assert feedback tiers and term changes. Cover missing calibration with new evidence, no new evidence, saturation and every exhausted budget. Read the trace independently and assert no dispatch after terminal outcomes. Reject stale feedback and hostile critique.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9
Bounded typed hierarchy retrieval (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Bounded typed hierarchy retrieval (rollup).** Children `.1` through `.6` retain community-to-entity retrieval. Child `.7` adds distinct document-section retrieval. EG owns retrieval decisions and evidence; applications consume or execute its bounded decisions. | Both hierarchy kinds require served positive and negative acceptance. Definition publication claims no runtime delivery.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `HierarchyRetrievalPolicy` and `HierarchyStageReceipt` to `crates/eg-types/src/retrieval_verdict.rs`. Carry hierarchy revision, community/summary/entity IDs, parent links, stage, score provenance, beam width and depth. Bound visited communities, entity candidates, reranker calls, tokens and total cost. | Reject absent hierarchy revisions, invalid parent links and zero or missing required limits.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Read community summaries, refine selected communities, then descend to entity evidence. Rerank at each declared stage and prune with the declared beam and stable ID tie-breaks. Deduplicate entities and retain their community paths. Apply tenant predicates before every stage and candidate truncation. | A small hierarchy has exact expected stage order, selected paths and final entity IDs. A wider beam consumes an explicitly measured additional budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Attach the hierarchy operator before terminal fusion in `crates/eg-plan/src/exec.rs:536`. Bind graph community summaries and entity reads through `PlanCtx`; the served caller is `crates/eg-graphql/src/crossmodal.rs:429`. Reuse `fuse_rrf` only for its existing rank-combination role. Revision-aware descent and stage reranking remain missing production calls. | A served query must invoke all three stages before returning entities. Flat entity retrieval alone cannot claim hierarchical acceptance.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Return `RETRIEVAL_HIERARCHY_INVALID` for cycles, stale summaries or dangling parents/entities. Exhausted breadth, depth, scoring or cost bounds return `RETRIEVAL_BUDGET_EXCEEDED` with completed-stage evidence. Never silently replace failed descent with unbounded global retrieval. | Negative fixtures prove typed refusals and no reads beyond scope or budget. Partial evidence is explicitly marked incomplete.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record each visited community, pruning decision, entity path, stage score, reranker invocation and cumulative cost. Bind summary generation and graph/corpus revisions to the receipt. Compare quality and measured work against a declared flat-retrieval baseline. | Trace readback accounts for every stage and rejected candidate. Fixture expectations do not stand in for measured production costs.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: the authenticated served cross-modal query. `tests/retrieval/test_hierarchy_served.py` loads two tenant hierarchies with deterministic summaries and entity evidence. It uses production graph reads and scoring. | Prove summary-to-community-to-entity descent and exact cost counters. Refuse stale hierarchy, dangling entity and exhausted beam/cost budgets; another tenant remains unread.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R082
Iterative retrieval stop rule with calibrated confidence and bounded termination (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Iterative retrieval stop rule with calibrated confidence and bounded termination (rollup).** EG applies one precedence rule for invalid feedback, exhausted limits, measured retrieval progress and calibrated confidence. Only the confidence branch can claim `answer_repeated_margin_met`. No component is learned. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R082.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `CalibrationTable`, `RoundCalibration`, `StopContext` and `StopVerdict` in `crates/eg-types/src/retrieval_stop.rs`. Calibration rows hold round, baseline confidence and margin threshold. Context carries validated limits, completed-round progress and policy revision. Verdict carries stop, reason, round, optional margin/threshold, optional calibration refusal and exhausted dimension. Closed reasons: `round_limit`, `budget_exhausted`, `no_new_evidence`, `quality_saturated`, `answer_repeated_margin_met`, `continue_uncalibrated`, `continue_answer_changed`, `continue_margin_low`. Missing calibration retains `ROUND_NOT_CALIBRATED` and absent margin/threshold. | `crates/eg-types/src/retrieval_stop.rs::tests::table_and_verdict_round_trip` preserves all reasons and the simultaneous terminal reason/calibration refusal. Unknown reasons refuse.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R082.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Add `decide_stop(table, history, context) -> StopVerdict`. After feedback validation, precedence is round limit, other exhausted budget, no new evidence, declared quality saturation, then calibrated confidence. A confidence stop requires repeated answers and `confidence - baseline_confidence > margin_threshold`. Missing calibration selects `continue_uncalibrated` only if no earlier terminal condition applies. Other continuations use answer-changed or low-margin reasons. Stop alone does not assert R081 sufficiency. | `crates/eg-plan/src/retrieval_stop.rs::tests::repeat_and_margin_stops` covers each branch and simultaneous conditions. Equality at the margin threshold continues. Terminal progress requires completed-round evidence, not caller or critique assertions.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R082.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** `decide_stop` attaches beside `judge_sufficiency` at `crates/eg-plan/src/exec.rs:536`, reached through `crates/eg-graphql/src/crossmodal.rs:429`. Apply continuation validation and limit checks before dispatch; evaluate completed-round progress before issuing another continuation. EG derives context from validated evidence and counters. This row creates the call site. The harness cannot bypass a terminal verdict. | `crates/eg-plan/src/exec.rs::tests::execute_returns_stop_verdict_with_history` covers both hooks. A feedback continuation checks limits even without prior answer history. An ordinary query outside that path without history has no confidence verdict.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R082.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A missing calibration row prohibits a confidence-based early stop and records `ROUND_NOT_CALIBRATED` with the round. It never overrides an exhausted limit, no new evidence or declared saturation. Such terminal outcomes retain the calibration refusal; only a valid progressing round with remaining budgets may continue. Exhausted limits return `RETRIEVAL_BUDGET_EXCEEDED` with the terminal verdict. Invalid feedback refuses before continuation. | `crates/eg-plan/src/retrieval_stop.rs::tests::uncalibrated_round_refuses` asserts the missing calibration marker for both terminal and continuing cases. No fallback calibration, synthetic margin or budget reset is allowed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R082.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record each `StopVerdict` as a retrieval `DecisionRecord` premise. Include round, reason, optional margin/threshold, calibration refusal, policy revision, completed-round progress and exhausted dimension. Return the same typed outcome to the caller. Retain R081 insufficiency where present. | `crates/eg-plan/src/retrieval_stop.rs::tests::stop_premise_lists_margin_and_reason` proves missing calibration remains visible on a terminal verdict and never becomes a successful confidence claim.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R082.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: the served cross-modal query through `execute` at `crates/eg-plan/src/exec.rs:536`. `tests/retrieval/test_stop_rule_served.py::test_repeat_with_margin_stops` proves the calibrated branch. `tests/retrieval/test_feedback_served.py::test_uncalibrated_continuation_precedence` sends real successive continuations through production retrieval and inference operators with pinned artifacts. | A deterministic corpus proves progressing, saturated and exhausted uncalibrated outcomes. Assert exact reasons, calibration refusals, optional margins and independently read trace/counters. Terminal responses cause zero subsequent retrieval or inference calls; forged saturation cannot bypass validation.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R083
Arbitration between model prior and evidence (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Arbitration between model prior and evidence (rollup).** EG arbitrates between the answer a model gives without retrieval and the answer from retrieved evidence. Below the confidence margin EG abstains and returns both candidates. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R083.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `Candidate{answer, confidence, evidence_class}` and `ArbitrationVerdict{choice, margin, prior, retrieved}` in `crates/eg-types/src/retrieval_arbitration.rs`. `evidence_class` is closed: `parametric`, `retrieved`. `choice` is `Prior`, `Retrieved` or `Abstain`. Both candidates ride on every verdict. Search found no such type. Proving test: `crates/eg-types/src/retrieval_arbitration.rs::tests::verdict_carries_both_candidates`. | A verdict round trip keeps both candidates and their classes.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R083.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Add `arbitrate(prior, retrieved, margin) -> ArbitrationVerdict` and preserve the named replaceable default confidence margin 0.10. Before comparing confidence, classify support using citations bound to the same query digest and graph snapshot. `Supported` requires a valid source span for every material claim. Missing or invalid support is `unsupported` or `unknown`, never supported. A supported candidate beats an unsupported/unknown candidate in either case of confidence delta. If both candidates are supported, choose one only when its confidence exceeds the other's by more than `margin`. Otherwise abstain. If neither is supported, abstain. Both candidates, support states, citation ids, confidence values and margin remain in every verdict. The policy is deterministic and has no learned part. Proving test: `crates/eg-plan/src/retrieval_arbitration.rs::tests::support_precedence_precedes_confidence_margin`. | A supported 0.70 candidate beats an unsupported 0.95 candidate. Both-supported candidates still use the 0.10 margin. Both unsupported/unknown abstain.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R083.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** `arbitrate` attaches at the end of `execute` in `crates/eg-plan/src/exec.rs:536`. The harness runs the prior probe, the answer without retrieval, and sends it as a `Candidate` in the query call. EG scores the evidence side from the same call. The production caller of `execute` is `crates/eg-graphql/src/crossmodal.rs:429`. This row creates the call site. No production caller of an arbitration exists today. Proving test: `crates/eg-plan/src/exec.rs::tests::execute_returns_arbitration_for_prior_candidate`. | A call with a prior candidate returns a verdict. A call without one returns none.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R083.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A verdict that abstains must return the typed code `ARBITRATION_ABSTAIN` with both candidates and no chosen answer. A call whose prior candidate lacks `evidence_class` must refuse with `CANDIDATE_CLASS_REQUIRED`. The typed abstention follows the pattern at `crates/eg-compute/src/assemble/conclude.rs:69`. Proving test: `crates/eg-plan/src/retrieval_arbitration.rs::tests::abstain_returns_both_candidates`. | The abstain response holds two candidates and no answer.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R083.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Each verdict must be recorded as a premise on the retrieval `DecisionRecord`. The premise lists both candidates, their `evidence_class`, the margin and the choice. Proving test: `crates/eg-plan/src/retrieval_arbitration.rs::tests::arbitration_premise_lists_both_classes`. | The decision record shows parametric and retrieved classes.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R083.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served cross-modal query operation. The test sends a prior candidate and an evidence set whose confidence gap is below the margin. The call passes through `execute` at `crates/eg-plan/src/exec.rs:536`. It observes `ARBITRATION_ABSTAIN` with both candidates. Proving test: `tests/retrieval/test_arbitration_served.py::test_small_gap_abstains_with_both`. | The served response is the abstain code with two candidates.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.1
Shared multimodal space and missing-embedding shortfall (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Shared multimodal space and missing-embedding shortfall (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.1.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** The engine must extend EmbeddingSpaceRef in `crates/eg-types/src/embedding.rs:47` with a modality contract. It must declare text, image, audio and video bindings within one pinned coordinate space. | Planned: `tests/retrieval/test_multimodal_served.py`. Round-trip all four modality bindings and reject absent space identity.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.1.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The planner must rank each query modality against every target modality using the same compatible space. The named compatible_space_only policy must preserve R039 candidate replenishment and R040 exclusions. | Planned: `tests/retrieval/test_multimodal_served.py`. Compare all sixteen modality pairs against an independent permitted-candidate oracle.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.1.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The server must extend run_unified_bind_embedder at `src/server/handlers/query/planning.rs:611`, called by run_unified_with at `src/server/handlers/query/planning.rs:424`. It must bind approved multimodal encoders before rank_top at `crates/eg-plan/src/exec/vector_rank.rs:65`. No production caller today supplies this complete multimodal contract. | Planned: `tests/retrieval/test_multimodal_served.py`. The served UnifiedQuery must reach actual model bindings and the maintained index.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.1.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** The planner must return missing_embedding shortfall when eligible target items lack embeddings. It must report requested, returned and authorized missing counts without padding. Incompatible spaces and unavailable query encoders must refuse before ranking. | Planned: `tests/retrieval/test_multimodal_served.py`. Distinguish missing embeddings, too few eligible items and exhausted budgets without leaking hidden counts.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.1.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The retrieval receipt must record modality direction, space identity, model revisions, index generation and authorized shortfall counts. It must identify every actual encoding call. | Planned: `tests/retrieval/test_multimodal_served.py`. Independent receipt readback must match model calls and permitted results.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.1.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: authenticated UnifiedQuery. `tests/retrieval/test_multimodal_served.py` must use production encoders and persistent indexes for all sixteen pairs. | Planned: `tests/retrieval/test_multimodal_served.py`. Prove expected cross-modal matches; reject incompatible spaces and missing query bindings; expose target shortfall and preserve tenant isolation.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.1
Hard entity and relationship constraints (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hard entity and relationship constraints (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.1.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** The engine must add RetrievalConstraints beside Pred at `crates/eg-types/src/wire_query_core.rs:27`. It must bind typed entity predicates, directed relationship predicates, quantifiers and graph revision. | Planned: `tests/retrieval/test_constraints_served.py`. Round-trip required and forbidden relationships, typed values and conjunctions; reject unknown operators.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.1.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The constraint compiler must apply every declared constraint before ranking or truncation. The named require_all policy must intersect authorized entity and relationship matches. Contradictory constraints must yield an empty eligible set. | Planned: `tests/retrieval/test_constraints_served.py`. An independent graph oracle must exclude the highest-scoring candidate when one declared constraint fails.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.1.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The planner must attach constraint compilation at `crates/eg-plan/src/exec.rs:536` before rank_limit at `crates/eg-plan/src/exec/vector_rank.rs:56`. Its caller is execute_rows at `src/server/handlers/query/planning.rs:411`. Generic filters exist; no production caller today compiles this declared constraint contract. | Planned: `tests/retrieval/test_constraints_served.py`. Optimized and unoptimized served plans must feed identical constrained sets into vector and text ranking.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.1.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** The planner must refuse invalid predicates, stale graph revisions and unevaluable required constraints. It must never replace hard exclusion with a score penalty. An unsatisfiable valid conjunction must return R039 typed shortfall. | Planned: `tests/retrieval/test_constraints_served.py`. Malformed and unsupported predicates must perform no ranking; contradictory valid predicates must return zero eligible results.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.1.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The trace must record constraint digest, graph revision, authorized exclusion counts and per-predicate outcomes. It must retain the same constraint binding across replenishment and fusion. | Planned: `tests/retrieval/test_constraints_served.py`. Receipt readback must prove excluded candidates never reappear in any ranking branch.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.1.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: authenticated UnifiedQuery. `tests/retrieval/test_constraints_served.py` must traverse real entity relationships before production vector and text ranking. | Planned: `tests/retrieval/test_constraints_served.py`. Prove required and forbidden edge predicates, contradictory constraints, exact top-k replenishment, stale revisions and cross-tenant negatives.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.7
Vector-free document-section traversal (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Vector-free document-section traversal (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.7.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** The engine must extend HierarchyRetrievalPolicy in `crates/eg-types/src/retrieval_verdict.rs` with distinct community and document_section kinds. Section nodes must carry document revision, parent, ordered children, granularity, summary and source span. | Planned: `tests/retrieval/test_section_tree_served.py`. Validate one root, acyclic single-parent links and nested source spans; preserve all community fields.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.7.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The planner must traverse document sections through bounded reasoning over authorized summaries and section contents. The named section_beam policy must declare breadth, depth, visits, tokens, inference calls and cost limits. It must require no vector storage. | Planned: `tests/retrieval/test_section_tree_served.py`. Compare selected leaf spans and every visited path with a deterministic section-tree oracle.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.7.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The planner must add section traversal before fusion at `crates/eg-plan/src/exec.rs:536` through PlanCtx. run_unified_with at `src/server/handlers/query/planning.rs:424` must bind section reads and approved reasoning. No production caller today supplies this vector-free path. | Planned: `tests/retrieval/test_section_tree_served.py`. The served query must reach document reads and reasoning with no vector index or embedding calls.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.7.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** The planner must reject cycles, dangling parents, stale summaries, invalid spans and unavailable reasoning. It must stop before exceeding any traversal limit. Partial paths must carry incomplete evidence. | Planned: `tests/retrieval/test_section_tree_served.py`. Refuse malformed trees and exhausted limits without unbounded search or conversion into community retrieval.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.7.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** HierarchyStageReceipt must retain ordered visits, full root-to-section paths, selected spans, pruned branches and bounded decision premises. It must bind document, summary, model and policy revisions with measured work. | Planned: `tests/retrieval/test_section_tree_served.py`. An independent reader must reconstruct all visited paths, including rejected branches, without hidden section contents.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.7.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: authenticated UnifiedQuery. `tests/retrieval/test_section_tree_served.py` must read real section records and invoke production reasoning without vector storage. | Planned: `tests/retrieval/test_section_tree_served.py`. Prove multilevel descent and full paths; reject cycles, stale spans and exhausted budgets; retain community acceptance and tenant isolation.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.2
Independent document-chunk encoding and aggregation (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Independent document-chunk encoding and aggregation (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.2.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** The engine must define DocumentEncodingPolicy in `crates/eg-types/src/embedding.rs` beside EmbeddingSpaceRef. It must pin tokenizer, chunk size, overlap, position mode, aggregation and model revision. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Round-trip local_reset and absolute_offset modes; reject zero size, overlap at least size and unsupported policy revisions.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.2.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The encoder must split token IDs into ordered windows without losing token identities. Each window must reset positions locally or preserve absolute document offsets according to policy. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Golden boundaries must cover empty, short, exact-size, overlapping and partial-final windows.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.2.3
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The encoder must process every chunk independently with the pinned model and no state from another chunk. It must leave query encoding unchanged. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Production invocation records must show exactly one independent encode per declared chunk.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.2.4
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The named mean_chunks policy must average chunk vectors in ordinal order before one final declared normalization. Aggregation must be query-independent and produce exactly one document vector. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. An independent numerical oracle must reproduce the aggregate within declared floating-point tolerance.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.2.5
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The engine must validate chunk receipts at `src/server/handlers/semantic_index/worker.rs:175`, called by `src/server/handlers/semantic_index/dispatch.rs:14`. The governed ingestion worker must execute the approved encoding recipe before completing that generation. No production caller today validates this complete composition contract. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Served ingestion and query must share the same approved encoding policy and vector generation.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.2.6
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** The encoder must refuse unsupported position modes, incompatible vector dimensions, non-finite outputs and exhausted encoding budgets. Failed chunks must prevent aggregate publication. Empty input and zero-norm aggregates must return typed no_embedding outcomes. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Negative fixtures must leave the prior complete index generation intact and expose the specific refusal.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.2.7
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The encoding receipt must retain document digest, token ranges, position mode, per-chunk model revision and aggregate digest. It must bind policy, index generation and measured encoding cost. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Independent receipt readback must account for every chunk and the single stored vector.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.2.8
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: authenticated UnifiedQuery after governed ingestion. `tests/retrieval/test_chunk_encoding_served.py` must use actual model bindings and maintained indexes. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Compare local-reset and absolute-offset encodes, exact aggregation and one-vector retrieval; refuse invalid overlap, failed chunks and incompatible revisions.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.6
Workload-aware column vectorization advice (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Workload-aware column vectorization advice (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.6.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** The engine must add ColumnVectorAdvice beside EmbeddingBinding at `crates/eg-query/src/tables/embedding_binding.rs:398`. It must include table, column, schema revision, observed workload window, sample count, embedding eligibility and reason. | Planned: `tests/retrieval/test_column_advice_served.py`. Round-trip ranked advice and unsupported_type refusal without creating a binding.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.6.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The named workload_first policy must rank eligible text columns using observed text-search demand, average length and distinct ratio. It must use type admission before scoring and stable column identifiers for ties. Missing workload must produce insufficient_observations. | Planned: `tests/retrieval/test_column_advice_served.py`. Actual column-specific text-search traffic must change advice while unchanged data statistics remain equal.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.6.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The SQL handler must record resolved column usage at `src/server/handlers/query/sql_read.rs:379`, called by handle_sql_read at `src/server/handlers/query/sql_read.rs:100`. It must expose a bounded read-only advice relation through the existing authorized catalog. No production caller today supplies this advice contract. | Planned: `tests/retrieval/test_column_advice_served.py`. Served SQL advice must consume production query observations and authorized schema records.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.6.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** The advisor must refuse recommending any unembeddable type before scoring. It must reject stale schemas and unavailable model capability. Advice must never create a binding or queue embeddings. | Planned: `tests/retrieval/test_column_advice_served.py`. Integer, boolean, timestamp and unsupported binary columns must return unsupported_type with zero embedding side effects.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.6.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The advice receipt must record per-column workload counts, observation window, schema revision, policy revision and ranking contributions. It must omit raw query text and hidden columns. | Planned: `tests/retrieval/test_column_advice_served.py`. Independent readback must match authorized production observations and confirm unchanged binding state.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R077.6.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: authenticated Sql. `tests/retrieval/test_column_advice_served.py` must issue real table queries followed by the planned advice relation. | Planned: `tests/retrieval/test_column_advice_served.py`. Prove workload-dependent ordering, unembeddable-type refusal, absent observations, stale schema, tenant isolation and zero automatic bindings.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.2
Topic and dense ranking fusion (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Topic and dense ranking fusion (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.2.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** The engine must add TopicBackend and TopicRankingPolicy beside PlanCtx in `crates/eg-plan/src/exec.rs:84`. Backend results must carry topic weights, centroid vectors, corpus revision and the retriever EmbeddingSpaceRef. | Planned: `tests/retrieval/test_topic_fusion_served.py`. Two interchangeable backend implementations must satisfy one typed result contract.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.2.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The named weighted_topic_dense policy must combine normalized dense similarity and responsibility-weighted centroid similarity. It must use a bounded explicit weight and stable candidate identifiers for ties. Hard constraints must precede topic scoring. | Planned: `tests/retrieval/test_topic_fusion_served.py`. An independent score oracle must reproduce ordering for both backends and weights zero, one and an intermediate value.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.2.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The planner must attach topic scoring before final truncation at `crates/eg-plan/src/exec.rs:536`. run_unified_with at `src/server/handlers/query/planning.rs:424` must bind the selected backend. Existing fuse_rrf at `crates/eg-plan/src/exec.rs:848` combines ranks; no production caller today supplies topic fusion. | Planned: `tests/retrieval/test_topic_fusion_served.py`. The served query must exercise both dense ranking and the selected production topic backend.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.2.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** The planner must reject centroid dimensions, model revisions or coordinate spaces differing from the retriever. It must refuse non-finite weights, stale corpus revisions and unavailable backends. Equal dimensions alone must never establish compatibility. | Planned: `tests/retrieval/test_topic_fusion_served.py`. Negative fixtures must refuse before fusion without silently dropping the requested topic contribution.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.2.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The receipt must record backend identity, centroid generation, space tuple, topic responsibilities, component scores and fusion policy. Empirical centroids must record their authorized source-vector generation. | Planned: `tests/retrieval/test_topic_fusion_served.py`. Independent readback must reproduce the final score and prove constraints remain effective.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.2.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Entry point: authenticated UnifiedQuery. `tests/retrieval/test_topic_fusion_served.py` must swap two actual topic backends over the same authorized corpus. | Planned: `tests/retrieval/test_topic_fusion_served.py`. Prove backend interchange and score effects; reject incompatible centroids, stale generations, missing backends and cross-tenant topics.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.3
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The planner must replenish only candidates satisfying R040.1 constraints. Constraint exhaustion must produce typed shortfall without relaxing any entity or relationship predicate. | Planned: `tests/retrieval/test_constraints_served.py`. Positive and negative served generation checks.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The filtered index must consume only complete R039.2 aggregates through rank_top at `crates/eg-plan/src/exec/vector_rank.rs:65`. Its caller is execute at `crates/eg-plan/src/exec.rs:536`. It must reject stale encoding-policy generations before ranking. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Positive and negative served generation checks.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R039.4
Residual behavior: mixed multi-hop traversal and vector top-k
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Residual behavior: mixed multi-hop traversal and vector top-k.** A query must combine multi-hop graph traversal and vector similarity. It must replenish candidates until k results survive the traversal filter. Otherwise, it must return a typed shortfall naming the number of permitted matches. It must never return a silent undercount. | A correctness oracle must run mixed traversal-plus-vector queries against a reference corpus. It must confirm exactly k permitted results or an explicit typed shortfall, never a silent undercount. Retain S-01 with two-hop traversal, parallel edges and stable edge identity. Include ten permitted matches below unfiltered top-k. Planned: `tests/retrieval/test_mixed_traversal_topk_served.py`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.4
Residual behavior: filter-aware ANN and BM25 scans
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Residual behavior: filter-aware ANN and BM25 scans.** Filtered approximate-nearest-neighbor and BM25 text search must plan filter-aware index scans. These scans must consume pre-filtered candidate sets or bitmap filters. They must not scan the full unfiltered index and discard non-matching rows afterward. They must preserve the filtered-search correctness guarantee. | A benchmark must compare filtered vector and text search latency before and after the filter-aware scan change. Use a fixed corpus. A physical filtered-scan correctness oracle must confirm that results remain correct. Planned: `tests/retrieval/test_filtered_scan_benchmark_served.py`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R084
Served ShEx validation (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Served ShEx validation (rollup).** Define the existing ShexValidate surface and bounded eg-shex behavior. Preserve all existing reasoning and query obligations. Every child requires its planned evidence; parser availability and unit reports do not establish served conformance. | Planned: tests/shex_served.rs::served_shex_contract_journey.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R084.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Reuse Method::ShexValidate and ShexValidationReport. The request carries ShExJ schema text, optional Turtle data and ordered node-IRI/shape-label pairs. Preserve result order, node lexical form, shape, conforms and optional reason. An empty map produces zero results and a true aggregate, not a whole-graph validation claim. | Planned: tests/shex_served.rs::wire_report_preserves_shape_map.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R084.2
Behavior: data selection
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior: data selection.** The handler parses ShExJ. Nonblank data_graph supplies an inline Turtle graph. Empty or whitespace-only data_graph exports the authority-projected request graph. The operation reads these inputs without importing the inline graph or persisting a schema. Do not infer a broader durable snapshot from this exported core view. | Planned: tests/shex_served.rs::inline_and_live_data_selection.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R084.3
Behavior: supported constraints
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior: supported constraints.** Record existing node-kind, datatype, value-set, string-facet and numeric-facet checks. Triple constraints count matching outgoing arcs against min/max bounds. EachOf consumes matches sequentially. Closed shapes and extra predicates use the current matcher. Focused fixtures must show both conformance and a specific nonconforming result. | Planned: tests/shex_served.rs::bounded_constraints_report_results.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R084.4
Behavior: semantic limits
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior: semantic limits.** Record actual matcher limits without expanding them. OneOf chooses the first matching branch on a trial consumed set. Shared-predicate matching is greedy. The matcher ignores the parsed inverse flag and assumes success beyond depth 40. Neither limit establishes full ShEx conformance or satisfies existing reasoner-budget obligations. | Planned: tests/shex_served.rs::semantic_limits_remain_visible.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R084.5
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Trace authenticated ShexValidate through src/server/handlers/rdf/dispatch.rs:13, :281 and :357 to src/server/handlers/rdf/validation.rs:176. The handler calls Schema::from_shexj, ShapeMap::from_iri_pairs, validate and shex_report_wire. The shex feature supplies the handler; the method remains classified Internal. No new parser, planner path or wire method is introduced. | Planned: tests/shex_served.rs::real_dispatch_reaches_shex_validator.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R084.6
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Preserve the existing bad-schema, bad-data and live-export error paths. An unknown shape label produces a nonconforming result with a reason, not a transport parse error. Missing handler support must not fabricate a validation report. Do not claim that every unsupported schema field is rejected. | Planned: tests/shex_served.rs::parse_and_dispatch_failures_are_distinct.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R084.7
Scoped reads
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Scoped reads.** Retain universal served-read authority and GraphReadAuthority::project_core before live graph export. Hidden rows and another graph must not influence the caller-visible live report. Inline Turtle is caller-supplied data, not a read of hidden stored rows. Validation must leave graph rows and stored schema unchanged. | Planned: tests/shex_served.rs::live_validation_obeys_read_authority.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R084.8
Evidence and hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence and hot-path proof.** Enter through a real authenticated ShexValidate request. Observe the production handler, eg-shex validator and typed report projection. Prove inline and live cases, ordered mixed outcomes, parse failures, unknown labels and denied scope. Retain source, binary, feature and request identities. Record semantic discrepancies instead of claiming complete language support. | Planned: tests/shex_served.rs::served_shex_contract_journey.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R085
EG approves immutable source queries for bounded connector execution (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**EG approves immutable source queries for bounded connector execution (rollup).** EG owns the read-only query meaning and authorization. SDK-SOURCE-INGEST-R004.1–.6 executes the approved query through its registered adapter. Children `.1`–`.8` define the producer and its served evidence. Existing R015, R043 and R069 remain unchanged. | Each child must pass; these definitions do not establish runtime delivery.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R085.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `SourceQueryRequest`, `ApprovedSourceQuery`, `SourceQueryApprovalCheck`, `SourceQueryApprovalValidity` and `SourceQueryLimits` in planned `crates/eg-types/src/source_query.rs`. The exact fields and methods are specified in the plan. Bind typed parameters, dialect, source/schema/snapshot identities, read-only operations, authority, expiry and finite limits. Reject unknown fields and unrepresentable parameter values. Proving test: `crates/eg-types/src/source_query.rs::tests::approval_records_round_trip` (planned). | Round trips preserve every binding. Invalid references, parameter types, nonfinite values, absent snapshot identity and zero/unbounded limits refuse.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R085.2
Behavior: issue approval
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior: issue approval.** `ApproveSourceQuery` validates the registered source and query under the verified carrier before issuing `ApprovedSourceQuery`. Reuse the immutable control-lease grant and native authoritative commit path in `src/redb_store/work_item/control_lease.rs:58`. Reserve kind `source.query.approval` against generic `IssueControlLease`, following `crates/eg-types/src/control_lease.rs:244`. Only the validated producer may issue this kind. Grant digests bind every approved field; the server controls issue time and clamps expiry to existing lease limits. Proving test: `src/server/handlers/federation/source_query_tests.rs::approval_requires_authority_and_native_commit` (planned). | A successful response follows durable issuance. Generic lease writes cannot forge approval. Issuance uses existing storage and credentials; no external SQL executes during approval.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R085.3
Behavior: verify approval
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior: verify approval.** Add `VerifySourceQueryApproval`, taking the complete approved descriptor and observed source/schema/snapshot identities. Recompute its digest and read the authoritative control lease. Require active status, current server time before both expiries, matching caller/delegation and current source permissions. Recheck bound policy, identity and source revisions. Reuse `read_control_lease` at `src/redb_store/work_item/control_lease.rs:130`; a supplied lease view is not proof. Proving test: `src/server/handlers/federation/source_query_tests.rs::changed_or_revoked_approval_refuses` (planned). | Changing any binding, authority, source or revision refuses. Revoked, expired, consumed, unavailable or missing leases refuse. Verification grants no SQL effect and creates no bearer credential.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R085.4
Behavior: read-only SQL
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior: read-only SQL.** Reuse R015 classification, R043 destination checks and R069 SQL rendering within existing query machinery. `crates/eg-plan/src/federation.rs:933` validates one read statement; `federation_opt/columns.rs:215` and `sql_text.rs:48` own rendering helpers. Keep typed parameter binding separate from SQL text. Reject DDL, DML, COPY, external-table creation, multiple statements, locking reads and unknown effects. Require database-enforced read-only execution; read syntax alone cannot authorize side-effecting functions. Proving test: `crates/eg-plan/src/federation_tests.rs::approved_source_query_has_no_write_effects` (planned). | Native parameter binding preserves values and query meaning. Supported projections, predicates, ordering and limits match the query oracle. Unknown dialects, functions or effects refuse without issuing approval.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R085.5
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Register both planned methods in `crates/eg-capabilities/src/domains/query.rs` with generated request/result contracts and explicit authorization and durability metadata. Attach through `src/server/dispatch/graph_pipeline/pipeline.rs:333` to `handlers/federation.rs:21`, beside `QueryForeignColumns`. Extend the existing native control-lease commit route for issuance; verification remains an authoritative read. SDK receives the generated `ApprovedSourceQuery` type under SDK-SOURCE-INGEST-R004.1–.3. Proving test: `tests/source_query_approval_served.rs::real_dispatch_issues_and_verifies_approval` (planned). | Real authenticated dispatch reaches source validation, native issuance and fresh verification. No parallel planner, store or client-side approval authority appears. Current source has neither method.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R085.6
Behavior: bounded execution contract
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior: bounded execution contract.** The approved limits constrain total rows/bytes, chunk rows/bytes, queue depth/bytes, deadline and resident-memory budget. All are positive and finite. SDK-SOURCE-INGEST-R004.2 applies backpressure and retains no complete result. It verifies approval before opening the driver, before publishing each chunk and before terminal success. Each chunk binds query digest, source/schema/snapshot, sequence and cumulative totals. Proving test: `tests/source_query_approval_served.rs::bounded_stream_preserves_approval` (planned). | Oversized rows, exceeded budgets or failed revalidation stop execution and close the driver. Exactly one explicit completion or typed failure stops an execution. Missing terminal completion never means success.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R085.7
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Planned `source_query.rs` defines closed errors: `unsupported_dialect`, `invalid_query`, `unauthorized`, `approval_expired`, `approval_revoked`, `stale_source`, `query_failed`, `limit_exceeded`, `cancelled`, `verification_unavailable`. Errors carry query identity, stage and last completed chunk, without SQL literals, parameter values or credentials. SDK-SOURCE-INGEST-R004.4 retains these semantics after partial output. Proving test: `tests/source_query_approval_served.rs::failure_after_three_chunks_is_terminal` (planned). | Failure after three chunks stays failure with an incomplete execution identity. No successful terminal event or failed-chunk checkpoint follows. Earlier accepted pages retain their actual durable receipts.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R085.8
Evidence and hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence and hot-path proof.** `tests/source_query_approval_served.rs::approval_to_connector_query_journey` enters both real EG methods and links SDK-SOURCE-INGEST-R004.6's actual connector/driver receipt. Prove correct rows, typed binding, immutable provenance, authorization refusal and zero unauthorized database effects. Measure EG and connector peak resident memory in fresh processes across increasing result cardinalities. Proving test: `tests/source_query_approval_served.rs::approval_to_connector_query_journey` (planned). | Keep row widths, driver settings and all limits fixed while increasing cardinality by two orders of magnitude. Declare the baseline, memory envelope and tolerance before runs. Every peak must fit that fixed envelope; whole-result buffering fails. Record exact revisions, features, commands, rows/bytes, queue high-water marks, terminal outcomes and checkpoint agreement.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R070.1
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Definition hold — governed raw-corpus producer is not defined.** R070.1 requires exact lexical search, file reads, context verification, per-query cost and abstention before budget overrun. While R070 only bounds indexed UQL rows/visits and GraphOS retrieval returns a top-K boundary. Do not route this requirement through the indexed retriever or claim that its budget is a raw-source cost. The missing owner contract must identify the authorized raw-source provider and immutable source/snapshot identity. Exact search/read/verification operations and byte/line coordinate system. Finite scan/read/verification cost units and ceilings. The typed over-budget refusal. And the producer-to-EG request/response fields consumed by GovernedRetriever/AU. Until those decisions exist, this row defines no callable producer and remains held. Source objective: An agent may search a raw corpus directly with exact lexical, file-read and context-verification operations without an index. Each query reports its cost, and over-budget scans abstain. Source record `AU:71` SHA-256 `0f1b775fd66c41586bdcdf0047a9ccbc52e38aa1bc21a4e8234e9c641e45c68e`. Preserve existing obligations: `EG-FEDERATED-QUERY-R070; ARBORA-OPS-R053.2, ARBORA-OPS-R053.3, ARBORA-OPS-R053.5`. | Definition acceptance is blocked until the owner publishes the producer fields above. Serve an authorized query over an unindexed corpus. Return exact lexical hits, bounded file spans, verification result, source revision and measured cost. An over-ceiling query must return typed abstention before reading beyond the ceiling. Repeat against an indexed-only fixture and prove it is not accepted as this contract. Do not claim a served test or implementation now.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R006.1
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Definition hold — temporal derivation producer and semantics are absent.** R006 continues to require proof-carrying results for rule-derived queries. The source asks for temporal forward chaining from extracted facts. It requires provenance from every derived fact to its originating sentence or axiom. But the owner review found only answer-level proofs and no persistent fact-production API/origin chain. Before specifying a producer, the owner must decide rule language/version, temporal interval vocabulary, join/overlap semantics and conflict handling. The owner must also define derived-fact identity/update/retraction behavior and the persistent origin-record schema. The owner must also name the authoritative admission/readback operation. Do not treat query proof premises as a durable fact producer. No derivation or write is authorized by this row. Source objective: The engine derives facts from extracted facts using temporal forward-chaining rules. It records each derived fact's provenance to its originating sentence or axiom. Source record `EG:11` SHA-256 `2c2ffcf18d947730bc60a935fed942e1f82e9e8547f4509fe2941a34672fb8f3`. Preserve existing obligations: `EG-FEDERATED-QUERY-R001, EG-FEDERATED-QUERY-R011, EG-DECISION-ENGINE-R003, EG-FEDERATED-QUERY-R006`. | After owner decisions are recorded, acceptance uses two source facts with sentence and axiom origins. It exercises matching and nonmatching temporal intervals. Read back the derived fact with rule digest, graph generation and complete origin refs. Missing/stale origins, unsupported rule versions, conflicting validity windows and unauthorized writes must refuse without changing graph revision. Until then no producer test is specified as executable.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.5
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Definition hold — no parameter-free memory admission/encoding owner exists.** Existing lifecycle and filter-aware query operators do not specify persistent memory admission. They also do not define knowledge retention or cross-document relations. The source leaves the memory owner, admitted record/source identity, relation vocabulary, update/retention policy, and selectivity-versus-corpus benchmark target undecided. Those fields and an authorized producer/consumer operation are prerequisites. R040.4 filtered scans remain separate coverage; they cannot stand in for memory admission. Do not claim model weights change or that a no-forgetting property follows from ordinary graph writes. Source objective: The platform absorbs new knowledge into a retrievable memory module without changing model parameters or discarding earlier knowledge. Retrieval cost scales with query selectivity rather than corpus size, and cross-document relations are encoded. Source record `EG:20` SHA-256 `07df52b453f0f1b7be7aec7bf790f087c3fc5e13500915011382a9fcd8d9d41a`. Preserve existing obligations: `EG-FEDERATED-QUERY-R007, EG-FEDERATED-QUERY-R040, EG-FEDERATED-QUERY-R040.4, EG-FEDERATED-QUERY-R008`. | Blocked until the owner binds admission, relation, retention and benchmark semantics. The benchmark compares fixed query-selectivity workloads at multiple corpus sizes. It reports rows/bytes/visits and demonstrates the declared cost bound. Read back new knowledge; prove prior records and model revision remain unchanged. Missing admission authority, relation target or bound refuses. No runnable acceptance is asserted before the missing policy is supplied.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.6
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Definition hold — episode/layer producer and consumer policy are absent.** Existing SourceIngest validates/projects transcript records and UnifiedQuery supports filtered search. Neither defines semantic/procedural/episodic layer identity or builds graph episodes across sessions. The owner must define session and episode identity/boundaries, participant ordering and turn ordering. The owner must define utterance assignment to semantic, procedural or episodic memory. The owner must define cross-session merge/duplicate rules and temporal validation/conflict behavior. Name the AU operation that consumes/retrieves episodes. Keep the existing transcript and search contracts intact. Do not infer episode construction from transcript projection or introduce an unapproved AU consumer. Source objective: Agents keep semantic, procedural and episodic memory layers. These layers use graph-structured episodes built from multi-session dialogue. Retrieval spans sessions using hybrid vector and keyword search with temporal validation. Source record `EG:21` SHA-256 `c321db3aa79c29d891456f2bee98f545611b8d1be7c93d299b939c3d73a40279`. Preserve existing obligations: `EG-INGEST-WORKER-R003.13, EG-INGEST-WORKER-R003.14, EG-INGEST-WORKER-R003.17, EG-FEDERATED-QUERY-R040, EG-INGEST-WORKER-R003.18, EG-INGEST-WORKER-R003.16, EG-FEDERATED-QUERY-R016`. | After the owner fixes those decisions, acceptance ingests two ordered sessions. It builds and independently reads back an episode with transcript/revision/span provenance. It searches for the episode using hybrid vector+keyword search. Validate event time against storage time. Refuse or report partial for duplicate/conflicting chronology, stale transcript revision or unauthorized cross-session reference. Apply the owner-approved rule. No executable test exists until taxonomy and consumer are fixed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R083.7
Support-aware arbitration prevents unsupported confidence wins
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Support-aware arbitration prevents unsupported confidence wins.** Extend the existing `Candidate`/`ArbitrationVerdict` in R083.1 with `query_digest`, `graph_snapshot_revision`, `support_state` (`supported`, `unsupported`, `unknown`) and ordered `supporting_span_ids`. Preserve both candidates, the confidence margin, typed abstention and R083.2's existing >0.10 confidence rule for candidates with equal support state. Support is valid only when every material claim resolves to a source span. The span must share the query digest and graph snapshot. The decision order is fixed: exactly one supported candidate wins before confidence comparison. Both supported use the R083.2 margin. Both unsupported/unknown abstain with `ARBITRATION_ABSTAIN`. Missing citation, mismatched snapshot/query or unverifiable claim cannot raise support state and is treated as unknown. Wire validation and arbitration at existing `crates/eg-plan/src/exec.rs::execute` and `crates/eg-graphql/src/crossmodal.rs`. No separate arbitration endpoint. Proving tests: `crates/eg-types/src/retrieval_arbitration.rs::tests::support_state_round_trips_with_query_binding`, `crates/eg-plan/src/retrieval_arbitration.rs::tests::unsupported_high_confidence_loses_to_supported_candidate`, and `tests/retrieval/test_arbitration_served.py::test_supported_lower_confidence_beats_unsupported_prior`. AU prior probe dependency remains `AU-RETRIEVAL-R006`; R083.3/.6 define the EG execution path but do not prove that producer. Preserve existing coverage `EG-FEDERATED-QUERY-R083.1`, `EG-FEDERATED-QUERY-R083.2`, `EG-FEDERATED-QUERY-R083.3`, `EG-FEDERATED-QUERY-R083.4`, `EG-FEDERATED-QUERY-R083.6`. Source record EG:22 SHA-256 `544b7b0054e8c7cd9a76aedd0d665589d555a0bcf20d1f00679442574936af36`. This remains SPECIFIED pending producer/consumer implementation and served receipts. | Serve two candidates with a common query/snapshot: supported 0.70 versus unsupported 0.95 must select supported. Verify supported 0.95 versus supported 0.70 follows the 0.10 margin. Both unsupported abstain. Missing, stale or cross-snapshot citation evidence must not select a candidate. Read back both candidates and all support refs. Retain the existing R083.2 margin test. AU producer and runtime receipts remain unclaimed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.10
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Definition hold — clock precedence and fallback trigger are unspecified.** R081.8.1-.6 already own follow-up query expansion and remain credited. This child covers confusion among storage time, event time and narrative time. It also covers a bounded second pass when first-pass context is insufficient. Existing transcript ingestion supplies event/storage fields but no narrative-time interpretation. The owner must define three typed clock fields and their source/provenance. The owner must set precedence when values disagree. Define the sufficiency threshold that triggers fallback. Specify fallback query construction and maximum fanout. Report the selected clock basis. Until policy values are approved, do not choose narrative, event or storage time by heuristic. Do not duplicate R081.8 follow-up behavior. Source objective: Retrieval detects confusion among storage date, event date and narrative time using explicit rules. If first-pass context is insufficient, it runs a second pass with fallback queries. Source record `EG:25` SHA-256 `fb8d54d8554b8158da64f7c9e8bf02ea846e5b411768a0381c2682b2e6302dac`. Preserve existing obligations: `EG-FEDERATED-QUERY-R081.1, EG-FEDERATED-QUERY-R081.2, EG-FEDERATED-QUERY-R081.3, EG-FEDERATED-QUERY-R081.4, EG-FEDERATED-QUERY-R081.8.1, EG-FEDERATED-QUERY-R081.8.2, EG-FEDERATED-QUERY-R081.8.3, EG-FEDERATED-QUERY-R081.8.4, EG-FEDERATED-QUERY-R081.8.5, EG-FEDERATED-QUERY-R081.8.6`. | Once defined, serve a fixture where all three clocks disagree and another where one clock is absent. Assert the selected basis and its provenance, and trigger exactly the configured bounded fallback only below the declared sufficiency threshold. enough first-pass context must issue no second pass. Stale or conflicting clock provenance and exhausted query budget must return a typed partial/refusal with no unbounded retry. No executable acceptance is currently authorized.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R028.1
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Typed KnowledgeSet row contract.** Reuse the existing `KnowledgeSet`/`KnowledgeRow` producer in `crates/eg-plan/src/knowledge.rs`, the `UqlKnowledge` wire carrier in `crates/eg-types/src/wire_query_core.rs`. And the existing `WITH KNOWLEDGE` attachment in `crates/eg-plan/src/uql/serve/annotate.rs`. Do not substitute `ForeignRows`. Each row carries its own provenance-frame state and policy-frame state alongside the existing row id, `source_refs`, `evidence_refs` and `policy_labels`. `Resolved` means row provenance and policy were resolved from one pinned graph snapshot. Missing or unresolved frames do not count as empty success. The KnowledgeSet remains a superset of a plain row set: id/score and requested projection preserve existing values. Structured and UQL surfaces must serialize the same carrier. If either per-row frame is absent, malformed, or from a different snapshot, return typed `KNOWLEDGE_FRAME_MISSING`/`KNOWLEDGE_FRAME_STALE` and no partially annotated result. This is a contract clarification only. The source explicitly withholds UQL implementation authorization. Source objective: Typed KnowledgeSet rows carry provenance and policy frame per row. The query surface returns them as a superset of plain row sets and refuses rows lacking either. Source record `EG:29` SHA-256 `2eb8aadb1b6ccc2d5de77a4d1964fc04a4e944bccf9bcc1793e262f146af7583`. Preserve existing obligations: `EG-FEDERATED-QUERY-R028, EG-FEDERATED-QUERY-R045`. | Create one plain row and one row with resolved evidence/policy frames. Compare both with the same structured KnowledgeSet producer. Verify row id/score/projection are unchanged and both frame states are row-local. Independently omit provenance, policy and snapshot binding. Each case must return the typed refusal without a partial row. Keep R045 foreign-row pushdown behavior unchanged. Tests are acceptance targets only. No UQL implementation or served receipt is claimed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R005.1
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Typed consistency-violation matrix on the existing validation result.** Extend the existing R005 VALIDATE SHAPE / reasoning-validation result with a closed `ViolationKindV1`: `temporal_conflict`, `cardinality`, `self_loop`, `asymmetry`, `ontology_defect`. Each `ViolationV1` binds `kind`, focus entity, relation/property ids, graph/ontology revisions, expected/observed values and source axiom/evidence refs. Kind-specific fields are required: conflicting validity intervals for temporal conflict. Declared min/max and observed count for cardinality. One entity and its forbidden self-edge for self-loop. A declared asymmetric relation with an observed reverse pair. Include the property/axiom id, the subject and object, both forward and reverse edge ids, their evidence refs. And the pinned graph/ontology revisions. An absent reverse edge is not a violation. Violated axiom id and affected terms for ontology defect. The validator is read-only: it reports each independent violation and never chooses a winner or retracts facts. Any later retraction requires a distinct explicit authorized mutation. Do not add a UQL implementation under this row. Source objective: The platform detects temporal conflicts, cardinality, self-loop and asymmetry violations, plus ontology defects. Conflict rules report each with a typed reason, never silently choosing. Source record `EG:31` SHA-256 `973de1c3b38646a438d057299d8070070f0ef7a2056bb30acff6d1a3814df513`. Preserve existing obligations: `EG-DECISION-ENGINE-R034, EG-FEDERATED-QUERY-R001, EG-FEDERATED-QUERY-R005, EG-FEDERATED-QUERY-R011, EG-FEDERATED-QUERY-R012`. | Serve a violating fixture and repaired control for each of the five kinds. Assert exactly the typed diagnostic with pinned graph/ontology revision and evidence refs. For asymmetry, the control contains only `(a,p,b)` and has no asymmetry diagnostic. Adding `(b,p,a)` as the sole change creates the violation, which cites both observed edge ids and the declared asymmetric axiom. A missing reverse edge is not a violation. Combine two independent defects and require both diagnostics. Missing kind-specific fields, unknown kinds and stale ontology revision refuse validation. Querying graph state afterward proves no mutation. Retraction remains denied absent explicit authorization.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R078.7
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Governed company-context logical view.** The authenticated query uses the existing `PlanScope` and `inject_scope` path (R078.1-.6) over one pinned graph snapshot. It composes stored organization/role vocabulary (`crates/eg-core/ontology/core-foundation-v1.ttl` and `company-v1.ttl`), registered data-source mappings and native time-series facts. It returns references/projections from those sources as one logical view. It does not copy or merge source records. Every result is scoped by verified tenant and clearance before retrieval, and every source row retains its source identity/revision. **Definition hold:** Owner review found no exact canonical ontology/mapping ids for organizations, roles, data assets, permissions or time-series facts. The time-series source/revision join key is also unknown. Before complete acceptance, map each category to its existing class/property or registered mapping. Name the time-series key. Do not invent or duplicate terms. Source objective: Company context combines organizations, roles, data assets, permissions and time-series facts in one graph. Agents query it under caller tenant and clearance. Source record `EG:59` SHA-256 `fd5990a7c9f30e1e1aa0eed9aa08efef4e2ebc8f5f34387598f1c9e577c458dc`. Preserve existing obligations: `EG-DURABLE-KERNEL-R043, EG-FEDERATED-QUERY-R078, EG-UNIFIED-DATA-PLANE-R001, EG-UNIFIED-DATA-PLANE-R003, EG-FEDERATED-QUERY-R078.1, EG-FEDERATED-QUERY-R078.2, EG-FEDERATED-QUERY-R078.3, EG-FEDERATED-QUERY-R078.4, EG-FEDERATED-QUERY-R078.5, EG-FEDERATED-QUERY-R078.6`. | With category mappings supplied, serve identical company-context queries as two tenants with differing clearances. Verify the authorized tenant receives each mapped category as source-bound references. Exclude denied rows before any source read and copy no source record. Join native time-series values only by the declared series/time key and snapshot. Missing/ambiguous mapping, unverified tenant, stale source revision or cross-tenant join refuses. Current scope-planning acceptance remains covered by R078.1-.6. This new composed view stays held until mappings are exact.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.7.7
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Vector-free hierarchy mode with zero external model calls.** Add a read-only mode to the existing `HierarchyRetrievalPolicy`/authenticated `UnifiedQuery` section traversal. It accepts requested granularity (`document`, `section`, or `source_span`) and uses only the stored authorized section summaries and source spans already bound by R081.9.7.1-.6. It returns the selected stored summary or exact source span plus the ordered root-to-leaf path. It does not generate or rewrite summaries. In this mode external inference-call budget is exactly zero, vector index and embedding calls are forbidden. And the traversal limits from the existing section-beam policy remain enforced. Wire only at the existing `PlanCtx` section traversal before fusion in `crates/eg-plan/src/exec.rs`, reached through `run_unified_with`. Do not create a second retriever. Refuse requests for generated answer text, missing/stale summaries or spans, invalid trees, or external inference dispatch. Source objective: Retrieval builds hierarchical document trees. It answers at multiple granularities by traversing them without external model calls. Source record `GRAPHOS:24` SHA-256 `b2e5de8386b3ca72b59a81ca5fa3193eaf7736af86aca472a720b9e4511961c0`. Preserve existing obligations: `EG-FEDERATED-QUERY-R081.9.7.1, EG-FEDERATED-QUERY-R081.9.7.2, EG-FEDERATED-QUERY-R081.9.7.3, EG-FEDERATED-QUERY-R081.9.7.4, EG-FEDERATED-QUERY-R081.9.7.5, EG-FEDERATED-QUERY-R081.9.7.6`. | Serve all three granularities over a nested authorized section tree. Compare selected path/span ids with an independent tree oracle. Instrument external model, embedding and vector calls and require zero calls on every positive query. Malformed or stale section records and exhausted depth/visit/token limits refuse before extra dispatch. Tenant isolation and existing community traversal outputs remain unchanged. No runtime proof is claimed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.9.7.8
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Definition hold — offline TOC producer and finite span-read policy are unbound.** Preserve existing space/section mappings. Do not recreate interaction spaces. The requested producer builds an offline line-numbered TOC from an immutable document revision. Each entry binds section id, title/path, inclusive start/end lines and source digest. EG needs a bounded line-span read from the pinned document. It returns exact lines, source digest and line range; it never returns the whole document. The current SDK source-ingest -> EG document/section -> GraphOS retrieval.space -> AU path leaves the TOC producer unresolved. It does not define who builds or refreshes the TOC. Source byte/line encoding and finite line-span/response-byte limits are also undefined. Those owner decisions and their producer/consumer schema are required before this can be executable. Existing directory mappings do not fill the gap. Source objective: Documents in a retrieved space are preprocessed offline into line-numbered TOCs. Agents use them to navigate sub-document spans without reading whole files. Source record `GRAPHOS:25` SHA-256 `6797cff839c16c3b9c3877d6bbf48bf8953eae8696087abc99f2b57147daed93`. Preserve existing obligations: `ARBORA-OPS-R053.1, ARBORA-OPS-R053.2, ARBORA-OPS-R053.3, ARBORA-OPS-R053.6, EG-FEDERATED-QUERY-R081.9.7.1, EG-FEDERATED-QUERY-R081.9.7.5`. | Once the owner supplies TOC generation and versioned positive finite `max_lines` and `max_bytes`, index a multisection fixture offline. Read a bounded middle span and verify exact line numbers and source digest. Refuse stale document/TOC revision, invalid or too-wide range, a response above the bound, and whole-file requests. Verify current GRAPHOS space/section links still resolve. Until producer and caps are named, no served acceptance is claimed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R040.2.7
Source-backed definition disposition
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Source-backed definition disposition.** **Revision-bound per-document topic responsibilities.** Extend the existing `TopicBackend` result and `weighted_topic_dense` score in `run_unified_with` before final truncation. For each eligible candidate, the backend supplies a `DocumentTopicAssignment`. It binds document id/content revision, corpus generation, backend identity/revision and the retriever's `EmbeddingSpaceRef`. Each assignment identifies topic id and that document’s responsibility. Compute each candidate's topic component from its revision-matched responsibilities and the existing centroid similarity formula. Feed it into existing weighted dense/topic fusion. Preserve hard constraints, fusion weight, deterministic ties, tenant scope and all R040.2 refusals. Missing, duplicate, stale or cross-space assignments refuse the requested topic contribution. The planner must not silently fall back to dense-only ranking. GraphOS projects reads and does not rank; ARBORA-FLEET-R014 is unrelated. Source objective: Retrieval uses document topic metadata as semantic guidance to improve ranking and relevance. Source record `GRAPHOS:28` SHA-256 `f7654cd07d4d95f32f09fec742c4172b35c689749b3228aef9424830b1f7cc1b`. Preserve existing obligations: `EG-FEDERATED-QUERY-R040.2.1, EG-FEDERATED-QUERY-R040.2.2, EG-FEDERATED-QUERY-R040.2.3, EG-FEDERATED-QUERY-R040.2.6`. | Serve the same corpus/backend with two candidates whose assignments differ. Independently recompute both topic components and final scores. Change only one candidate’s responsibility vector and prove only the expected candidate contribution/order changes. Refuse missing/duplicate document assignment, stale document or corpus revision, backend mismatch and embedding-space mismatch before truncation. Verify hard exclusions still hold and `run_unified_with` records the assignment/backend revision in the existing topic receipt. No implementation or served receipt is claimed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.8.100
Retriever-bound query strategy and transfer revalidation
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Retriever-bound query strategy and transfer revalidation.** Extend existing retrieval feedback with retriever id/version, strategy id/digest, corpus/model revisions, evaluation-set digest and transfer-validation receipt. A strategy is reusable without new validation only for the same target retriever id/version. Corpus, model and policy revisions must be byte-identical. A target or bound-revision change requires a target-bound validation receipt. It contains target retriever id/version, strategy id/digest, evaluation-set digest and metric id. It also binds measured value, acceptance threshold, pass/fail outcome and corpus/model/policy revisions. Activate only when measured value meets or exceeds the declared threshold. A valid receipt below threshold refuses activation and retains the prior strategy. A different retriever never receives a copied strategy by default. Reuse R081.8 feedback and R082 budgets. Producer/consumer boundary: Authenticated crossmodal -> `eg-plan::exec` R081.8 feedback -> selected retriever. Preserve existing R081.8.1-.6 tiering, feedback and refusal behavior. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R081.8.1-.6; R082`. Source record `AU:77` SHA-256 `213700ec5b9e8648657ec47d0c587483a978db10f4661475b467be451d3bb2e1`. Parent `R081.8` remains unchanged. | Planned served acceptance: Same-retriever feedback reuse succeeds. A retriever-version change requires validation. Failed, stale or missing transfer receipts refuse retrieval. Verify the receipt binds the strategy digest and target retriever. Keep feedback budgets unchanged. Rejected critiques must not change the active strategy. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R053.100
Generated Cypher property keys use grammar-valid backtick quoting and build refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Generated Cypher property keys use grammar-valid backtick quoting and build refusal.** Extend the existing Cypher federation renderer so every generated property key is emitted as a backtick-quoted identifier. Embedded backticks use the Cypher grammar escape representation, and values remain parameters rather than interpolated identifiers. The renderer is shared by every Cypher generation path. The build gate validates generated query fixtures and fails on any property key that is unquoted or malformed. It must not add a second renderer or rely on SQL identifier quoting. Producer/consumer boundary: `ForeignSourceSpec::Cypher` federation renderer -> generated Cypher -> configured build gate. Preserve R053 typed source registration. Cypher Manual naming rules define backtick quoting and doubled backtick representation. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R053; EG-DURABLE-KERNEL-R024.1/.3; EG-FEDERATED-QUERY-R069`. Source record `EG:37` SHA-256 `803f4e4ffbcd939af750e23451469835555beaa37e14ce555ffd0a59c0a3ac48`. Parent `R053` remains unchanged. | Planned served acceptance: Gate fixtures cover plain, reserved, spaced, Unicode and embedded-backtick identifiers. They also include an intentionally unescaped generated key. Parse/execute safe cases against the Cypher grammar and assert build refusal for unescaped/malformed output. The existing ForeignSourceSpec capability matrix and Spark batch-only constraint remain unchanged. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R032.100
Layer- and history-weighted impact traverses both dependency directions
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Layer- and history-weighted impact traverses both dependency directions.** Extend the existing authenticated R032 `PROPAGATE` result with a separate historical-risk dimension. Bind target node/revision, direction and bounded HOPS. Also bind ordered layer taxonomy/weights, authorized failure-dataset id/revision/window/digest, observation counts, policy revision and request digest. For each node with observations compute `failure_rate = failures / observations` and `layer_contribution = layer_weight * failure_rate`, with weights and rates in [0,1]. For a path, compute `path_risk = 1 - product(1 - layer_contribution)` over its unique nodes. Aggregate duplicate paths to a node by maximum path risk. list upstream and downstream path sets separately. Suppress repeated-node cycles within a path and order ties by hop count, node id and path-edge ids. Return per-node path, layer contribution, counts, coverage state and risk. Missing per-node history yields `unknown` and a partial result with `aggregate_risk = null`. An unavailable or unauthorized dataset refuses. The new score is an additional dimension and cannot replace or alter R032 Noisy-OR or Independent-Cascade results. Producer/consumer boundary: EG owns graph impact query/risk decision; AU requests and consumes the result. Existing numeric risk helpers are not this two-direction historical impact contract. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R032 existing Noisy-OR and Independent-Cascade obligations`. Source record `AU:43` SHA-256 `327ced0e0605f34366c662017d82ac892a481c5ca5f40bba2f3693ba6a5f7649`. Parent `R032` remains unchanged. | Planned served acceptance: Graph fixtures cover ancestors and descendants across three layers. Include differing historical failure counts, a cycle boundary and missing-history data. Verify both directions and deterministic layer/history contribution. Refuse stale or malformed history, and compare existing R032 propagation outputs unchanged. Owner-source review only. No runtime/test receipt is inferred.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R086
Inductive n-ary hypothesis-only link prediction (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Inductive n-ary hypothesis-only link prediction (rollup).** Defines ordered n-ary inference that returns unasserted hypotheses. It does not mutate graph facts or replace observed-edge query/write contracts. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R086.100
Ordered n-ary inductive link prediction emits hypotheses only
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Ordered n-ary inductive link prediction emits hypotheses only.** **Definition hold — current graph learner is binary and has a write path.** The source requires ordered n-ary hyperedge prediction and generalization to unseen-at-fit entities. Hypotheses carry an evidence class and are never asserted facts. Current `Method::GraphLearnPredict`/`src/server/handlers/graphlearn.rs` scores binary `(src,dst)` pairs over a resident graph and optionally writes `PredictedEdge`. It cannot satisfy ordered n-ary tuples, unseen-entity induction, or hypothesis-only guarantees. Preserve it unchanged. Before defining a public producer, the owner must choose the n-ary model/training artifact. The owner must also define ordered-tuple inference semantics for unseen entities. Define the evidence-class vocabulary and source binding. Choose the read-only capability/auth action. And name the AU proposal consumer receipt. Only then can a separate method be attached in the existing graphlearn method family and routed through `src/server/handlers/graph_ops/gateway_mining_ml.rs`/`src/server/handlers/graphlearn.rs`. Do not route this through the binary `GraphLearnPredict` write-capable method. No model, endpoint, or authority is invented here. Source record `EG:14` SHA-256 `7223250e7f899a187aad0b152e597c6174b772c49779ca2bdd12d3ba68f4f5ef`. Preserve existing obligations: EG-FEDERATED-QUERY-R086, binary GraphLearnPredict behavior, and its graph-write authority. | Acceptance is blocked until model, evidence-class, authorization and AU receipt decisions are published. A served ordered three-source fixture includes an unseen-at-fit entity. Return candidates with tuple order, graph/model/policy revisions and evidence class. Leave graph revision unchanged. Changing source order must change request digest. Refuse unary tuples, unresolved/unauthorized sources, stale revisions and malformed relation constraints. Confirm `GraphLearnPredict` binary results and write authority are unchanged. No producer test is currently defined as runnable.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.101
Reusable compressed document state with decoding-free reranking
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Reusable compressed document state with decoding-free reranking.** Build a document-only state keyed by document id/content digest, encoder revision and compression-policy revision. Store ordered segment boundaries, compressed token representations and the key/value projections required by the scorer. The state must not depend on candidate order or query context. At query time, score queries against stored projections without decoding/generation. Return document digest, state revision, segment policy, score and scorer revision. Measure interaction cost against the declared full-token baseline using the same document/query set and report denominator and result digest. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R081`. Source record `AU:126` SHA-256 `deca151180a749cb3784d9946da0de17205eca89c92e5eb4f275859e1d4be165`. | Build state once, then rerank under two query contexts and reversed candidate order. Assert the state digest stays identical and per-document scores remain aligned. Assert no decoder/model-generation call. Compare measured interaction cost with the same full-token baseline. Refuse stale document/encoder revisions, malformed segment coverage or any query-time state rewrite.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.102
Index-time teacher distillation with measured quality and zero query model calls
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Index-time teacher distillation with measured quality and zero query model calls.** Persist an index-time distilled scorer with corpus/index revision, teacher model revision and teacher-judgment dataset digest. Bind scorer artifact digest and quality metric/threshold policy. The scorer is eligible for query use only when its measured quality reaches the declared held-out target-set threshold. Query-time retrieval applies the stored scorer without any model-service call. It never distills or repairs the scorer on demand. A below-threshold, stale or unbound artifact refuses activation and leaves the prior scorer active. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R081`. Source record `GRAPHOS:27` SHA-256 `baac22c9fb42470957b5b91499c6e42e1bb2410d24446d15f6f364638c88138e`. | Distill and read back an artifact meeting held-out quality threshold. Serve queries and assert zero model-service calls plus scorer-digest binding. Below-threshold, missing held-out evidence, stale corpus/index or teacher revision all refuse activation. Verify the prior scorer remains active.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.100
Joint sparse nonnegative reconstruction selects a diverse document set
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Joint sparse nonnegative reconstruction selects a diverse document set.** Given query vector q and candidate matrix V, select a joint coefficient vector x by minimizing `||q - Vᵀx||₂² + λ||x||₁`. V rows are revision-pinned embeddings in the same declared embedding space. Require xᵢ >= 0 and existing result-count/tenant bounds. λ, solver version, convergence tolerance, embedding-space revision and input digest are bound to the request. Return selected document ids, nonnegative coefficients, reconstruction residual, solver status and policy revision in deterministic coefficient-descending then document-id order. Do not substitute independent dense/lexical dual-score ranking. Preserve the distinct R081.7 mechanism. Refuse mismatched embedding revisions, invalid λ, solver non-convergence or a result set that exceeds existing bounds. Producer/consumer boundary: EG retrieval selection owns the joint objective and set result. The existing served UnifiedQuery/retrieval path consumes it. Preserve R081.1-.9 selection and tenant bounds. No new caller-controlled score authority. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R081`. Source record `EG:41` SHA-256 `bceeed106b5db2933cf5161d58b4203fc7afe9d714503a31d68323992906c23b`. Parent `R081` remains unchanged. | Planned served acceptance: Compare served retrieval on a tiny fixture with an independent exhaustive nonnegative-sparse oracle. Include two highly correlated documents and an alternative diverse pair. Assert exact selection, coefficients, residual and deterministic order. Refuse embedding-space mismatch, invalid policy and non-convergence. Verify existing tenant and result-count filters still apply. No implementation or receipt is claimed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R081.103
Viewport-bounded scatter and line queries over billion-point indexed sources
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Viewport-bounded scatter and line queries over billion-point indexed sources.** Add a closed `ViewportQueryV1` plan variant to existing authenticated `Method::UnifiedQuery`/`run_unified_with` and public `Method::ResolveViewportSelection` (`ResolveViewportSelectionV1`) operation. Request binds tenant authority, indexed source id/revision/cardinality, `scatter or line` variant and typed axes/units. It also binds filter digest, viewport domain, `pixel_width` and `pixel_height` (each 1..4096), binning-policy revision and required byte ceiling (1..16777216). For v1, the effective encoded response ceiling is `min(requested_byte_ceiling, formula_cap)`. Invalid or too-small ceilings that cannot contain the mandatory response envelope refuse with `BYTE_CEILING_TOO_SMALL` before scanning. Results are never silently truncated. Scatter cap is `min(pixel_width * pixel_height, 262144)` bins. Line cap is `min(4 * pixel_width, 65536)` bins. Both are positive integer formulas independent of source cardinality. Encoded response cap is `min(16777216, 65536 + 96 * max_bin_count)` bytes, measured after wire serialization. Scatter bins return stable id, count and axis extrema. Line bins return first/last/min/max/count and an explicit continuity/gap flag. Results bind source revision, viewport, policy revision, full-source cardinality and query digest. No path may transfer the full source. Selection tokens form a closed union. `ExactPoint` binds one authorized point id/revision. `AggregateBin` binds one bin id plus source/index/viewport revisions. It cannot expand into unbounded raw points. Refuse absent/outdated spatial index, stale source revision, invalid viewport, unauthorized source/selection and exceeded caps. Never silently drop bins. Consumer: GraphOS typed query adapter and `WEBUI-APPS-R001.2` chart renderer. Source objective WEBUI:7: The interface renders interactive scatter/line charts with pan, zoom and selection for billion-point datasets. Screen-bounded binning keeps payloads bounded. Source record SHA-256 `483b80b268ba6924ced162740792071fb43f482b1cddf16d9fbd424727d4ed89`. | On a real indexed source with at least 1,000,000,000 points, serve scatter and line queries at three viewport sizes. Verify versioned formulas, encoded byte cap, exact source revision, continuity and no full-source transfer. Pan/zoom changes the query digest and bins. Exact and aggregate selection tokens resolve only within their pinned revisions. Stale index, denied selection, invalid/exceeded caps and absent source refuse. No runtime or owner receipt is claimed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R087
Native visualization static export (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Native visualization static export (rollup).** The engine renders a validated view specification to PNG, SVG or PDF bytes through the served visualization method. Export is an engine capability, not a connector capability. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R087.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** The export contract is the `StaticExportBackend` trait at `crates/eg-viz-core/src/traits.rs:115`. Its `export` method takes a view specification, a resolved result and a format. The formats are `StaticExportFormat` at `crates/eg-viz-core/src/traits.rs:106`: PNG, SVG and PDF. The wire mirror is `VizFormat` at `crates/eg-types/src/viz.rs:73`, with the same three snake-case values. The code has no HTML export. Surface `StaticExport` at `crates/eg-viz-core/src/capability.rs:33` names this capability. The engine must not add HTML without a new requirement. | A served-path test observes this behavior.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R087.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** A render request carries a view specification, a dataset reference, canvas pixels, a primitive ceiling and a byte ceiling. The handler at `src/server/handlers/viz.rs:116` must validate the specification and clamp the canvas to 16..8192 pixels. It must resolve the specification against the dataset under the frame budget. It must export through `ColumnStoreExportBackend` at `crates/eg-viz-export/src/backend.rs:84`. It must return bytes, a content type, a result reference and a cached flag. The same inputs must give a cache hit. | A served-path test observes this behavior.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R087.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The served wire method is `Method::Viz` with `VizOp::Render`. Dispatch routes it at `src/server/dispatch/router/control_plane.rs:654` to `handle` at `src/server/handlers/viz.rs:104`. The export call sits at `src/server/handlers/viz.rs:366`. Feature `viz-static-export` at `Cargo.toml:486` gates the route, and the default `full` feature set includes it. The Python `VizClient` at `epistemic_graph/client.py:3165` wraps the method. No production caller beyond that client was found in this repository today. | A served-path test observes this behavior.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R087.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** The handler must refuse, never return an empty image. An unparseable or invalid specification refuses with a typed message from `src/server/handlers/viz.rs:310`. An empty dataset reference refuses with `ACCESS_DENIED`. An unknown dataset reference refuses with `ENGINE_UNAVAILABLE` at `src/server/handlers/viz.rs:328`. A result reference outside the verified owner scope refuses with `ACCESS_DENIED`. A resolve or export failure must surface as an error response. | A served-path test observes this behavior.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R087.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Tests at `tests/viz_dispatch.rs` drive the dispatch path and assert valid PNG bytes. The test at line 341 asserts the unavailable-dataset refusal. The test at line 304 asserts the invalid-specification refusal. The test at line 448 asserts the repeat-render cache hit. SVG and PDF output have no served-path test at present. Verification must add one for each before this child is VERIFIED. | A served-path test observes this behavior.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R087.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Method::Viz` wire method with `VizOp::Render`. A test must request each of PNG, SVG and PDF through `dispatch`. It must observe the returned content type and a non-empty body for each format. It must also observe the refusal for an unknown dataset reference. Today only the PNG path has such a test, in `tests/viz_dispatch.rs`. | A served-path test observes this behavior.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.4
Natural-language planning context, dialect choice and bounded steps (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Natural-language planning context, dialect choice and bounded steps (rollup).** The engine must build the schema context, choose the dialect and run a bounded correction loop for a natural-language request. Each step runs as disclosed read-only text under `EG-FEDERATED-QUERY-R058`. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.4.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `SchemaContext{labels, tables, properties, digest}` and `NlPlanStep{dialect, query_text, outcome}` in `crates/eg-plan/src/nl/context.rs`. Extend `Method::NlQuery` at `crates/eg-types/src/protocol/method/method_05.rs:394` with `dialect` and `max_steps`. Closed `dialect` values are `auto`, `uql`, `sql`, `sparql` and `cypher`. `max_steps` ranges from 1 to 4. Proving test: `context.rs::tests::context_round_trips`. | A serde round trip keeps every field and rejects `max_steps = 5`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.4.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Schema linking scores labels and tables by token overlap with the request. It keeps at most 60 labels, 60 tables and 16 properties per label. Choice `auto` selects UQL, except for relational-only or RDF-only linked schemas. A parse or execution error returns to the planner as a typed message. The loop stops at `max_steps`. | Unit tests cover linking, each dialect choice and one corrected step.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.4.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The loop attaches in `handle_nl_query_plan` at `src/server/handlers/query/nl.rs:48`. The schema comes from the in-process graph schema read. The planner is the configured `NlPlanner` port. Each step runs through the read-only pipelines of `EG-FEDERATED-QUERY-R058`. | A dispatch test observes one schema read per request.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.4.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** An exhausted step budget must return `NL_QUERY_STEPS_EXHAUSTED` with every step's text. A missing planner must return `NL_PLANNER_UNCONFIGURED`. The generated error contract must declare both codes. A mutation-shaped candidate keeps the `EG-FEDERATED-QUERY-R058` refusal. | Each case returns its code and no rows.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.4.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The result must carry every step's dialect, text and typed outcome. It must carry the schema context digest and the planner id and revision. | A test reads the step list and the digest.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.4.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `NlQuery` method. The test `tests/nl_query_bounded_steps.rs::second_step_corrects_parse_error` uses a scripted planner that returns invalid text, then valid text. The result must show two steps and rows equal to the direct `Uql` call. Engine overhead must stay under 10 ms at p99 per step, excluding planner latency. | The served test passes, and the measured overhead meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R058.5
Configurable NL planner request
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Configurable NL planner request.** The standalone planner reads a read timeout and an extra request body. They come from the same configuration as the endpoint and model. The `nl_query` or `llm` config section holds `read_timeout_secs` (default 30, accepted 1 to 600). It also holds `extra_body`, a JSON object that the planner merges into the request top level. The default `extra_body` is `{"chat_template_kwargs":{"enable_thinking":false}}`, so a reasoning model answers directly. The env keys `EPISTEMIC_GRAPH_NL_READ_TIMEOUT_SECS` and `EPISTEMIC_GRAPH_NL_EXTRA_BODY` (JSON) override the file. A configured `extra_body` replaces the default and cannot set `model` or `messages`. The planner refuses invalid values with the typed `NlConfigError` (`ReadTimeoutOutOfRange`, `ExtraBodyNotObject`, `ExtraBodyReservedKey`, `InvalidValue`). `Method::NlQuery` then refuses with the `ENGINE_UNAVAILABLE` code and a detail that names the bad key. | Tests against a local stub HTTP server confirm the default and a configured extra body reach the request body. They also confirm a peer slower than the configured read timeout fails within bounds. Refusal tests confirm each `NlConfigError` variant. A config test confirms the keys parse and invalid values are refused. An unparseable env or config value is refused with `InvalidValue`, which carries the source name and the raw text. A handler test confirms the served refusal carries the code and names the key.
requirementEG-FEDERATED-QUERYVERIFIED545288fec504
8d0681dc8250
f555f9a29661
crates/eg-plan/src/nl_regressions.rs:278
crates/eg-plan/src/nl_regressions.rs:290
crates/eg-plan/src/nl_regressions.rs:319
src/server/handlers/query/nl.rs:253
src/server/nl.rs:450
EG-FEDERATED-QUERY-R088
UQL text rows carry governance and an epistemic summary (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**UQL text rows carry governance and an epistemic summary (rollup).** The served `Uql` method must apply owner and scope visibility before rows leave the engine. On request it must attach an epistemic summary to each row from the same snapshot. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R088.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `include_epistemic: bool` to `Method::Uql` at `crates/eg-types/src/protocol/method/method_05.rs:112`. Add `UqlRowSummary{status, confidence_q16, evidence_count, revision}` to `UqlResult`. A request without the flag returns the existing row shape. Proving test: `crates/eg-types/src/wire.rs::tests::uql_summary_round_trips`. | A serde round trip keeps every field and the default row shape.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R088.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Visibility through `row_visibility` runs before `LIMIT` and ranking trims. Summaries resolve in one batch from the same snapshot. Cost is O(r) in returned rows. | A unit test shows that hidden rows do not displace visible rows.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R088.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The attach point is `handle_uql` at `src/server/handlers/query/uql_statement.rs:17`. It reuses the provenance-by-ids resolver in process. It makes no second wire call. | A dispatch test observes one snapshot for rows and summaries.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R088.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A build without the epistemic feature must return `METHOD_NOT_YET_SERVED` for `include_epistemic`. Existing parameter refusals stay unchanged. | The test asserts the code and no partial rows.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R088.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The result header must carry snapshot revision, hidden row count and summary revision. | A test reads the header fields.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R088.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Uql` method. The test `tests/uql_governed_summary.rs::governed_rows_carry_summary` uses two principals. Hidden rows must be absent. The row order must match a request without the flag. Summaries must add under 2 ms at p99 for 100 rows. | The served test passes, and the measured cost meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R089
Discover returns a retrieval-quality verdict (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Discover returns a retrieval-quality verdict (rollup).** The served `Discover` method must return a fail-closed retrieval-quality verdict with its rows. The harness applies the received verdict and computes none. Children `.1` to `.7` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R089.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Extend `Method::Discover` at `crates/eg-types/src/protocol/method/method_03.rs:362` with an optional quality policy reference. Add `RetrievalVerdict{gate_passed, failure_modes, composite_quality_q16, index_population_ratio_q16, above_threshold, total_candidates, policy_revision}`. Closed failure modes are `drift`, `context_truncation`, `stale_index`, `low_relevance_topk` and `sparse_index`. Proving test: `crates/eg-types/src/wire.rs::tests::verdict_round_trips`. | A serde round trip keeps every field and rejects an unknown failure mode.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R089.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The verdict uses the scores that `Discover` already computes. The population ratio divides embedded nodes by candidate-type nodes from semantic store counters. `stale_index` fires when the index generation trails the graph write watermark. A keyword-only result sets `sparse_index`. Cost is O(k). | Unit tests cover each failure mode.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R089.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The attach point is `discover` at `src/server/handlers/graph_ops/semantic.rs:88`. Its caller is the `Discover` arm at `semantic.rs:297`. The policy thresholds come from a policy node. The defaults are a minimum composite quality of 0.3 and a population ratio of 0.5. | A dispatch test reads the policy node and returns the verdict.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R089.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** An unknown policy reference must return `INVALID_ARGUMENT`. A failed verdict is not a refusal. It must return `gate_passed = false` with the rows. | Tests assert the code and a failed verdict with rows.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R089.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The verdict must carry the policy revision, the index generation and the thresholds used. | A test reads the three fields.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R089.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Discover` method. The test `tests/discover_quality_verdict.rs::sparse_index_fails_closed` embeds 10% of a fixture graph. It must observe `gate_passed = false` with `sparse_index`. A fully embedded fixture must pass. The verdict must add under 50 µs at p99. | The served test passes, and the measured cost meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R089.7
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The `drift` failure mode fires when a drift signal of `EG-DECISION-ENGINE-R174.8` is firing for a candidate shard. Add `adapter_digest: Option<String>` and `shard_generations` to `RetrievalVerdict`. A verdict with no active adapter names `base`. Proving test: `crates/eg-plan/src/retrieval_verdict.rs::tests::drift_mode_reads_monitor_and_names_adapter`. | A firing signal sets `drift`, and the verdict names the adapter digest and each shard generation.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R090
Discover plans expansions, recency and multi-hop context (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Discover plans expansions, recency and multi-hop context (rollup).** The served `Discover` method must plan query expansions, apply recency decay as of a date and expand multi-hop context. The harness passes query text and an embedding only. Children `.1` to `.7` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R090.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Extend `Method::Discover` at `crates/eg-types/src/protocol/method/method_03.rs:362` with `query_text`, `mode`, `as_of` and `hops`. Closed `mode` values are `standard` and `deep`. `hops` ranges from 0 to 2. Add per-row `arm_ranks`, `recency_boost` and `hop_path` to the result. Proving test: `crates/eg-types/src/wire.rs::tests::discover_plan_round_trips`. | A serde round trip keeps every field and rejects `hops = 3`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R090.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Mode `deep` asks the planner port for at most 4 hypothetical passages and sub-queries. The embedding endpoint embeds them. Arms fuse by reciprocal rank with `k = 60`. Recency boost is at least 1.0 and decays from `as_of` by the pack's per-type spec. A node without a date gets 1.0. Hop expansion keeps at most 32 neighbors per hop. Retrieved rows that score below the cutoff feed hard-negative mining. | Unit tests cover fusion, decay, the neutral date and the frontier cap.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R090.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The attach point is `discover` at `src/server/handlers/graph_ops/semantic.rs:88`. The planner port is the one `EG-FEDERATED-QUERY-R058.4` uses. The embedding endpoint is the one `EG-DECISION-ENGINE-R174` uses. Neighbor reads use the batched adjacency path. | A dispatch test observes one planner call and batched neighbor reads.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R090.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Mode `deep` without a configured planner must return `DISCOVER_PLANNER_UNCONFIGURED`. An unparsable `as_of` must return `INVALID_ARGUMENT`. The generated error contract must declare the new code. | Each case returns its code and no rows.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R090.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The result must list each expansion digest, the per-arm ranks, the recency boost and the hop path of each row. | A test reads each field.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R090.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `Discover` method. The test `tests/discover_planning_served.rs::deep_recency_multihop` uses `deep`, `as_of` and `hops = 2`. It must observe a two-hop neighbor and recency order in the fused rows. The benchmark `benches/discover_planning.rs` must show p99 under 15 ms in `standard` mode at 1,000,000 vectors. It must show engine overhead under 40 ms in `deep` mode, excluding model latency. | The served test passes, and the benchmark receipt meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R091
Virtual-query plans evolve by measured improvement (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Virtual-query plans evolve by measured improvement (rollup).** The engine records each virtual-query execution. In downtime windows it tries better plans for frequent question shapes. It keeps a plan only on a measured gain and reverts otherwise. Candidate kinds are a rewrite, a pushdown choice, a cached sub-graph, a pre-materialized hot sub-graph and an index suggestion. Materialization reuses the acceleration policy of `EG-UNIFIED-DATA-PLANE-R038`. The downtime scheduler is `EG-DURABLE-KERNEL-R101`. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R091.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `PlanObservation{shape_digest, plan_digest, sources, pushdowns, latency_us, rows_fetched, bytes_fetched, cache_hit, graph_revision}` and `PlanCandidate{shape_digest, kind, plan_digest, baseline_digest}` in `crates/eg-plan/src/federation_opt/plan_evolution.rs`. Closed `kind` values are `rewrite`, `pushdown_choice`, `cache_subgraph`, `materialize_subgraph` and `index_suggestion`. The store keeps 4,096 observations per shape and 1,024 shapes per tenant. It evicts the least recently seen shape, as `stats.rs:77` does. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::observation_store_bounds`. | A serde round trip keeps every field and rejects an unknown kind; the store evicts at its bound.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R091.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** A downtime job replays the 32 most frequent shapes against the baseline and one candidate. The named default `keep_on_measured_gain` keeps a candidate under three conditions. The p50 latency or bytes fetched must improve by 10% or more. The test needs 20 or more replays. The result multiset must equal the baseline. Otherwise the job reverts the candidate. A kept plan re-validates when source statistics drift by more than 25%. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::keep_or_revert_by_measurement`. | A faster equal candidate is kept, and a slower or unequal candidate is reverted.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R091.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Recording attaches at `record` in `crates/eg-plan/src/federation_opt/run.rs:102`. `foreign_scan` at `run.rs:26` reads the kept plan by shape digest. The evaluation runs as an `eg-jobs` job of the downtime job type `plan_evolution`. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::served_path_records_and_reads`. | A served query records one observation, and a later query uses the kept plan.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R091.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A candidate with a different result must revert with `PLAN_RESULT_MISMATCH`. An exhausted budget must stop with `DOWNTIME_BUDGET_EXHAUSTED` and keep the baseline. A materialization that `validate_policy` (`crates/eg-types/src/metadata_acceleration.rs:91`) refuses must not run. An index suggestion for a source index must record a suggestion fact and change no source. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::evolution_refusals`. | Each case returns its code, and the active plan stays the baseline.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R091.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** `PlanEvolutionReceipt` must carry shape digest, baseline digest, candidate digest and replay count. It must also carry p50 and bytes before and after, the decision and the reason. EXPLAIN must name the kept plan digest and its receipt. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::receipt_names_measurements`. | A served read finds the receipt linked to the shape.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R091.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served SPARQL method over two connectors. The test runs one shape 50 times and opens a downtime window. A later served query must use the kept plan. A second, unequal candidate must revert. Recording overhead must stay under 20 microseconds per execution. Proving test: `tests/federation/test_plan_evolution_served.py::test_kept_plan_measurably_faster_and_mismatch_reverts`. | The kept plan improves p50 by 10% or more, the unequal candidate reverts, and the overhead meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R090.7
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Mode `deep` passes each expansion embedding through the scoped adapter of `EG-DECISION-ENGINE-R174.7` before arm fusion. A row from a freshness refresh of `EG-DECISION-ENGINE-R174.9` lists its source, retrieval time and query digest in the row evidence. Proving test: `tests/discover_planning_served.rs::deep_arms_use_scoped_adapter`. | A dispatch test observes one adapter application per arm and the refresh provenance on a fresh row.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R607
Topology analytics find communities, analogies and cross-domain synergy (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Topology analytics find communities, analogies and cross-domain synergy (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R607.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** `crates/eg-analytics/src/topology.rs` defines CommunityResult, MincutPartition, SpectralCluster, AnalogyMatch, SynergyBridge, PositionalEncoding. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R607.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Spectral clustering and mincut partitioning return stable community ids across runs. Analogy search matches structurally similar subgraphs across domains. Synergy ranks concept bridges and pillar couplings from shared types and edge patterns. Positional interaction encodings support inductive scoring on unseen hyperedges. | Unit tests cover each rule with positive and boundary cases.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R607.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Exposed as engine analytics methods reachable through the federated query surface; reuses EG-REPO-INGEST-R011 for Leiden. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R607.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A request whose graph exceeds the payload bound of EG-PLACEMENT-R003 is refused with the bound. The stable code is `ANALYTICS_PAYLOAD_BOUND`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R607.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Per call: modularity, partition cut, match scores. | Test reads the trace or metrics after one success and one refusal.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R607.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** spectral clustering of 100k nodes: p50 under 4 s, p99 under 10 s; analogy match on 10k-edge subgraphs under 800 ms. The benchmark is `benches/r607_federated_query_and_reasoning.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R608
Rule inference, causal verification and paradigm routing run in the engine (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Rule inference, causal verification and paradigm routing run in the engine (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R608.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** `crates/eg-reasoning/src/rules.rs` defines InferenceRule, DerivedFact, CausalEdge, ParadigmRouter, OpsCausalLink. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R608.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Inference rules derive new facts to a fixpoint with provenance. Subsumption follows the ontology. Causal verification checks a structural causal model against observed data. A router picks a reasoning paradigm per task from capability tags and learns from outcomes. Operational entities (traces, services, changes, incidents) join into one causal chain with links carrying evidence. | Unit tests cover each rule with positive and boundary cases.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R608.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Reached through the reasoning methods of EG-FEDERATED-QUERY and the decision ladder of EG-DECISION-ENGINE-R001. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R608.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A rule set that does not converge within the step bound stops and returns the partial derivation flagged incomplete. The stable code is `RULE_FIXPOINT_BOUND`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R608.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Per run: rules fired, facts derived, steps, causal verdict. | Test reads the trace or metrics after one success and one refusal.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R608.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** fixpoint over 1M facts and 200 rules: p50 under 2 s, p99 under 6 s. The benchmark is `benches/r608_federated_query_and_reasoning.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R650
Context bundle compilation under a certified token budget (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Context bundle compilation under a certified token budget (rollup).** Given a ranked candidate set and a token budget, EG compiles one context bundle. The bundle holds items at the resolution that maximizes value inside the budget. Each item has a citation and proof edges. The bundle has a stable cache key. EG also owns the score fusion, cut-off and per-source budget rules that shape the candidate set. The Rust home is `crates/eg-plan/src/context_bundle.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R650.1`-`EG-FEDERATED-QUERY-R650.6` are satisfied. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R650.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `ContextBundleRequest`, `ContextItem{resolution,tokens,value}`, `Citation`, `ProofEdge`, `BundleKey` (BLAKE3 of tenant, request, graph revision, policy digest), `KnapsackCertificate{bound,gap}` in `crates/eg-plan/src/context_bundle.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R650.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Solve the multi-resolution 0-1 knapsack by dynamic programming over quantized token cost (O(n*B/q)). Fall back to a greedy density order only when the certificate reports a gap under the configured tolerance. Fuse per-source scores by reciprocal-rank and calibrated-score rules. Cut the tail at the largest score gap. Reject nothing silently. Every excluded item carries a reason. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R650.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Attach after retrieval fusion in `crates/eg-plan/src/exec.rs`. Expose it as the served `ContextCompile` method in `contract/methods.json`. The AU harness only submits the request and renders the returned bundle. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R650.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A request without a token budget returns a typed refusal. So does a request with a negative item cost or one over the tenant's visibility scope. A bundle never contains a row the caller cannot read. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R650.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record input scores and normalization. Record selected and excluded item IDs with reasons. Record resolution per item, budget used, certificate bound and cache-key inputs. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R650.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Benchmark `context_bundle_compile` (256 candidates, 8k-token budget): p50 2 ms, p99 12 ms, peak memory 16 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan context_bundle_compile` against the stored baseline.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R651
Query understanding, expansion and stopping (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Query understanding, expansion and stopping (rollup).** EG analyses a query into filters and a relational intent. It plans hypothetical-document and iterative expansion rounds with relevance feedback. It reconstructs evidence by bounded neighbour walks and runs executable retrieval plans. It stops when the answer repeats or the gain falls below a threshold. The Rust home is `crates/eg-plan/src/query_understanding.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R651.1`-`EG-FEDERATED-QUERY-R651.6` are satisfied. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R651.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `QueryFilters`, `RelationalIntent{subject,relation,object}`, `ExpansionRound{terms,feedback_ids}`, `ReconstructionStep`, `RetrievalProgram{ops}`, `StopDecision{reason,round}` in `crates/eg-plan/src/query_understanding.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R651.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Parse filters and relational intent without a model call. Expand terms with relevance feedback in at most the configured number of rounds. Walk neighbours breadth-first to a hop and node cap (O(V+E) in the visited subgraph). Execute a linear or branching retrieval program over the existing plan operators. Stop when two consecutive normalized answers match. Also stop when marginal gain is under the threshold. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R651.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Planner entry in `crates/eg-plan/src/nl.rs` feeding `Discover`; the model-backed hypothetical-document step is a pluggable `ExpansionProvider` whose output is data, never a decision. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R651.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** EG refuses unbounded hop, round or program-length requests with a stable code. It refuses a program step that names an unknown operator before execution. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R651.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record each round's terms, feedback IDs, visited nodes, program trace and the stop reason. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R651.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Benchmark `query_understanding_plan` (typical 20-token query, 3 rounds): p50 300 us, p99 2 ms, peak memory 4 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan query_understanding_plan` against the stored baseline.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R652
Reranking and learned retrieval signals (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Reranking and learned retrieval signals (rollup).** EG reranks candidates with a cross-encoder or reasoning-aware scorer. It calibrates raw scores to probabilities and routes hierarchical and spectral topology signals. It encodes temporal semantic identifiers. It produces recommender-style candidates from text-to-identifier bridges. The Rust home is `crates/eg-plan/src/rerank.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R652.1`-`EG-FEDERATED-QUERY-R652.6` are satisfied. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R652.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `RerankScorer` trait, `CalibrationCurve`, `TopologyRoute`, `TemporalSemanticId`, `SidBridge` in `crates/eg-plan/src/rerank.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R652.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Score the top-k only (k bounded). Calibrate with isotonic fitting stored per scorer version. Run the scorer through the `eg-tensor` kernels. Fall back to the lexical scorer when the model scorer is unavailable, and say so in the receipt. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R652.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Operator before terminal fusion in `crates/eg-plan/src/exec.rs` beside the hierarchy operator of `EG-FEDERATED-QUERY-R081.9`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R652.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A scorer whose version differs from the pinned calibration is refused rather than mixed. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R652.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record scorer ID and version, calibration digest, input and output ranks and any fallback. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R652.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Benchmark `rerank_top64` (64 candidates, 256-token passages, CPU): p50 6 ms, p99 25 ms, peak memory 64 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan rerank_top64` against the stored baseline.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R653
Document, corpus, memory and entity retrieval (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Document, corpus, memory and entity retrieval (rollup).** EG retrieves by document section tree and by direct grep over a corpus. It also retrieves by community-level local and global search, by session history, by memory tier and by entity neighbourhood. It resolves the lineage of any answer back to its sources. The Rust home is `crates/eg-plan/src/corpus_retrieval.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R653.1`-`EG-FEDERATED-QUERY-R653.6` are satisfied. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R653.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `SectionMatch{path,span}`, `GrepMatch`, `CommunityReport`, `SessionHit`, `EntityContext`, `LineagePath` in `crates/eg-plan/src/corpus_retrieval.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R653.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Rank sections on the section tree top-down with pruning. Scan the corpus with a bounded regular-expression engine. Answer global questions from precomputed community reports. Answer local questions from the entity neighbourhood. Resolve lineage by a bounded provenance walk. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R653.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Served `Discover` sub-operators in `crates/eg-plan/src/exec.rs`; community reports come from the `eg-core` community phase. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R653.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** EG refuses regular expressions past the complexity cap, lineage walks past the depth cap and scopes the caller cannot read. Each refusal has a stable code. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R653.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record visited sections, matches, community IDs, lineage hops and the visibility filter applied. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R653.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Benchmark `corpus_retrieval_mixed` (10k sections, 1M-token corpus): p50 4 ms, p99 20 ms, peak memory 32 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan corpus_retrieval_mixed` against the stored baseline.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R653.7
Web Document citations
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Web Document citations.** A hybrid hit on a web Document must cite its source URL, retrieval time, content digest, backend and originating query. Retrieval fuses vector, graph and keyword scores through `fuse_rrf` at `crates/eg-plan/src/exec.rs:848`. The citation reuses `Citation` of `EG-FEDERATED-QUERY-R650.1`. Proving test: `tests/retrieval/test_web_citation_served.py::test_hybrid_hit_cites_source_url`. | A served `Discover` returns a fused hit whose citation names the URL, the retrieval time and the query.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R654
Code, operations and deployment context (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Code, operations and deployment context (rollup).** EG answers how, usage and impact questions over the resolved code graph. It computes code-scoped hubs, communities and surprising connections. It diagnoses operations, deployment and symptom queries from causal hub types. The Rust home is `crates/eg-plan/src/code_context.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R654.1`-`EG-FEDERATED-QUERY-R654.6` are satisfied. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R654.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `CodeContextAnswer{anchors,usages,impact}`, `CodeMetrics`, `OpsCausalStage`, `SymptomDiagnosis` in `crates/eg-plan/src/code_context.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R654.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Resolve anchors by symbol index. Expand callers and callees to a bounded depth across repositories. Rank hubs by centrality on the code subgraph. Map operations nodes to causal stages for diagnosis. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R654.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Served `CodeContext` and `Diagnose` methods built on the repository index of `EG-REPO-INGEST`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R654.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** An ambiguous anchor returns the candidate list rather than a guess; a degraded engine read returns a typed degraded answer. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R654.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record anchors, hop counts, centrality inputs and causal stage per node. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R654.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Benchmark `code_context_impact` (1M-symbol graph, depth 3): p50 3 ms, p99 15 ms, peak memory 24 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan code_context_impact` against the stored baseline.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R655
Retrieval quality gates and evaluation corpora (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Retrieval quality gates and evaluation corpora (rollup).** EG gates retrieval on measured quality. The gate covers failure modes, context provenance, Bayesian trust and evaluation corpora. It also covers intent-selection accuracy, structured-retrieval adoption decisions, embedding versions and the governance rules applied to results. The Rust home is `crates/eg-plan/src/retrieval_quality.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R655.1`-`EG-FEDERATED-QUERY-R655.6` are satisfied. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R655.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `RetrievalFailureMode`, `QualityReport`, `EvaluationCorpus`, `AccuracyReport`, `EmbeddingVersion`, `AdoptionDecision` in `crates/eg-plan/src/retrieval_quality.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R655.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Score each retrieval for sufficiency, staleness and provenance coverage. Update a Beta posterior of trust per source. Refuse results whose embedding version differs from the index version. Decide adoption of a retrieval strategy from paired corpus runs. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R655.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Verdict attached to every `Discover` response beside the sufficiency verdict of `EG-FEDERATED-QUERY-R081`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R655.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A result set with unknown embedding version or without provenance is marked insufficient and never reported as complete. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R655.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Record corpus ID, per-query verdicts, posterior parameters and the adoption decision inputs. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R655.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** Benchmark `retrieval_quality_gate` (100 results, 20 sources): p50 400 us, p99 2 ms, peak memory 8 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan retrieval_quality_gate` against the stored baseline.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R700
Argument maps with a Dung projection (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Argument maps with a Dung projection (rollup).** The engine stores argument maps in the Argument Interchange Format. It imports and exports the interchange JSON and validates map well-formedness. It projects a map to an abstract argumentation framework. It computes the grounded and preferred extensions of that framework natively. Implemented in eg-reason, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R700.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** `AifNode`, `AifEdge`, `ArgumentMap` and `DungProjection { arguments, attacks }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R700.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Grounded extension is a fixed-point iteration in O(arguments + attacks); preferred extensions are enumerated under a node budget (as R011). | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R700.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Reachable as a UQL stage and as a served method; stored as native OWL/RDF relationships. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R700.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A map with a dangling edge or an invalid node kind is refused with the offending id. Enumeration past the budget returns a certified-gap result. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R700.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Every extension result carries the map digest it was computed from. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R700.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/reasoning/test_aif_dung_served.py::test_grounded_extension_matches_fixture` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/dung_grounded.rs` must show p50 under 1 ms and p99 under 6 ms with peak memory under 16 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R701
Live artifacts re-derive from a query and keep the prior value on failure (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Live artifacts re-derive from a query and keep the prior value on failure (rollup).** A live artifact is a bounded-JSON document with a template and a query source. A refresh re-runs the query and replaces the data. On failure the engine keeps the prior data and records the failure with provenance. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R701.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** `LiveArtifact { id, template, source: QuerySource, data, provenance }` with a validated size and depth bound in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R701.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Refresh is compare-and-set on the artifact version; interpolation is a single non-recursive pass over the template. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R701.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Stored as graph content; refresh is a served method so a scheduler or a viewer can request it. Presentation belongs to the web front end. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R701.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** The engine refuses template text that executes code or exceeds the depth bound. A failed refresh never clears data. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R701.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Each refresh records start, end, row count and error. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R701.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/query/test_live_artifact_served.py::test_failed_refresh_preserves_prior_data` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/live_artifact_refresh.rs` must show p50 under 5 ms and p99 under 30 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R702
Search-task synthesis with shortcut-risk diagnostics (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Search-task synthesis with shortcut-risk diagnostics (rollup).** From an evidence subgraph the engine formulates multi-hop search questions. It diagnoses four shortcut risks. The first is a single clue that selects the answer. The second is evidence that co-covers other clues. The third is exposed constants. The fourth is answers bound by prior knowledge. A risky question is refined or rejected. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R702.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** `EvidenceGraph`, `SearchTask`, `RiskFinding` and `RiskReport` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R702.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Each detector is a bounded query over the evidence graph; formulation refines for at most the configured number of rounds. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R702.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Consumes the epistemic graph through UQL; used to build evaluation sets for retrieval and for the gold set (DE R053). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R702.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A task failing any detector beyond threshold is refused with the detector name. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R702.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Reports list every detector value and the nodes involved. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R702.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/query/test_search_task_synthesis_served.py::test_single_clue_task_is_rejected` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/shortcut_detectors.rs` must show p50 under 6 ms and p99 under 40 ms with peak memory under 48 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R053.700
Trino and Spark job sources with idempotent submission: model and behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Trino and Spark job sources with idempotent submission: model and behavior.** A Trino query source reads against a named snapshot and refuses an unknown snapshot. A Spark transform submission is idempotent on a submission id derived from its inputs. It refuses an unavailable preset with a typed reason. Its change envelope carries the fence fields the consumer needs. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R053.701
Trino and Spark job sources with idempotent submission: refusal, evidence and hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Trino and Spark job sources with idempotent submission: refusal, evidence and hot-path proof.** A missing fence field is refused; an unknown snapshot is refused. Test `tests/query/test_spark_trino_sources_served.py::test_resubmission_returns_same_submission`; benchmark `benches/spark_submission_id.rs` p50 under 0.02 ms and p99 under 0.2 ms, memory under 8 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R005.700
Graph integrity validation as shape checks: model and behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Graph integrity validation as shape checks: model and behavior.** Graph integrity (required properties, orphan nodes, dangling edges, invalid references) is a set of named shapes. VALIDATE SHAPE evaluates them. It produces a report with severity and a fatal class that blocks the caller. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R005.701
Graph integrity validation as shape checks: refusal, evidence and hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Graph integrity validation as shape checks: refusal, evidence and hot-path proof.** A fatal finding blocks with its shape id; validation over a graph exceeding the node budget returns a certified-gap result. Test `tests/query/test_graph_integrity_shapes_served.py::test_fatal_finding_blocks`; benchmark `benches/graph_integrity_validate.rs` p50 under 50 ms and p99 under 250 ms per 100,000 nodes, memory under 128 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R703
Query-time access check for dynamic-access sources (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Query-time access check for dynamic-access sources (rollup).** Some sources decide access only at read time. For their records, the engine must confirm access through the source before a hit enters a context bundle. It fails closed. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R703.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `AccessCheckRequest{source, principal, record_refs}` and `AccessCheckAnswer{allowed, denied, checked_at}` in `crates/eg-plan/src/access_check.rs`. A source pack declares `access_mode` as `synced` or `checked_at_read`. | `crates/eg-plan/tests/access_check.rs::request_round_trips` round-trips both records.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R703.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Before bundle compile, the engine groups `checked_at_read` hits by source. It sends one bounded check per source with up to 200 records. It caches each answer per principal for 300 s at most. A timeout of 2 s drops every hit of that source. | `crates/eg-plan/tests/access_check.rs::timeout_drops_hits` simulates a slow source.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R703.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** `ContextCompile` of R650 calls the check after retrieval fusion in `crates/eg-plan/src/exec.rs`. The SDK access-check port of `SDK-SOURCE-INGEST-R805.5` answers it. | `tests/retrieval/test_access_check_served.py::test_denied_hit_never_enters_bundle` denies one record and reads the bundle.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R703.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A source that declares `checked_at_read` without a registered check port must refuse every hit with `ACCESS_CHECK_UNAVAILABLE`. | `tests/retrieval/test_access_check_served.py::test_missing_port_fails_closed` asserts the code and an empty bundle.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R703.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** The bundle evidence of R650.5 lists each dropped record with its reason: `denied`, `timeout` or `unavailable`. | `tests/retrieval/test_access_check_served.py::test_drop_reasons_read_back` reads the reasons back.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R703.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-plan/benches/access_check.rs` filters 256 hits over 4 sources with warm caches. The added p99 stays under 1 ms. | `cargo bench -p eg-plan --bench access_check` fails on a 10 percent regression.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R704
Agent knowledge scope (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Agent knowledge scope (rollup).** An agent profile must bind a knowledge scope: knowledge sets, source container subtrees and source filters. Retrieval for that agent intersects the scope with the caller access. A scope only narrows access. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R704.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `KnowledgeScope{agent_ref, knowledge_sets, container_refs, source_kinds, time_floor}` in `crates/eg-plan/src/knowledge_scope.rs`. | `crates/eg-plan/tests/knowledge_scope.rs::scope_round_trips` round-trips the record.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R704.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The planner adds the scope as a prefilter before candidate truncation, beside the tenant predicates of R078. An empty scope means the caller access alone. | `crates/eg-plan/tests/knowledge_scope.rs::scope_prefilters_before_truncation` checks recall inside the scope.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R704.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** `Discover` and `ContextCompile` read the scope of the requesting agent profile. The scope stores as a graph fact of EG-ORCH-VOCAB-R800. The containers come from EG-INGEST-WORKER-R904. | `tests/retrieval/test_knowledge_scope_served.py::test_agent_sees_only_scoped_sources` runs two agents over one corpus.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R704.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A scope that names a knowledge set outside the caller tenant must refuse with `SCOPE_SET_FOREIGN`. A scope can never widen access. | `tests/retrieval/test_knowledge_scope_served.py::test_scope_refusals` asserts the code and no widened read.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R704.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Each answer records the scope digest it applied. | `tests/retrieval/test_knowledge_scope_served.py::test_scope_digest_recorded` reads the digest back.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R704.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-plan/benches/knowledge_scope.rs` adds a 50-container scope to a 1M-document hybrid search. The added p99 stays under 2 ms. | `cargo bench -p eg-plan --bench knowledge_scope` fails on a 10 percent regression.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R705
Feedback-adjusted document rank (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Feedback-adjusted document rank (rollup).** The engine must turn explicit and implicit retrieval feedback into a bounded rank boost per document. The boost decays with time. It never overrides access or safety ordering. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R705.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `RetrievalFeedback{tenant, principal, document_ref, kind, weight, at}` and `DocumentBoost{document_ref, value, half_life_s}` in `crates/eg-plan/src/feedback_boost.rs`. `kind` is a closed set: `upvote`, `downvote`, `cited`, `ignored`. | `crates/eg-plan/tests/feedback_boost.rs::feedback_round_trips` round-trips both records.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R705.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The boost is the decayed sum of weights, clamped to the range -0.5 to 0.5. The default half life is 30 days. Fusion of R650.2 adds the boost after score calibration. The ordering stays monotone in safety per EG-DECISION-ENGINE-R009. | `crates/eg-plan/tests/feedback_boost.rs::boost_decays_and_clamps` checks the decay and both clamps.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R705.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Add the served method `RetrievalFeedbackRecord`. arbora serves it through the generated `eg.*` operations. The `cited` kind comes from the answer citations of R650. | `tests/retrieval/test_feedback_boost_served.py::test_upvote_raises_rank` records feedback and observes the rank change.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R705.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Feedback on a document the principal cannot read must refuse with `FEEDBACK_TARGET_HIDDEN`. More than 100 feedback events per principal per hour must refuse with `FEEDBACK_RATE_LIMIT`. | `tests/retrieval/test_feedback_boost_served.py::test_feedback_refusals` asserts both codes.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R705.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Each feedback event joins the outcome evidence of EG-DECISION-ENGINE-R100. A rank answer lists the boost per hit. | `tests/retrieval/test_feedback_boost_served.py::test_boost_listed_per_hit` reads the boost back.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R705.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-plan/benches/feedback_boost.rs` applies boosts to 256 fused candidates. The added p99 stays under 200 microseconds. | `cargo bench -p eg-plan --bench feedback_boost` fails on a 10 percent regression.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R706
Tag-based column masking and row filters (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Tag-based column masking and row filters (rollup).** The engine must enforce masking and row-filter policies inside the query plan. A policy binds to a classification tag. The tag propagates from EG-TYPED-PACKS-R652 markings and EG-TYPED-PACKS-R803 detections. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R706.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `MaskPolicy{tag, principals_exempt, method}` and `RowFilterPolicy{tag, predicate}` in `crates/eg-plan/src/policy_mask.rs`. `method` is a closed set: `null`, `hash`, `partial`, `redact`. | `crates/eg-plan/tests/policy_mask.rs::policies_round_trip` round-trips both records.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R706.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** The planner rewrites each tagged column projection with the mask expression. It adds each row filter beside the R078 predicates. SQL, UQL, SPARQL and the wire protocol of EG-DURABLE-KERNEL-R035 share one rewrite. | `crates/eg-plan/tests/policy_mask.rs::one_rewrite_serves_every_language` compares the four language plans.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R706.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Attach the rewrite in `crates/eg-plan/src/exec.rs` before pushdown. A pushed source query carries the masked projection. | `tests/test_policy_mask_served.py::test_masked_column_over_sql_and_uql` reads one tagged column through two languages.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R706.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A policy on an unknown tag must refuse with `POLICY_TAG_UNKNOWN`. A query that requests the raw value of a masked column must still receive the masked value. | `tests/test_policy_mask_served.py::test_mask_refusals` asserts the code and the masked value.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R706.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** EXPLAIN of R044 lists each applied policy and its tag. | `tests/test_policy_mask_served.py::test_explain_lists_policies` reads the policy list back.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R706.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-plan/benches/policy_mask.rs` masks 4 columns over 1M rows. The overhead stays under 8 percent of the unmasked scan. | `cargo bench -p eg-plan --bench policy_mask` fails on a 10 percent regression.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R707
SPARQL 1.1 Update and Graph Store semantics (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**SPARQL 1.1 Update and Graph Store semantics (rollup).** The engine must apply SPARQL 1.1 Update operations to named graphs. It must also apply Graph Store HTTP semantics. Each update commits as one MutationBatch of EG-DURABLE-KERNEL-R043. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R707.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add the update algebra for `INSERT DATA`, `DELETE DATA`, `DELETE/INSERT WHERE`, `LOAD`, `CLEAR`, `CREATE`, `DROP`, `COPY`, `MOVE` and `ADD` in `crates/eg-rdf/src/update.rs`. | `crates/eg-rdf/tests/sparql_update.rs::update_forms_parse` parses each form.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R707.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** An update request applies as one atomic batch. A failure in any operation leaves the store unchanged. Graph Store `GET`, `PUT`, `POST` and `DELETE` map to read, replace, merge and drop. | `crates/eg-rdf/tests/sparql_update.rs::multi_operation_update_is_atomic` fails the third operation and checks the store.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R707.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Add the served method `SparqlUpdate` beside the SPARQL query path. arbora serves the protocol endpoint through `ARBORA-OPS-R857`. | `tests/test_sparql_update_served.py::test_insert_then_select` inserts data and reads it with a query.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R707.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** An update without the write scope must refuse with `SPARQL_UPDATE_FORBIDDEN`. `LOAD` from a private address must refuse through the outbound guard of R054. | `tests/test_sparql_update_served.py::test_update_refusals` asserts both refusals.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R707.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Each update records its request digest and the batch receipt. | `tests/test_sparql_update_served.py::test_update_receipt_reads_back` compares the receipt.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R707.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-rdf/benches/sparql_update.rs` applies `INSERT DATA` of 10,000 triples. The p99 stays under 50 ms. | `cargo bench -p eg-rdf --bench sparql_update` fails on a 10 percent regression.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R708
Named stored queries and materialized results (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Named stored queries and materialized results (rollup).** The engine must hold named, parameterized, versioned queries in any query language. A stored query may keep a materialized result. The engine refreshes it on change or on a schedule. Children `.1` to `.7` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R708.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `StoredQuery{name, version, language, text, params, materialize, refresh}` in `crates/eg-plan/src/stored_query.rs`. `refresh` is `on_change` or a period of at least 60 s. | `crates/eg-plan/tests/stored_query.rs::stored_query_round_trips` round-trips the record.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R708.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** A call binds typed parameters through R025 and runs the named version. An `on_change` result recomputes when the dependency tracker of R017 marks an input changed. | `crates/eg-plan/tests/stored_query.rs::on_change_refreshes` changes an input and reads the new result.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R708.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Add the served methods `StoredQueryPut` and `StoredQueryCall`. UQL resolves `CALL STORED name(...)` to the same path. | `tests/test_stored_query_served.py::test_put_then_call` stores and calls one query.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R708.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A missing parameter must refuse with `STORED_QUERY_PARAM_MISSING`. A write to a published version must refuse with `STORED_QUERY_IMMUTABLE`. | `tests/test_stored_query_served.py::test_stored_query_refusals` asserts both codes.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R708.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** A materialized result records its input generation and refresh time. A read reports staleness in seconds. | `tests/test_stored_query_served.py::test_staleness_reported` reads the staleness back.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R708.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-plan/benches/stored_query.rs` reads a materialized result of 10,000 rows. The p99 stays under 3 ms. | `cargo bench -p eg-plan --bench stored_query` fails on a 10 percent regression.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R708.7
Shared query workspace
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Shared query workspace.** A stored query must carry an author, a share scope and an optional run schedule of at least 300 s. Before a save or a scheduled run, the engine lints the query against trust flags of EG-TYPED-PACKS-R802.7. A query that reads a deprecated asset returns a typed warning. | `tests/test_stored_query_served.py::test_workspace_share_schedule_and_lint` shares one query, schedules it and deprecates its table.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R709
GeoSPARQL query functions (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**GeoSPARQL query functions (rollup).** SPARQL evaluation must support the GeoSPARQL simple-features topology functions and the distance, buffer and envelope functions. The functions reuse the geometry kernels of `crates/eg-geo`. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R709.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Register `geof:sfEquals`, `sfDisjoint`, `sfIntersects`, `sfTouches`, `sfWithin`, `sfContains`, `sfOverlaps`, `sfCrosses`, `distance`, `buffer` and `envelope` in `crates/eg-rdf/src/geosparql.rs`. Literals use WKT. | `crates/eg-rdf/tests/geosparql.rs::functions_registered` lists the function set.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R709.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Each function delegates to `crates/eg-geo`. Shared-boundary cases follow EG-DURABLE-KERNEL-R046. | `crates/eg-rdf/tests/geosparql.rs::topology_matches_kernel` compares each function with the kernel on 50 fixtures.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R709.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** The SPARQL evaluator calls the registry for the `geof:` namespace. | `tests/test_geosparql_served.py::test_within_query` answers a served within-query.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R709.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Malformed WKT must refuse with `GEO_LITERAL_INVALID`. An unknown coordinate reference must refuse with `GEO_CRS_UNSUPPORTED`. | `tests/test_geosparql_served.py::test_geo_refusals` asserts both codes.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R709.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** EXPLAIN names each spatial function and whether a spatial index served it. | `tests/test_geosparql_served.py::test_explain_names_spatial_index` reads the plan back.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R709.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The benchmark `crates/eg-rdf/benches/geosparql.rs` filters 1M points by `sfWithin` on one polygon with the spatial index. The p99 stays under 40 ms. | `cargo bench -p eg-rdf --bench geosparql` fails on a 10 percent regression.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R720
One UQL plan across graph, vector, SQL, SPARQL and epistemic stages (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**One UQL plan across graph, vector, SQL, SPARQL and epistemic stages (rollup).** One UQL program must compile to one plan DAG with one root. The DAG may mix graph traversal, vector similarity, SQL analytics, SPARQL with OWL entailment and epistemic stages. Every stage must exchange the `RowSet` of `crates/eg-plan/src/rowset.rs:79`. Children `.1` to `.6` deliver it. | Each child requirement has its own verification.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R720.1
Epistemic row fields
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Epistemic row fields.** `Row` at `crates/eg-plan/src/rowset.rs:68` must carry an optional confidence, valid time and transaction time. A stage that reads none of these fields must pass them through unchanged. | `crates/eg-plan/src/rowset.rs` unit test round-trips the three fields through a traversal and a vector stage.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R720.2
Confidence, bitemporal and time-decay stages
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Confidence, bitemporal and time-decay stages.** `CONFIDENCE` at `crates/eg-plan/src/uql/grammar.rs:316` must drop rows below its threshold. `BELIEF AS OF` at line 311 must read the bitemporal state at its time. A new `DECAY HALF_LIFE <seconds>` stage must multiply each score by the age decay of its valid time. | `crates/eg-plan/tests/uql_epistemic_stages.rs::confidence_asof_decay` checks each stage on a fixed fixture.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R720.3
Embedding-similarity clustering stage
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Embedding-similarity clustering stage.** A new `CLUSTER BY EMBEDDING K <n>` stage must group rows by vector similarity. It must reuse the kernels of `crates/eg-compute/src/mining/cluster.rs`. Each row must gain a cluster id and a distance to its centroid. | `crates/eg-plan/tests/uql_epistemic_stages.rs::cluster_by_embedding_is_deterministic` checks fixed clusters with a fixed seed.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R720.4
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** `handle_uql` at `src/server/handlers/query/uql_statement.rs:17` must compile and run the whole program as one plan. arbora serves the program through `ARBORA-OPS-R018`. | A served test shows the program reaches `handle_uql` and runs no second planner.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R720.5
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** `DECAY` over rows without valid time must refuse with `UQL_E_DECAY_NO_TIME`. `CLUSTER BY EMBEDDING` over rows without vectors must refuse with `UQL_E_CLUSTER_NO_VECTOR`. A refused program must return no partial rows. | `crates/eg-plan/tests/uql_epistemic_stages.rs::decay_and_cluster_refusals` asserts each code and an empty result.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R720.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The test must enter at the served query method with a program of all five stage kinds. `EXPLAIN` must report one plan id and the modality of each stage. `EG-DURABLE-KERNEL-R042.2` measures the latency. | `tests/uql_single_plan_all_modalities.rs::five_stage_kinds_one_plan` passes through the served path.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R721
Modalities are views over one RowSet algebra in one store (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Modalities are views over one RowSet algebra in one store (rollup).** Graph, vector, SQL, RDF with OWL, time series, KV and blob data must each adapt to the `RowSet` algebra. The one planner in `crates/eg-plan` must plan every modality. Each modality must keep its durable authority in a registered redb store. Children `.1` to `.4` deliver it. | Each child requirement has its own verification.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R721.1
Each modality implements the modality contract
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Each modality implements the modality contract.** Each of the seven modalities must implement `ModalityContract` of `crates/eg-modality/src/contract.rs:232`. Its `to_rowset` must give the row that a value contributes. | `crates/eg-modality/tests/rowset_views.rs::seven_modalities_implement_contract` lists the seven modalities and finds one implementation each.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R721.2
Wiring and store authority
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring and store authority.** The plan executor must fold each modality output into a `RowSet` through `RowSet::from_rows` at `crates/eg-plan/src/rowset.rs:146`. The registry of `EG-DURABLE-KERNEL-R055` must map each modality to a redb store. A derived projection may exist only when the committed stream feeds it. | A registry test maps each modality to one registered redb store.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R721.3
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** A query that names an unregistered modality must refuse with `UQL_E_UNKNOWN_MODALITY`. | A parser test asserts the code and no plan.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R721.4
Hot-path proof: cross-modal queries with default configuration
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof: cross-modal queries with default configuration.** A fresh engine with default configuration must answer a cross-modal query after ingest. The query must need no per-tenant setup, extension load or index build command. Ingest must build the indexes that the query reads. | `tests/advanced_crossmodal_roundtrip.rs::fresh_engine_answers_cross_modal_query` starts a fresh engine, ingests a fixture and runs a graph, vector and SQL query.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R722
Connector data resources register as virtual-graph sources at pack import (rollup)
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Connector data resources register as virtual-graph sources at pack import (rollup).** The pack contract of `EG-TYPED-PACKS-R101` and `SDK-CONNECTOR-CONTROL-R074` declares each data resource with its ontology class, access method and pagination. Import registers one `vg:SourceConnection` and one `vg:VirtualMapping` per resource, and one typed foreign source per `EG-FEDERATED-QUERY-R073`. A mapping serves reads only after admission approves it (`ARBORA-FLEET-R042`). Queries resolve through the active contract version of `EG-TYPED-PACKS-R107`. UQL and NL queries then answer from native facts and these sources together. Each read records usage and freshness on the catalog asset of `EG-TYPED-PACKS-R106`. The engine reads the source at query time and copies nothing. A declared materialisation policy of `EG-CQ-CONN-R067.6` is the only exception. Children `.1` to `.6` deliver it. | See each child.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R722.1
Model
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Model.** Add `PackSourceRegistration{connector, contract_iri, resource_uri, source_kind, approval, class_iri}` in `crates/eg-types/src/connector_pack.rs`. `source_kind` maps `mcp_tool`, `http_endpoint`, `graphql_query`, `a2a_skill` and `virtual_graph` to the `ForeignSourceSpec` kinds of `EG-FEDERATED-QUERY-R073.1` and `EG-UNIFIED-DATA-PLANE-R037`. `approval` is `held` or `approved`. | `crates/eg-types/tests/pack_source.rs::access_kinds_map_to_foreign_source_kinds`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R722.2
Behavior
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Behavior.** Import registers each declared resource as a held source and mapping. An `approved` mapping serves reads and a `held` one serves none. A re-import with an unchanged contract digest changes nothing. A changed contract replaces the mapping and returns it to `held`. The planner pushes down only the pagination and key filters the contract declares. The exact local residual filter always stays. | `crates/eg-plan/tests/pack_source.rs::held_serves_none_approved_serves_rows_and_changed_contract_returns_to_held`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R722.3
Wiring
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Wiring.** Registration calls `ForeignSourceCatalog::register` (`src/server/foreign_catalog.rs:133`) from `project` (`src/server/connector_pack_projection.rs:228`). Reads go through `foreign_scan` (`crates/eg-plan/src/federation_opt/run.rs:26`). The approval call is a served engine method that arbora invokes. Nothing else registers a pack source. | `tests/federated/test_pack_source_served.py::test_import_registers_through_the_one_catalog`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R722.4
Refusal
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Refusal.** Import refuses a contract that names a literal secret with `CONTRACT_SECRET`. The outbound guard refuses a source whose target is a forbidden destination. A query over a `held` mapping returns `SOURCE_HELD` and names the mapping. A source that is down returns `SOURCE_UNAVAILABLE` with the native rows still answered and the gap flagged. | `tests/federated/test_pack_source_served.py::test_secret_guard_held_and_unavailable_refuse_with_named_codes`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R722.5
Evidence
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Evidence.** Each answer row from a pack source carries the connector, the contract IRI, the mapping IRI and the fetch time. The read records one usage count and a freshness age on the catalog asset. A store audit shows zero source rows written for a non-materialised source. | `tests/federated/test_pack_source_served.py::test_rows_carry_contract_provenance_and_nothing_is_copied`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FEDERATED-QUERY-R722.6
Hot-path proof
Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method, then the served UQL method. A fixture connector with a mock operation backs one data resource. The test approves the mapping, then runs a UQL query that joins a native fact to the connector rows. It counts source rows in the store. | `tests/federated/test_pack_source_served.py::test_uql_joins_native_fact_to_live_connector_rows_with_zero_copy`.
requirementEG-FEDERATED-QUERYSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES
EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidence
specNoneSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R001
Cross-host BacktestRun digest and Pine parity for finance-core
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Cross-host BacktestRun digest and Pine parity for finance-core.** The BacktestRun content digest is canonical across supported host architectures by normalizing serialization, floating-point and timestamp inputs before hashing. A Pine companion script for the SuperTrend and ATR kernels produces the same signal transitions as the Rust implementation from a shared checked-in bar fixture and parameter version, and finance-specific classes are folded into one finance-v1 ontology with duplicate class definitions removed. | Independent builds on two architectures are compared for equal digests, and a parity fixture test asserts the Pine and Rust implementations produce identical signal transitions.
requirementEG-FINANCE-PRIMITIVESVERIFIED0374378eb9db
ae7b0d664749
crates/eg-compute/src/finance/market/record_tests.rs:405
src/server/graph_schema/finance_tests.rs:139
EG-FINANCE-PRIMITIVES-R002
Rehome generic finance evaluation kernels into eg-numeric
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Rehome generic finance evaluation kernels into eg-numeric.** Rolling z-score, EWMA, information coefficient and ratio, effective sample size, Diebold-Mariano, deflated Sharpe, purged combinatorial cross-validation, probability of backtest overfitting, Brier, Kalman, Ornstein-Uhlenbeck, ADF and regime HMM calculations are owned by eg-numeric evaluation and calibration modules and are callable as UQL time-series functions. Finance-specific method wrappers are removed or remain only as thin documented aliases over the shared kernels, with callers migrated to the generic surface and generated method counts reconciled in one change. A regime derivation that requires an unbounded prefix refit declares a bound or refuses with a typed state-budget error rather than reporting an unverified result. Children R002.1 through R002.10 retain this entire contract and add causal, adaptive state-space filtering. | Unit tests cover each relocated kernel. A method-count reconciliation confirms that the generated inventory matches client bindings with no duplicate implementation.
requirementEG-FINANCE-PRIMITIVESSPECIFIED0374378eb9db
31cbdeb6d98b
crates/eg-numeric/src/evaluation/backtest.rs:193
crates/eg-numeric/src/evaluation/backtest.rs:204
crates/eg-numeric/src/evaluation/skill.rs:237
EG-FINANCE-PRIMITIVES-R002.1
Complete the original shared-kernel inventory
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Complete the original shared-kernel inventory.** Rollup: every child below is required; the original acceptance remains mandatory. Model: the original kernel inventory remains mandatory. Behavior: eg-numeric owns rolling z-score, EWMA, information coefficient, information ratio and effective sample size. It also owns Diebold-Mariano, deflated Sharpe, purged combinatorial cross-validation, probability of backtest overfitting, Brier, Kalman, Ornstein-Uhlenbeck, ADF and regime HMM. Wiring: reuse `crates/eg-numeric/src/series/` and `crates/eg-numeric/src/evaluation/`; migrate remaining finance implementations. Refusal: invalid inputs produce typed outcomes; duplicate implementations fail qualification. Evidence: independent vectors cover every listed kernel. | Proposed test: `tests/test_finance_shared_kernel_inventory.py::test_complete_kernel_inventory`. Compare each relocated kernel with independent vectors, including malformed and short inputs. Preserve every original R002 unit-test obligation.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.1
Rolling z-score shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Rolling z-score shared kernel.** Model: The Rolling z-score inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/series/kernel.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/series/kernel.rs::tests::rolling_z_score_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.2
EWMA shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**EWMA shared kernel.** Model: The EWMA inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/series/kernel.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/series/kernel.rs::tests::ewma_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.3
Information coefficient shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Information coefficient shared kernel.** Model: The Information coefficient inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::information_coefficient_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.4
Information ratio shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Information ratio shared kernel.** Model: The Information ratio inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::information_ratio_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.5
Effective sample size shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Effective sample size shared kernel.** Model: The Effective sample size inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::effective_sample_size_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.6
Diebold-Mariano shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Diebold-Mariano shared kernel.** Model: The Diebold-Mariano inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::diebold_mariano_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.7
Deflated Sharpe shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Deflated Sharpe shared kernel.** Model: The Deflated Sharpe inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/backtest.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/backtest.rs::tests::deflated_sharpe_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.8
Purged combinatorial cross-validation shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Purged combinatorial cross-validation shared kernel.** Model: The Purged combinatorial cross-validation inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/backtest.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/backtest.rs::tests::purged_cv_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.9
Probability of backtest overfitting shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Probability of backtest overfitting shared kernel.** Model: The Probability of backtest overfitting inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/backtest.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/backtest.rs::tests::pbo_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.10
Brier shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Brier shared kernel.** Model: The Brier inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::brier_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.11
Kalman shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Kalman shared kernel.** Model: The Kalman inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::kalman_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.12
Ornstein-Uhlenbeck shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Ornstein-Uhlenbeck shared kernel.** Model: The Ornstein-Uhlenbeck inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/mod.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/mod.rs::tests::ou_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.13
ADF shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**ADF shared kernel.** Model: The ADF inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/mod.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/mod.rs::tests::adf_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.1.14
Regime HMM shared kernel
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Regime HMM shared kernel.** Model: The Regime HMM inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/mod.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/mod.rs::tests::regime_hmm_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2
Migrate callers and preserve generic time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Migrate callers and preserve generic time-series exposure.** Rollup: every child below is required; the original acceptance remains mandatory. Model: one generic operation owns each original kernel. Behavior: finance wrappers are removed or documented thin aliases. All callers migrate to the generic surface. Wiring: `src/server/handlers/finance/route_families.rs:576` and the existing series execution path call shared kernels. Every original kernel remains callable as a UQL time-series function. Refusal: unknown aliases and incompatible precision refuse. Evidence: real generic, retained-alias and UQL requests agree. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_generic_alias_and_uql_equivalence`. Test every R002 kernel through its served route. Detect duplicate implementations and precision drift. Missing textual exposure remains an explicit prerequisite under the query hold.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1
Generic caller migration rollup
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Generic caller migration rollup.** Model: Fourteen kernel-specific children retain every original kernel. Behavior: Each caller uses the shared numerical authority. Wiring: Reuse `crates/eg-compute/src/finance/`. Each child names its proving entry. Refusal: Any missing kernel or uncovered caller prevents completion. Evidence: Every kernel-specific child passes its served positive and negative cases. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_generic_inventory`. Every kernel-specific child passes its served positive and negative cases. One passing kernel cannot satisfy this rollup.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.1
Rolling z-score generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Rolling z-score generic caller migration.** Model: One Rolling z-score caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/signals.rs` and the R002.1.1 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_rolling_z_score_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.2
EWMA generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**EWMA generic caller migration.** Model: One EWMA caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/signals.rs` and the R002.1.2 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ewma_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.3
Information coefficient generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Information coefficient generic caller migration.** Model: One Information coefficient caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.3 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_coefficient_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.4
Information ratio generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Information ratio generic caller migration.** Model: One Information ratio caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.4 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_ratio_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.5
Effective sample size generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Effective sample size generic caller migration.** Model: One Effective sample size caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.5 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_effective_sample_size_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.6
Diebold-Mariano generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Diebold-Mariano generic caller migration.** Model: One Diebold-Mariano caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.6 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_diebold_mariano_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.7
Deflated Sharpe generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Deflated Sharpe generic caller migration.** Model: One Deflated Sharpe caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.7 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_deflated_sharpe_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.8
Purged combinatorial cross-validation generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Purged combinatorial cross-validation generic caller migration.** Model: One Purged combinatorial cross-validation caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.8 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_purged_cv_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.9
Probability of backtest overfitting generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Probability of backtest overfitting generic caller migration.** Model: One Probability of backtest overfitting caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.9 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_pbo_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.10
Brier generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Brier generic caller migration.** Model: One Brier caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.10 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_brier_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.11
Kalman generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Kalman generic caller migration.** Model: One Kalman caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/statespace.rs` and the R002.1.11 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_kalman_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.12
Ornstein-Uhlenbeck generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Ornstein-Uhlenbeck generic caller migration.** Model: One Ornstein-Uhlenbeck caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/statespace.rs` and the R002.1.12 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ou_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.13
ADF generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**ADF generic caller migration.** Model: One ADF caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/statespace.rs` and the R002.1.13 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_adf_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.1.14
Regime HMM generic caller migration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Regime HMM generic caller migration.** Model: One Regime HMM caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/regime.rs` and the R002.1.14 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_regime_hmm_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2
Finance alias compatibility rollup
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Finance alias compatibility rollup.** Model: Fourteen kernel-specific children retain every original kernel. Behavior: Each retained method is a documented thin alias; removed methods follow the declared compatibility contract. Wiring: Reuse `src/server/handlers/finance/route_families.rs`. Each child names its proving entry. Refusal: Any missing kernel or uncovered caller prevents completion. Evidence: Every kernel-specific child passes its served positive and negative cases. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_alias_inventory`. Every kernel-specific child passes its served positive and negative cases. One passing kernel cannot satisfy this rollup.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.1
Rolling z-score finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Rolling z-score finance alias compatibility.** Model: One Rolling z-score caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_rolling_z_score_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.2
EWMA finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**EWMA finance alias compatibility.** Model: One EWMA caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ewma_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.3
Information coefficient finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Information coefficient finance alias compatibility.** Model: One Information coefficient caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_coefficient_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.4
Information ratio finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Information ratio finance alias compatibility.** Model: One Information ratio caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_ratio_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.5
Effective sample size finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Effective sample size finance alias compatibility.** Model: One Effective sample size caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_effective_sample_size_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.6
Diebold-Mariano finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Diebold-Mariano finance alias compatibility.** Model: One Diebold-Mariano caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_diebold_mariano_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.7
Deflated Sharpe finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Deflated Sharpe finance alias compatibility.** Model: One Deflated Sharpe caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_deflated_sharpe_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.8
Purged combinatorial cross-validation finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Purged combinatorial cross-validation finance alias compatibility.** Model: One Purged combinatorial cross-validation caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_purged_cv_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.9
Probability of backtest overfitting finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Probability of backtest overfitting finance alias compatibility.** Model: One Probability of backtest overfitting caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_pbo_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.10
Brier finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Brier finance alias compatibility.** Model: One Brier caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_brier_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.11
Kalman finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Kalman finance alias compatibility.** Model: One Kalman caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_kalman_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.12
Ornstein-Uhlenbeck finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Ornstein-Uhlenbeck finance alias compatibility.** Model: One Ornstein-Uhlenbeck caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ou_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.13
ADF finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**ADF finance alias compatibility.** Model: One ADF caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_adf_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.2.14
Regime HMM finance alias compatibility
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Regime HMM finance alias compatibility.** Model: One Regime HMM caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_regime_hmm_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3
UQL time-series exposure rollup
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**UQL time-series exposure rollup.** Model: Fourteen kernel-specific children retain every original kernel. Behavior: Each kernel remains callable through the served UQL time-series path. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs`. Each child names its proving entry. Refusal: Any missing kernel or uncovered caller prevents completion. Evidence: Every kernel-specific child passes its served positive and negative cases. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_uql_inventory`. Every kernel-specific child passes its served positive and negative cases. One passing kernel cannot satisfy this rollup.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.1
Rolling z-score uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Rolling z-score uql time-series exposure.** Model: One Rolling z-score caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_rolling_z_score_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.2
EWMA uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**EWMA uql time-series exposure.** Model: One EWMA caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ewma_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.3
Information coefficient uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Information coefficient uql time-series exposure.** Model: One Information coefficient caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_coefficient_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.4
Information ratio uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Information ratio uql time-series exposure.** Model: One Information ratio caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_ratio_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.5
Effective sample size uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Effective sample size uql time-series exposure.** Model: One Effective sample size caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_effective_sample_size_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.6
Diebold-Mariano uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Diebold-Mariano uql time-series exposure.** Model: One Diebold-Mariano caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_diebold_mariano_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.7
Deflated Sharpe uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Deflated Sharpe uql time-series exposure.** Model: One Deflated Sharpe caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_deflated_sharpe_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.8
Purged combinatorial cross-validation uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Purged combinatorial cross-validation uql time-series exposure.** Model: One Purged combinatorial cross-validation caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_purged_cv_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.9
Probability of backtest overfitting uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Probability of backtest overfitting uql time-series exposure.** Model: One Probability of backtest overfitting caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_pbo_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.10
Brier uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Brier uql time-series exposure.** Model: One Brier caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_brier_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.11
Kalman uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Kalman uql time-series exposure.** Model: One Kalman caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_kalman_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.12
Ornstein-Uhlenbeck uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Ornstein-Uhlenbeck uql time-series exposure.** Model: One Ornstein-Uhlenbeck caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ou_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.13
ADF uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**ADF uql time-series exposure.** Model: One ADF caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_adf_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.3.14
Regime HMM uql time-series exposure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Regime HMM uql time-series exposure.** Model: One Regime HMM caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_regime_hmm_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.2.4
Complete caller coverage check
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Complete caller coverage check.** Model: A versioned census maps every original kernel caller and alias to its migration child. Behavior: Compare the full reference census with the child coverage. Add explicit children for any remaining independent caller before completion. Wiring: The proposed `tests/test_finance_shared_kernel_routes.py` check inspects production references and corresponding served receipts. Refusal: An unmapped, unmigrated or duplicate caller fails qualification. Evidence: Every discovered caller has a named child and observed use of the generic authority. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_complete_caller_coverage`. Every discovered caller has a named child and observed use of the generic authority. Removing a census entry or leaving an old implementation must fail.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.3
Reconcile generated methods and client bindings
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Reconcile generated methods and client bindings.** Model: Rust descriptors remain the method authority. Behavior: reconcile counts, schemas and all generated client bindings in the caller-migration change. Wiring: `crates/eg-capabilities/src/bin/gen_contract.rs` generates the projections. Refusal: stale, missing or duplicated bindings fail qualification. Evidence: compare method identities as well as counts. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_generated_method_identity_reconciliation`. Regenerate and compare the full identity set. A same-count substitution and a stale client must fail.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.4
Bound original regime derivations and streaming work
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Bound original regime derivations and streaming work.** Model: explicit limits cover dimensions, retained observations, checkpoint bytes, update work and replay work. Behavior: bound every prefix refit before allocation. Wiring: extend `crates/eg-tsdb/src/derive/maintain.rs` and shared numerical admission. Refusal: exhausted limits return typed state-budget or work-budget outcomes. No uncomputed result appears as complete. Evidence: exact-limit and limit-plus-one tests include original regime HMM and new filters. | Proposed test: `crates/eg-tsdb/src/derive/maintain_tests.rs::state_space_resource_bounds`. Compare reported consumption with observed allocations and updates. A rejected update preserves the previous checkpoint. Existing bounded partial progress must expose its cursor and lag.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.5
Define versioned state-space inputs and checkpoints
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Define versioned state-space inputs and checkpoints.** Model: observations carry sequence, event time, known-at time, source revision and typed finite vectors. State includes mean, covariance, cursor, model revision and kernel revision. Behavior: validate dimensions, units, ordering, noise assumptions and all budgets before updating. Wiring: `crates/eg-types/src/series_expr.rs` owns public carriers consumed by eg-numeric. Refusal: conflicting retries, unsupported revisions and invalid covariance refuse without state changes. Evidence: model and checkpoint round trips preserve all fields. | Proposed test: `crates/eg-types/src/series_expr.rs::tests::state_space_model_and_refusals`. Exercise all four models, exact retries, conflicting retries, nonfinite values, dimension errors and invalid covariance.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.6
Apply causal predict-update filtering to four state models
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Apply causal predict-update filtering to four state models.** Rollup: every child below is required; the original acceptance remains mandatory. Model: explicit profiles cover volatility regime, mean-reversion strength, hedge ratio and time-varying factor sensitivity. Behavior: perform the recurrence and initialization defined in plan.md once per ordered observation. State the conditions for optimal linear gain. Wiring: extend `crates/eg-numeric/src/series/kalman.rs`; all profiles share its recurrence. Refusal: invalid transforms and singular innovation covariance refuse. Evidence: independent numerical oracles cover each profile and causal prefix replay. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::four_models_match_independent_oracles`. Compare prior, innovation, gain, posterior and covariance at every step. Future observations must never change an earlier prefix result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.6.1
Shared causal linear recurrence
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Shared causal linear recurrence.** Model: Versioned prior, observation and mutually uncorrelated process/measurement noises define one update. Behavior: Apply the plan recurrence and Joseph covariance once per observation. Preserve causal prefix replay. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs`; R002.5 carriers are a prerequisite. Refusal: Singular innovation covariance and unsupported correlated-noise declarations refuse before state changes. Evidence: The existing scalar rational vectors match every intermediate and checkpoint. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::causal_linear_recurrence_and_noise_refusal`. The existing scalar rational vectors match every intermediate and checkpoint. The Q=1, R=4, cross-covariance=1 declaration refuses; it must not return the independent-noise gain.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.6.2
Volatility regime profile
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Volatility regime profile.** Model: Log variance uses random-walk dynamics and the declared log-return transform. Behavior: Emit latent variance and configured bands after the declared prior or causal warmup. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs` after R002.5 and R002.6.1. Refusal: Invalid profile inputs preserve the prior checkpoint. Evidence: Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Zero returns without an admitted floor and invalid transform revisions refuse. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::volatility_profile_oracle`. Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Zero returns without an admitted floor and invalid transform revisions refuse. Zero returns without an admitted floor and invalid transform revisions refuse. Future observations cannot alter earlier prefix results.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.6.3
Mean-reversion strength profile
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Mean-reversion strength profile.** Model: The varying phi profile binds dt and centering revision. Behavior: Apply the shared recurrence and emit theta only for 0 < phi < 1. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs` after R002.5 and R002.6.1. Refusal: Invalid profile inputs preserve the prior checkpoint. Evidence: Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Other phi values produce the typed non-reverting outcome; invalid dt refuses. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::mean_reversion_profile_oracle`. Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Other phi values produce the typed non-reverting outcome; invalid dt refuses. Other phi values produce the typed non-reverting outcome; invalid dt refuses. Future observations cannot alter earlier prefix results.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.6.4
Hedge ratio profile
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Hedge ratio profile.** Model: The state contains intercept and hedge coefficient with H = [1, hedge_input]. Behavior: Apply the shared recurrence to one aligned pair and preserve units and hedge direction. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs` after R002.5 and R002.6.1. Refusal: Invalid profile inputs preserve the prior checkpoint. Evidence: Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Misaligned pairs and incompatible units refuse. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::hedge_profile_oracle`. Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Misaligned pairs and incompatible units refuse. Misaligned pairs and incompatible units refuse. Future observations cannot alter earlier prefix results.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.6.5
Time-varying factor sensitivity profile
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Time-varying factor sensitivity profile.** Model: Ordered coefficients bind factor identities and source timestamps. Behavior: Apply the shared recurrence to contemporaneously available factor returns. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs` after R002.5 and R002.6.1. Refusal: Invalid profile inputs preserve the prior checkpoint. Evidence: Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Unequal factor arrays, changed ordering and future factor observations refuse. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::factor_profile_oracle`. Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Unequal factor arrays, changed ordering and future factor observations refuse. Unequal factor arrays, changed ordering and future factor observations refuse. Future observations cannot alter earlier prefix results.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.7
Detect innovation shifts and retune within fixed bounds
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Detect innovation shifts and retune within fixed bounds.** Model: versioned windows, thresholds, confirmation count, cooldown and retuning clamps follow plan.md. Behavior: detect persistent innovation-variance shifts and publish the parameter revision effective on the next observation. Wiring: extend the shared eg-numeric filter state. Refusal: invalid windows, unavailable warmup and retuning-budget exhaustion produce typed outcomes. Evidence: stable, shifted and isolated-outlier sequences identify exact trigger indices. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::bounded_innovation_retuning`. Compare window statistics, clamp results, cooldown and revision timing with an independent seeded oracle.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.8
Bound nonlinear approximation and robust tail influence
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Bound nonlinear approximation and robust tail influence.** Model: registered differentiable transition and observation profiles declare Jacobians, domains and approximation revisions. Behavior: linearize once, then apply the bounded robust gain from plan.md. Wiring: extend the existing eg-numeric numerical authority. Refusal: unsupported models, invalid derivatives and nonfinite results refuse. Evidence: linear reduction, nonlinear goldens and extreme innovations cover covariance and bounded influence. No universal optimality claim applies. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::nonlinear_robust_gain`. Use the specified nonlinear profile, both residual signs and seeded heavy-tail vectors. Compare Joseph covariance and bounded corrections with an independent oracle.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.9
Wire versioned filtering through served series operations
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Wire versioned filtering through served series operations.** Model: results expose revisions, cursor, state, covariance, innovation, gain, tail weight, retuning and consumed budgets. Behavior: reuse the existing authorized series and structured-query routes. Wiring: `src/server/handlers/timeseries.rs:367` reaches `derived::maintain_after_append`; `src/server/handlers/query/sql_read.rs:305` handles structured queries. Both reach eg-tsdb and shared eg-numeric kernels. Refusal: unavailable schema support, scope denial and stale checkpoints return typed outcomes. Evidence: authenticated requests reach these production call sites. | Proposed test: `tests/test_finance_state_space_served.py::test_served_filter_wiring`. A real server receives append and structured-query requests. Readback exposes every required diagnostic and revision. Invalid requests must preserve prior derived state.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.10
Prove filtering on the production hot paths
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Prove filtering on the production hot paths.** Model: fixtures pin source, model, schema, kernel and seed identities. Behavior: qualify streaming, chunked and restart replay through the real server. Wiring: `src/server/handlers/timeseries/derived.rs:222` commits derived points and checkpoints; served range queries read them back. Refusal: invalid-input, scope, revision and budget cases must remain observable. Evidence: execute the complete numerical and served matrix in test-spec.md. Helper-only tests cannot satisfy this row. | Proposed test: `tests/test_finance_state_space_served.py::test_stream_restart_refusals_and_hot_path_receipts`. Record exact head, feature set, entry methods, exercised production call sites, request IDs and readback digests. Require all original residual children too.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R003
Compute PBO from a BacktestRun's own CSCV splits
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Compute PBO from a BacktestRun's own CSCV splits.** Probability of backtest overfitting is computed from a BacktestRun's own combinatorial symmetric cross-validation splits rather than a separate caller-supplied summary of performance rows. For each split the implementation selects the top in-sample candidate by a deterministic tie rule, ranks its out-of-sample performance against all candidates, and counts it as overfit only when strictly below the exact median, treating equality to the median as not overfit. | A skilled-strategy fixture and an overfit-strategy fixture each assert the expected PBO value computed directly from the record's own split matrix.
requirementEG-FINANCE-PRIMITIVESVERIFIED458eb5bb9475
69979c407216
72c7dfa478ba
crates/eg-compute/src/finance/market/record_tests.rs:446
EG-FINANCE-PRIMITIVES-R004
finance-v1 asset, account, and strategy record types
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**finance-v1 asset, account, and strategy record types.** finance-v1 defines validated asset classes for equity, ETF, fund, index, FX pair, commodity spot and future with contract spec, crypto, real-estate holding, and cash, along with Account, Activity, Lot, Position, PortfolioGroup with Basic and Holdings views, StrategySpec, StrategyRun, and LeverageTerms record types. Delivered as child requirements, one per code root, producer first: `EG-FINANCE-PRIMITIVES-R004.1` (ontology/SHACL asset-class vocabulary), `.2` (the Rust record types), `.3` (server wiring and contract regeneration). Every child must satisfy its acceptance before this parent is complete. | Ontology and SHACL schema validation tests confirm each record type enforces its required fields, links, and controlled vocabulary.
requirementEG-FINANCE-PRIMITIVESSPECIFIED0ae2193fae8d
EG-FINANCE-PRIMITIVES-R004.1
finance-v1 asset-class controlled vocabulary
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**finance-v1 asset-class controlled vocabulary.** The `:assetClass` SHACL shape accepts the canonical `equity`, `etf`, `fund`, `index`, `fx_pair`, `commodity_spot`, `commodity_future`, `crypto`, `real_estate` and `cash` values, plus the deprecated migration aliases `stock`, `forex` and `commodity` preserved from the prior vocabulary. Code root: `crates/eg-core/ontology/finance-v1.ttl` and `finance-v1.shapes.ttl`. | SHACL validation tests assert every canonical and legacy alias value conforms and an unlisted value (for example `bond`) is refused.
requirementEG-FINANCE-PRIMITIVESVERIFIED0ae2193fae8d
src/server/graph_schema/finance_tests.rs:299
EG-FINANCE-PRIMITIVES-R004.2
finance-v1 Account/Activity/Lot/Position/PortfolioGroup/StrategySpec/StrategyRun/LeverageTerms Rust record types
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**finance-v1 Account/Activity/Lot/Position/PortfolioGroup/StrategySpec/StrategyRun/LeverageTerms Rust record types.** Delivered as child requirements, one per record-type group, producer first: `EG-FINANCE-PRIMITIVES-R004.2.1` (the `Account` and `Position` OWL classes and SHACL shapes), `.2.2` (`Activity` and `Lot`), `.2.3` (`PortfolioGroup`), `.2.4` (`StrategySpec`), `.2.5` (`StrategyRun`) and `.2.6` (`LeverageTerms`). Every child must satisfy its acceptance before this parent is complete. | Ontology and SHACL schema validation tests confirm each record type enforces its required fields, links, and controlled vocabulary.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDa189dbe4067f
fd0aa73cb7b5
EG-FINANCE-PRIMITIVES-R004.2.1
Account and Position OWL classes and SHACL shapes
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Account and Position OWL classes and SHACL shapes.** finance-v1 defines `:Account` (a portfolio owner's brokerage/custodial account: `accountId`, `baseCurrency`, closed-vocabulary `accountKind`) and `:Position` (an account's signed holding of one instrument under one cost-basis method: `positionAccount`, `positionInstrument`, `positionQuantity`, closed-vocabulary `costBasisMethod`), distinct from the pre-existing exchange-execution `:PortfolioPosition`. Code root: `crates/eg-core/ontology/finance-v1.ttl` and `finance-v1.shapes.ttl`. | SHACL validation tests assert required fields/links are enforced and each closed vocabulary (`accountKind`, `costBasisMethod`) refuses an unlisted value.
requirementEG-FINANCE-PRIMITIVESSPECIFIED1d12fc4e1fff
994ffe8ffa60
a189dbe4067f
fd0aa73cb7b5
src/server/graph_schema/finance_tests.rs:230
src/server/graph_schema/finance_tests.rs:260
src/server/graph_schema/finance_tests.rs:45
EG-FINANCE-PRIMITIVES-R004.2.2
Activity and Lot OWL classes and SHACL shapes
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Activity and Lot OWL classes and SHACL shapes.** finance-v1 defines `:Activity` (a point-in-time ledger event against a position: buy, sell, dividend, transfer, split, fee) and `:Lot` (one FIFO/LIFO/specific-lot cost-basis parcel opened by an acquiring activity). Code root: `crates/eg-core/ontology/finance-v1.ttl` and `finance-v1.shapes.ttl`. | SHACL validation tests assert required fields/links are enforced and each closed vocabulary value is checked.
requirementEG-FINANCE-PRIMITIVESSPECIFIED1d12fc4e1fff
994ffe8ffa60
a189dbe4067f
fd0aa73cb7b5
src/server/graph_schema/finance_tests.rs:230
src/server/graph_schema/finance_tests.rs:260
src/server/graph_schema/finance_tests.rs:45
EG-FINANCE-PRIMITIVES-R004.2.1.1
Account/Position complete shape acceptance
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Account/Position complete shape acceptance.** Run the full required-field and vocabulary matrix against the existing finance SHACL module. Source: `crates/eg-core/ontology/finance-v1.shapes.ttl; src/server/graph_schema/finance_tests.rs`. | Omit each required field independently: accountId, baseCurrency, positionAccount, positionInstrument and positionQuantity. Every omission must refuse. Each IRI link must refuse literal values. Wrong datatypes and duplicate singleton fields refuse. Accept every declared value of accountKind and costBasisMethod; refuse unknown values. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::account_position_complete_schema_matrix (intended test)`.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.2.2.1
Activity/Lot complete shape acceptance
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Activity/Lot complete shape acceptance.** Run the full required-field and vocabulary matrix against the existing finance SHACL module. Source: `crates/eg-core/ontology/finance-v1.shapes.ttl; src/server/graph_schema/finance_tests.rs`. | Omit each required field independently: activityPosition, activityKind, activityQuantity, activityTradeDate, lotPosition, lotOpenedBy, lotQuantity and lotUnitCostBasis. Every omission must refuse. Each IRI link must refuse literal values. Wrong datatypes and duplicate singleton fields refuse. Accept every declared value of activityKind; refuse unknown values. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::activity_lot_complete_schema_matrix (intended test)`.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.2.3
PortfolioGroup ontology and shapes
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**PortfolioGroup ontology and shapes.** Declare `PortfolioGroup` in the existing finance module. Define its SHACL fields and links from the existing versioned record contract. Reuse shared vocabulary. Source: `crates/eg-core/ontology/finance-v1.ttl; crates/eg-core/ontology/finance-v1.shapes.ttl`. | Native SHACL tests accept a valid record. Missing required fields, invalid links, and unknown closed-vocabulary values refuse. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::portfolio_group_schema_acceptance (intended test)`.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.2.4
StrategySpec ontology and shapes
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**StrategySpec ontology and shapes.** Declare `StrategySpec` in the existing finance module. Define its SHACL fields and links from the existing versioned record contract. Reuse shared vocabulary. Source: `crates/eg-core/ontology/finance-v1.ttl; crates/eg-core/ontology/finance-v1.shapes.ttl`. | Native SHACL tests accept a valid record. Missing required fields, invalid links, and unknown closed-vocabulary values refuse. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::strategy_spec_schema_acceptance (intended test)`.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.2.5
StrategyRun ontology and shapes
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**StrategyRun ontology and shapes.** Declare `StrategyRun` in the existing finance module. Define its SHACL fields and links from the existing versioned record contract. Reuse shared vocabulary. Source: `crates/eg-core/ontology/finance-v1.ttl; crates/eg-core/ontology/finance-v1.shapes.ttl`. | Native SHACL tests accept a valid record. Missing required fields, invalid links, and unknown closed-vocabulary values refuse. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::strategy_run_schema_acceptance (intended test)`.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.2.6
LeverageTerms ontology and shapes
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**LeverageTerms ontology and shapes.** Declare `LeverageTerms` in the existing finance module. Define its SHACL fields and links from the existing versioned record contract. Reuse shared vocabulary. Source: `crates/eg-core/ontology/finance-v1.ttl; crates/eg-core/ontology/finance-v1.shapes.ttl`. | Native SHACL tests accept a valid record. Missing required fields, invalid links, and unknown closed-vocabulary values refuse. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::leverage_terms_schema_acceptance (intended test)`.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3
finance-v1 record-type server wiring and contract regeneration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**finance-v1 record-type server wiring and contract regeneration.** The R004.2 record types are wired into server handlers and the generated contract/client surfaces are regenerated to carry them. Split per the dependency-first sizing rule: `EG-FINANCE-PRIMITIVES-R004.3.1` (the wire-boundary schema-version gate) and further children for the served method registration and generated-client contract regeneration. Code root: `src/server/`, `contract/`, generated clients. | A handler test reads/writes each record type through its entry point, and the contract-freshness check passes with the regenerated artifacts committed.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDfcca865a0505
fd0aa73cb7b5
EG-FINANCE-PRIMITIVES-R004.3.1
The wire boundary refuses an unknown finance-v1 schema version
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**The wire boundary refuses an unknown finance-v1 schema version.** `admit_finance_record_version` accepts only the current `finance-v1` declared schema version at the wire boundary, refusing an unknown or empty one rather than silently accepting it or guessing a migration. Code root: `crates/eg-types/src/wire_finance.rs`. | Unit tests assert the current schema version is admitted and an unknown or empty declared version is refused.
requirementEG-FINANCE-PRIMITIVESVERIFIED69979c407216
fcca865a0505
crates/eg-types/src/wire_finance.rs:80
crates/eg-types/src/wire_finance.rs:86
crates/eg-types/src/wire_finance.rs:93
EG-FINANCE-PRIMITIVES-R004.3.2
Served record registration and round trips
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Served record registration and round trips.** Rollup of record-specific handler acceptance below. The server must preserve the R004.3 read/write and schema-version acceptance. Intended source: `src/server/handlers/finance.rs`. | Each record-specific child passes through a served entry point. A typed schema gate alone does not satisfy handler acceptance.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.2.1
Account served entry point
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Account served entry point.** The server must register the `Account` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::account_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `Account` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.2.2
Activity served entry point
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Activity served entry point.** The server must register the `Activity` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::activity_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `Activity` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.2.3
Lot served entry point
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Lot served entry point.** The server must register the `Lot` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::lot_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `Lot` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.2.4
Position served entry point
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Position served entry point.** The server must register the `Position` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::position_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `Position` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.2.5
PortfolioGroup served entry point
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**PortfolioGroup served entry point.** The server must register the `PortfolioGroup` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::portfolio_group_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `PortfolioGroup` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.2.6
StrategySpec served entry point
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**StrategySpec served entry point.** The server must register the `StrategySpec` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::strategy_spec_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `StrategySpec` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.2.7
StrategyRun served entry point
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**StrategyRun served entry point.** The server must register the `StrategyRun` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::strategy_run_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `StrategyRun` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.2.8
LeverageTerms served entry point
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**LeverageTerms served entry point.** The server must register the `LeverageTerms` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::leverage_terms_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `LeverageTerms` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.3
Record contract and generated-client acceptance
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Record contract and generated-client acceptance.** Rollup of schema export and generated-client acceptance below. Both children depend on the served record registration. Intended source: `crates/eg-capabilities/src/bin/gen_contract.rs`. | Both generated-surface children pass. A schema-version constant alone does not establish generated-client support.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.3.1
Finance record contract regeneration
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Finance record contract regeneration.** The contract generator must export the served record schemas and entry points from their authoritative Rust definitions. Intended source: `crates/eg-capabilities/src/bin/gen_contract.rs; contract/methods.json; contract/schemas/`. | Intended test: `tests/test_contract_wave_surface.py::test_finance_record_contract_surface (intended test)`. The generated contract represents each R004.2 record and served entry point. The contract freshness check rejects stale generated artifacts.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R004.3.3.2
Finance generated-client round trips
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Finance generated-client round trips.** The generator must produce clients from the record contract. Client tests must round-trip every served record. Intended source: `crates/eg-capabilities/src/bin/gen_contract.rs; epistemic_graph/generated/`. | Intended test: `tests/test_generated_client_contract.py::test_finance_record_client_round_trips (intended test)`. Generated clients preserve all required record fields through served requests. Unknown versions refuse; omitted required fields fail. The generator check rejects stale clients.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R005
Deterministic fixed-point portfolio accounting
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Deterministic fixed-point portfolio accounting.** Portfolio accounting uses fixed-point arithmetic for lot and cost-basis tracking under FIFO, LIFO, specific-lot, and average-cost elections, and derives realized and unrealized profit and loss, time-weighted return, money-weighted return and XIRR, dividend handling, multi-currency conversion at trade and valuation dates, and benchmark comparison. Delivered as child requirements, producer first: `EG-FINANCE-PRIMITIVES-R005.1` (the FIFO/LIFO fixed-point lot-matching engine), `.2` (specific-lot/average-cost elections and transfer/split invariants), further children for P&L/TWR/XIRR/FX/benchmark. Every child must satisfy its acceptance before this parent is complete. | Deterministic unit and golden fixture tests reproduce byte-identical results across replays of the same ordered inputs.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R005.1
FIFO/LIFO fixed-point lot-matching engine
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**FIFO/LIFO fixed-point lot-matching engine.** A pure function over an ordered slice of signed fixed-point buy/sell activities matches sells to open lots under FIFO or LIFO, refusing non-positive quantity/price, out-of-order sequence, and oversold quantity. Code root: `crates/eg-compute/src/finance/lot_accounting.rs`. | Unit tests assert FIFO/LIFO matching order, each refusal, and that replaying the same ordered activities is byte-identical.
requirementEG-FINANCE-PRIMITIVESVERIFIED72c7dfa478ba
ac32740601a8
eee78d6b3d1d
crates/eg-compute/src/finance/lot_accounting.rs:283
crates/eg-compute/src/finance/lot_accounting.rs:284
crates/eg-compute/src/finance/lot_accounting.rs:304
crates/eg-compute/src/finance/lot_accounting.rs:305
crates/eg-compute/src/finance/lot_accounting.rs:323
EG-FINANCE-PRIMITIVES-R005.1.1
FIFO/LIFO lot-matching tests are confirmed to run and pass against mixed buy/sell activity
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**FIFO/LIFO lot-matching tests are confirmed to run and pass against mixed buy/sell activity.** `fifo_closes_the_oldest_lot_first` and its two siblings assert closing behavior using buy-only activity fixtures; confirm these tests actually execute and pass, and extend them to a representative mixed buy/sell activity sequence rather than buy-only fixtures. Code root: `crates/eg-compute/src/finance/lot_accounting.rs`. | Test: `crates/eg-compute/src/finance/lot_accounting.rs::tests::fifo_and_lifo_lot_matching_tests_run_and_pass_against_a_mixed_buy_sell_sequence`.
requirementEG-FINANCE-PRIMITIVESVERIFIEDac32740601a8
crates/eg-compute/src/finance/lot_accounting.rs:284
crates/eg-compute/src/finance/lot_accounting.rs:305
EG-FINANCE-PRIMITIVES-R005.2
Specific-lot/average-cost elections and transfer/split invariants
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Specific-lot/average-cost elections and transfer/split invariants.** Oversized; delivered as grandchildren, producer first: `EG-FINANCE-PRIMITIVES-R005.2.1` (the specific-lot election), further grandchildren for average-cost election and transfer/split invariants. Every grandchild must satisfy its acceptance before this parent is complete. | Deterministic unit and golden fixture tests reproduce byte-identical results across replays of the same ordered inputs
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R005.2.1
Specific-lot election
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Specific-lot election.** `LotMethod::Specific(opened_by)` closes exactly the open lot named by its opening sequence instead of a FIFO/LIFO choice, refusing a named lot that is not open and a named lot without enough remaining quantity even when other lots have it. Code root: `crates/eg-compute/src/finance/lot_accounting.rs`. | Unit tests assert the named lot closes instead of the FIFO/LIFO choice, and that an absent or insufficient named lot is refused.
requirementEG-FINANCE-PRIMITIVESVERIFIEDeadb412ffa03
crates/eg-compute/src/finance/lot_accounting.rs:382
crates/eg-compute/src/finance/lot_accounting.rs:410
crates/eg-compute/src/finance/lot_accounting.rs:431
EG-FINANCE-PRIMITIVES-R005.2.2
Average-cost election
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Average-cost election.** The lot engine must apply an explicit average-cost election using checked fixed-point arithmetic and declared rounding. Intended source: `crates/eg-compute/src/finance/lot_accounting.rs`. | Intended test: `crates/eg-compute/src/finance/lot_accounting.rs::tests::average_cost_election_preserves_basis (intended test)`. Mixed-price buys and partial sells reproduce expected basis and realized gains. Identical ordered inputs replay identically. Oversell and arithmetic overflow refuse. Rounding follows the declared scale without floating-point money.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R005.2.3
Transfer conservation
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Transfer conservation.** The lot engine must conserve aggregate quantity, cash and basis across an ordered paired transfer, accounting for explicit fees. Intended source: `crates/eg-compute/src/finance/lot_accounting.rs`. | Intended test: `crates/eg-compute/src/finance/lot_accounting.rs::tests::paired_transfer_conserves_quantity_cash_and_basis (intended test)`. A transfer preserves source-lot identity and basis across included accounts. Identical ordered inputs replay identically. Unbalanced transfers and insufficient source quantity refuse without a partial ledger update.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R005.2.4
Split basis preservation
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Split basis preservation.** The lot engine must adjust quantity for a declared split ratio while preserving aggregate basis with explicit rounding. Intended source: `crates/eg-compute/src/finance/lot_accounting.rs`. | Intended test: `crates/eg-compute/src/finance/lot_accounting.rs::tests::split_preserves_aggregate_basis (intended test)`. Forward and reverse splits preserve aggregate basis. Identical ordered inputs replay identically. Invalid ratios and arithmetic overflow refuse. Fractional quantities follow the declared rounding policy.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R006
Point-in-time corporate actions and exchange session calendars
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Point-in-time corporate actions and exchange session calendars.** Corporate actions, including splits, dividends, symbol changes, and delistings, are recorded as point-in-time facts, and exchange calendars model regular, pre-market, and post-market sessions. Every price result carries the session in which it was observed. | Golden fixtures covering corporate-action and session-boundary cases assert correct point-in-time resolution and session tagging.
requirementEG-FINANCE-PRIMITIVESVERIFIED0374378eb9db
86432b21655e
b9870e23567b
crates/eg-compute/src/finance/market/resolve.rs:167
EG-FINANCE-PRIMITIVES-R007
Versioned StrategySpec evaluator with DCA, trend, rebalancing
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Versioned StrategySpec evaluator with DCA, trend, rebalancing.** A versioned, typed StrategySpec is evaluated deterministically and ships default strategies for dollar-cost averaging by fixed amount, by shares, or by value-averaging target, trend following using moving-average and trend-flip signals, and calendar- or threshold-based rebalancing. Evaluation emits proposed actions only and never places or authorizes an order. | Deterministic unit tests exercise each default strategy's proposed-action output against fixed input fixtures.
requirementEG-FINANCE-PRIMITIVESVERIFIED6602649a6bff
82cf765518b6
crates/eg-compute/src/finance/strategy.rs:70
crates/eg-compute/src/finance/strategy.rs:85
crates/eg-compute/src/finance/strategy.rs:97
EG-FINANCE-PRIMITIVES-R007.1
DCA-by-fixed-amount default strategy evaluator
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**DCA-by-fixed-amount default strategy evaluator.** A versioned `StrategySpec` with a dollar-cost-averaging-by-fixed-amount kind is evaluated deterministically into a proposed buy action, and a non-positive configured amount is refused rather than proposed. Evaluation never places or authorizes an order. | Deterministic unit tests assert the proposed-action output for a fixed-amount input fixture, the refusal on a non-positive amount, and repeat-call determinism.
requirementEG-FINANCE-PRIMITIVESVERIFIED6602649a6bff
82cf765518b6
crates/eg-compute/src/finance/strategy.rs:70
crates/eg-compute/src/finance/strategy.rs:85
crates/eg-compute/src/finance/strategy.rs:97
EG-FINANCE-PRIMITIVES-R008
Strategy backtests sealed through BacktestRun
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Strategy backtests sealed through BacktestRun.** Strategy backtests are sealed as BacktestRun records that mandate purged combinatorial cross-validation, deflated Sharpe, probability of backtest overfitting, and transaction costs, and support standard comparisons of dollar-cost averaging, lump-sum, and trend strategies over the same point-in-time universe. | Integration tests seal a BacktestRun for each compared strategy and assert the mandatory validation fields are present and mutually consistent.
requirementEG-FINANCE-PRIMITIVESVERIFIED82cf765518b6
b96ef8ebd9df
crates/eg-compute/src/finance/market/strategy_backtest.rs:105
crates/eg-compute/src/finance/market/strategy_backtest.rs:120
crates/eg-compute/src/finance/market/strategy_backtest.rs:129
EG-FINANCE-PRIMITIVES-R008.1
Dollar-cost-averaging backtest seals through BacktestRun
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Dollar-cost-averaging backtest seals through BacktestRun.** A dollar-cost-averaging-by-fixed-amount strategy's simulated contributions seal as a BacktestRun through the existing mandatory-validation seal path, refusing a non-positive contribution amount and any fill outside the point-in-time universe. | An integration test seals a BacktestRun for the fixed-amount DCA strategy and asserts the mandatory CV/Sharpe/PBO fields are present, plus refusal fixtures for a non-positive amount and an out-of-universe fill.
requirementEG-FINANCE-PRIMITIVESVERIFIED82cf765518b6
b96ef8ebd9df
crates/eg-compute/src/finance/market/strategy_backtest.rs:105
crates/eg-compute/src/finance/market/strategy_backtest.rs:120
crates/eg-compute/src/finance/market/strategy_backtest.rs:129
EG-FINANCE-PRIMITIVES-R009
Calibrated abstaining recommendations with scorecards
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Calibrated abstaining recommendations with scorecards.** Each holding or watchlist item receives a calibrated recommendation of accumulate, hold, de-risk, or abstain, citing the strategy version and supporting evidence, and per-strategy scorecards compare prior recommendations against later outcomes. Recommendations are sealed as informational-only AnalysisSnapshot records that authorize no order. | Unit tests assert that insufficient-evidence conditions produce an abstain result and that a non-abstaining recommendation cites its strategy version and evidence.
requirementEG-FINANCE-PRIMITIVESVERIFIED82cf765518b6
e93220a15cd2
crates/eg-compute/src/finance/market/recommendation.rs:81
crates/eg-compute/src/finance/market/recommendation.rs:94
EG-FINANCE-PRIMITIVES-R009.1
Calibrated recommendation decision over flip confidence
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Calibrated recommendation decision over flip confidence.** A calibrated flip-confidence outcome maps to one of accumulate, hold, de-risk, or abstain, citing the strategy version and the calibrated evidence. An abstained confidence outcome always recommends abstain. | Unit tests assert an abstained confidence outcome recommends abstain and a non-abstaining recommendation's result carries its strategy version and the cited evidence.
requirementEG-FINANCE-PRIMITIVESVERIFIED82cf765518b6
e93220a15cd2
crates/eg-compute/src/finance/market/recommendation.rs:81
crates/eg-compute/src/finance/market/recommendation.rs:94
EG-FINANCE-PRIMITIVES-R010
Margin-trading risk module with margin, sizing, live-order boundary
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Margin-trading risk module with margin, sizing, live-order boundary.** The margin-trading module models Reg T margin, futures contract specs, leveraged-ETF daily-reset decay, and US FX limits, and simulates margin calls, liquidation, position sizing, and risk of ruin. Analysis defaults to paper mode; a live leveraged order requires a per-instrument policy and designated approvers, and CFDs are flagged unavailable for US retail accounts. | Scenario-based unit tests assert margin-call and liquidation simulation results and confirm live-order eligibility is refused without a matching policy and approver.
requirementEG-FINANCE-PRIMITIVESVERIFIED76107c24568d
82cf765518b6
crates/eg-compute/src/finance/leverage.rs:113
crates/eg-compute/src/finance/leverage.rs:131
crates/eg-compute/src/finance/leverage.rs:151
crates/eg-compute/src/finance/leverage.rs:171
crates/eg-compute/src/finance/leverage.rs:98
EG-FINANCE-PRIMITIVES-R010.1
Live-order eligibility boundary
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Live-order eligibility boundary.** A live leveraged order is eligible only with a per-instrument policy naming the acting approver; a paper-mode order is never eligible, and a CFD is refused for a US retail account regardless of policy. | Unit tests confirm live-order eligibility is refused for paper mode, a missing policy, an undesignated approver, and a US-retail CFD, and confirm eligibility with a matching policy and approver.
requirementEG-FINANCE-PRIMITIVESVERIFIED76107c24568d
82cf765518b6
crates/eg-compute/src/finance/leverage.rs:113
crates/eg-compute/src/finance/leverage.rs:131
crates/eg-compute/src/finance/leverage.rs:151
crates/eg-compute/src/finance/leverage.rs:171
crates/eg-compute/src/finance/leverage.rs:98
EG-FINANCE-PRIMITIVES-R011
Finance alerts published through the finance outbox
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Finance alerts published through the finance outbox.** Price, trend-flip, DCA-due, and margin-threshold alerts are published as finance events through the outbox topic family for delivery by existing channels. | Integration tests assert each alert condition produces the correct typed event on the outbox and that delivery is idempotent on replay.
requirementEG-FINANCE-PRIMITIVESSPECIFIED3eeb3126f421
EG-FINANCE-PRIMITIVES-R011.1
Typed finance alert envelope (producer-first split of R011)
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Typed finance alert envelope (producer-first split of R011).** `FinanceAlertEnvelope` validates its identity, listing, timestamp and message. `FinanceAlertKind` assigns distinct schema names to price, trend-flip, DCA-due and margin-threshold alerts. Source: `crates/eg-types/src/finance_event_envelope.rs`. | Module tests admit a valid envelope and refuse empty identity, listing or message fields and non-positive timestamps. `each_alert_kind_has_a_distinct_outbox_schema` checks four distinct schema names. Transactional append and replay acceptance remain under R011.2 and R011.3.
requirementEG-FINANCE-PRIMITIVESVERIFIED3eeb3126f421
crates/eg-types/src/finance_event_envelope.rs:102
EG-FINANCE-PRIMITIVES-R011.2
Finance transactional append
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Finance transactional append.** Rollup of envelope conversion and atomic append acceptance below. The existing transaction owner remains the outbox authority. Intended source: `src/server/mutation_batch/compile/finish_helpers.rs`. | Both append children preserve the existing flip identity. Envelope validation alone does not establish committed delivery.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R011.2.1
Finance envelope to outbox intent
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Finance envelope to outbox intent.** The mutation compiler must convert each validated finance alert into the matching typed outbox intent. Intended source: `src/server/mutation_batch/compile/finish_helpers.rs`. | Intended test: `src/server/mutation_batch/compile.rs::tests::finance_alert_intents_preserve_schema_and_identity (intended test)`. Price, trend-flip, DCA-due and margin-threshold alerts preserve their schema, payload and event identity. Invalid envelopes refuse. Existing `finance.flip` identifiers remain unchanged.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R011.2.2
Finance event atomic commit
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Finance event atomic commit.** The server must append each finance event and its outbox fact within the existing owner transaction. Intended source: `src/server/mutation_batch.rs; src/server/mutation_batch/compile.rs`. | Intended test: `src/server/mutation_batch/tests.rs::finance_alert_and_outbox_commit_atomically (intended test)`. Each alert condition commits its typed event and outbox fact together. Failed transactions publish neither record. Unauthorized tenants and conflicting source revisions refuse.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R011.3
Finance delivery replay
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Finance delivery replay.** The server must preserve one event identity and one outbox fact when it replays a committed finance alert. Intended source: `src/server/mutation_batch.rs; crates/eg-transaction/src/outbox/mod.rs`. | Intended test: `src/server/mutation_batch/tests.rs::finance_alert_replay_preserves_one_outbox_fact (intended test)`. All four alert kinds retain their event identity across replay and restart. Existing `finance.flip` delivery remains compatible. Duplicate replay creates no extra event or delivery fact. Alert delivery never authorizes an order.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R012
Optional one-way Ghostfolio activity import
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Optional one-way Ghostfolio activity import.** An optional Ghostfolio instance on the shared Postgres database attaches through the typed source registry, and a one-way mapper converts its activities into finance-v1 records without EG writing back into Ghostfolio's own schema. Net-new, sliced per the sizing rule: `EG-FINANCE-PRIMITIVES-R012.1` (the typed flow-direction gate and activity mapping) and `.2` (the typed source-registry attachment and disposable-fixture integration tests). | Integration tests against a disposable Ghostfolio fixture assert idempotent, one-way import of activities into finance-v1.
requirementEG-FINANCE-PRIMITIVESVERIFIED82cf765518b6
eadb412ffa03
fcca865a0505
crates/eg-compute/src/finance/ghostfolio_import.rs:152
crates/eg-compute/src/finance/ghostfolio_import.rs:158
crates/eg-compute/src/finance/ghostfolio_import.rs:166
crates/eg-compute/src/finance/ghostfolio_import.rs:174
crates/eg-compute/src/finance/ghostfolio_import.rs:184
EG-FINANCE-PRIMITIVES-R012.1
A typed gate admits only a one-way Ghostfolio import, never a write-back
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**A typed gate admits only a one-way Ghostfolio import, never a write-back.** `GhostfolioFlowDirection` distinguishes importing FROM Ghostfolio (admitted) from writing BACK to it (refused unconditionally); `map_ghostfolio_activity` maps one activity into a fixed-point `MappedGhostfolioActivity`, refusing a missing source id or a non-positive price. Code root: `crates/eg-compute/src/finance/ghostfolio_import.rs`. | Unit tests assert the import direction is admitted, the write-back direction is always refused, a valid activity maps, and a missing source id or non-positive price is refused.
requirementEG-FINANCE-PRIMITIVESVERIFIED82cf765518b6
fcca865a0505
crates/eg-compute/src/finance/ghostfolio_import.rs:152
crates/eg-compute/src/finance/ghostfolio_import.rs:158
crates/eg-compute/src/finance/ghostfolio_import.rs:166
crates/eg-compute/src/finance/ghostfolio_import.rs:174
crates/eg-compute/src/finance/ghostfolio_import.rs:184
EG-FINANCE-PRIMITIVES-R012.2
Ghostfolio attaches through the typed source registry with disposable-fixture coverage
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Ghostfolio attaches through the typed source registry with disposable-fixture coverage.** Depends on `EG-FINANCE-PRIMITIVES-R012.1`. `register_ghostfolio_source` attaches an optional Ghostfolio instance under a source name, admitted only via the `ImportFromGhostfolio` direction. `import_ghostfolio_fixture` maps a disposable fixture of raw activity rows, deduplicating by `ghostfolio_activity_id` so a repeated row or a re-run import is idempotent. Code root: `crates/eg-compute/src/finance/ghostfolio_import.rs`. | Integration tests against a disposable Ghostfolio fixture assert idempotent, one-way import of activities into finance-v1.
requirementEG-FINANCE-PRIMITIVESVERIFIEDeadb412ffa03
crates/eg-compute/src/finance/ghostfolio_import.rs:191
crates/eg-compute/src/finance/ghostfolio_import.rs:198
crates/eg-compute/src/finance/ghostfolio_import.rs:221
EG-FINANCE-PRIMITIVES-R013
Golden accounting and risk fixtures with full provenance
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Golden accounting and risk fixtures with full provenance.** Finance golden fixtures cover broker statements, corporate actions, daylight-saving and session boundaries, leveraged-ETF decay against published returns, and futures rolls, using fixed-point arithmetic with no floating-point money. Every displayed figure carries its source, as-of time, and session. Net-new, sliced per the sizing rule: `EG-FINANCE-PRIMITIVES-R013.1` (the figure shape and provenance-refusal gate) and `.2` (the fixtures themselves, compared against published reference values). | Golden fixture tests compare computed results against published reference values and assert the source, as-of, and session provenance fields are present on every output.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R013.1
A golden-fixture figure is refused when its provenance is incomplete
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**A golden-fixture figure is refused when its provenance is incomplete.** `GoldenFixtureFigure` carries a fixed-point `value_ticks`, `source`, `as_of`, and `session`; `check_figure_provenance` refuses a figure missing any provenance field. Code root: `crates/eg-compute/src/finance/golden_fixture.rs`. | Unit tests assert a fully-provenanced figure is admitted and a figure missing its source, as-of time, or session is refused.
requirementEG-FINANCE-PRIMITIVESVERIFIED168b52ef6307
fcca865a0505
crates/eg-compute/src/finance/golden_fixture.rs:117
crates/eg-compute/src/finance/golden_fixture.rs:123
crates/eg-compute/src/finance/golden_fixture.rs:132
crates/eg-compute/src/finance/golden_fixture.rs:140
EG-FINANCE-PRIMITIVES-R013.2
Golden fixtures compare computed figures against published reference values
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Golden fixtures compare computed figures against published reference values.** Depends on `EG-FINANCE-PRIMITIVES-R013.1`. Oversized; delivered as grandchildren, producer first: `EG-FINANCE-PRIMITIVES-R013.2.1` (the broker-statement comparison fixture), `.2.2` (corporate-action fixtures), `.2.3` (DST/session-boundary fixtures), `.2.4` (leveraged-ETF-decay fixtures), and `.2.5` (futures-roll fixtures). Comparison-fixture unit tests alone do not establish independent broker-statement dataset acceptance. Every grandchild must satisfy its acceptance before this parent is complete. | Golden fixture tests compare computed results against published reference values and assert the source, as-of, and session provenance fields are present on every output.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R013.2.1
Broker-statement golden fixture comparison
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Broker-statement golden fixture comparison.** `compare_broker_statement_figure` refuses a computed `GoldenFixtureFigure` with incomplete provenance (via `check_figure_provenance`) before comparing it, then refuses a `value_ticks` that diverges from its published reference tick value. Code root: `crates/eg-compute/src/finance/golden_fixture.rs`. | Golden fixture tests compare a computed figure against its published reference value and assert provenance is checked first.
requirementEG-FINANCE-PRIMITIVESVERIFIEDeadb412ffa03
crates/eg-compute/src/finance/golden_fixture.rs:148
crates/eg-compute/src/finance/golden_fixture.rs:156
crates/eg-compute/src/finance/golden_fixture.rs:168
EG-FINANCE-PRIMITIVES-R013.2.2
Corporate-action golden fixtures against published notices
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Corporate-action golden fixtures against published notices.** Reuse the existing corporate-action and fixed-point accounting authorities to replay checked-in split and dividend vectors from independently published issuer or exchange notices. Record the notice URL, publication/version and content digest, effective/as-of time, session and currency; every computed figure passes R013.1. Planned code root: `crates/eg-compute/src/finance/`. | Exact reference share, basis and cash ticks match before and after the action; a changed reference value or missing source/as-of/session fails. Expected values must be independently transcribed from the cited source, never computed by the implementation under test.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R013.2.3
DST and session-boundary golden fixtures against published exchange calendars
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**DST and session-boundary golden fixtures against published exchange calendars.** Replay checked-in opening/closing and daylight-saving transition vectors using versioned exchange calendar and offset source records. Record the source URL, publication/version and content digest, as-of time and expected session on each result. Every displayed figure passes R013.1. Planned code root: `crates/eg-compute/src/finance/`. | Published boundary and offset vectors reproduce the expected session and timestamp across both DST transitions. Incorrect offsets/session labels and missing source/as-of/session fail. Replaying under different host time zones cannot change the reference result.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R013.2.4
Leveraged-ETF daily-reset decay golden fixtures against published returns
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Leveraged-ETF daily-reset decay golden fixtures against published returns.** Run the existing daily-reset calculation over a checked-in multi-session path and compare with independently published fund return/NAV references under explicit fee and rounding assumptions. Record the provider URL, publication/version and content digest, as-of time, session and currency; use fixed-point money and the R013.1 gate. Planned code root: `crates/eg-compute/src/finance/`. | The reference path matches exact ticks under the documented scale/rounding policy and exhibits the published daily-reset result; a changed return/reference, an omitted reset, or missing source/as-of/session fails. Expected values cannot be derived by the implementation under test.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R013.2.5
Futures-roll golden fixtures against published contract and settlement records
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Futures-roll golden fixtures against published contract and settlement records.** Replay a checked-in expiring-to-successor contract roll through existing finance authorities using independently published exchange settlements, expiry dates, tick sizes and multipliers. Record source URLs, publication/versions and content digests, as-of time, session and currency; use fixed-point money and the R013.1 gate. Planned code root: `crates/eg-compute/src/finance/`. | Roll cash and position values match independent reference ticks for the declared contracts and roll policy; wrong contract terms/reference ticks and missing source/as-of/session fail. Replaying the same sourced vector is byte-identical.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R014
finance-v1 thin instrument and signal module
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**finance-v1 thin instrument and signal module.** finance-v1 defines a thin module of Instrument, Listing, Venue, BarSeries, IndicatorSpec, SignalState, TrendFlip, and MacroEvent types aligned to the FIBO ontology. | Schema validation tests confirm each type's required fields and its alignment to the FIBO ontology.
requirementEG-FINANCE-PRIMITIVESVERIFIED46c93a87f9ed
532418b7e55b
src/server/graph_schema/finance_tests.rs:230
src/server/graph_schema/finance_tests.rs:83
EG-FINANCE-PRIMITIVES-R015
AnalysisSnapshot records with share.read control leases
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**AnalysisSnapshot records with share.read control leases.** AnalysisSnapshot records capture informational analysis output together with a share.read control-lease link for access control, and each snapshot carries a notice marking the output as informational-only. | Unit tests assert a sealed AnalysisSnapshot includes its control-lease link and informational-only notice.
requirementEG-FINANCE-PRIMITIVESSPECIFIED3899594fed44
EG-FINANCE-PRIMITIVES-R016
Incremental deterministic indicator kernels with Pine parity
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Incremental deterministic indicator kernels with Pine parity.** Indicator kernels for ATR, SuperTrend, SMA and EMA, 200-week SMA, the 20/21 band, and Heikin-Ashi are computed incrementally and deterministically, with Pine parity fixtures proving the reference implementation matches. | Parity fixture tests compare each kernel's output against the Pine reference implementation on shared bar data.
requirementEG-FINANCE-PRIMITIVESVERIFIED532418b7e55b
8bb121fedd18
crates/eg-compute/src/finance/market/pine_parity_tests.rs:102
crates/eg-compute/src/finance/market/pine_parity_tests.rs:112
crates/eg-compute/src/finance/market/pine_parity_tests.rs:122
crates/eg-compute/src/finance/market/pine_parity_tests.rs:134
crates/eg-compute/src/finance/market/pine_parity_tests.rs:165
EG-FINANCE-PRIMITIVES-R017
BacktestRun provenance record with mandatory fields
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**BacktestRun provenance record with mandatory fields.** A BacktestRun record captures full provenance for a backtest, including mandatory purged combinatorial cross-validation, deflated Sharpe, probability of backtest overfitting, transaction costs, the fill rule, the point-in-time universe, and a no-look-ahead check. | Unit tests assert sealing a BacktestRun without any mandatory field is refused and that a valid record passes the no-look-ahead check.
requirementEG-FINANCE-PRIMITIVESVERIFIED46c93a87f9ed
532418b7e55b
crates/eg-compute/src/finance/market/record_tests.rs:379
crates/eg-compute/src/finance/market/record_tests.rs:420
EG-FINANCE-PRIMITIVES-R018
Factor research records each factor as a typed node (rollup)
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Factor research records each factor as a typed node (rollup).** The finance domain must compute information coefficient and information ratio per factor and rank the factors. It must record each factor as a typed graph node with provenance to its inputs. | Tests prove ranking, node recording and typed abstention on thin input.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R018.1
Model
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Model.** `crates/eg-compute/src/finance/factor.rs` must define `FactorRecord` with factor id, information coefficient, information ratio, rank and input provenance keys. | Unit test round-trips a record and rejects an empty provenance list.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R018.2
Behavior
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Behavior.** `rank_factors` must call `information_coefficient` and `information_ratio` at `crates/eg-numeric/src/evaluation/skill.rs:16` and `:31`. The rank rule should default to absolute information ratio. | Unit test ranks three factors in the expected order.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R018.3
Wiring
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Wiring.** The route for `FinanceInformationCoefficient` at `src/server/handlers/finance/route_families.rs:211` must dispatch to `rank_factors` for a factor set. Its production caller is the served finance wire method. | Test asserts a factor-set request reaches `rank_factors`.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R018.4
Refusal
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Refusal.** Empty or single-row input must return the typed abstention `FACTOR_INSUFFICIENT_DATA` and record no node. | Test sends zero and one row and asserts the abstention and no node.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R018.5
Evidence
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Evidence.** Each recorded node must carry `derivedFrom` edges to its inputs and the kernel versions used. | Test reads one node and asserts the edges and versions.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R018.6
Hot-path proof
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Hot-path proof.** The entry point is the served finance wire method. It must rank three factors and write three nodes. | Integration test `tests/finance_factor_ranking.rs` asserts the ranking, the nodes and the edges.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R015.1
Immutable order-proposal snapshot and atomic admission boundary
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Immutable order-proposal snapshot and atomic admission boundary.** EG owns `OrderProposalSnapshotV1` with `{tenant_id, proposal_id, revision, predecessor_digest, decision_id, decision_revision, decision_digest, payload_schema_id, payload_schema_revision, canonical_payload_bytes, payload_sha256, policy_id, policy_revision, policy_digest, evidence_refs: [{owner_requirement_id, record_id, revision, digest}]}`. EG defines typed `FinanceOrderProposal.StageV1` and `FinanceOrderProposal.PromoteV1` methods. `StageV1` accepts the snapshot plus expected head revision/digest. It creates a sealed, create-only, content-addressed snapshot. It returns `{proposal_id, revision, predecessor_digest, snapshot_digest, state=staged}`. Revision 1 has no predecessor. Each later revision names the exact prior digest and uses expected-head compare-and-set. An exact same-revision/digest retry is idempotent. Conflicting bytes at that revision refuse. `PromoteV1` accepts `{tenant_id, proposal_id, candidate_revision, snapshot_digest, expected_promoted_revision, required_gate_manifest_digest, gate_receipts}`. Each gate receipt binds `{gate_id, gate_revision, candidate_digest, pass_fail, evidence_digest}`. Recompute SHA-256 over schema-versioned canonical payload bytes and the staged digest. Validate R019 decision verification/approval and applicable R010 risk/sizing policy. Include per-instrument policy and designated approvers when applicable. Atomically write the promoted pointer, append-only `derivedFrom` history, and `OrderAdmissionReceiptV1`. The receipt binds `{proposal_id, revision, snapshot_digest, decision_digest, policy_id, policy_revision, policy_digest, gate_manifest_digest, gate_receipt_digests, transaction_revision}`. A stale head, payload/hash mismatch, missing or mismatched evidence, failed or unavailable gate, incomplete receipts, or hook veto refuses. Refusal writes no pointer, history, or admission receipt. Output means host-review admission only. It is not an order or provider effect. Preserve `EG-DECISION-ENGINE-R019`, `EG-DURABLE-KERNEL-R057`, and `EG-FINANCE-PRIMITIVES-R015`. **Exact cross-owner hold:** the reviewed evidence lacks the SDK writeback payload schema/version. It lacks the admission-gate manifest owner, complete gate-id set, and required hook contracts. It also lacks GraphOS confirmation operation and receipt fields. Until those owners define them, EG may stage and validate the opaque versioned snapshot. EG must refuse promotion for host review. SDK writeback must not cause an effect. Source record SHA-256 `e3ad9b1e3121eb3278c3e2b52ce948817e317db3de48d5886a624ffe2ba9be47`. This remains SPECIFIED; no implementation or consumer receipt is claimed. | Planned tests: `StageV1` creates and independently reads back revision 1. Stage revision 2 with the correct predecessor. Prove exact retries are idempotent. Refuse same-revision byte changes, hash mismatches, stale heads, missing/mismatched DecisionCommit or R010 evidence, incomplete receipts, and each failed/unavailable gate. Each refusal leaves pointer, history, and receipt absent and unchanged. Promotion must refuse with no writes until the SDK schema, gate registry, and GraphOS confirmation contract are served. Then prove atomic admission with host-review-only output. No order is sent.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R002.11
Multi-horizon Markov regime forecast and policy-bound sizing input
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Multi-horizon Markov regime forecast and policy-bound sizing input.** Extend the existing `eg-numeric` regime-HMM kernel and typed model route from R002.1.14/R002.9. `RegimeForecastV1` accepts `{model_id, model_revision, source_series_id, source_revision, as_of, increasing_positive_horizons, horizon_unit, calibration_policy_id, calibration_policy_revision, calibration_policy_digest, heldout_dataset_digest}`. Resolve ordered state IDs, posterior `p0`, and transition matrix `T` only from the pinned HMM model/source revision. Refuse caller-supplied state probabilities or `T`. For each horizon `h`, compute `p_h=p0*T^h` and preserve state order. Return `{forecast_digest, model/source revisions, as_of, ordered_state_ids, posterior_p0, transition_matrix_digest, per_horizon_probability_vectors, per_horizon_top_state_probability, calibration_evidence_by_horizon}`. Require finite nonnegative probabilities. Require the posterior, held-out prediction, output vectors, and transition rows to sum to one within pinned model precision. Each held-out sample binds `{sample_id, model_revision, source_series_id, origin_as_of, horizon, ordered_state_ids, predicted_probability_vector, realized_state_id, target_observation_at, scoring_revision}`. Require origin before target observation. Require unique sample IDs and matching state order/model revision. Require one row per source/origin/horizon. Compute categorical Brier separately for each horizon: `Brier_h = (1/N_h) Σ_n Σ_s (p_{n,h,s} - 1[y_n=s])²`. Bind dataset, model, state-order, and scoring revisions. Require positive `N_h` meeting `minimum_heldout_examples_by_horizon`. A versioned policy supplies per-horizon `max_brier_by_horizon` in [0,2]. It supplies `min_top_state_probability_by_horizon` in [0,1]. It supplies positive integer `minimum_heldout_examples_by_horizon`. Each policy map covers every requested horizon exactly once. All thresholds must pass before sizing eligibility. Return `{horizon, dataset_digest, model_revision, state_ids_digest, scoring_revision, calibration_policy_digest, sample_count, brier, applied_thresholds, passed}`. R010 sizing consumes the forecast digest and `RegimeSizingPolicyV1` `{policy_id, revision, instrument_id, target_weight_by_state, unit, fixed_point_scale, risk_cap}`. All state weights and the risk cap use the same R010 policy unit/scale. Compute `expected_target_weight_h=Σ_s p_{h,s}×target_weight_s`, then apply its risk cap. Missing weights, exceeded cap, stale revision, or failed calibration returns typed abstention and no sizing value. Never create an order. Invalid dimensions, duplicate state IDs, negative/nonfinite probabilities, and non-stochastic rows refuse. Empty/unsorted horizons and stale model/source revisions also refuse. Duplicate, missing, or future-leaking calibration rows refuse. Zero denominator, sample counts below the policy floor, invalid policy, or unknown thresholds refuse. A refused forecast is never sizing-eligible. Preserve `EG-DECISION-ENGINE-R103`, `EG-FINANCE-PRIMITIVES-R002`, R010, R002.1.14, R002.6.2, and R009.1. R009.1 remains flip calibration, not state calibration. **Exact policy hold:** source evidence supplies no Brier thresholds, confidence floors, sample floors, state weights, or risk cap. A complete versioned policy must supply each value. No defaults exist. Missing or invalid values refuse sizing. Source record SHA-256 `037f3edf5fe38f55ac24d6e0cc7bd85f1efc60cadf7c97b66b44978613a7acb6`. This remains SPECIFIED; no implementation or served receipt is claimed. | Planned tests: Seed a three-state transition matrix and compare independent `p0*T^h` vectors at every horizon. Confirm each vector sum is one. Compare held-out Brier with the formula using a positive denominator. Bind dataset, model, state order, and scoring revision. Confirm deterministic sizing with a complete policy. Refuse malformed matrices/vectors, nonfinite/negative values, duplicate/reordered states, stale revisions, and invalid horizons. Also refuse missing/duplicate samples and future-leaking origins. Refuse zero denominator, low sample counts, threshold failures, missing weights, and risk-cap excess. Vary one state probability and prove sizing changes only through bound R010 policy. No live-order effect occurs. Missing policy values refuse; they are not runtime test claims.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R613
Regime detection and optimal-execution schedules are engine numeric kernels (rollup)
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Regime detection and optimal-execution schedules are engine numeric kernels (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` pass their tests.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R613.1
Model
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Model.** `crates/eg-numeric/src/execution.rs` defines RegimeState, TransitionMatrix, ExecutionPlan, AlmgrenChriss, MarketMakingQuote, PairsSignal. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R613.2
Behavior
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Behavior.** A Markov chain over thresholded returns estimates a transition matrix and forecasts regime probabilities with a backtest summary. Execution schedules solve discrete and continuous impact-minimizing trajectories, market-making quotes and pairs signals from declared parameters. All results are deterministic for fixed input. | Unit tests cover each rule with positive and boundary cases.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R613.3
Wiring
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Wiring.** Registered with the numeric kernel and reachable through the finance methods of EG-FINANCE-PRIMITIVES. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R613.4
Refusal
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Refusal.** Non-positive risk aversion, horizon or volatility is refused with the field name. The stable code is `EXEC_PARAM_INVALID`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R613.5
Evidence
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Evidence.** Result carries parameters, objective and solver status. | Test reads the trace or metrics after one success and one refusal.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R613.6
Hot-path proof
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Hot-path proof.** schedule solve of 1000 slices under 2 ms p99; regime fit over 1M bars under 250 ms p99. The benchmark is `benches/r613_finance_primitives.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R750
Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure (rollup)
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure (rollup).** Rust-native in `crates/eg-numeric/src/finance`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R750.750
Model: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Model: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure.** The numeric crate holds deterministic kernels, and the finance domain exposes them. The kernels cover alpha factors, mean-variance and risk-parity optimization, cointegration and pairs statistics, and regime detection. They also cover microstructure estimators, price-action pattern classification, signal fusion, profit attribution and a risk-first limit pipeline. Types: `AlphaFactor`, `PortfolioWeights`, `RiskLimitSet`, `RegimeState`, `CointegrationTest`, `PatternMatch`, `AttributionBreakdown`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R750.751
Behavior: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Behavior: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure.** Kernels use fixed-point or pinned software floating point, so results are identical across targets. They take explicit windows. They return typed insufficient-data results. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R750.752
Refusal: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Refusal: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure.** The engine refuses a window shorter than the minimum, a singular covariance and a limit breach. Each refusal carries a typed reason and no partial result. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R750.753
Hot-path proof: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Hot-path proof: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure.** Criterion benchmark `finance_kernels` runs over 500 assets by 1k bars. The p50 is under 25 ms and the p99 is under 60 ms. Memory stays under 48 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R751
Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion (rollup)
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion (rollup).** Rust-native in `crates/eg-types/src/finance`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R751.750
Model: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Model: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion.** The engine stores these as typed graph records with provenance. They are bull and bear debate rounds, journal entries with bias audits, and immutable versioned orders. They are also forensic screens, filing differences, and sentiment and geopolitical scores. The last group is copy-trade cards and shared strategy cards. Types: `DebateRound`, `TradeJournalEntry`, `BiasAudit`, `VersionedOrder`, `ForensicFlag`, `SentimentFusion`, `GeopoliticalRisk`, `StrategyCard`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R751.751
Behavior: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Behavior: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion.** Orders are append-only revisions with a digest chain. Scores are computed from cited records and carry their evidence ids. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R751.752
Refusal: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Refusal: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion.** An order revision that rewrites history, a score without evidence and a strategy card without a licence-class fact are refused. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R751.753
Hot-path proof: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Hot-path proof: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion.** Criterion benchmark `order_chain_append`. The p50 is under 150 microseconds and the p99 is under 700 microseconds. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R900
Position sizing and distribution-shift detection (rollup)
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Position sizing and distribution-shift detection (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` pass.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R900.1
Model
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Model.** `crates/eg-numeric/src/sizing.rs` defines `KellyInput { accuracy, win_loss_ratio, fraction, max_risk }` and `ShiftResult { statistic, p_value, shifted }`. Accuracy lies in [0, 1]. The fraction defaults to one half and the cap to 0.02. | Unit test round-trips both types and rejects an accuracy outside [0, 1].
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R900.2
Behavior
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Behavior.** `kelly_fraction` returns `(p * b - q) / b`, scaled by the fraction and clamped to [0, max_risk]. A ratio of zero or less returns zero. `distribution_shift` calls `eg_numeric::stats::ks_2samp` and reports a shift when the statistic exceeds the threshold. Both are pure. Sizing is O(1); shift detection is O(n log n). | Unit tests compare against published Kelly values and `ks_2samp` vectors.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R900.3
Wiring
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Wiring.** The finance route family in `src/server/handlers/finance/route_families.rs` serves both kernels. Callers that size positions call this route and hold no copy of the formula. | Test calls the served route and asserts the kernel ran.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R900.4
Refusal
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Refusal.** A non-finite input is refused with `SIZING_INPUT_INVALID`. An empty sample is refused with `SHIFT_SAMPLE_EMPTY`. | Test submits each invalid input and asserts the code.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R900.5
Evidence
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Evidence.** Each call records the inputs digest, the result and the cap that applied. | Test reads the trace after one call.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R900.6
Hot-path proof
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Hot-path proof.** Shift detection over two samples of 100k values: p50 under 25 ms, p99 under 60 ms, memory under 8 MiB. The benchmark is `benches/r900_sizing_shift.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R901
Banking risk calculations: AML screening, capital ratios, credit loss and settlement legs (rollup)
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Banking risk calculations: AML screening, capital ratios, credit loss and settlement legs (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` pass.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R901.1
Model
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Model.** `crates/eg-numeric/src/banking.rs` defines `AmlRule`, `AmlAlert`, `CapitalInputs`, `CapitalRatios`, `CreditExposure` and `SettlementLeg`. Severities are a closed enum: info, warning, critical, report-required. | Unit test round-trips each type and rejects an unknown severity.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R901.2
Behavior
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Behavior.** `screen_transaction` raises a structuring alert for an amount in [0.8 t, t) and a threshold alert at or above t. `capital_ratios` divides CET1, AT1 and Tier 2 capital by risk-weighted assets and compares them with the 4.5 percent CET1, 8 percent total capital and 3 percent Tier 1 to total exposure minimums. `expected_loss` returns PD times LGD times EAD. `settlement_chain` builds ordered legs through the correspondent chain. All are pure and O(n) in their inputs. | Unit tests cover each rule at, below and above every boundary.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R901.3
Wiring
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Wiring.** The finance route family serves these kernels. Banking records arrive from the SDK `finance.banking` models of SDK-FINANCE-SOURCES-R900. No connector computes them. | Test calls each served route and asserts the kernel ran.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R901.4
Refusal
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Refusal.** Zero or negative risk-weighted assets are refused with `CAPITAL_RWA_INVALID`. A PD or LGD outside [0, 1] is refused with `CREDIT_INPUT_INVALID`. | Test submits each invalid input and asserts the code.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R901.5
Evidence
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Evidence.** Each call records the rule set version, the inputs digest and the outcome. | Test reads the trace after one call of each kernel.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-FINANCE-PRIMITIVES-R901.6
Hot-path proof
Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source
**Hot-path proof.** Screening of 100k transactions: p50 under 20 ms, p99 under 50 ms, memory under 8 MiB. The benchmark is `benches/r901_banking_risk.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-FINANCE-PRIMITIVESSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER
EG-INGEST-WORKER — Durable ingest worker
specNoneSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001
Ingest worker capability is served by the engine queue and run by the SDK runner (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Ingest worker capability is served by the engine queue and run by the SDK runner (rollup).** Replaces agent-utilities `kg-ingest-worker` (ingest_worker.py, deleted by commit b02e39950). Split into `EG-INGEST-WORKER-R001.1`-`EG-INGEST-WORKER-R001.17`; satisfied only when every child is satisfied. | See each child.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.1
Typed ingest job envelope with refusal tests
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Typed ingest job envelope with refusal tests.** `eg-types` (file to be created: crates/eg-types/src/ingest_job.rs) defines `IngestJobEnvelope{job_id, tenant, corpus_key, kind, target, attempt}`. A blank job_id, blank target, unknown kind or attempt above the retry ceiling is refused with a typed error. | Unit tests in the same file cover each refusal and a serde round trip.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.2
Typed job kinds and lane derivation
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Typed job kinds and lane derivation.** One `IngestJobKind` enum (document, codebase, skill_workflows, capability_hydration) and one pure function `lane_for(kind)` returning hydration for skill_workflows and capability_hydration, general otherwise, in the same file as R001.1. | Unit test asserts the lane for every kind.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.3
Partition key function
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Partition key function.** One pure function `partition_key(envelope)` in the same file returns the tenant, then corpus, then kind hierarchy so the queue can keep per-tenant and per-corpus ordering without global serialization. | Unit test asserts equal keys for jobs of one corpus and different keys across tenants.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.4
Enqueue maps onto the served task queue with deterministic ids
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Enqueue maps onto the served task queue with deterministic ids.** One function `enqueue_ingest_job` in crates/eg-capabilities/src (file to be created: ingest_queue.rs) wraps `TaskQueueEnqueue` from EG-DURABLE-KERNEL-R072 on queues `ingest` and `ingest-hydration`, deriving the task id from job_id so a duplicate enqueue is a no-op. | Integration test enqueues the same job twice and asserts one claimable task.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.5
Prerequisite: durable task queue (this repository, EG-DURABLE-KERNEL-R071, R072, R073)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Prerequisite: durable task queue (this repository, EG-DURABLE-KERNEL-R071, R072, R073).** Typed enqueue/claim/ack model, served RPC pair and generated Python client methods must land before R001.4 and R001.11. Not re-specified here. | Linked rows verified by their own tests.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.6
Prerequisite: worker registry, reserved admission and scheduler floors (this repository, EG-DURABLE-KERNEL-R074, R075, R076)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Prerequisite: worker registry, reserved admission and scheduler floors (this repository, EG-DURABLE-KERNEL-R074, R075, R076).** The reserved hydration floor in R001.10 is computed from the served `SchedulerConfig` lane floors, not a worker-side environment knob. | Linked rows verified by their own tests.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.7
Typed retry policy with validation
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Typed retry policy with validation.** One `IngestRetryPolicy{max_attempts, base_delay, max_delay, jitter}` model in the same file as R001.1; zero attempts, base above max, or negative jitter is refused. | Unit tests for each refusal.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.8
Retry delay function with jitter
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Retry delay function with jitter.** One function `next_delay(policy, attempt, seed)` returns a bounded exponential delay with jitter so idle or failed workers do not retry in lockstep. | Unit test asserts the bound, monotonic growth and that two seeds differ.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.9
Failure routing: retry then dead letter
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Failure routing: retry then dead letter.** The ack path of R001.4 maps a failed outcome to redelivery with `next_delay` while attempts remain, and to a dead-letter record carrying the last error once exhausted. Reuse the SourceIngest dead_letter capability named in EG-REPO-INGEST-R002 rather than a second dead-letter writer. | Integration test fails a job past max_attempts and asserts one dead-letter record and no further delivery.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.10
Hydration-reserved lane served as a distinct queue
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hydration-reserved lane served as a distinct queue.** Claim on `ingest-hydration` is admitted first for reserved workers using `AdmitWorkerTask` (EG-DURABLE-KERNEL-R075); a lone worker is never fully reserved. | Integration test with a one-worker pool asserts it still claims general work; with two, one claims hydration first.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.11
Backpressure read and producer refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Backpressure read and producer refusal.** One read op `IngestQueueDepth` returns depth and oldest-age per queue. `enqueue_ingest_job` refuses above a configured depth with stable code INGEST_QUEUE_FULL and bounded detail so producers can slow down. | Integration test fills the queue to the limit and asserts the refusal code and that depth is unchanged.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.12
Lease renewal for long jobs
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Lease renewal for long jobs.** The runner renews the claim through the existing `RenewWorkItemLease` method at a third of the lease. A missed renewal lets the job redeliver. Already provided by the work-item coordination domain. Verify with a test. | Integration test pauses renewal and asserts redelivery after expiry.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.13
Ingest queue metrics
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Ingest queue metrics.** Engine exports gauges `eg_ingest_queue_depth`, `eg_ingest_oldest_age_seconds` and counters `eg_ingest_jobs_total{outcome}`, `eg_ingest_dead_letter_total`, from the R001.11 read. | Metrics test scrapes after one success, one retry and one dead letter and asserts the values.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.14
Cross-repo (connector SDK repository): ingest worker runner
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Cross-repo (connector SDK repository): ingest worker runner.** Add a runner module with one function `run_ingest_worker` that claims through the generated client, executes the job body, acks success or failure, and commits only after the ack (at-least-once). The job body reuses the SDK's existing source-effect runners; EG holds no source credentials. | SDK unit test with a fake client asserts ack after execution and no ack when the body is killed.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.15
Cross-repo (connector SDK repository): CLI entry point and autosize
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Cross-repo (connector SDK repository): CLI entry point and autosize.** Add one console command `ingest-worker` with `--workers` (default CPU and memory autosized, 0.36 of cores, 3 GiB per worker) and `--engine-endpoint`; it fails loud with a non-zero exit if the engine is unreachable or lacks the task-queue methods before claiming anything, and drains on SIGTERM. | CLI test asserts exit code 2 against an unreachable engine and clean drain on SIGTERM.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.16
Cross-repo (graph-os): host and supervise the worker
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Cross-repo (graph-os): host and supervise the worker.** graph-os declares the worker as a supervised deployment unit and surfaces its health and the R001.13 metrics through its existing health route. It does not contain job logic. | Graph-os health test asserts a stopped worker shows as unhealthy.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.17
Parity test against the deleted module
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Parity test against the deleted module.** One test enumerates the parity table in plan.md and asserts every row marked exists or to-build has a passing proving test, and rows marked dropped carry a reason. | The test runs in the spec checks.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.1006
Model: catalogue, log and declaration ingest
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model: catalogue, log and declaration ingest.** `eg-ingest` defines `ToolCatalogEntry{server_ref, tool_name, schema_digest, freshness_digest}`, `LogRecord{source_ref, level, at_ms, body_ref}` and `DataPrepDeclaration{field_refs, policy_digest, capability}`. No record holds a credential. Arbora deleted its engine discovery mixin, its log self-ingest and its declaration loader. | Planned: model tests in `crates/eg-ingest/tests/catalog_logs.rs`
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.1007
Behavior: catalogue, log and declaration ingest
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior: catalogue, log and declaration ingest.** A catalogue ingest compares the freshness digest and writes only changed entries, in O(tools). A log batch appends in arrival order. A new declaration replaces the old one in one transaction. | Planned: behavior tests in `crates/eg-ingest/tests/catalog_logs.rs`
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.1008
Wiring: catalogue, log and declaration ingest
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring: catalogue, log and declaration ingest.** The served methods are `ingest.tool_catalog`, `ingest.process_logs` and `ingest.data_prep_declaration`. Each method takes the verified request context and writes through `MutationBatch`. | Planned: a contract test checks that the manifest lists every method.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.1009
Refusal: catalogue, log and declaration ingest
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal: catalogue, log and declaration ingest.** The engine refuses a catalogue entry with inline credentials. It refuses a log batch over 4 MiB. It refuses a declaration that names an import path or an executable. | Planned: refusal tests in `crates/eg-ingest/tests/catalog_logs.rs`
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.1010
Evidence: catalogue, log and declaration ingest
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence: catalogue, log and declaration ingest.** Per batch, the engine reports written, unchanged and refused counts. An unchanged catalogue writes nothing. | Planned: an evidence test reads the counts after one success and one refusal.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R001.1011
Hot-path proof: catalogue, log and declaration ingest
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof: catalogue, log and declaration ingest.** Criterion benchmark `tool_catalog_ingest` ingests 1,000 servers of 50 tools with 16 concurrent writers. The p50 per server is under 2 ms and the p99 under 10 ms, under 128 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress by more than 10 percent.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R002
Ontology induction from text stays a draft until it passes checks (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Ontology induction from text stays a draft until it passes checks (rollup).** The ingest worker must propose classes and properties from unstructured text, then populate instances against that proposal. A proposal must be admitted only after property-coverage and redundancy checks pass. Otherwise it must stay a draft. | Tests prove a passing proposal is admitted and a failing one stays a draft.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R002.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** `crates/eg-types/src/ontology_proposal.rs` must define `OntologyProposal` with classes, properties, a `state` of `Draft` or `Admitted`, and provenance. New proposals must start as `Draft`. | Unit test round-trips a proposal and asserts the initial state.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R002.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** `score_proposal` must compute property coverage and class redundancy. The defaults should be coverage of at least 0.8 and redundancy of at most 0.1, replaced by measurement. | Unit test checks three proposals against both thresholds.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R002.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** The `ingest_document` job body must call `score_proposal` after induction. This row creates the call site in `crates/eg-capabilities/src/ingest_queue.rs`, reached from the runner of R001.14. | Test runs one document job and asserts the check ran.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R002.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** A proposal that fails a check must stay `Draft` and return `PROPOSAL_NOT_ADMITTED` with the failing check. Instances must not populate against it. | Test fails coverage and asserts the draft state and zero instances.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R002.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Each job must record `coverage`, `redundancy` and `decision` in its trace. | Test reads the trace after one admitted and one draft job.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R002.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The entry point is the served ingest queue claim. A worker claims a document job and the passing proposal must reach `Admitted`. | Integration test `tests/ingest_ontology_induction.rs` runs one passing and one failing document and asserts both states.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003
Documents become typed knowledge atoms with mandatory provenance (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Documents become typed knowledge atoms with mandatory provenance (rollup).** The ingest worker must decompose documents and interactions into typed atoms, each with a provenance key. A query must select only relevant atoms to build context. Children `.1` to `.18` cover atoms, normalized documents and transcript records. | Satisfied only when `.1` to `.18` are verified.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** `crates/eg-types/src/knowledge_atom.rs` (new; search terms in `plan.md`) must define `KnowledgeAtom` with `atom_id`, `kind`, `text`, `provenance_key` and `tenant`. The `kind` set is closed: fact, event, preference, procedure. | Unit test round-trips an atom and rejects an unknown kind.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** `decompose(document, policy)` must emit atoms from the parsed chunks of `crates/eg-document/src/contract.rs:141`. `select_atoms(query, atoms, budget)` must rank atoms by relevance and stop at the token budget. Both defaults should be replaced by measurement. | Unit test decomposes one document and selects under a budget.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** The `ingest_document` job body must call `decompose` and store atoms. This row creates the call site in `crates/eg-capabilities/src/ingest_queue.rs`, reached from the runner of R001.14. The context query path must call `select_atoms`. No production caller exists for either function today. | Test runs one document job and asserts atoms exist.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** An atom without a provenance key must return `ATOM_PROVENANCE_MISSING` and must not be stored. A query over zero relevant atoms must return an empty context, not a guess. | Test submits an atom without provenance and asserts the refusal and zero stored atoms.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Each job must record `atoms_emitted`, `atoms_refused` and the context query must record `atoms_selected` and `tokens_used` in its trace. | Test reads the trace after one job and one query.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The entry point is the served ingest queue claim. A worker claims a document job. A later query assembles context from atoms alone and cites each provenance key. | Integration test `tests/ingest_knowledge_atoms.rs` ingests one document, queries it and asserts selected atoms and provenance.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.7
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** The engine must add `NormalizedDocument`, `NormalizationReceipt` and `QuarantineReceipt` in new `crates/eg-types/src/source_document.rs`. They must reuse `SourceIngestionRequest` at `crates/eg-types/src/source_ingestion.rs:265`. Fields must include source digest, mapping revision, document ID, atom IDs and concept IDs. `SourceIngestionOutcome` must distinguish `Accepted(SourceIngestionReceipt)` from `Quarantined(QuarantineReceipt)`. The quarantine receipt must carry a typed reason, restricted evidence reference, replay disposition and optional prior accepted checkpoint. The engine must derive tenant and policy identities from verified server authority. | Planned proving test: `crates/eg-types/src/source_document.rs::tests::document_receipt_round_trips`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.8
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** The engine must validate normalized documents against resolved mappings in `src/server/handlers/source_ingestion.rs`. The named default `complete_document` must require valid structure and provenance for every atom. The default `content_identity` must bind tenant, connector, stream, source record ID and digest. Successful retries must reuse the committed receipt. Validators must consume one resolved mapping snapshot before source admission or graph projection. | Planned proving test: `src/server/handlers/source_ingestion.rs::tests::complete_document_is_idempotent`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.9
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** The engine must extend `prepare` at `src/server/handlers/source_ingestion.rs:155`. Authorization and the authorized committed-replay shortcut at lines 159–170 must remain first. New batches must resolve trusted mappings once at line 174, then validate before reconciliation and admission. The existing caller is `route_source_ingestion_request` at `src/server/dispatch/graph_pipeline/native_routes.rs:408`. It must commit one accepted or quarantine envelope at line 428, then call `finish` at line 429. This row creates the document validator call; no production caller reaches that validator today. | Planned proving test: `src/server/handlers/source_ingestion.rs::tests::prepare_validates_document_after_resolution`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.10
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** The engine must add typed `DocumentIngestError` in `crates/eg-types/src/source_document.rs`. Codes must include `NormalizationFailed`, `MissingProvenance` and `MappingRevisionMismatch`. Normalization failure must produce a prepared quarantine outcome, not an error that bypasses commit. Its envelope must store restricted evidence without accepted projections, source-marker changes or checkpoint advancement. The prior accepted checkpoint must remain unchanged, including `None`. Authorization or commit failure must return refusal without claiming durable quarantine. | Planned proving test: `src/server/handlers/source_ingestion.rs::tests::invalid_document_quarantines_without_partial_graph`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.11
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** The engine must extend `finish` and `prepared_replay` at `src/server/handlers/source_ingestion.rs:1683` and `src/server/handlers/source_ingestion.rs:1791`. They must return the stored typed outcome only after commit or authorized committed replay. Accepted outcomes must retain `SourceIngestionReceipt`; quarantine must not fabricate its mandatory accepted checkpoint. Quarantine evidence must include source digest, mapping revision, rule ID, optional prior checkpoint and committed graph version. Replay must preserve that receipt and must not reset the current source checkpoint. Quarantine detail must omit source text. | Planned proving test: `src/server/handlers/source_ingestion.rs::tests::quarantine_finish_and_replay_preserve_outcome`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.12
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The entry point must be the served `SourceIngest` wire method. `tests/ingest/test_document_normalization_served.py::test_document_batch_is_atomic` must prove accepted replay and zero partial projections for a mixed invalid batch. `test_first_batch_quarantine_and_replay` must prove durable quarantine with prior checkpoint `None`, then replay without another quarantine record. `test_quarantine_preserves_prior_checkpoint` must cover prior acceptance and later successful ingestion before quarantine replay. `test_failed_quarantine_commit_is_not_reported_durable` must reject false durable receipts. `test_quarantine_reads_require_policy` must deny same-tenant unauthorized receipt, provenance and raw-reference reads. | Planned proving test: `tests/ingest/test_document_normalization_served.py::test_document_batch_is_atomic`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.13
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** The engine must add `TranscriptThread` and `TranscriptMessage` in new `crates/eg-types/src/source_transcript.rs`. Fields must include connector, stream, session ID, message ID, role, event time, storage time, concept references and provenance. Roles must be `System`, `User`, `Assistant` or `Tool`. A thread must hold ordered message references. The engine must derive tenant and policy identities from verified server authority. Connector and stream must match the validated source request. | Planned proving test: `crates/eg-types/src/source_transcript.rs::tests::transcript_round_trips`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.14
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** The engine must add `validate_transcript` in new `src/server/handlers/source_ingestion/transcript.rs`. The named default `source_sequence` must preserve source order and distinguish event time from storage time. The default `source_identity` must namespace threads by tenant, connector, stream and session ID. Message identity must also include message ID. IDs must reuse the scoped convention at `src/server/handlers/source_ingestion.rs:2187` with unambiguous record-key encoding. Concept links must reference concepts visible under verified tenant and policy authority. | Planned proving test: `src/server/handlers/source_ingestion/transcript.rs::tests::source_sequence_and_identity_are_preserved`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.15
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** The engine must call `validate_transcript` from `prepare` at `src/server/handlers/source_ingestion.rs:155` after mapping resolution at line 174. It must pass the same resolved mapping snapshot and verified authority into validation and admission. The validator must not resolve mappings again. The existing caller at `src/server/dispatch/graph_pipeline/native_routes.rs:408` must retain its single-envelope commit and authorized committed-replay shortcut. No production caller reaches this new validator today. | Planned proving test: `src/server/handlers/source_ingestion/transcript.rs::tests::prepare_routes_declared_transcript_format`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.16
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** The engine must add typed `TranscriptIngestError` in `crates/eg-types/src/source_transcript.rs`. Codes must include `UnknownFormat`, `MissingEventTime`, `DuplicateMessageConflict` and `ForeignConcept`. The engine must refuse unsupported revisions and conflicting duplicate IDs before graph mutation. It must publish zero thread, message or concept links on refusal. Read authorization must deny transcript text and provenance to unauthorized callers, including callers within the same tenant. Source payloads must not override tenant or policy authority. | Planned proving test: `src/server/handlers/source_ingestion/transcript.rs::tests::unknown_format_and_foreign_concept_are_refused`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.17
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** The engine must extend the receipt projection in `src/server/handlers/source_ingestion/transcript.rs`. It must record connector, stream, source session, source digest, format revision, message count, concept-link count and accepted checkpoint. Each message must retain its source-record reference. Context, provenance and receipt reads must enforce verified tenant and policy authority. Quarantine evidence and raw-content retrieval must enforce their stored policy independently of tenant membership. | Planned proving test: `src/server/handlers/source_ingestion/transcript.rs::tests::receipt_preserves_message_provenance`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.18
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The entry point must be the served `SourceIngest` wire method. `tests/ingest/test_transcript_served.py::test_thread_messages_are_shared_within_scope` must use identical session/message IDs across different connectors and streams. Records must remain distinct; same-source replay must remain idempotent. A second authorized agent must read timestamped messages and concept links. Same-tenant unauthorized callers and other tenants must read neither transcript text nor provenance. Payload authority spoofing and unknown formats must leave graph and checkpoint unchanged. | Planned proving test: `tests/ingest/test_transcript_served.py::test_thread_messages_are_shared_within_scope`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R604
Ingest tasks run through lane-fair queues with reserved workers and stage tiers (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Ingest tasks run through lane-fair queues with reserved workers and stage tiers (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R604.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** `crates/eg-capabilities/src/ingest_lanes.rs` defines Lane, QueueClass{fast, medium, slow_heavy}, SchedulerConfig, WorkerRegistry, LaneMetrics. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R604.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** Tasks map to a lane by kind. They map to a queue class by semantic stage. Source commit is fast. Projection and lexical are medium. Vector and index are slow. Claims rotate across lanes, then by priority bucket inside a lane. The engine refuses a free worker if the claim drops the reserved hot-spare count. The exception is a lane with pending work and no running worker. A lane with an unhealthy model folds onto a healthy lane. The engine exports per-lane depth, oldest age and in-flight count. | Unit tests cover each rule with positive and boundary cases.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R604.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** Extends the claim path of EG-DURABLE-KERNEL-R071 and the floors of EG-INGEST-WORKER-R001.6; the runner asks `AdmitWorkerTask` before every claim. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R604.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** The engine answers a claim that starves the reserve with a retry hint and the lane. It never waits silently. The stable code is `ADMIT_HELD_FOR_RESERVE`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R604.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Gauges eg_lane_depth, eg_lane_oldest_age_seconds, eg_lane_inflight; counter eg_admit_refused_total. | Test reads the trace or metrics after one success and one refusal.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R604.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** claim plus admit under 64 workers and 8 lanes: p50 under 150 us, p99 under 1 ms, no allocation per claim. The benchmark is `benches/r604_ingest_worker.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R605
Queue backends, chunked source drains and graph routing are one durable engine surface (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Queue backends, chunked source drains and graph routing are one durable engine surface (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R605.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** `crates/eg-capabilities/src/drain.rs` defines DrainHandle{drain_id}, PageCheckpoint, GraphRoute, IngestProfile. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R605.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** A full-source drain returns a handle at once. It runs as a chain of bounded page tasks. Each task carries the advanced cursor and enqueues the next while pages remain. One pure policy routes ingestion graph names (source, repository, tenant or default). Shard writers commit in parallel and reads union the routed graphs. Each stage records wall time, token usage and embedding usage. The queue is the engine's durable task queue; no second queue backend exists. | Unit tests cover each rule with positive and boundary cases.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R605.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** Enqueue and ack use EG-DURABLE-KERNEL-R071; `route_graph` is called by SourceIngest before graph resolution. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R605.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** A page task whose cursor is older than the stored checkpoint is dropped and counted, so a redelivery never double-ingests. The stable code is `DRAIN_CURSOR_STALE`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R605.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Per drain: pages, items, cursor, per-stage profile. | Test reads the trace or metrics after one success and one refusal.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R605.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** Page task overhead is p50 under 5 ms and p99 under 25 ms, excluding source reads. The route_graph call takes under 2 us. The benchmark is `benches/r605_ingest_worker.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R606
One materialization path writes every connector's records with provenance, hash filtering and partition routing (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**One materialization path writes every connector's records with provenance, hash filtering and partition routing (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R606.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** `crates/eg-capabilities/src/materialize.rs` defines MaterializeBatch, ContentHash, SourceProvenance, SourcePartition, ExtractorRegistry. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R606.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** Every connector batch converges on one write path. The path normalizes labels and drops records with an unchanged content hash. It stamps source system, source id and ingest time on every node and edge. It places the data in a per-source named graph. Connector rows may also mirror into native engine tables. Extractor modules self-register by category, and the written set is reported per category. | Unit tests cover each rule with positive and boundary cases.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R606.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** SourceIngest is the sole write path; the SDK vendor extractors of SDK-SOURCE-INGEST-R006 emit the batches. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R606.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** A batch without a source system is refused whole. The stable code is `MATERIALIZE_NO_PROVENANCE`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R606.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Per batch: written, unchanged, refused. | Test reads the trace or metrics after one success and one refusal.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R606.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** hash filter of 100k records: p50 under 120 ms, p99 under 300 ms, memory under 64 MiB. The benchmark is `benches/r606_ingest_worker.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R700
Multi-modal readers produce typed fragments with span provenance (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Multi-modal readers produce typed fragments with span provenance (rollup).** Readers turn PDF, office (email, presentation, spreadsheet), HTML, delimited text, audio transcript and scanned-image OCR into fragments. Each fragment carries source span provenance. Each format has one bounded, license-approved path. Implemented in eg-ingest. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R700.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** `Fragment { source, span, text, modality }` and `ReaderRegistry` keyed by media type in `crates/eg-ingest`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R700.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** Readers stream per file with a fixed per-reader memory bound. Page and sheet readers are independent. They run in parallel up to the worker lane limit. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R700.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** Run by the ingest worker queue (R001); results enter the atom pipeline (R003). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R700.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** The engine refuses a file over the size bound, an encrypted document or an unsupported media type. The refusal carries a typed code. The engine does not skip the file. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R700.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Each fragment is traceable to byte or page span. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R700.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/ingest/test_readers_served.py::test_each_format_yields_spanned_fragments` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/reader_pdf.rs` must show p50 under 20 ms and p99 under 120 ms with peak memory under 128 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R701
Fact and claim extraction is grounded to the ontology and repaired by direction (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Fact and claim extraction is grounded to the ontology and repaired by direction (rollup).** Text routed as prose yields atomic facts and candidate claims with evidence spans. Each fact is grounded to ontology classes and properties. Its relation direction is repaired from domain and range. The engine drops duplicates incrementally and aggregates confidence. The language-model call itself runs in the worker runner, not in the engine. Implemented in eg-ingest, eg-reason. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R701.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** `ExtractedFact`, `CandidateClaim`, `EvidenceSpan` and `GroundingResult` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R701.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** Grounding is a lookup against the compiled ontology cache (UDP R035). Direction repair swaps subject and object when only the swapped pair satisfies domain and range. The deduper is an incremental hash set. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R701.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** Structure routing (prose or structured) precedes extraction; results commit as atoms with mandatory provenance (R003). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R701.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** A fact without an evidence span is refused. A fact that grounds to no class stays an ungrounded claim. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R701.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Outcome per unit (created, updated, unchanged, rejected) is recorded with the content hash. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R701.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/ingest/test_fact_grounding_served.py::test_direction_repair_and_ungrounded_claims` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/fact_grounding.rs` must show p50 under 2 ms and p99 under 12 ms with peak memory under 48 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R702
Near-duplicate detection with a locality-sensitive index (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Near-duplicate detection with a locality-sensitive index (rollup).** The engine fingerprints documents and chunks with MinHash and indexes them by banded locality-sensitive hashing. This finds near duplicates without comparing all pairs. The engine deduplicates knowledge before it enters the graph. Implemented in eg-vector, eg-ingest. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R702.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** `MinHashSignature` and `LshIndex { bands, rows }` in `crates/eg-vector`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R702.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** Insert and query are O(bands). Memory is O(documents x bands). The Jaccard threshold is configurable. The engine reports the false-negative rate. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R702.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** Used at ingest admission before enrichment is scheduled (R006). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R702.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** A duplicate above threshold is linked, not stored twice. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R702.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Each link stores the estimated similarity. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R702.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/ingest/test_lsh_dedup_served.py::test_near_duplicates_link_and_distinct_pass` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/lsh_index.rs` must show p50 under 1 ms and p99 under 5 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.700
Knowledge-base run outcomes, entity and claim extraction, link inference and note-vault sync: model and behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Knowledge-base run outcomes, entity and claim extraction, link inference and note-vault sync: model and behavior.** Each extraction unit gets a deterministic outcome (created, updated, unchanged, rejected) from its content hash. The engine classifies entities, claims and relationships. It links them by inference over shared mentions. A note vault syncs incrementally by file hash. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R003.701
Knowledge-base run outcomes, entity and claim extraction, link inference and note-vault sync: refusal, evidence and hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Knowledge-base run outcomes, entity and claim extraction, link inference and note-vault sync: refusal, evidence and hot-path proof.** A unit without provenance is rejected; a link below the calibrated threshold is not created. Test `tests/ingest/test_kb_outcomes_served.py::test_unchanged_content_is_unchanged`; benchmark `benches/kb_outcomes.rs` p50 under 2 ms and p99 under 10 ms per document, memory under 48 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R910
Source ingest content versions chain per stream (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Source ingest content versions chain per stream (rollup).** The engine must version source content per connector stream, not per batch. A second batch on one stream must admit. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R910.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** The content version object id must derive from tenant, connector, source and stream. The batch id `source-ingest:<digest>` at `src/server/handlers/source_ingestion.rs:162` must not name the object. | `crates/eg-types` unit test `stream_content_version_id_is_stable` builds two batches of one stream and asserts one object id.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R910.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** The first batch of a stream must carry no previous digest. Each later batch must name the digest of the prior batch on that stream. A batch with equal content must count as unchanged and write nothing. | Test submits three batches on one stream and asserts admitted, admitted and unchanged.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R910.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** `admit_records` in `src/server/handlers/source_ingestion.rs` must stamp the stream object id. The content check at `src/redb_store/store_state.rs:481` must read the stream chain. The SDK runner of SDK-SOURCE-INGEST-R004.20 reaches this path. | Test drives two served `SourceIngest` batches and asserts no `STALE_CONTENT_VERSION`.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R910.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** A batch whose previous digest differs from the stored stream head must refuse with `STALE_CONTENT_VERSION`. A refused batch writes nothing. | Test races two writers on one stream and asserts one refusal and no partial write.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R910.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** The receipt must name the stream object id, the previous digest and the new digest. | Test reads the receipt after two batches and compares the digest chain.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R910.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `SourceIngest` method. The test submits two batches on one stream, as ARBORA-OPS-R020.6.6 does. Version chaining for 10k records must stay under 20 ms p99. The benchmark is `benches/r910_stream_content_version.rs`. | `tests/test_source_stream_versions_served.py::test_second_batch_on_one_stream_admits` passes, and the benchmark meets the budget.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R900
Source records enforce the governance properties that connectors send (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Source records enforce the governance properties that connectors send (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R900.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** `crates/eg-types/src/source_governance.rs` defines `RecordGovernance` with `classification`, `retention`, `legal_hold`, `access_public`, `access_read_roles` and `access_markings`. `Classification` is a closed enum: public, internal, confidential, restricted. Read roles and markings are bounded sorted sets of at most 256 entries each. | Unit test round-trips the type and rejects an unknown classification.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R900.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** Admission parses `RecordGovernance` from the reserved properties of each `SourceRecord`. It writes one ACL and the markings for the record node. The node then carries its retention and legal hold. A public classification must match `access_public`. Parsing is O(p) in the property count and holds no lock. | Unit tests cover public, restricted, marked and legal-hold records.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R900.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** `admit_records` in `src/server/handlers/source_ingestion.rs` calls the parser before the projection. The SDK sources of SDK-SOURCE-INGEST-R901 and SDK-SOURCE-INGEST-R900 send these properties. No other caller writes record ACLs from a connector. | Test drives `SourceIngest` and asserts the ACL exists before the projection.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R900.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** A record whose classification and public flag disagree is refused with `SOURCE_GOVERNANCE_CONFLICT`. A record without retention under a retention-required policy is refused with `SOURCE_RETENTION_MISSING`. A refused record writes nothing. | Test submits each invalid record and asserts the code and zero writes.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R900.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Each batch records governed, refused and marked counts in the receipt. | Test reads the receipt after one success and one refusal.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R900.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** Governance parsing of 10k records: p50 under 15 ms, p99 under 40 ms, memory under 16 MiB. The benchmark is `benches/r900_source_governance.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R901
Source records may carry a row-version evidence locus (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Source records may carry a row-version evidence locus (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R901.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** The admission path reuses the `RowVersion { row_ref, version }` locus of `crates/eg-modality/src/artifact.rs`. `SourceRowVersion` adds the table reference and the evidence digest. All references are opaque. | Unit test round-trips the type and rejects an empty table reference.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R901.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** A record can name its table and an integer version. Admission then stores the row text as an evidence artifact with that locus. A later version of the same row supersedes the earlier one. The store is O(1) per record. | Unit tests cover a first version, a newer version and a replayed version.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R901.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** `admit_records` stores the locus after the record commits. The SDK database source of SDK-SOURCE-INGEST-R900 refuses its `table` option until this row is verified. | Test drives `SourceIngest` with a versioned record and reads the locus back.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R901.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** A non-integer or decreasing version is refused with `ROW_VERSION_INVALID` and stores no evidence. | Test submits each invalid version and asserts the code.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R901.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Each batch records stored, superseded and refused evidence counts. | Test reads the receipt after one success and one refusal.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R901.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** Locus storage for 10k rows: p50 under 60 ms, p99 under 150 ms, memory under 32 MiB. The benchmark is `benches/r901_row_version.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R902
Source permission and group sync (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Source permission and group sync (rollup).** The engine must refresh the access of held source records without a content re-ingest. It must hold the group membership of each source. Retrieval expands groups at query time, so a membership change applies without a record rewrite. Children `.1` to `.6` deliver it. | See each child.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R902.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** Add `AccessSnapshot{source, record_ref, access_public, read_principals, read_groups, synced_at}` and `SourceGroup{source, group_id, members, synced_at}` in `crates/eg-types/src/source_governance.rs`. | `crates/eg-types/tests/source_governance.rs::access_snapshot_round_trips` round-trips both records.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R902.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** An access-only batch replaces the ACL of each named record as a new version. It never touches content, vectors or edges. A group batch replaces the member set of each group. A record whose access is older than its source bound becomes `acl_stale`. The default bound is 3,600 s. | `crates/eg-core/tests/source_permission_sync.rs::access_batch_leaves_content_unchanged` compares content digests before and after.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R902.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** `admit_records` in `src/server/handlers/source_ingestion.rs` routes a batch of kind `access` or `groups` to the new path. The SDK permission sync of `SDK-SOURCE-INGEST-R805` sends these batches. The read-RLS gate of EG-DURABLE-KERNEL-R029 expands groups. | `tests/test_source_permission_sync_served.py::test_group_change_applies_without_rewrite` deletes a member and observes a denied read.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R902.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** An access batch for an unknown record must refuse that record with `SOURCE_RECORD_UNKNOWN`. A group with more than 100,000 members must refuse with `SOURCE_GROUP_TOO_LARGE`. A refusal writes nothing for that item. | `tests/test_source_permission_sync_served.py::test_permission_sync_refusals` asserts both codes.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R902.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Each batch receipt counts updated, refused and stale records. A restricted record in `acl_stale` state must fail closed on retrieval. | `tests/test_source_permission_sync_served.py::test_stale_restricted_record_fails_closed` ages one record past the bound.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R902.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `SourceIngest`. The benchmark `benches/source_permission_sync.rs` applies 100,000 access updates. The p99 per 1,000-record batch stays under 20 ms. A group expansion on read adds under 50 microseconds at p99. | `cargo bench --bench source_permission_sync` fails on a 10 percent regression.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R903
Source deletion reconciliation (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Source deletion reconciliation (rollup).** The engine must delete held records that their source no longer holds. It compares an identifier-only enumeration with the held set. Children `.1` to `.6` deliver it. | See each child.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R903.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** Add `SourceEnumeration{source, run_id, ids_digest, complete}` and `ReconcilePlan{source, missing, grace_until}` in `crates/eg-types/src/source_governance.rs`. | `crates/eg-types/tests/source_governance.rs::reconcile_plan_round_trips` round-trips both records.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R903.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** A complete enumeration yields the held identifiers that it lacks. Each missing record enters a grace window of 86,400 s by default. After the window, the engine deletes it through the cascade of EG-UNIFIED-DATA-PLANE-R651. A record that reappears leaves the plan. | `crates/eg-core/tests/source_reconcile.rs::missing_records_delete_after_grace` advances the clock past the window.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R903.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** `admit_records` in `src/server/handlers/source_ingestion.rs` accepts a batch of kind `enumeration`. The SDK identifier enumeration of `SDK-SOURCE-INGEST-R805` sends it. | `tests/test_source_reconcile_served.py::test_enumeration_prunes_deleted_record` deletes one source record and observes the prune.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R903.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** An incomplete enumeration must never delete. A plan that deletes more than 20 percent of a source must refuse with `SOURCE_MASS_DELETE_GUARD`. An admin override lifts the guard. | `tests/test_source_reconcile_served.py::test_mass_delete_guard_refuses` enumerates an empty set.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R903.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** The receipt names the enumeration digest, the missing count, the deleted count and the override principal. | `tests/test_source_reconcile_served.py::test_reconcile_receipt_reads_back` compares every field.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R903.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/source_reconcile.rs` compares an enumeration of 1M identifiers with 1M held records. It stays under 2 s and 256 MiB. | `cargo bench --bench source_reconcile` fails on a 10 percent regression.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R904
Source container hierarchy (rollup)
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Source container hierarchy (rollup).** The engine must hold the container tree of a source, such as spaces, folders and channels. A record links to its container. A scope filter may name a container subtree. Children `.1` to `.6` deliver it. | See each child.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R904.1
Model
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Model.** Add `:SourceContainer` with `containedIn` and `inContainer` edges to `crates/eg-core/ontology/sdd-v1.ttl`. Add `SourceContainer{source, container_id, parent_id, title}` in `crates/eg-types/src/source_governance.rs`. | `crates/eg-types/tests/source_governance.rs::container_round_trips` round-trips a container.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R904.2
Behavior
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Behavior.** A container batch upserts nodes and parent edges. A subtree query returns the container and its descendants to depth 32. | `crates/eg-core/tests/source_hierarchy.rs::subtree_returns_descendants` checks a three-level fixture.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R904.3
Wiring
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Wiring.** `admit_records` accepts a batch of kind `containers`. The SDK hierarchy declaration of `SDK-SOURCE-INGEST-R805` sends it. EG-FEDERATED-QUERY-R704 reads the subtree. | `tests/test_source_hierarchy_served.py::test_containers_ingest_and_scope` ingests a tree and scopes a search to one folder.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R904.4
Refusal
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Refusal.** A parent cycle must refuse with `SOURCE_CONTAINER_CYCLE`. A depth over 32 must refuse with `SOURCE_CONTAINER_TOO_DEEP`. | `tests/test_source_hierarchy_served.py::test_container_refusals` asserts both codes.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R904.5
Evidence
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Evidence.** Each container records its source path and sync time. A readback must equal the written tree. | `tests/test_source_hierarchy_served.py::test_container_tree_reads_back` compares the tree.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-INGEST-WORKER-R904.6
Hot-path proof
Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/source_hierarchy.rs` resolves a subtree of 10,000 containers. The p99 stays under 5 ms. | `cargo bench --bench source_hierarchy` fails on a 10 percent regression.
requirementEG-INGEST-WORKERSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB
EG-MEDIA-VOCAB — Media and personal-content vocabulary
specNoneSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001
Shared media ontology
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Shared media ontology.** `crates/eg-core/ontology/media-v1.ttl` defines media classes and properties. It reuses core terms. The vocabulary covers `{work, series, season, episode, album, track, audiobook, podcast, game, ROM, library, library item, media file, playback session, download request, transfer, indexer, broadcast, viewer sample, transcript segment}`. Children R001.1-.6 remain mandatory. Children R001.100-.102 add authorized tags, transcript/summary provenance, and bookmark search/relationships. | Preserve every landed child. Close extensions only with producer/consumer acceptance. Infer no provider or export receipt.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001.1
Add `mv:MediaWork` (⊑ `:CreativeWork`) with `mv:Film`, `mv:TelevisionSeries`, `mv:TelevisionSeason`, `mv:TelevisionEpisode`, `mv:MusicAlbum`, `mv:MusicTrack`, `mv:Audiobook`, `mv:PodcastShow`, `mv:PodcastEpisode`, `mv:Game` to media-v1.ttl
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add `mv:MediaWork` (⊑ `:CreativeWork`) with `mv:Film`, `mv:TelevisionSeries`, `mv:TelevisionSeason`, `mv:TelevisionEpisode`, `mv:MusicAlbum`, `mv:MusicTrack`, `mv:Audiobook`, `mv:PodcastShow`, `mv:PodcastEpisode`, `mv:Game` to media-v1.ttl. | Test: ontology load test asserts each class and its subClassOf path to `:CreativeWork`.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001.2
Add `mv:MediaLibrary`, `mv:LibraryItem` (links a work to a library, `mv:itemOf`, `mv:inLibrary`), `mv:MediaFile`, `mv:RomFile`, `mv:GamePlatform`, `mv:MusicArtist` (⊑ `:Organization`) to media-v1.ttl
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add `mv:MediaLibrary`, `mv:LibraryItem` (links a work to a library, `mv:itemOf`, `mv:inLibrary`), `mv:MediaFile`, `mv:RomFile`, `mv:GamePlatform`, `mv:MusicArtist` (⊑ `:Organization`) to media-v1.ttl. | Test: ontology load test.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001.3
Add `mv:PlaybackSession` (⊑ `:Session`) with `mv:playedBy`, `mv:lastPlayedAt`, `mv:playCount`, `mv:playbackPositionSeconds`, and `mv:BroadcastStream` (⊑ `:Event`) with `mv:ViewerSample`, `mv:viewerCount`, `mv:sampledAt`, `mv:lastConnectAt`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add `mv:PlaybackSession` (⊑ `:Session`) with `mv:playedBy`, `mv:lastPlayedAt`, `mv:playCount`, `mv:playbackPositionSeconds`, and `mv:BroadcastStream` (⊑ `:Event`) with `mv:ViewerSample`, `mv:viewerCount`, `mv:sampledAt`, `mv:lastConnectAt`. | Test: ontology load test; domain and range check.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001.4
Add `mv:DownloadRequest` (states requested, wanted, grabbed, importing, imported, failed), `mv:DownloadTransfer`, `mv:GrabEvent`, `mv:MediaIndexer` and properties `mv:requestsWork`, `mv:transferOf`, `mv:grabbedFromIndexer`, `mv:transferState`, `mv:shareRatio`, `mv:lastActivityAt`, `mv:addedAt`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add `mv:DownloadRequest` (states requested, wanted, grabbed, importing, imported, failed), `mv:DownloadTransfer`, `mv:GrabEvent`, `mv:MediaIndexer` and properties `mv:requestsWork`, `mv:transferOf`, `mv:grabbedFromIndexer`, `mv:transferState`, `mv:shareRatio`, `mv:lastActivityAt`, `mv:addedAt`. | Test: ontology load test.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001.5
Add `mv:TranscriptSegment` (part of the existing `:Transcript` in personal-v1.ttl: reuse, do not redefine) with `mv:segmentStart`, `mv:segmentEnd`, `mv:noSpeechProb`, `mv:transcriptOf`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add `mv:TranscriptSegment` (part of the existing `:Transcript` in personal-v1.ttl: reuse, do not redefine) with `mv:segmentStart`, `mv:segmentEnd`, `mv:noSpeechProb`, `mv:transcriptOf`. | Test: ontology load test asserts `:Transcript` is not redefined in media-v1.ttl.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001.6
Resolve the two name collisions: connector packages declare `:Episode` (TV) and `:Author` in the shared `:` namespace, while core-foundation-v1.ttl already defines `:Episode` (interaction unit) and software-v1.ttl `:Author` (git author). media-v1.ttl uses `mv:TelevisionEpisode`; cross-repo rows EG-MEDIA-VOCAB-R032 and EG-MEDIA-VOCAB-R033 move the connectors onto it
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Resolve the two name collisions: connector packages declare `:Episode` (TV) and `:Author` in the shared `:` namespace, while core-foundation-v1.ttl already defines `:Episode` (interaction unit) and software-v1.ttl `:Author` (git author). media-v1.ttl uses `mv:TelevisionEpisode`; cross-repo rows EG-MEDIA-VOCAB-R032 and EG-MEDIA-VOCAB-R033 move the connectors onto it. | Test: collision test lists every duplicate class IRI across ontology/*.ttl and the baseline names exactly the two connector aliases.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R002
Content-channel vocabulary: content-v1.ttl
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Content-channel vocabulary: content-v1.ttl.** crates/eg-core/ontology/content-v1.ttl defines feed, article, research paper, search query and result, social post and channel, email campaign, mailing list, subscriber, message channel and chat message. Children R002.1 to R002.4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R002.1
Add `cv:Feed`, `cv:FeedSubscription`, `cv:Article` (⊑ `:Document`), `cv:ResearchPaper` (⊑ `:Document`, seeAlso `bibo:AcademicArticle`), `cv:SearchQuery`, `cv:SearchResult`, `cv:SearchEngine`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add `cv:Feed`, `cv:FeedSubscription`, `cv:Article` (⊑ `:Document`), `cv:ResearchPaper` (⊑ `:Document`, seeAlso `bibo:AcademicArticle`), `cv:SearchQuery`, `cv:SearchResult`, `cv:SearchEngine`. | Test: ontology load test.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R002.2
Add `cv:SocialPost`, `cv:PublishingChannel`, `cv:EngagementMetric`, `cv:EmailCampaign`, `cv:MailingList`, `cv:Subscriber` (opaque identity), with `cv:sentCount`, `cv:viewCount`, `cv:clickCount`, `cv:postState`, `cv:subscriptionStatus`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add `cv:SocialPost`, `cv:PublishingChannel`, `cv:EngagementMetric`, `cv:EmailCampaign`, `cv:MailingList`, `cv:Subscriber` (opaque identity), with `cv:sentCount`, `cv:viewCount`, `cv:clickCount`, `cv:postState`, `cv:subscriptionStatus`. | Test: ontology load test.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R002.3
Add `cv:MessageChannel` and `cv:ChatMessage`; reuse existing `kg:Team` from core-foundation-v1.ttl without redeclaration, with `cv:memberCount`, `cv:lastPostAt`, `cv:postedAt`, `cv:postedBy`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add `cv:MessageChannel` and `cv:ChatMessage`; reuse existing `kg:Team` from core-foundation-v1.ttl without redeclaration, with `cv:memberCount`, `cv:lastPostAt`, `cv:postedAt`, `cv:postedBy`. | Test: ontology load test.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R002.4
Add content properties `cv:publishedAt`, `cv:isRead`, `cv:feedUrl`, `cv:resultUrl`, `cv:rank`, `cv:servedByEngine`, `cv:doi`, `cv:arxivId`, `cv:citationCount`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add content properties `cv:publishedAt`, `cv:isRead`, `cv:feedUrl`, `cv:resultUrl`, `cv:rank`, `cv:servedByEngine`, `cv:doi`, `cv:arxivId`, `cv:citationCount`. | Test: ontology load test.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R003
Cross-source identity keys
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-source identity keys.** Shared join keys so independent connectors meet on one IRI: `mv:tmdbId`, `mv:tvdbId`, `mv:imdbId`, `mv:musicBrainzId`, `mv:isbn`, `mv:infoHash`, `cv:canonicalUrl`, `mv:contentSha256`. Children R003.1 to R003.3. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R003.1
Declare the eight key properties as datatype correlation properties in media-v1.ttl and content-v1.ttl, without global inverse-functionality. Work identity keys include the class and provider namespace (Film and TelevisionSeries IDs cannot collide). Article identity uses its class-scoped normalized canonical URL. SearchResult uses source, query and native result key; SocialPost and EmailCampaign retain source-native IDs. Shared target URLs support joins without identifying the result, post, campaign and document as one entity. Repeated reads of the same source-native key upsert the same entity
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Declare the eight key properties as datatype correlation properties in media-v1.ttl and content-v1.ttl, without global inverse-functionality. Work identity keys include the class and provider namespace (Film and TelevisionSeries IDs cannot collide). Article identity uses its class-scoped normalized canonical URL. SearchResult uses source, query and native result key; SocialPost and EmailCampaign retain source-native IDs. Shared target URLs support joins without identifying the result, post, campaign and document as one entity. Repeated reads of the same source-native key upsert the same entity. | Test: equal URLs across Article, two queries' SearchResults and two SocialPosts preserve distinct records and their provenance; repeated same-key reads are idempotent; Film and TelevisionSeries with the same numeric provider ID remain distinct.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R003.2
Specify normalisation (infoHash lower-case hex; canonicalUrl via scheme/host lower-case, tracking parameters and fragment stripped) as an `rdfs:comment` and a fixture table
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Specify normalisation (infoHash lower-case hex; canonicalUrl via scheme/host lower-case, tracking parameters and fragment stripped) as an `rdfs:comment` and a fixture table. | Test: normalisation fixture table passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R003.3
Add the keyed-hash identity rule for email-derived joins (`cv:subscriberKey`), never storing the raw address
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the keyed-hash identity rule for email-derived joins (`cv:subscriberKey`), never storing the raw address. | Test: SHACL rejects a `cv:Subscriber` carrying a raw address property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R004
SHACL shapes
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**SHACL shapes.** Shapes in media-v1.shapes.ttl and content-v1.shapes.ttl. Children R004.1 to R004.4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R004.1
Shape: `mv:Film`/`mv:TelevisionSeries` carry at least one of `mv:tmdbId`, `mv:tvdbId`, `mv:imdbId` when sourced from a connector
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Shape: `mv:Film`/`mv:TelevisionSeries` carry at least one of `mv:tmdbId`, `mv:tvdbId`, `mv:imdbId` when sourced from a connector. | Test: SHACL pass and fail fixture.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R004.2
Shape: `mv:DownloadTransfer` has exactly one `mv:infoHash` matching `^[0-9a-f]{40}$` or `^[0-9a-f]{64}$`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Shape: `mv:DownloadTransfer` has exactly one `mv:infoHash` matching `^[0-9a-f]{40}$` or `^[0-9a-f]{64}$`. | Test: SHACL pass and fail fixture.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R004.3
Shape: `mv:DownloadRequest` `mv:downloadRequestState` in the closed set (requested, wanted, grabbed, importing, imported, failed)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Shape: `mv:DownloadRequest` `mv:downloadRequestState` in the closed set (requested, wanted, grabbed, importing, imported, failed). | Test: SHACL pass and fail fixture.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R004.4
Shape: `cv:Article`, `cv:SearchResult` carry exactly one normalised `cv:canonicalUrl`; shapes are aggregate-free per the virtual-graph shapes convention
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Shape: `cv:Article`, `cv:SearchResult` carry exactly one normalised `cv:canonicalUrl`; shapes are aggregate-free per the virtual-graph shapes convention. | Test: SHACL pass and fail fixture.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R005
arr virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**arr virtual-graph mapping.** Mapping table for the `arr` connector (arr-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R005`. Children R005.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R005.1
Add the `arr` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `arr` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R005.2
Add the `arr` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R005.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `arr` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R005.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R005.3
Add the test that answers the `arr` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `arr` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R005.4
Update `EG-CQ-CONN-R005` vocabulary column from MISSING to media-v1 / content-v1 once R005.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R005` vocabulary column from MISSING to media-v1 / content-v1 once R005.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R006
jellyfin virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**jellyfin virtual-graph mapping.** Mapping table for the `jellyfin` connector (jellyfin-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R027`. Children R006.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R006.1
Add the `jellyfin` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `jellyfin` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R006.2
Add the `jellyfin` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R027.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `jellyfin` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R027.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R006.3
Add the test that answers the `jellyfin` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `jellyfin` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R006.4
Update `EG-CQ-CONN-R027` vocabulary column from MISSING to media-v1 / content-v1 once R006.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R027` vocabulary column from MISSING to media-v1 / content-v1 once R006.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R007
audiobookshelf virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**audiobookshelf virtual-graph mapping.** Mapping table for the `audiobookshelf` connector (audiobookshelf-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R007`. Children R007.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R007.1
Add the `audiobookshelf` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `audiobookshelf` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R007.2
Add the `audiobookshelf` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R007.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `audiobookshelf` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R007.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R007.3
Add the test that answers the `audiobookshelf` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `audiobookshelf` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R007.4
Update `EG-CQ-CONN-R007` vocabulary column from MISSING to media-v1 / content-v1 once R007.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R007` vocabulary column from MISSING to media-v1 / content-v1 once R007.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R008
qbittorrent virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**qbittorrent virtual-graph mapping.** Mapping table for the `qbittorrent` connector (qbittorrent-agent): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R051`. Children R008.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R008.1
Add the `qbittorrent` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `qbittorrent` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R008.2
Add the `qbittorrent` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R051.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `qbittorrent` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R051.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R008.3
Add the test that answers the `qbittorrent` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `qbittorrent` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R008.4
Update `EG-CQ-CONN-R051` vocabulary column from MISSING to media-v1 / content-v1 once R008.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R051` vocabulary column from MISSING to media-v1 / content-v1 once R008.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R009
rom-manager virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**rom-manager virtual-graph mapping.** Mapping table for the `rom-manager` connector (rom-manager): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R053`. Children R009.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R009.1
Add the `rom-manager` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `rom-manager` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R009.2
Add the `rom-manager` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R053.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `rom-manager` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R053.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R009.3
Add the test that answers the `rom-manager` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `rom-manager` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R009.4
Update `EG-CQ-CONN-R053` vocabulary column from MISSING to media-v1 / content-v1 once R009.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R053` vocabulary column from MISSING to media-v1 / content-v1 once R009.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R010
owncast virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**owncast virtual-graph mapping.** Mapping table for the `owncast` connector (owncast-agent): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R045`. Children R010.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R010.1
Add the `owncast` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `owncast` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R010.2
Add the `owncast` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R045.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `owncast` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R045.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R010.3
Add the test that answers the `owncast` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `owncast` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R010.4
Update `EG-CQ-CONN-R045` vocabulary column from MISSING to media-v1 / content-v1 once R010.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R045` vocabulary column from MISSING to media-v1 / content-v1 once R010.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R011
media-downloader virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**media-downloader virtual-graph mapping.** Mapping table for the `media-downloader` connector (media-downloader): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R038`. Children R011.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R011.1
Add the `media-downloader` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `media-downloader` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R011.2
Add the `media-downloader` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R038.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `media-downloader` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R038.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R011.3
Add the test that answers the `media-downloader` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `media-downloader` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R011.4
Update `EG-CQ-CONN-R038` vocabulary column from MISSING to media-v1 / content-v1 once R011.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R038` vocabulary column from MISSING to media-v1 / content-v1 once R011.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R012
audio-transcriber virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**audio-transcriber virtual-graph mapping.** Mapping table for the `audio-transcriber` connector (audio-transcriber): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R008`. Children R012.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R012.1
Add the `audio-transcriber` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `audio-transcriber` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R012.2
Add the `audio-transcriber` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R008.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `audio-transcriber` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R008.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R012.3
Add the test that answers the `audio-transcriber` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `audio-transcriber` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R012.4
Update `EG-CQ-CONN-R008` vocabulary column from MISSING to media-v1 / content-v1 once R012.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R008` vocabulary column from MISSING to media-v1 / content-v1 once R012.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R013
freshrss virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**freshrss virtual-graph mapping.** Mapping table for the `freshrss` connector (freshrss-agent): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R022`. Children R013.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R013.1
Add the `freshrss` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `freshrss` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R013.2
Add the `freshrss` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R022.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `freshrss` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R022.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R013.3
Add the test that answers the `freshrss` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `freshrss` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R013.4
Update `EG-CQ-CONN-R022` vocabulary column from MISSING to media-v1 / content-v1 once R013.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R022` vocabulary column from MISSING to media-v1 / content-v1 once R013.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R014
scholarx virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**scholarx virtual-graph mapping.** Mapping table for the `scholarx` connector (scholarx): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R055`. Children R014.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R014.1
Add the `scholarx` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `scholarx` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R014.2
Add the `scholarx` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R055.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `scholarx` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R055.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R014.3
Add the test that answers the `scholarx` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `scholarx` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R014.4
Update `EG-CQ-CONN-R055` vocabulary column from MISSING to media-v1 / content-v1 once R014.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R055` vocabulary column from MISSING to media-v1 / content-v1 once R014.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R015
searxng virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**searxng virtual-graph mapping.** Mapping table for the `searxng` connector (searxng-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R056`. Children R015.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R015.1
Add the `searxng` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `searxng` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R015.2
Add the `searxng` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R056.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `searxng` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R056.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R015.3
Add the test that answers the `searxng` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `searxng` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R015.4
Update `EG-CQ-CONN-R056` vocabulary column from MISSING to media-v1 / content-v1 once R015.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R056` vocabulary column from MISSING to media-v1 / content-v1 once R015.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R016
pulselink virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**pulselink virtual-graph mapping.** Mapping table for the `pulselink` connector (pulselink-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R050`. Children R016.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R016.1
Add the `pulselink` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `pulselink` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R016.2
Add the `pulselink` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R050.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `pulselink` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R050.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R016.3
Add the test that answers the `pulselink` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `pulselink` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R016.4
Update `EG-CQ-CONN-R050` vocabulary column from MISSING to media-v1 / content-v1 once R016.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R050` vocabulary column from MISSING to media-v1 / content-v1 once R016.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R017
postiz virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**postiz virtual-graph mapping.** Mapping table for the `postiz` connector (postiz-agent): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R049`. Children R017.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R017.1
Add the `postiz` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `postiz` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R017.2
Add the `postiz` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R049.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `postiz` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R049.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R017.3
Add the test that answers the `postiz` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `postiz` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R017.4
Update `EG-CQ-CONN-R049` vocabulary column from MISSING to media-v1 / content-v1 once R017.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R049` vocabulary column from MISSING to media-v1 / content-v1 once R017.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R018
listmonk virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**listmonk virtual-graph mapping.** Mapping table for the `listmonk` connector (listmonk-api): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R035`. Children R018.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R018.1
Add the `listmonk` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `listmonk` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R018.2
Add the `listmonk` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R035.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `listmonk` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R035.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R018.3
Add the test that answers the `listmonk` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `listmonk` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R018.4
Update `EG-CQ-CONN-R035` vocabulary column from MISSING to media-v1 / content-v1 once R018.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R035` vocabulary column from MISSING to media-v1 / content-v1 once R018.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R019
mattermost virtual-graph mapping
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**mattermost virtual-graph mapping.** Mapping table for the `mattermost` connector (mattermost-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R036`. Children R019.1 to .4. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R019.1
Add the `mattermost` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `mattermost` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R019.2
Add the `mattermost` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R036.1`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the `mattermost` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R036.1`. | Test: fixture round-trips through the mapping.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R019.3
Add the test that answers the `mattermost` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Add the test that answers the `mattermost` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R019.4
Update `EG-CQ-CONN-R036` vocabulary column from MISSING to media-v1 / content-v1 once R019.1 is LANDED (wire one call site: specs/connector-competency/design.md)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Update `EG-CQ-CONN-R036` vocabulary column from MISSING to media-v1 / content-v1 once R019.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R020
Cross-source worked examples
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-source worked examples.** Two federated examples run by the existing federated query planner (specs/federated-query-and-reasoning), not new routing. Children .1 and .2. | Children LANDED.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R020.1
Fixture and test: 'Which requested films are downloaded but not yet in the library?' across arr, qbittorrent, jellyfin. Returns the film set difference with provenance per leg
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Fixture and test: 'Which requested films are downloaded but not yet in the library?' across arr, qbittorrent, jellyfin. Returns the film set difference with provenance per leg. | Test: `media_vocab_films_downloaded_not_in_library`.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R020.2
Fixture and test: 'Which feed articles are not archived and have no matching search result?' across freshrss, searxng, archivebox on `cv:canonicalUrl`
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
Fixture and test: 'Which feed articles are not archived and have no matching search result?' across freshrss, searxng, archivebox on `cv:canonicalUrl`. | Test: `media_vocab_articles_unarchived`.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R021
Cross-repo, owner arr-mcp: per-title 'last searched indexer' (Radarr/Sonarr keep no per-title search log; Prowlarr history is query-keyed, not title-keyed): add a prowlarr_action history-by-title projection
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner arr-mcp: per-title 'last searched indexer' (Radarr/Sonarr keep no per-title search log; Prowlarr history is query-keyed, not title-keyed): add a prowlarr_action history-by-title projection.** Blocks the arr competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: arr-mcp (agent-packages). One 5-minute unit: add the operation and its test in arr-mcp. | Test in arr-mcp: operation returns the documented fields; EG-side test `media_vocab_arr_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R022
Cross-repo, owner audiobookshelf-mcp: user listening progress: add a library_operations or users action for media progress per user and item
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner audiobookshelf-mcp: user listening progress: add a library_operations or users action for media progress per user and item.** Blocks the audiobookshelf competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: audiobookshelf-mcp (agent-packages). One 5-minute unit: add the operation and its test in audiobookshelf-mcp. | Test in audiobookshelf-mcp: operation returns the documented fields; EG-side test `media_vocab_audiobookshelf_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R023
Cross-repo, owner media-downloader: see media-downloader B1
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner media-downloader: see media-downloader B1.** Blocks the audiobookshelf competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: media-downloader (agent-packages). One 5-minute unit: add the operation and its test in media-downloader. | Test in media-downloader: operation returns the documented fields; EG-side test `media_vocab_audiobookshelf_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R024
Cross-repo, owner rom-manager: reference-set verification: add a romm_roms verify action returning per-ROM checksum verdict
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner rom-manager: reference-set verification: add a romm_roms verify action returning per-ROM checksum verdict.** Blocks the rom-manager competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: rom-manager (agent-packages). One 5-minute unit: add the operation and its test in rom-manager. | Test in rom-manager: operation returns the documented fields; EG-side test `media_vocab_rom_manager_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R025
Cross-repo, owner media-downloader: see media-downloader B1
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner media-downloader: see media-downloader B1.** Blocks the rom-manager competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: media-downloader (agent-packages). One 5-minute unit: add the operation and its test in media-downloader. | Test in media-downloader: operation returns the documented fields; EG-side test `media_vocab_rom_manager_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R026
Cross-repo, owner owncast-agent: past broadcast list with start/end and peak viewers: add an owncast_internal stream-history action or persist sessions
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner owncast-agent: past broadcast list with start/end and peak viewers: add an owncast_internal stream-history action or persist sessions.** Blocks the owncast competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: owncast-agent (agent-packages). One 5-minute unit: add the operation and its test in owncast-agent. | Test in owncast-agent: operation returns the documented fields; EG-side test `media_vocab_owncast_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R027
Cross-repo, owner media-downloader: download history: add a list_downloads operation returning job id, source URL, status, error, completedAt, output path
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner media-downloader: download history: add a list_downloads operation returning job id, source URL, status, error, completedAt, output path.** Blocks the media-downloader competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: media-downloader (agent-packages). One 5-minute unit: add the operation and its test in media-downloader. | Test in media-downloader: operation returns the documented fields; EG-side test `media_vocab_media_downloader_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R028
Cross-repo, owner audio-transcriber: transcript list/get operation by recording id and date
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner audio-transcriber: transcript list/get operation by recording id and date.** Blocks the audio-transcriber competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: audio-transcriber (agent-packages). One 5-minute unit: add the operation and its test in audio-transcriber. | Test in audio-transcriber: operation returns the documented fields; EG-side test `media_vocab_audio_transcriber_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R029
Cross-repo, owner audio-transcriber: expose avg_logprob (confidence) per segment
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner audio-transcriber: expose avg_logprob (confidence) per segment.** Blocks the audio-transcriber competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: audio-transcriber (agent-packages). One 5-minute unit: add the operation and its test in audio-transcriber. | Test in audio-transcriber: operation returns the documented fields; EG-side test `media_vocab_audio_transcriber_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R030
Cross-repo, owner scholarx: citing-papers operation: add sx_search action 'citations' returning papers that cite a given id
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner scholarx: citing-papers operation: add sx_search action 'citations' returning papers that cite a given id.** Blocks the scholarx competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: scholarx (agent-packages). One 5-minute unit: add the operation and its test in scholarx. | Test in scholarx: operation returns the documented fields; EG-side test `media_vocab_scholarx_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R031
Cross-repo, owner searxng-mcp: pass through per-engine result counts and unresponsive_engines from the SearXNG response
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner searxng-mcp: pass through per-engine result counts and unresponsive_engines from the SearXNG response.** Blocks the searxng competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: searxng-mcp (agent-packages). One 5-minute unit: add the operation and its test in searxng-mcp. | Test in searxng-mcp: operation returns the documented fields; EG-side test `media_vocab_searxng_blocked_abstains` then flips to a positive answer.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R032
Cross-repo, owner arr-mcp: rename connector :Episode to mv:TelevisionEpisode subclass (collision with core :Episode)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner arr-mcp: rename connector :Episode to mv:TelevisionEpisode subclass (collision with core :Episode).** Resolves the R001.6 collision. One 5-minute unit in the owning package ontology plus its test. | Test in the owning package: ontology load test shows no duplicate IRI with core.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R033
Cross-repo, owner jellyfin-mcp and audiobookshelf-mcp: stop declaring :Author in the shared namespace; use mv:contributor to :Person
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Cross-repo, owner jellyfin-mcp and audiobookshelf-mcp: stop declaring :Author in the shared namespace; use mv:contributor to :Person.** Resolves the R001.6 collision. One 5-minute unit in the owning package ontology plus its test. | Test in the owning package: ontology load test shows no duplicate IRI with core.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R002.5
Receipt-bound paper facts; citation-edge hold
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Receipt-bound paper facts; citation-edge hold.** Reuse SDK `PaperSearchResult`, `PaperRecord`, and `DocumentReceipt` with EG `Method::SourceIngest`. Accept records only from a tenant-scoped `PaperQuery`. Require provider identity, stable canonical identity, revision, and SDK `exact_identity`. Require a matching tenant receipt for the same paper/revision. The receipt binds `{source_url, media_type, byte_count, sha256, authorized_local_artifact}`. Require source-field provenance for every asserted fact. Map accepted records to `cv:ResearchPaper` and existing DOI/arXiv/publication-date/citation-count facts. Attach receipt and document digest as provenance. Exact identity/revision/digest replay is idempotent. Refuse only the offending paper before graph writes for invalid identity, receipt mismatch, unavailable/incomplete artifact, or provenance mismatch. Keep healthy siblings from partial provider results. **Hold:** SDK records/receipts omit cited-paper IDs. Paper-serving registration is unestablished. Citation counts cannot create edges. Emit no citation edges until SDK serves reference IDs, identity normalization, and paper-serving registration. Select no provider here. Preserve `EG-MEDIA-VOCAB-R002.1`, `.4`, `SDK-SOURCE-INGEST-R005.1`, `.2`, `.4`, and `EG-REPO-INGEST-R002`. Source SHA-256 `b6d12a184f1c5812c8f4fd56a0a299e48381e85ad9b18af4eb0ed19faf3d7e0b`. Remains SPECIFIED; no producer/readback receipt is claimed. | Planned served acceptance: Ingest a valid tenant-scoped `PaperRecord` and matching `PaperQuery`/`DocumentReceipt`. Independently read back paper facts, receipt digest, and field provenance. Replay the same identity/revision/digest idempotently. In a mixed result, refuse an unidentified paper while persisting its identified sibling. Refuse mismatched revision/digest, incomplete artifact, or field-provenance mismatch before graph writes. Confirm count-only records create no citation edges. Hold citation-edge acceptance until SDK reference IDs and serving registration are reviewed and merged. Do not count held cases as passing.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001.100
Provenanced object/context tags and authorized media search
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Provenanced object/context tags and authorized media search.** Define each tag as `{media_item, media_revision, taxonomy_id, taxonomy_version, object_or_context, confidence, evidence_span_or_ref, opaque_producer_id, producer_revision, provenance_digest}`. Store source-backed assertions on the media item. Do not store unqualified labels. Search returns only caller-authorized tags. Bind matched tag IDs, media revisions, and authorization revision. Missing provenance or stale media revision refuses. Unauthorized queries reveal no protected tags. Vision producer identity and served extraction remain unresolved. Do not invent the producer. Preserve parent `EG-MEDIA-VOCAB-R001`. Source `EG:69` SHA-256 `38f71f6a205cf8df27631a4aa86ec3312a91f7902dfd8bfe843db2a142d1d30f`. | Read back tag provenance and media revision from an authorized tagged item. Query as allowed and denied principals. Assert only authorized results appear. Refuse missing producer/evidence provenance and stale media revisions. Keep producer testing pending until its identity and contract are resolved.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001.101
Meeting transcript revisions and provider-bound summary context
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Meeting transcript revisions and provider-bound summary context.** Add public `Method::MeetingTranscriptRevision` with `{Append, Correct, DeleteSegment, Finalize, GetFinal}`. Commit immutable revisions through SourceIngest/ChangeEnvelope and `TranscriptSegment`. Each revision binds `{meeting_id, base_revision, new_revision, monotonic_event_sequence, idempotency_key, ordered_segment_ids, start_ms, end_ms, optional_speaker_ref, text_digest, provenance_ref, finalization_digest}`. A base mismatch or reordered/repeated event with a different digest returns typed conflict. Exact replay is idempotent. Finalization seals ordered segments and transcript digest. Later corrections create a new revision. They stale old-digest summaries without rewriting them. `MeetingSummaryContextV1` accepts a current finalized transcript digest, provider-admission ref `{provider, model, policy_revision, admission_id, admission_digest}`, and pinned `MeetingSummaryLimitPolicyV1`. Require positive finite `max_spans` ≤128, `max_segment_bytes` ≤16384, and `max_tokens` ≤8192. Return ordered spans, citations, context digest, and applied policy revision. Make no model call. Missing/invalid limits or exceeded caps refuse before summary effects. `CommitMeetingSummaryV1` accepts AU receipt `{owner_requirement_id, receipt_id, receipt_digest, provider, model, policy_revision, input_context_digest, output_digest}` plus per-claim citations. EG validates the receipt. EG never mints it or uses model weights. Refuse unfinalized/stale transcript, missing admission, unknown/mismatched AU receipt, citation outside sealed text, or cross-tenant request before writes. **AU hold:** AU owns provider admission, retry/attempt accounting, and disabled-provider refusal. `AU-SEMANTIC-R030` remains pending. Wrapper retries do not count as one invocation without its receipt contract. Consumer `WEBUI-APPS-R001.5` uses this contract. WebUI owns provider choice/rendering. AU owns admission, invocation, and receipt. Source WEBUI:10 SHA-256 `c82a815c87428a5baf4379ef7790bafb24a5d3367d16ebd85a6c39ff9b52521d`. | Serve ordered append/correction/finalization. Independently read back the sealed digest. Late corrections must stale old summaries. Read bounded context from a current transcript with validated provider admission. Accept only summaries with matching AU provider/model/policy/context/output receipt and valid citations. Refuse stale, unfinalized, unauthorized, or mismatched cases before mutation. AU R030 admission/retry/disable/receipt tests and WebUI journey remain required. EG does not claim them.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R001.102
Bookmark semantic search and authorized relation projection
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Bookmark semantic search and authorized relation projection.** Add no parallel ingestion path. SDK `SDK-SOURCE-INGEST-R005.7-.12` envelopes enter existing `Method::SourceIngest` and ChangeEnvelope commit. Reuse `src/server/dispatch/graph_pipeline/native_routes.rs` and `src/server/handlers/source_ingestion.rs`. Add read methods `Method::BookmarkSemanticSearch` (`BookmarkSemanticSearchV1`) and `Method::BookmarkRelations` (`BookmarkRelationsV1`). Use existing `Method::SemanticSearch` and UQL paths. Bind `{source/bookmark_ids, ingestion_receipt_id/digest, source_revision, index_revision, query_digest, graph_snapshot_revision, authorization_revision, limit_policy_digest}`. `BookmarkQueryLimitPolicyV1` requires positive finite `max_hits` ≤100, `max_relationships` ≤500, and `max_response_bytes` ≤1048576. Search returns score, provenance, explicit unknown metadata, and a tenant/query/index/snapshot-bound cursor. Relations return authorized node/edge IDs and mindmap provenance only. Filter before counting. Never leak denied edges/counts. Missing metadata remains unknown. Missing/invalid policy or exceeded cap refuses before truncated success. Identical source receipt is idempotent. Stale/unavailable indexes or mismatched revisions return typed refusal, never empty success. EG owns bookmark meaning/index/query/relationship data. GraphOS owns served query/export adapter. `WEBUI-APPS-R001.6` owns mindmap and CSV/JSON rendering. Source WEBUI:11 specifies `{searchable bookmark knowledge base, meaning-based semantic filtering, interactive mindmap, CSV or JSON export}`. Source SHA-256 `b1708c96d6b9cadcb1c9f35cc5cb7dde4e60ed2cb1250598e55b9ce4cc66907e`. | Ingest through named SDK envelopes and SourceIngest. Read back the committed bookmark and receipt. Search/read relations on the same pinned index/snapshot. Confirm paging and unknown metadata. Refuse stale indexes, mismatched revisions, and denied edges/counts without leakage. GraphOS/WebUI separately prove served export and mindmap. Add no duplicate EG ingest path. No runtime/owner receipt is claimed.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R650
Multimodal memory over the blob substrate (rollup)
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Multimodal memory over the blob substrate (rollup).** EG stores media the user sends (image, voice note, chart) as a content-addressed blob node. The node links to its transcription and to the memory entry that cites it. EG recalls it through the same tiers as text memory. The Rust home is `crates/eg-modality/src/media_memory.rs`. Satisfied only when children `EG-MEDIA-VOCAB-R650.1`-`EG-MEDIA-VOCAB-R650.6` are satisfied. | See each child.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R650.1
Model
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Model.** Add `MediaMemory{blob_id,mime,transcript_ref,source_message}`, `MediaRecall` in `crates/eg-modality/src/media_memory.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R650.2
Behavior
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Behavior.** Write the blob once by digest. Attach modality-specific derivations (transcript, caption) as separate derived nodes. Recall by digest or by derivation text. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R650.3
Wiring
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Wiring.** Served `MediaRemember` and `MediaRecall` over the existing blob substrate. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R650.4
Refusal
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Refusal.** A blob over the size ceiling or with a mismatched declared and sniffed type is refused. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R650.5
Evidence
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Evidence.** Record digest, size, type, derivation IDs and the citing memory entry. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-MEDIA-VOCAB-R650.6
Hot-path proof
Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source
**Hot-path proof.** Benchmark `media_memory_write` (1 MiB image): p50 1 ms, p99 8 ms, peak memory bounded by blob size. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-modality media_memory_write` against the stored baseline.
requirementEG-MEDIA-VOCABSPECIFIEDNo recorded commit/test evidence
EG-OBJECT-STORAGE-BACKEND
EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost Gate
specNoneSPECIFIEDNo recorded commit/test evidence
EG-OBJECT-STORAGE-BACKEND-R001
Typed object-store backend specification
Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source
**Typed object-store backend specification.** Model: a `StorageBackendSpec` declares the durable-store backend for a graph. Two variants exist. `local` is redb and is the default. `object-store` is S3-compatible. The spec names endpoint, bucket, and root by secret reference only. It declares a durability class. It names a layout lineage entry. Behavior: the engine opens the graph from the spec. An unbound spec refuses with a named reason before any effect. An unsupported spec refuses the same way. Wiring: extend the physical store binding in `crates/eg-storage`. Reuse the owner-store layout lineage registry (EG-DURABLE-KERNEL-R003). Reuse the store-authority binding (EG-DURABLE-KERNEL-R021). Refusal: the engine refuses a missing secret reference. It refuses an unknown variant. It refuses a layout absent from the lineage registry. Every refusal is atomic and typed. Evidence: the spec round-trips over the wire. Each refusal case stays typed with no state change. | `tests/test_object_storage_backend_spec.py::test_backend_spec_roundtrip_and_refusals` round-trips both variants. It asserts each refusal leaves the registry unchanged.
requirementEG-OBJECT-STORAGE-BACKENDSPECIFIEDNo recorded commit/test evidence
EG-OBJECT-STORAGE-BACKEND-R002
Object-store read path
Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source
**Object-store read path.** Model: durable state on object storage is immutable content-addressed segments. A version manifest joins them. A snapshot read at a committed version fetches exactly the segments that version's manifest names. Behavior: reads never mutate store state. They trigger no copy-on-read. They trigger no compaction. Reads at any committed version are consistent with the commit chain. A corrupt segment refuses with a typed layout or corruption error. It never reinterprets. Wiring: extend the physical read path in `crates/eg-storage` with an object-store fetcher. Reuse the existing `GraphView` snapshot machinery. Refusal: the engine refuses a manifest naming a missing segment. It refuses a segment whose digest mismatches. Each refusal is typed and names the version. Evidence: a read at version N equals the write set at N. The corrupt-segment case refuses. Earlier versions stay readable. | `tests/test_object_storage_reads.py::test_versioned_reads_and_corruption_refusal` reads three versions. It corrupts one segment. It asserts the typed refusal with earlier versions intact.
requirementEG-OBJECT-STORAGE-BACKENDSPECIFIEDNo recorded commit/test evidence
EG-OBJECT-STORAGE-BACKEND-R003
Object-store commit path (commit before ack)
Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source
**Object-store commit path (commit before ack).** Model: a commit writes immutable versioned segments. It publishes the new version by a single conditional manifest swap. The swap is a compare-and-set on the manifest object. The manifest carries version, digest, tenant, graph, and parent version. Behavior: the engine acks the client only after the manifest publish is durable. Durability follows the store's declared durability class. A failed or interrupted publish leaves the prior version intact. No partial version appears. No dangling publish appears. Wiring: extend the commit path with an object-store publisher. Reuse the commit/raft path. Reuse the existing receipt shape. Refusal: a publish that loses the CAS to a concurrent writer refuses as stale. It reconciles per the existing rules. A spec without a declared durability class refuses at open. Evidence: a crash between segment write and manifest publish reopens the graph at the prior version. The CAS-loss case never produces two heads. | `tests/test_object_storage_commits.py::test_commit_before_ack_and_partial_publish` interrupts publish between phases. It reopens. It asserts the prior version is whole. The concurrent-CAS case yields one head.
requirementEG-OBJECT-STORAGE-BACKENDSPECIFIEDNo recorded commit/test evidence
EG-OBJECT-STORAGE-BACKEND-R004
Shared-root multi-node access
Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source
**Shared-root multi-node access.** Model: any engine node opens any tenant graph directly from the shared object-store root. Branch and commit coordination keep their existing owners. The consensus and placement authorities coordinate. The store layer adds no second consensus. Behavior: a node with no local pre-materialized copy serves tenant reads. It first re-fetches the current version's manifest and segments in a bounded pass. It never re-materializes full history. A node that lost local state reopens from the root. It loses no data. Wiring: extend the open and placement path (catalog-driven resharding, M3). Reuse the existing placement authority. Reuse the resharding handoff. Refusal: the engine refuses a node without a placement grant for the tenant. The refusal happens before reads. A stale local cache behind a newer manifest discards. It never serves. Evidence: two nodes open the same root. They read identical state. A node that drops local state rejoins from the root within the bounded re-fetch. | `tests/test_object_storage_shared_root.py::test_multi_node_cold_open_and_rejoin` opens one root on two nodes. It drops one node's local state. It asserts identical served state after rejoin.
requirementEG-OBJECT-STORAGE-BACKENDSPECIFIEDNo recorded commit/test evidence
EG-OBJECT-STORAGE-BACKEND-R005
Comparative cost gate across releases
Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source
**Comparative cost gate across releases.** Model: a pinned, environment-stamped comparative cost harness drives the same logical cold lifecycle against two builds. The lifecycle covers open, read, commit, and merge. The harness records four dimensions. Time, object actions, bytes, and peak memory. Output is versioned JSONL with a pass/fail reporter. Behavior: a bounded regression guard fails the release on unexplained growth in the fixed open cost. Storage-traffic and timing measurements use separate matched runs. A counting proxy perturbs timing. Wiring: add the harness under `benches/` and `scripts/`. Reuse the existing benchmark and cost-model machinery (transport benchmarks, multi-shard scaling, cost model). Refusal: the harness refuses a run missing its environment stamp. It refuses a run missing its pinned revision. The run is claim-ineligible. It never enters the gate's evidence. Evidence: an injected regression in the fixed open cost trips the guard. A clean run records the stamped JSONL. Stated advantage: the harness counts cross-shard federation actions. A single-store comparative harness cannot express those. | `tests/test_comparative_cost_gate.py::test_regression_guard_and_claim_eligibility` injects a fixed-cost regression. It asserts the release gate fails. It asserts an unstamped run is claim-ineligible.
requirementEG-OBJECT-STORAGE-BACKENDSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH
EG-CQ-ORCH — Orchestration competency questions
specNoneSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R001
Q1: "What steps do I need to follow to complete task XYZ?" (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q1: "What steps do I need to follow to complete task XYZ?" (rollup).** Answered by one query over the ontology reading L0 (task, process and standard ontologies), L3 (stored agent graphs and workflows), L5 (past runs and outcomes). Mechanism: EG-DECISION-ENGINE-R036 (graph.assemble composes tasks), R003 (is_a derivation records), EG-FEDERATED-QUERY-R006 (proof-carrying results). Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R001.1
Q1 Ontology gap: ordered step
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q1 Ontology gap: ordered step.** Add `eg:TaskStep`, `eg:hasStep` and `eg:precedes` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R001.2
Q1 SHACL shape
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q1 SHACL shape.** Add one SHACL shape for the Q1 answer inputs (step order is acyclic) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R001.3
Q1 Source-authority mapping
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q1 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q1 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R001.4
Q1 Query fixture
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q1 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q1` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R001.5
Q1 Acceptance test
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q1 Acceptance test.** Add one acceptance test running Q1 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R002
Q2: "How many agents and what type of agents are needed to complete the task?" (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q2: "How many agents and what type of agents are needed to complete the task?" (rollup).** Answered by one query over the ontology reading L3 (topology slots), L2 (agent kinds), L5 (observed width/outcomes). Mechanism: EG-DECISION-ENGINE-R046 and R111 (topology decision), R014 (composition as bounded 0-1 optimization), R036. Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R002.1
Q2 Ontology gap: agent kind
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q2 Ontology gap: agent kind.** Add `eg:AgentKind` and `eg:fillsAgentKind` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R002.2
Q2 SHACL shape
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q2 SHACL shape.** Add one SHACL shape for the Q2 answer inputs (slot role and width bounds) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R002.3
Q2 Source-authority mapping
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q2 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q2 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R002.4
Q2 Query fixture
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q2 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q2` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R002.5
Q2 Acceptance test
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q2 Acceptance test.** Add one acceptance test running Q2 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R003
Q3: "Can we use an agent template we already have, or an external A2A agent we have added to our Agent Library, based on their capabilities?" (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q3: "Can we use an agent template we already have, or an external A2A agent we have added to our Agent Library, based on their capabilities?" (rollup).** Answered by one query over the ontology reading L2 (agents, templates, A2A cards in the Agent Library), L1 (capabilities of components). Mechanism: EG-DECISION-ENGINE-R126 and children (capability coverage over Agent Library candidates and A2A cards), R044 (A2A routing), EG-TYPED-PACKS-R013 (capability IRI validation), R006 (pack projection). Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R003.1
Q3 Ontology gap: agent template
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q3 Ontology gap: agent template.** Add `eg:AgentTemplate` to `crates/eg-core/ontology/catalog-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R003.2
Q3 SHACL shape
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q3 SHACL shape.** Add one SHACL shape for the Q3 answer inputs (candidate has a provided capability) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R003.3
Q3 Source-authority mapping
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q3 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q3 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R003.4
Q3 Query fixture
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q3 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q3` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R003.5
Q3 Acceptance test
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q3 Acceptance test.** Add one acceptance test running Q3 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R004
Q4: "What standards, best practices, or guardrails should I follow?" (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q4: "What standards, best practices, or guardrails should I follow?" (rollup).** Answered by one query over the ontology reading L0 (standards, shapes, policies), L1 (component-level constraints). Mechanism: EG-DECISION-ENGINE-R127 and children (guardrail entailment with entailment path and source generation), EG-FEDERATED-QUERY-R005 (VALIDATE SHAPE), R006. Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R004.1
Q4 Ontology gap: best practice and rule scope
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q4 Ontology gap: best practice and rule scope.** Add `eg:BestPractice` and `eg:appliesToTaskClass` to `crates/eg-core/ontology/capability-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R004.2
Q4 SHACL shape
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q4 SHACL shape.** Add one SHACL shape for the Q4 answer inputs (rule names its task class and source) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R004.3
Q4 Source-authority mapping
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q4 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q4 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R004.4
Q4 Query fixture
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q4 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q4` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R004.5
Q4 Acceptance test
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q4 Acceptance test.** Add one acceptance test running Q4 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R005
Q5: "What skills, tools, prompts, and LLM models does each agent need to complete each subtask?" (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q5: "What skills, tools, prompts, and LLM models does each agent need to complete each subtask?" (rollup).** Answered by one query over the ontology reading L1 (skills, tools, prompts, model profiles), L2 (which agent holds them). Mechanism: EG-DECISION-ENGINE-R036 (assembly binds components), R126 (coverage), R014 (knapsack/cardinality constraints), R002 (evidence class). Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R005.1
Q5 Ontology gap: model profile
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q5 Ontology gap: model profile.** Add `eg:ModelProfile` and `eg:needsSkill` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R005.2
Q5 SHACL shape
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q5 SHACL shape.** Add one SHACL shape for the Q5 answer inputs (binding names agent, model and prompt) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R005.3
Q5 Source-authority mapping
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q5 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q5 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R005.4
Q5 Query fixture
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q5 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q5` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R005.5
Q5 Acceptance test
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q5 Acceptance test.** Add one acceptance test running Q5 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R006
Q6: "What workflow do the agents need to follow?" (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q6: "What workflow do the agents need to follow?" (rollup).** Answered by one query over the ontology reading L3 (workflows and agent graphs), L4 (harness hooks and extension points), L5 (past runs). Mechanism: EG-DECISION-ENGINE-R036 (assembled graph carries workflow), R044 (routing to an existing graph), plus the durable-run kernel already in orchestration-v1. Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R006.1
Q6 Ontology gap: handoff
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q6 Ontology gap: handoff.** Add `eg:handsOffTo` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R006.2
Q6 SHACL shape
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q6 SHACL shape.** Add one SHACL shape for the Q6 answer inputs (handoff names source and target step) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R006.3
Q6 Source-authority mapping
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q6 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q6 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R006.4
Q6 Query fixture
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q6 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q6` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R006.5
Q6 Acceptance test
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q6 Acceptance test.** Add one acceptance test running Q6 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R007
Q7: "What does the agent graph shape (DAG) look like?" (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q7: "What does the agent graph shape (DAG) look like?" (rollup).** Answered by one query over the ontology reading L3 (agent graphs and topology templates). Mechanism: EG-DECISION-ENGINE-R046, R111 and R111.1 (topology as typed Decide question), R036. Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R007.1
Q7 Ontology gap: slot edge
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q7 Ontology gap: slot edge.** Add `eg:feeds` between `swarm:Slot` nodes to `crates/eg-core/ontology/swarm_topology-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R007.2
Q7 SHACL shape
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q7 SHACL shape.** Add one SHACL shape for the Q7 answer inputs (graph is acyclic with one root) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R007.3
Q7 Source-authority mapping
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q7 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q7 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R007.4
Q7 Query fixture
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q7 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q7` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R007.5
Q7 Acceptance test
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Q7 Acceptance test.** Add one acceptance test running Q7 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R008
Composed answer to "How can I execute task XYZ?" (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Composed answer to "How can I execute task XYZ?" (rollup).** One response carries all seven parts, each with provenance, produced through the engine's assembly (`graph.assemble()` / AgentAssemble, `EG-DECISION-ENGINE-R036`), not a second planner. Split into `.1` envelope type, `.2` assemble wiring, `.3` abstention per part, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R008.1
Composed Envelope type
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Composed Envelope type.** Add the typed `ExecutionAnswer` DTO (`crates/eg-types/src/decision/`) with seven part slots, each `answer|abstain` plus provenance and evidence class. Owner: epistemic-graph. | Serde round-trip test and golden-digest test for the envelope.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R008.2
Composed Assemble wiring
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Composed Assemble wiring.** Populate the envelope from the existing assemble handler output and the R126 and R127 queries; add no new solver or planner. Owner: epistemic-graph. | Test asserts the envelope's `assembled_by` is the assemble path and the certificate digest matches R004 verification.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R008.3
Composed Typed abstention per part
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Composed Typed abstention per part.** Each part that lacks data returns a typed `AbstainReason`, never an omitted field. Owner: epistemic-graph. | Negative test removes one source and asserts that part abstains while the others answer.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R008.4
Composed Query fixture
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Composed Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/composed` for task XYZ spanning all seven parts. Owner: epistemic-graph. | Fixture-load test asserts every part has expected rows.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R008.5
Composed Acceptance test
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Composed Acceptance test.** Add the end-to-end test asserting all seven parts non-empty with provenance. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::composed_answer_has_seven_parts_with_provenance`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R009
Probe questions through the intent surface (rollup, owned by graph-os, cross-repo)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Probe questions through the intent surface (rollup, owned by graph-os, cross-repo).** Each probe is an acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Split into one child per probe (`.1` to `.6`). | Rollup closes when children .1-.6 pass in graph-os.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R009.1
Probe: "How many nodes does the graph hold, by label?"
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Probe: "How many nodes does the graph hold, by label?"** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: correct SQL, empty answer. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R009.2
Probe: "How can I deploy a container with container-manager?"
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Probe: "How can I deploy a container with container-manager?"** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: 1-step plan. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R009.3
Probe: "Which agents are in the Agent Library?"
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Probe: "Which agents are in the Agent Library?"** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: routed. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R009.4
Probe: "Why does graph-os use the intent surface?"
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Probe: "Why does graph-os use the intent surface?"** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: pending. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R009.5
Probe: "Find a tool that lists Docker containers."
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Probe: "Find a tool that lists Docker containers."** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: pending. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R009.6
Probe: "Delegate: list running containers."
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Probe: "Delegate: list running containers."** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: pending. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R010
The graph serves architecture views (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**The graph serves architecture views (rollup).** The engine derives container-level architecture views from ingested code and ingested diagrams, and serves them as a read-only view. Children .1-.6. | Rollup closes when children .1-.6 are verified.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R010.1
Model
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Model.** Add `ArchitectureView`, `ViewContainer` and `ViewEdge` in new file `crates/eg-types/src/architecture_view.rs`. A container carries a name, a technology label and the source paths that support it. An edge carries a kind and a count of supporting calls. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::view_types_round_trip`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R010.2
Behavior
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Behavior.** Add `derive_architecture_view(graph, scope) -> ArchitectureView` in `crates/eg-core/src/architecture_view.rs`. Each rule is a named, replaceable default. One container per deployable package. Edges come from cross-package calls. Ingested diagram elements merge by name. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::derivation_merges_code_and_diagram_elements`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R010.3
Wiring
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Wiring.** Call `derive_architecture_view` from the read handler at `src/server/handlers/mining/impact.rs:264`. The `handle_impact` function already runs for the served impact operation in production. The view branch of that handler creates the call site. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::served_operation_returns_view`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R010.4
Refusal
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Refusal.** `derive_architecture_view` must return the typed abstention `ViewAbstained::NoSupportingSource` for a scope with no ingested code and no diagram. It must never invent a container. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::empty_scope_abstains`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R010.5
Evidence
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Evidence.** Every container and edge in the served view must list its supporting node ids. A reader traces each box to the ingested files that justify it. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::every_container_cites_support`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R010.6
Hot-path proof
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Hot-path proof.** Entry point: the served impact operation with an architecture-view request over a fixture repository and one ingested diagram. The test passes through `impact.rs:264` and observes the view with containers, edges and support ids. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::served_view_over_fixture_repository`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R010.7
Preplanning architecture-gap admission and unwired-feature refusal
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Preplanning architecture-gap admission and unwired-feature refusal.** Reuse the served architecture view from `EG-CQ-ORCH-R010.1-.6` and existing capability query. Do not re-derive architecture. Before `Method::Decide` accepts a plan-producing `TaskPlan`, require `PlanAdmissionV1` with `{repository_id, repository_revision, architecture_view_ref, architecture_snapshot_revision, study_gap_ref, study_gap_revision, plan_request_digest, features}`. Each feature binds a stable id and description digest. It binds a hot-path attach point `{file, symbol, operation}`. It binds input/output schema digests and at least one typed wiring edge. The edge targets an existing EG producer/consumer or scoped external owner. Compare every feature with pinned architecture and AU study-gap evidence. Return ordered `DesignDifference` records with feature id, existing container/edge refs, missing edge/attach point, and source ids. Refuse stale/mismatched revisions, omitted features, missing attach points, empty edge sets, and unreachable producer-consumer paths. Use `ARCHITECTURE_EVIDENCE_MISSING`, `STUDY_GAP_EVIDENCE_MISSING`, `FEATURE_ATTACH_POINT_REQUIRED`, or `FEATURE_UNWIRED`. Refusal emits no plan. Architecture producer: `EG-CQ-ORCH-R010.1-.6`. AU study-gap producer/consumer: `AU-HARNESS-R019.5-.7`. AU rows bind the same repository/revision and return stable proposal id/revision. If absent, keep this dependency open and refuse admission. Wire admission before TaskPlan returns at `src/server/handlers/decide/stat_decide.rs`. Use served architecture view from `src/server/handlers/mining/impact.rs`. Add no architecture derivation path. Proving tests: `src/server/handlers/decide/stat_tests/architecture_admission_tests.rs::unwired_feature_refuses_before_task_plan`, `src/server/handlers/decide/stat_tests/architecture_admission_tests.rs::stale_architecture_or_study_gap_refuses`, and `tests/decide/test_architecture_admission_served.py::test_plan_requires_pinned_architecture_and_attach_points`. Preserve `EG-CQ-ORCH-R010.1`, `EG-CQ-ORCH-R010.2`, `EG-CQ-ORCH-R010.3`, `EG-CQ-ORCH-R010.4`, `EG-CQ-ORCH-R010.5`, `EG-CQ-ORCH-R010.6`, `AU-HARNESS-R019.5`, `AU-HARNESS-R019.6`, and `AU-HARNESS-R019.7`. Source GRAPHOS:20 SHA-256 `bbc3f62e74bc899e49191e1d9bf324afe5e6dc2553df9e8d8651aae1311a8418`. Remains SPECIFIED pending AU field confirmation, implementation, and served receipts. | Planned acceptance: Matching pinned architecture/study-gap evidence and feature attach points return differences and a TaskPlan. Missing edges/attach points, stale revisions, omitted features, or absent owner receipts return named refusals and no plan. Use served impact and Decide handlers. Independently read back revisions and source refs. Keep AU proposal producer separate. Do not duplicate architecture derivation. These are future cases, not evidence.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R011
Job, downtime and plan competency questions (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Job, downtime and plan competency questions (rollup).** The ontology answers five questions about job loading, downtime work, plan choice, connector usage and connect-time contracts. Each answer carries provenance. Capability-to-component questions belong to `EG-CQ-CONN-R084`. Children `.1` to `.6` deliver it. | See each child.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R011.1
Question
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Question.** Q1 asks: Which tools, skills and local agents should be loaded for job J? The answer shape is rows of component kind, component id, prompt and premise. It is answered through `EG-DECISION-ENGINE-R176`. Fixture: `crates/eg-core/tests/fixtures/orchestration_competency/q11_load_set`. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_load_set`. | The answer is non-empty, bounded and carries one premise per row.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R011.2
Question
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Question.** Q2 asks: Which downtime jobs run next, given priorities and the current window? The answer shape is rows of job type, priority, budget and skip reason. It is answered through `EG-DURABLE-KERNEL-R101`. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_downtime_next`. | The answer lists jobs in priority order with reasons for skipped types.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R011.3
Question
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Question.** Q3 asks: Which virtual query plan is best for question Q across connectors A and B? The answer shape is the kept plan digest, its receipt and the measured gain. It is answered through `EG-FEDERATED-QUERY-R091`. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_best_plan`. | The answer names the kept plan and its measured gain over the baseline.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R011.4
Question
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Question.** Q4 asks: How and when should an agent use connector X for job J? The answer shape is conditions, ordered steps and cautions. It is answered through `EG-DECISION-ENGINE-R177`. An unknown connector must abstain with a typed reason. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_usage_guidance`. | The answer lists ordered steps with citations, and an unknown connector abstains.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R011.5
Question
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Question.** Q5 asks: Which seed facts did connector X contribute, and which parts changed at the last connect? The answer shape is part, outcome, digest and graph revision. It is answered through `EG-TYPED-PACKS-R104`. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_seed_changes`. | The answer lists each part outcome of the last import.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R011.6
Hot-path proof
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Hot-path proof.** The entry point is the graph-os intent surface. The test connects two fixture connectors and asks Q1 to Q5 through `find`. Proving test: `tests/competency/test_job_downtime_plan_served.py::test_five_questions_through_intent_surface`. | Each answer is non-empty and carries provenance.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R800
Run provenance, trace ontology and incident views answer operations questions (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Run provenance, trace ontology and incident views answer operations questions (rollup).** The engine stores run traces, token usage, repository provenance, incidents and portfolio rollups under the trace ontology. It answers operations questions (what ran, what it cost, what failed, what changed) from graph queries. This replaces the in-process aggregators of the old harness. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R800.1
Model
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Model.** `RunTrace`, `Incident` and `PortfolioView` are ontology classes in `crates/eg-rdf` with typed links to runs, repositories and usage records. | Planned: `crates/eg-rdf/tests/trace_competency.rs::questions_answer_with_provenance`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R800.2
Behavior
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Behavior.** Questions compile to UQL over the trace graph. Incident grouping is a single pass keyed by correlation id in O(events). Replay reads events in append order. | Planned: `crates/eg-rdf/tests/trace_competency.rs::incident_groups_by_correlation_id`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R800.3
Wiring
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Wiring.** Self-ingest writes through `MutationBatch` from the served trace method; views are read through the generated client and the web presentation layer. | Planned: `crates/eg-rdf/tests/trace_competency.rs::tenantless_trace_is_refused`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R800.4
Refusal
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Refusal.** The engine refuses a trace without a tenant. It refuses an event whose correlation id is empty. A view over another tenant's runs returns empty with no content. | Planned: `crates/eg-rdf/tests/trace_competency.rs::cross_tenant_view_is_empty`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R800.5
Evidence
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Evidence.** Evidence is the competency question set with expected answers over a fixed trace corpus and the provenance of each answer. | Planned: `crates/eg-rdf/tests/trace_competency.rs::replay_preserves_append_order`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R800.6
Hot-path proof
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Hot-path proof.** Hot-path proof: a Criterion benchmark answers each question over 1 million trace events. The p50 stays under 20 ms. The p99 stays under 100 ms. Memory stays under 256 MiB. | Planned: `crates/eg-rdf/tests/trace_competency.rs::question_bench_within_budget`.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R700
Business processes compile to executable workflows stored with replay (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Business processes compile to executable workflows stored with replay (rollup).** A modeled business process compiles deterministically into an executable workflow graph (steps, gates, hand-offs). Workflows persist as graph content with versions. The engine can replay them. Natural-language authoring of a workflow is an agent-harness concern that submits a typed workflow. Implemented in eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R700.1
Model
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Model.** `WorkflowSpec`, `WorkflowVersion` and `ProcessCompilationError` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R700.2
Behavior
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Behavior.** Compilation is a topological traversal of the process graph in linear time. The engine refuses a cycle without a declared loop gate. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R700.3
Wiring
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Wiring.** Extends R006 and R007; storage is versioned with compare-and-set. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R700.4
Refusal
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Refusal.** An unbound task or a cycle without a loop gate is refused with the node id. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R700.5
Evidence
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Evidence.** A stored workflow cites the process revision it compiled from. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R700.6
Hot-path proof
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/competency/test_process_compile_served.py::test_cycle_without_gate_refused` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/process_compile.rs` must show p50 under 3 ms and p99 under 20 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R701
External governance process models import to and export from workflows (rollup)
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**External governance process models import to and export from workflows (rollup).** External process models (activity and gate models) import into workflows with gates recognized. A workflow exports back to the interchange format. Implemented in eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R701.1
Model
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Model.** `ImportedProcess` and gate classification in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R701.2
Behavior
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Behavior.** Import is a single streaming pass; a round trip preserves steps, gates and hand-offs. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R701.3
Wiring
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Wiring.** Served as import and export methods beside the architecture views (R010). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R701.4
Refusal
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Refusal.** A model with an unmapped element type is refused listing the element type. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R701.5
Evidence
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Evidence.** Imported nodes keep the source model id and element id. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-CQ-ORCH-R701.6
Hot-path proof
Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/competency/test_governance_roundtrip_served.py::test_roundtrip_preserves_gates` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/governance_import.rs` must show p50 under 5 ms and p99 under 30 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-CQ-ORCHSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB
EG-ORCH-VOCAB — Orchestration vocabulary
specNoneSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R001
Task steps (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Task steps (rollup).** Adds the ordered-step vocabulary so "what steps" is one graph query. Step order reuses the existing core `:precedes`; no new order property. Children .1-.4. | Rollup closes when children .1-.4 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R001.1
Add class `:TaskStep`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add class `:TaskStep`.** Add `:TaskStep` (subclass of `bfo:0000001` so the existing `:precedes` domain and range accept it) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-rdf/tests/orchestration_vocabulary.rs::task_step_resolves_and_precedes_accepts_it`: term loads, reasoner consistent.
requirementEG-ORCH-VOCABVERIFIED232da0d60c91
481fa6ea2c55
fcf70c5bf0a8
crates/eg-rdf/tests/orchestration_vocabulary.rs:31
EG-ORCH-VOCAB-R001.2
Add property `:hasStep`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:hasStep`.** Add `:hasStep` (object property, range `:TaskStep`, no domain because a task is any class-typed IRI) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::has_step_resolves`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R001.3
Add step-order acyclicity shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add step-order acyclicity shape.** Create `crates/eg-core/ontology/orchestration-v1.shapes.ttl` with `:TaskStepShape` (target `:TaskStep`): no `$this :precedes+ $this`; a step has exactly one `:hasStep` owner. Aggregate-free `sh:sparql`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::step_shape_rejects_a_precedes_cycle` accepts the fixture and rejects a planted cycle.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R001.4
Add Q1 fixture and query test
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add Q1 fixture and query test.** Add `crates/eg-core/tests/fixtures/orchestration_vocabulary/deploy_container.ttl` (worked example in design.md) and a test running the Q1 query. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q1_returns_four_ordered_steps`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R002
Agent kinds and staffing (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Agent kinds and staffing (rollup).** Adds the agent-kind taxonomy and the slot-to-kind link so "how many and which agents" is answerable from a topology template. Children .1-.5. | Rollup closes when children .1-.5 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R002.1
Add class `:AgentKind` and seed members
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add class `:AgentKind` and seed members.** Add `:AgentKind` and seven named individuals (`:agentKindSupervisor`, `:agentKindWorker`, `:agentKindVerifier`, `:agentKindAggregator`, `:agentKindPlanner`, `:agentKindResearcher`, `:agentKindExecutor`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::agent_kind_members_resolve`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R002.2
Add property `:hasAgentKind`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:hasAgentKind`.** Add `:hasAgentKind` (domain `:Agent`, range `:AgentKind`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::has_agent_kind_resolves`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R002.3
Add property `swarm:requiresAgentKind` and the import
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `swarm:requiresAgentKind` and the import.** Add `swarm:requiresAgentKind` (domain `swarm:Slot`, range `:AgentKind`) to `crates/eg-core/ontology/swarm_topology-v1.ttl` and add `owl:imports <http://knuckles.team/kg/orchestration>` to the swarm ontology header. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::slot_requires_agent_kind_resolves`; the import-closure test passes with no cycle.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R002.4
Add slot-kind shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add slot-kind shape.** Extend `swarm:SlotShape` in `crates/eg-core/ontology/swarm_topology-v1.shapes.ttl` with `sh:path swarm:requiresAgentKind; sh:maxCount 1; sh:class :AgentKind`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::slot_shape_rejects_a_non_kind`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R002.5
Add Q2 query test
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add Q2 query test.** Test the Q2 query over the fixture: slot, role, kind, width bounds. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q2_returns_slots_roles_kinds_and_width`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R003
Agent Library, templates and A2A members (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Agent Library, templates and A2A members (rollup).** Adds `:AgentTemplate`, `:AgentLibrary` and library membership, and makes a registered `:A2AAgentCard` a library member the assembler can use. Children .1-.7. | Rollup closes when children .1-.7 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R003.1
Add class `:AgentTemplate`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add class `:AgentTemplate`.** Add `:AgentTemplate` (subclass of `:Agent`) to `crates/eg-core/ontology/orchestration-v1.ttl`, mirroring `crates/eg-types/src/agent_template.rs`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::agent_template_is_an_agent`: `:hasSkill` and `:usesModel` accept it.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R003.2
Add class `:AgentLibrary`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add class `:AgentLibrary`.** Add `:AgentLibrary` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::agent_library_resolves`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R003.3
Add property `:memberOfLibrary`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:memberOfLibrary`.** Add `:memberOfLibrary` (range `:AgentLibrary`; no domain, because members are `:Agent`, `:AgentTemplate` and `:A2AAgentCard`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::member_of_library_resolves`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R003.4
Add property `:instanceOfTemplate`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:instanceOfTemplate`.** Add `:instanceOfTemplate` (domain `:Agent`, range `:AgentTemplate`) to `crates/eg-core/ontology/orchestration-v1.ttl`, mirroring `TemplateInstanceRef`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::instance_of_template_resolves`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R003.5
Add library-member shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add library-member shape.** Add `:LibraryMemberShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`: every `:memberOfLibrary` subject has at least one `:providesCapability` (a member with none is useless to coverage). Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::member_shape_rejects_a_member_without_capability`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R003.6
Wire the Agent Library projection to emit membership
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Wire the Agent Library projection to emit membership.** In the Agent Library outbox projection (`src/server/connector_pack_projection.rs` and `src/server/persistence/agent_library/`), emit `:hasAgentKind` from typed component annotations, `:memberOfLibrary`, `:instanceOfTemplate` and, for kind `a2a_agent_card` components, `a :A2AAgentCard` plus `:providesCapability` from `declared_capabilities`. Capability triples from a card carry claim strength (EG-DECISION-ENGINE-R126.1). Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::a2a_card_component_projects_as_library_member_with_claim_capabilities`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R003.7
Add Q3 query test
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add Q3 query test.** Test the Q3 query returns the template and the A2A card as separate candidate kinds for one required capability. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q3_lists_template_and_a2a_candidates`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R004
Best practices and guardrail scope (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Best practices and guardrail scope (rollup).** Adds `:BestPractice` and the rule-to-task-class link; rule storage is the existing `GuardrailRule` component (EG-DECISION-ENGINE-R127.2.1). Children .1-.5. | Rollup closes when children .1-.5 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R004.1
Add class `:BestPractice`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add class `:BestPractice`.** Add `:BestPractice` (subclass of `:DevelopmentStandard`) to `crates/eg-core/ontology/capability-v1.ttl`. Owner: epistemic-graph. | `crates/eg-rdf/tests/orchestration_vocabulary.rs::best_practice_is_a_development_standard`.
requirementEG-ORCH-VOCABVERIFIED232da0d60c91
481fa6ea2c55
fcf70c5bf0a8
crates/eg-rdf/tests/orchestration_vocabulary.rs:64
EG-ORCH-VOCAB-R004.2
Add property `:appliesToTaskClass`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:appliesToTaskClass`.** Add `:appliesToTaskClass` (domain `:DevelopmentStandard`, range `owl:Class`) to `crates/eg-core/ontology/capability-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::applies_to_task_class_resolves`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R004.3
Add rule-scope shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add rule-scope shape.** Add `:RuleScopeShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`: target every projected `:BestPractice`, including nodes missing the scope property, and require exactly one IRI-valued `:appliesToTaskClass`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::rule_scope_shape_rejects_a_rule_without_a_class`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R004.4
Project `GuardrailRule` components
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Project `GuardrailRule` components.** In the Agent Library projection, emit `a :BestPractice` and `:appliesToTaskClass` from the `applies_to_class` attribute and the source generation as provenance for each `guardrail_rule` component. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::guardrail_rule_component_projects_applies_to_task_class`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R004.5
Add Q4 query test
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add Q4 query test.** Test that a rule on a superclass of the task class is returned with its entailment path (reuses R127.1 `entailed_guardrails`) and an unrelated rule is not. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q4_returns_entailed_rules_only`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R005
Per-subtask bindings (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Per-subtask bindings (rollup).** Adds `:ModelProfile`, `:needsSkill` and a typed step-to-agent assignment so "skills, tools, prompts, models per subtask" is one query. Children .1-.6. | Rollup closes when children .1-.6 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R005.1
Add class `:ModelProfile`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add class `:ModelProfile`.** Add `:ModelProfile` (subclass of `:Model`, so `:usesModel` and `:contextWindow` apply) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::model_profile_is_a_model`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R005.2
Add property `:needsSkill`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:needsSkill`.** Add `:needsSkill` (domain `:TaskStep`, range `:Skill`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::needs_skill_resolves`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R005.3
Add property `:stepAssignedAgent`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:stepAssignedAgent`.** Add `:stepAssignedAgent` (domain `:TaskStep`, no range) to `crates/eg-core/ontology/orchestration-v1.ttl`; the existing `:assignedAgent` is range-restricted to `:A2AAgentCard` and is left alone. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::step_assigned_agent_resolves`; reasoner does not infer an agent to be an A2A card.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R005.4
Add binding shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add binding shape.** Add `:StepBindingShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`: an assigned step has an agent that is `sh:or (:Agent :A2AAgentCard)`, and an `:Agent` assignee has exactly one `:usesModel` and one `:hasPrompt`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::binding_shape_rejects_agent_without_model`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R005.5
Project `model_profile` components
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Project `model_profile` components.** In the Agent Library projection, emit `a :ModelProfile` with `:contextWindow` for each `model_profile` component. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::model_profile_component_projects_with_context_window`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R005.6
Add Q5 query test
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add Q5 query test.** Test the Q5 query returns skills, tools, prompt and model per step. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q5_returns_bindings_per_step`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R006
Hand-off and agent-graph DAG (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Hand-off and agent-graph DAG (rollup).** Adds the hand-off property and the slot-to-slot edge with an acyclicity shape. Children .1-.6. | Rollup closes when children .1-.6 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R006.1
Add property `:handsOffTo`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:handsOffTo`.** Add `:handsOffTo` (domain and range `:TaskStep`, sub-property of `:precedes`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::hands_off_to_implies_precedes`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R006.2
Add property `swarm:feeds`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `swarm:feeds`.** Add `swarm:feeds` (domain and range `swarm:Slot`) to `crates/eg-core/ontology/swarm_topology-v1.ttl`: the forward data-flow edge. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::feeds_resolves`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R006.3
Add property `swarm:loopsBackTo`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `swarm:loopsBackTo`.** Add `swarm:loopsBackTo` (domain and range `swarm:Slot`) to `crates/eg-core/ontology/swarm_topology-v1.ttl`: the only legal back-edge, used by `CritiqueLoop`, `Debate` and `Council`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::loops_back_to_resolves`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R006.4
Add DAG acyclicity shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add DAG acyclicity shape.** Add `swarm:FeedsAcyclicShape` to `crates/eg-core/ontology/swarm_topology-v1.shapes.ttl` (target `swarm:TopologyTemplate`): no slot reaches itself through `swarm:feeds+`, and both ends of every `swarm:feeds` belong to the template's own `swarm:hasSlot`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::feeds_shape_rejects_a_forward_cycle_and_accepts_a_loop_back_edge`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R006.5
Project template topology facts to `swarm:feeds`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Project template topology facts to `swarm:feeds`.** Where the AgentGraph template projection (EG-DECISION-ENGINE-R106) writes `swarm:hasSlot`, also write `swarm:requiresAgentKind` from slot facts and `swarm:feeds` from `AgentGraphEdge` (`from`, `to`, unconditional) and `swarm:loopsBackTo` from an edge flagged as a loop back. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::template_projection_emits_feeds_edges`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R006.6
Add Q6 and Q7 query tests
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add Q6 and Q7 query tests.** Test the workflow query (steps, hand-offs) and the DAG query (nodes, edges, acyclic) over the fixture. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q6_returns_handoffs` and `crates/eg-core/tests/orchestration_vocabulary.rs::q7_returns_dag_adjacency`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R007
Assembly consumption (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Assembly consumption (rollup).** `graph.assemble()` (EG-DECISION-ENGINE-R036) reads the vocabulary for its task list and writes it back for its result; no planner is added. Children .1-.4. | Rollup closes when children .1-.4 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R007.1
Expand a task's steps into assembly tasks
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Expand a task's steps into assembly tasks.** In `src/server/handlers/decide/assemble.rs`, a task IRI with `:hasStep` steps produces one typed assembly task per step. Each task carries its step's `:requiresCapability` and `:needsSkill` capabilities. A task without steps stays one task. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::assemble_expands_has_step_into_tasks`: capability sets per step reach the solver.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R007.2
Project the assembled graph back
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Project the assembled graph back.** After `DecisionCommit` publishes the `AgentGraphDraft`, the projection emits `:stepAssignedAgent` per step and `swarm:feeds` per edge so the Q1-Q7 queries see the assembled graph. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::committed_assembly_is_queryable_through_q5_and_q7`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R007.3
Add the composed read
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add the composed read.** A test runs Q1-Q7 against one committed assembly and asserts every part is non-empty with provenance. This feeds `EG-CQ-ORCH-R008`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::all_seven_parts_present_after_assembly`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R007.4
Enforce slot agent-kind constraints before assembly selection
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Enforce slot agent-kind constraints before assembly selection.** Resolve `swarm:requiresAgentKind` and candidate `:hasAgentKind` from the visible projections in `src/server/handlers/decide/assemble.rs`; a constrained slot accepts only candidates carrying that kind. Unconstrained slots retain current behavior; no matching visible candidate yields a typed abstention. Kinds remain data, with no solver term list. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::assemble_enforces_slot_agent_kind` excludes an executor-only candidate from a verifier slot, accepts a verifier, and abstains when no visible verifier exists.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R008
Catalog registration and ontology gates (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Catalog registration and ontology gates (rollup).** Registers the new shapes file and keeps generated artifacts in step. Children .1-.2. | Rollup closes when children .1-.2 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R008.1
Register `orchestration-v1.shapes.ttl` with the shape loader
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Register `orchestration-v1.shapes.ttl` with the shape loader.** Add the new shapes file to the same loader list as `finance-v1.shapes.ttl` and `governance-core-v1.shapes.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::orchestration_shapes_are_loaded`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
99743823dcfa
fb545f2289df
crates/eg-rdf/tests/orchestration_vocabulary.rs:168
EG-ORCH-VOCAB-R008.2
Regenerate ontology artifacts
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Regenerate ontology artifacts.** Regenerate the ontology digests and the catalog import list, then run the byte-for-byte generated-artifact test. The file `catalog-v1.ttl` is import-only and gains no term. Owner: epistemic-graph. | Existing generated-artifact test passes on the regenerated files.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009
Harness run-trace vocabulary (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Harness run-trace vocabulary (rollup).** Adds the harness run-trace properties to `:RunTrace`, their shapes, and the ingestion proof. Existing children .1-.17 remain mandatory; reviewed extensions .18, .100 and .101 define the additional run-boundary, trace-export and indexed-session contracts without replacing those fields. | Preserve every original shape/ingestion acceptance; the extended rollup closes only when .1-.17 and each accepted extension are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.1
Add property `:terminationReason`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:terminationReason`.** Add owl:DatatypeProperty `:terminationReason` (`:RunTrace` -> xsd:string) to `crates/eg-core/ontology/orchestration-v1.ttl`. `sh:in` (final_answer|context_overflow|stuck|step_budget|error), in the shapes file. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`. Also `termination_reason_uses_the_closed_vocabulary`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
crates/eg-rdf/tests/orchestration_vocabulary.rs:126
crates/eg-rdf/tests/orchestration_vocabulary.rs:178
EG-ORCH-VOCAB-R009.2
Add property `:peakContextTokens`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:peakContextTokens`.** Add owl:DatatypeProperty `:peakContextTokens` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
crates/eg-rdf/tests/orchestration_vocabulary.rs:127
EG-ORCH-VOCAB-R009.3
Add property `:contextBudgetTokens`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:contextBudgetTokens`.** Add owl:DatatypeProperty `:contextBudgetTokens` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
crates/eg-rdf/tests/orchestration_vocabulary.rs:128
EG-ORCH-VOCAB-R009.4
Add property `:elisionCount`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:elisionCount`.** Add owl:DatatypeProperty `:elisionCount` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
crates/eg-rdf/tests/orchestration_vocabulary.rs:129
EG-ORCH-VOCAB-R009.5
Add property `:summarizationCount`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:summarizationCount`.** Add owl:DatatypeProperty `:summarizationCount` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
crates/eg-rdf/tests/orchestration_vocabulary.rs:130
EG-ORCH-VOCAB-R009.6
Add property `:turnCount`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:turnCount`.** Add owl:DatatypeProperty `:turnCount` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
crates/eg-rdf/tests/orchestration_vocabulary.rs:131
EG-ORCH-VOCAB-R009.7
Add property `:toolCallCount`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:toolCallCount`.** Add owl:DatatypeProperty `:toolCallCount` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
crates/eg-rdf/tests/orchestration_vocabulary.rs:132
EG-ORCH-VOCAB-R009.8
Add property `:costUsd`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:costUsd`.** Add owl:DatatypeProperty `:costUsd` (`:RunTrace` -> xsd:decimal) to `crates/eg-core/ontology/orchestration-v1.ttl`. Cost in US dollars; `:tokenCost` (`EG-CQ-CONN-R079.3`) stays as the raw token cost. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
crates/eg-rdf/tests/orchestration_vocabulary.rs:133
EG-ORCH-VOCAB-R009.9
Add property `:appliedHarnessConfig`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:appliedHarnessConfig`.** Add owl:ObjectProperty `:appliedHarnessConfig` (`:RunTrace` -> `:Decision`) to `crates/eg-core/ontology/orchestration-v1.ttl`. The range is the committed `HarnessConfig` decision node that the `EG-DECISION-ENGINE` row for `HarnessConfig` writes. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::applied_harness_config_links_trace_to_decision`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.10
Add property `:runModel`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:runModel`.** Add owl:ObjectProperty `:runModel` (`:RunTrace` -> `:ModelProfile`) to `crates/eg-core/ontology/orchestration-v1.ttl`. The existing `:usesModel` has an `:Agent` domain, so the per-model queries need this property. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::run_model_declared`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.11
Add property `:runTaskClass`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:runTaskClass`.** Add owl:ObjectProperty `:runTaskClass` (`:RunTrace` -> `:TaskClass`) to `crates/eg-core/ontology/orchestration-v1.ttl`. The `EG-TYPED-PACKS` rows for the task class own `:TaskClass` and `shellCentric`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::run_task_class_declared`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.12
Add counter shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add counter shape.** Add `:RunTraceCounterShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`. Each of the six counters and `:costUsd` must be a non-negative number; a negative or non-integer counter fails. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::counter_shape_rejects_negative_and_fractional_counts`.
requirementEG-ORCH-VOCABVERIFIED4039e99f3a6e
6ff9f3cda295
de7ab65f3ee0
f27723c2b36c
crates/eg-rdf/tests/orchestration_vocabulary.rs:194
EG-ORCH-VOCAB-R009.13
Add context-budget shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add context-budget shape.** Add `:RunTraceBudgetShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl` as an `sh:sparql` constraint. `:peakContextTokens` must not exceed `:contextBudgetTokens` unless `:terminationReason` is `context_overflow`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::budget_shape_allows_overshoot_only_for_overflow`.
requirementEG-ORCH-VOCABVERIFIED6ff9f3cda295
de7ab65f3ee0
crates/eg-rdf/tests/orchestration_vocabulary.rs:226
EG-ORCH-VOCAB-R009.14
Add completed-trace shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add completed-trace shape.** Add `:RunTraceCompletedShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`. A trace with a terminal status must carry `:terminationReason`, all counters, `:runModel`, `:runTaskClass` and `:appliedHarnessConfig`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::completed_trace_shape_rejects_missing_termination_reason`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.15
Refuse a shape-invalid RunTrace write
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refuse a shape-invalid RunTrace write.** In `src/server/handlers/graph_ops/gateway_graph.rs` (the `Method::AddNode` arm at line 62), validate a node whose `node_type` is `RunTrace` against the three shapes. A violation returns a typed refusal that names the shape and writes nothing. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::invalid_trace_is_refused_and_not_stored`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.16
Fixture trace for each termination reason
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Fixture trace for each termination reason.** Add `crates/eg-core/tests/fixtures/run_traces.json` with five valid traces, one per termination reason, and one overflow trace whose peak exceeds its budget. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::fixtures_pass_all_run_trace_shapes`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.17
Prove the ingestion hot path
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Prove the ingestion hot path.** Send each fixture through the generated client method (`EG-CONTRACT-R051.1`) and `Method::AddNode`, then read it back with Cypher `MATCH (t:RunTrace {id: $tid})`. The read must return every harness property and the `:appliedHarnessConfig` edge. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::client_ingest_round_trips_harness_properties`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R010
Run-trace metric queries (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Run-trace metric queries (rollup).** Defines the per-model, per-task-class queries that the measured-fact loop reads. A solved task is a trace with `final_answer` and `:evaluationScore` of 1.0. Existing children .1-.6 remain mandatory; .100 and .101 add proposal/progress joins and project/agent usage accounting. | Preserve the original solved-task and metric semantics; the extended rollup closes only when .1-.6 and .100-.101 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R010.1
Query success rate
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Query success rate.** Query `harness_success_rate` returns solved traces divided by all traces, grouped by `:runModel` and `:runTaskClass`. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::success_rate_per_model_and_task_class`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R010.2
Query cost per solved task
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Query cost per solved task.** Query `harness_cost_per_solved_task` returns the summed `:costUsd` of all traces divided by the solved-trace count. It groups by model, task class and `:appliedHarnessConfig`. It abstains when no trace is solved. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::cost_per_solved_task_abstains_without_solved_trace`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R010.3
Query overflow rate
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Query overflow rate.** Query `harness_overflow_rate` returns the share of traces with `:terminationReason` equal to `context_overflow`, grouped by model and task class. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::overflow_rate_counts_only_context_overflow`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R010.4
Query peak-to-budget ratio
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Query peak-to-budget ratio.** Query `harness_mean_peak_ratio` returns the mean of `:peakContextTokens` divided by `:contextBudgetTokens`, grouped by model and task class. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::mean_peak_ratio_per_model_and_task_class`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R010.5
Query mechanism counts
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Query mechanism counts.** Query `harness_mechanism_counts` returns mean `:elisionCount`, `:summarizationCount`, `:turnCount` and `:toolCallCount`, grouped by model and `:appliedHarnessConfig`. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::mechanism_counts_per_config`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R010.6
Query competency question
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Query competency question.** Query `harness_best_config` answers one question. For model M and task class C, it names the cheapest configuration per solved task, with evidence. It returns the configuration, its cost, and the trace ids. It abstains below a named default of 20 traces per configuration. A measured value may replace that default. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::best_config_names_evidence_and_abstains_on_small_samples`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011
Measured model facts from evaluation (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Measured model facts from evaluation (rollup).** Turns an evaluation result into a governed, replaceable model fact that cites its evidence. Storage of the model facts belongs to the `EG-TYPED-PACKS` rows for the measured model facts. Children .1-.11. | Rollup closes when children .1-.11 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.1
Add class `:EvaluationRun`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add class `:EvaluationRun`.** Add `:EvaluationRun`` (subclass of `:RunTrace`) to `crates/eg-core/ontology/orchestration-v1.ttl`. One node represents one matched ablation run; its traces link through `:HAS_EVENT` or `:produced`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::evaluation_run_is_a_run_trace`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.2
Add class `:MeasuredModelFact`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add class `:MeasuredModelFact`.** Add `:MeasuredModelFact` to `crates/eg-core/ontology/orchestration-v1.ttl`. One node records one measured value of one property of one model profile. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::measured_model_fact_declared`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.3
Add properties `:factOfModel` and `:measuredProperty`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add properties `:factOfModel` and `:measuredProperty`.** Add `:factOfModel` (-> `:ModelProfile`) and `:measuredProperty` (xsd:string) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::fact_of_model_and_measured_property_declared`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.4
Add property `:evidencedByRun`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:evidencedByRun`.** Add owl:ObjectProperty `:evidencedByRun` (`:MeasuredModelFact` -> `:EvaluationRun`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::evidenced_by_run_declared`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.5
Add property `:measuredSupersedes`
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add property `:measuredSupersedes`.** Add owl:ObjectProperty `:measuredSupersedes` (`:MeasuredModelFact` -> `:MeasuredModelFact`) to `crates/eg-core/ontology/orchestration-v1.ttl`. A newer measurement replaces an older one by this edge, never by deletion. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::measured_supersedes_declared`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.6
Add measured-fact shape
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Add measured-fact shape.** Add `:MeasuredModelFactShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`. A fact has exactly one `:evidencedByRun`; `:measuredProperty` is `sh:in` (shellProficiency|stoppingBehaviour|contextWindowTokens); the value matches that property's value set. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::measured_fact_shape_rejects_missing_evidence`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.7
Build the measured-fact envelope
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Build the measured-fact envelope.** Add `measured_fact_envelope(model_ref, property, value, evaluation_run_id, digest) -> ChangeEnvelope` in new file `crates/eg-types/src/change_envelope/measured_fact.rs`. It emits one `EvidenceRecord` (`change_envelope.rs:158`) whose `object_id` is the evaluation run id. Owner: epistemic-graph. | `crates/eg-types/src/change_envelope/measured_fact.rs::tests::envelope_carries_run_evidence`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.8
Refuse a measured fact without evidence
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refuse a measured fact without evidence.** `ChangeEnvelope::validate` (`crates/eg-types/src/change_envelope.rs:248`) must refuse an envelope that writes a `:MeasuredModelFact` without an `EvidenceRecord` naming an `:EvaluationRun`. The refusal is typed `MeasuredFactWithoutEvidence`. Owner: epistemic-graph. | `crates/eg-types/src/change_envelope/measured_fact.rs::tests::missing_evidence_is_refused`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.9
Replace a fact by a newer measurement
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Replace a fact by a newer measurement.** The envelope builder must add `:measuredSupersedes` to the current fact of the same model and property. The query `current_measured_fact` returns the newest fact that nothing supersedes. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::newer_measurement_replaces_older_and_old_stays_readable`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.10
Apply the envelope through the governed path
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Apply the envelope through the governed path.** `dispatch_change_envelopes` (`src/server/dispatch/change_envelope.rs:36`) applies the envelope; the existing `ApplyChangeEnvelopes` wire method needs no new variant. A client calls it once per evaluation result. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::evaluation_result_writes_fact_through_apply_change_envelopes`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R011.11
Prove the loop closes
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Prove the loop closes.** Ingest an evaluation, write `contextWindowTokens`, then call `Decide` for `HarnessConfig` (`EG-DECISION-ENGINE` row for `HarnessConfig`). The answer must cite the fact. Without the fact, the answer must abstain, per the `EG-TYPED-PACKS` rows. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::harness_config_decision_reads_measured_fact_and_abstains_without`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012
Spec-folder contents map to typed graph nodes (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Spec-folder contents map to typed graph nodes (rollup).** Workspace ingestion maps each file of a specification folder to one typed node: task, goal, document, memory or policy. Children .1-.6. | Rollup closes when children .1-.6 are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012.1
Model
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Model.** Add `SpecNodeKind` (closed set: `task`, `goal`, `document`, `memory`, `policy`) in new file `crates/eg-core/src/spec_folder.rs`. Add the matching classes `:SpecTask`, `:SpecGoal`, `:SpecMemory` and `:SpecPolicy` to `crates/eg-core/ontology/sdd-v1.ttl`; documents reuse `:Specification`. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::node_kinds_are_closed_and_declared`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012.2
Behavior
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Behavior.** Add `classify_spec_file(relative_path, front_matter) -> Result<SpecNodeKind, SpecFolderRefusal>` in `crates/eg-core/src/spec_folder.rs`. Each rule is a named, replaceable default. `tasks.md` maps to task. `spec.md` and `plan.md` map to document. A constitution file maps to policy. A memory folder maps to memory. A goal line maps to goal. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::default_rules_classify_each_file_kind`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012.3
Wiring
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Wiring.** Call `classify_spec_file` from the non-code branch of the `IndexRepository` handler at `src/server/dispatch/router/source_ingest.rs:24`. The dispatch router calls that handler for every `IndexRepository` request in production. The call site for the non-code branch is new. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::index_repository_writes_typed_nodes`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012.4
Refusal
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refusal.** `classify_spec_file` must return the typed refusal `SpecFolderRefusal::UnknownKind` for a file that matches no rule. The indexer must store a plain `:Document` for it and must not guess a kind. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::unknown_file_is_refused_not_guessed`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012.5
Evidence
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Evidence.** Each node written by the classifier must carry `:classifiedByRule` (xsd:string, the rule name) and the source path. A query must list every node with the rule that produced it. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::node_records_deciding_rule`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012.6
Hot-path proof
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Hot-path proof.** Entry point: the `IndexRepository` wire method with a fixture spec folder. The test passes through `source_ingest.rs:24` and then queries the graph. It must observe one task, one goal, one document, one memory and one policy node. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::index_repository_on_spec_folder_yields_five_kinds`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R013
Run trace step record with request, argument and result digests (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Run trace step record with request, argument and result digests (rollup).** EG stores a model-request digest, tool-argument digest, and result digest for each run step. Replays compare step digests with stored values. Children `.1` to `.6` deliver this contract. | See each child.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R013.1
Model
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Model.** Add `StepRecord{step_index, kind, model_request_digest, tool_args_digest, result_digest}` in `crates/eg-types/src/outcome_bundle.rs` beside `ReceiptNodeKind` at line 130. Add the kind `ModelRequest` to `ReceiptNodeKind`. `kind` is closed: `model_request`, `tool_call`. Raw prompt and argument bytes stay in a referenced artifact. Proving test: `crates/eg-types/src/outcome_bundle.rs::tests::step_record_round_trips`. | A serde round trip keeps the three digests and rejects an unknown kind.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R013.2
Behavior
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Behavior.** Add `step_digest(kind, canonical_bytes) -> Digest256` in `crates/eg-types/src/outcome_bundle.rs`. The default is SHA-256 over canonical JSON, a named replaceable recipe. The harness and the engine must use this one recipe. The harness compares digests span by span and names the first index that differs. Proving test: `crates/eg-types/src/outcome_bundle.rs::tests::step_digest_is_canonical`. | Key order and whitespace do not change the digest. A changed value does.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R013.3
Wiring
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Wiring.** `StepRecord` validation attaches where a terminal commit binds its receipt nodes, in `crates/eg-types/src/outcome_bundle.rs:668` (`RunEvent`). The production caller is the `AddNode` arm at `src/server/handlers/graph_ops/gateway_graph.rs:62`, which `EG-ORCH-VOCAB` already uses for run traces. This row creates the call site that validates the digests of each ordered step. No production replay compare reads the stored digests today. Proving test: `src/server/handlers/graph_ops/gateway_graph.rs::tests::add_run_trace_checks_step_digests`. | A run trace with a malformed digest is refused. A valid one is stored in step order.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R013.4
Refusal
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refusal.** A step with a digest that is not 64 hex characters must be refused with `STEP_DIGEST_INVALID`. A step index that skips or repeats must be refused with `STEP_ORDER_INVALID`. Proving test: `crates/eg-types/src/outcome_bundle.rs::tests::bad_digest_and_gap_refused`. | Each fault returns its own code and stores nothing.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R013.5
Evidence
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Evidence.** Each stored step must carry `:stepIndex` and `:recordedBy`, the actor that wrote it. The run trace must expose the ordered step digests to a read. Proving test: `crates/eg-types/src/outcome_bundle.rs::tests::stored_steps_read_in_order`. | A read returns the steps in index order with the writing actor.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R013.6
Hot-path proof
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Hot-path proof.** The entry point is the generated client run-trace write, which reaches the `AddNode` wire method. The test writes three steps, reads them back, and compares them with a replayed copy that differs at step two. The call passes through `src/server/handlers/graph_ops/gateway_graph.rs:62`. It observes that the first differing index is two. Proving test: `tests/orchestration/test_run_trace_steps_served.py::test_first_divergence_is_step_two`. | The read-back digests let the compare report index two.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.18
Use one run observation window for model and width adjustments
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Use one run observation window for model and width adjustments.** EG SHALL accept one revisioned observation window per run. The window SHALL bind run ID, window ID, start time, and end time. It SHALL record latency samples and units, error count, and eligible-attempt denominator. It SHALL record token usage and measured cost. Cost SHALL include currency and rate revision. The window SHALL bind current model/profile and parallel width. It SHALL record consumed/remaining budgets and host-capacity receipt. Missing samples or rates SHALL remain unknown. Zero denominator, stale window, or run-revision mismatch SHALL remain unknown. Unknowns SHALL NOT become zero-cost or zero-error evidence. A versioned policy SHALL state latency/error thresholds and model-adequacy/profile inputs. It SHALL state cost-prediction basis and deterministic tie breaks. EG SHALL evaluate model and width jointly against observations and remaining budget. It SHALL return a committed feasible pair or typed abstention/stop. It SHALL trace before/after model, width, budget, window, policy, evidence, and reason. Mid-run continuation SHALL obey AU-CONTROL-R019. AU permits narrowing width to release capacity and prohibits mid-run widening. A later-run allocation requires separate admission and capacity grant. Production wiring: Feed proposed AU RunAdjustmentObservation from existing routing/continuation paths to Method::Decide. Reuse R136 model adequacy/stage allocation and R009.17 RunTrace ingestion/readback. Persist adjustments and abstentions before application. GraphOS remains capacity authority. Owner link: `AU-CONTROL-R006` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:10`. Owner link: `AU-CONTROL-R019` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:24`. Owner link: `EG-DECISION-ENGINE-R136.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/decision-engine/requirements.md:298`. Owner link: `EG-ORCH-VOCAB-R009.17` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/orchestration-vocabulary/requirements.md:69`. Owner link: `ARBORA-CAPACITY-R001.1` at `graph-os@069eebc785afb9fb26bbbcc907cf5a2a4bcab5c5:specs/adaptive-capacity/requirements.md:6`. Draft dependency `AU-CONTROL-R006.30` remains `draft_unmerged` at `50c313ab01871ff7e10aee2a9d0254fa55d71f07`. It is not a merged producer or implementation receipt. Its path is `specs/agent-control-plane/requirements.md`. Explicit hold: AU-CONTROL-R006.30 remains unmerged. The owner must version joint-policy thresholds, predictive cost inputs, and tie-break semantics. Do not infer tuning defaults or implementation claims from source text. Owner-review proposal: The joint carrier makes missing decisions explicit. A self-referential adjustment command does not replace the published policy. Original source record `AU:26`, SHA-256 `8d2f83f788c5fdd36c4dc47f85c9f7673393b6b9075dc46a5ac1c32afd2386e2`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run run_observations_change_model_and_width_with_trace through real AU routing/continuation and served EG Decide. Use identical budgets and controlled latency/cost/error windows. Demonstrate policy-directed model/width changes and budget-forced refusal/stop. Read back exact before/after trace facts. Reject stale windows and invalid rates/denominators. Keep unknown values unknown. Show width narrowing releases capacity. Reject mid-run widening. Host-only AIMD or model-only allocator tests do not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R013.7
Source-pinned walkthrough artifact and graph-bound execution notes
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Source-pinned walkthrough artifact and graph-bound execution notes.** Reuse `Method::UnifiedQuery` for source reads and `Method::AddNode` for the existing RunTrace. Preserve R013.1-.6 StepRecord ordering and the content-addressed artifact read path. Add no graph writer or model executor. Define `CodeWalkthroughV1` as `{run_id, repository_id, repository_revision, graph_snapshot_revision, query_digest, ordered_sections, interaction_edges, artifact_ref, artifact_digest, execution_notes}`. Each section has a contiguous ordinal, source refs, and a content ref/digest. Each source ref is `{entity_id, source_revision, source_digest, path, start_line, end_line}`. Edges bind source/target section ordinals and a relation IRI. The manifest is versioned and self-contained. Content is embedded or referenced by immutable digest, never a mutable URL. It binds the exact query and graph snapshot. Each note binds run id, trace step index, span id, closed `StepRecord.kind`, result digest, and source refs. Notes follow contiguous R013.4-.6 order. The AddNode validator refuses a missing or stale repository revision. It also refuses refs outside the pinned snapshot, uncited sections, and unresolved artifact refs/digests. It refuses cross-tenant refs, duplicate/gapped note indices, or spans outside the run. Refusal stores nothing. UQL readback returns the same ordered refs/digests. Artifact read verifies its digest. EG validates/stores the manifest; AU owns explanation generation and execution spans; WebUI owns interaction/rendering. `EG-REPO-INGEST-R009` and `AU-HARNESS-R024` do not define the AU artifact producer or run binding. No WebUI artifact-consumer ID was found. AU must publish producer inputs, outputs, and invocation receipt. WebUI must publish artifact-consumption and interaction binding. Keep closure open until both exact owner IDs and served receipts are linked. Wire validation at `crates/eg-types/src/outcome_bundle.rs` and `src/server/handlers/graph_ops/gateway_graph.rs`; read back through `Method::Uql`. Proving tests: `crates/eg-types/src/outcome_bundle.rs::tests::code_walkthrough_manifest_round_trips`; `src/server/handlers/graph_ops/gateway_graph.rs::tests::add_run_trace_rejects_stale_walkthrough_source_or_artifact`; `tests/orchestration/test_code_walkthrough_served.py::test_walkthrough_trace_and_artifact_read_back`. Preserve `EG-REPO-INGEST-R009`, `AU-HARNESS-R024`, and `EG-ORCH-VOCAB-R013.1/.3`. Ordered-step validation retains `EG-ORCH-VOCAB-R013.3`. Source AU:115 SHA-256 `445704f78ae07d1c4b62f42dd23797823d91bc470f04a9dc779e3f6777fffbf0`. Status remains SPECIFIED; no producer, consumer, implementation, or receipt is claimed. | Planned served acceptance accepts a valid manifest through AddNode. UQL and artifact readback must independently return identical ordering and digests. Refuse stale revisions and uncited sections before storage. Also refuse foreign-tenant refs, unresolved/tampered artifacts, invalid span/run links, duplicate indices, and step gaps. Confirm EG invokes no generator. AU and WebUI journeys remain held until owner rows and receipts are linked. Existing producer tests do not prove these contracts.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R003.8
Successful-team promotion, safe similarity reuse, and typed handlers
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Successful-team promotion, safe similarity reuse, and typed handlers.** Extend R135 `CompiledProgram`/`lookup_program`, AgentLibraryStore, and R003.6 projection. Do not create a second program model or library. Promote only after a successful terminal run links its RunTrace and compiled program durably. The canonical signature binds task-class IRI, sorted capability IRIs, input/output schema digests, and topology digest. Lookup requires exact task-class/schema digests and topology accepted by R036. Score remaining candidates with caller-pinned `SimilarityPolicyV1`. The policy binds revision, weights summing to one, feature definitions, and minimum score. Capability overlap uses Jaccard on sorted sets. Every other feature names a deterministic score function and source revision. Missing/stale features are unknown and exclude candidates; they are not zero. Select the highest score meeting the minimum. Stable program IRI breaks ties. Projected bindings carry `{capability_id, handler_id, handler_version, input_schema_digest, output_schema_digest, declared_effects}`. IDs are IRIs and schema digests are SHA-256. Effects are a non-empty closed set: `read`, `write`, `external`, or `irreversible`. `graph.assemble()` consumes them as compatibility/effect constraints. It still runs the full R036 solver and policy guards. EG never invokes handlers. Refuse promotion without successful-run evidence, valid metadata, and source links. Abstain `no_compatible_program` when no candidate meets threshold/constraints. Wire through `crates/eg-types/src/decision/program_store.rs`, `src/server/handlers/decide/stat_decide.rs`, `src/server/handlers/decide/candidates.rs`, `src/server/handlers/decide/assemble.rs`, `src/server/persistence/agent_library.rs`, and R003.6 projection files. Tests: `crates/eg-types/src/decision/program_store.rs::tests::similarity_policy_and_signature_round_trip`; `src/server/handlers/decide/stat_tests/program_store_tests.rs::team_reuse_rejects_stale_or_incompatible_handler`; `tests/decide/test_program_store_served.py::test_successful_team_promotes_and_similar_task_reuses_constrained_plan`. Preserve `EG-DECISION-ENGINE-R135.2/.4/R036` and `EG-ORCH-VOCAB-R003.5/.6`. Existing coverage includes `EG-DECISION-ENGINE-R135.4`. The existing solver dependency is `EG-DECISION-ENGINE-R036`; the projection dependency is `EG-ORCH-VOCAB-R003.6`. Source EG:12 SHA-256 `517823a931bb93e173b301a9a31fbe6bd75c14687233c72278a59ced1940673a`. Status remains SPECIFIED pending reviewed implementation and served receipts. | Planned tests promote only a successful trace/program pair and independently read source IDs/signature. A pinned policy selects an exact-compatible candidate above threshold. It selects the highest score and breaks ties by stable ID. It excludes incompatible task/schema/topology or missing/stale features. Refuse malformed handler ID/version/schema/effect set. Confirm EG does not invoke handlers. Served assembly names program, policy/revision, score, bindings, and R036 certificate. No candidate yields `no_compatible_program`. These are future tests, not evidence.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012.7
Synthesize reviewed repository policy with invariant-guarded activation
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Synthesize reviewed repository policy with invariant-guarded activation.** IndexRepository SHALL bind each classified policy source to repository, path, commit, blob digest, and source spans. It SHALL synthesize typed GuardrailRule candidates linked to those spans. A versioned synthesis profile SHALL declare its supported rule grammar. Unparsed or ambiguous clauses SHALL remain inactive with explicit reasons. Synthesis SHALL NOT give source prose authority to trigger operations or activate itself. Before activation, EG SHALL compare every rule against the pinned invariant generation through R129.3. EG SHALL validate the R012.8 review binding and compare expected active-policy revision. A contradiction SHALL name the invariant IRI, candidate rule, and source clause. Stale generation/review or unsupported clauses SHALL refuse activation and preserve the prior set. Successful activation SHALL atomically publish candidate-set digest and policy revision. Later reasoning SHALL load active graph policy and record its revision in decision evidence. Production wiring: Extend existing source_ingest/SourceIngest after classify_spec_file. Reuse GuardrailRule storage and `check_rule_against_invariants`. Connect activation to decision policy under EG-IDENTITY-R008.4. R129.5 human-override guarding alone does not establish repository-policy guarding. Owner link: `EG-ORCH-VOCAB-R012.2` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/orchestration-vocabulary/requirements.md:91`. Owner link: `EG-IDENTITY-R008.4` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/engine-identity-and-scope/requirements.md:16`. Owner link: `EG-DECISION-ENGINE-R129.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/decision-engine/requirements.md:247`. Owner link: `EG-DECISION-ENGINE-R129.5` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/decision-engine/requirements.md:249`. No draft consumer dependency is assigned. Explicit hold: The owner must publish and bind supported declarative grammar/synthesis profile. The owner must publish and bind a concrete review-receipt producer. Text synthesis may produce candidates. It cannot fill either authority gap. Owner-review proposal: Atomic publication covers the active graph-policy set only. It does not imply atomic cross-repository filesystem effects. Original source record `EG:46`, SHA-256 `9de4d3274232cb97a9a85ad17ea20b368fff1bd729bdb4e7b2799991da106c58`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. The generated status has no receipt arrays. No implementation or served receipt is claimed. | Exercise repository_policy_is_synthesized_guarded_and_used with real IndexRepository input. Inspect typed candidates/spans. Review the exact digest. Activate through owner path. The served decision SHALL prove active-rule use. A conflicting rule names the invariant and preserves prior active revision. Test unparsed prose, missing review, changed source digest, and invariant-generation race. Classification and direct helper-only tests do not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R004.6
Persist and query capability gaps and enhancements by task class
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Persist and query capability gaps and enhancements by task class.** EG SHALL persist distinct typed CapabilityGap and DesiredEnhancement nodes. Each node SHALL bind tenant, node ID/revision, capability reference, task-class reference, and domain-taxonomy reference. Each node SHALL also bind source evidence/digest, owner, and disposition. Edges SHALL connect each node to its capability, task class, and domain. A request-local `AbstainReason` SHALL NOT itself be the durable registry `CapabilityGap` record. A gap SHALL be a separately admitted node and may cite the abstention as source evidence. An enhancement records a requested improvement without asserting capability absence. The governed mutation path SHALL validate references, ownership, and expected revisions. It SHALL deduplicate repeated source events. Unknown taxonomy/task-class references SHALL refuse instead of creating arbitrary terms. UnifiedQuery SHALL return these types filtered by task class. It SHALL support exact or taxonomy-descendant matching at pinned taxonomy revision. Authorization SHALL run before rows, counts, and pagination. A gap/enhancement node SHALL NOT mark capability implemented, admitted, or successfully tested. Production wiring: Extend existing orchestration ontology/shapes and governed AddNode/ChangeEnvelope path. Reuse current task-class/domain taxonomy and Method::UnifiedQuery. Do not add a second capability registry. Keep the separate EG:7 owner-export manifest question out of these domain nodes. Owner link: `EG-ORCH-VOCAB-R004` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/orchestration-vocabulary/requirements.md:24`. Owner link: `EG-DECISION-ENGINE-R010` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/decision-engine/requirements.md:16`. No draft consumer dependency is assigned. Producer binding: The proposed typed authority/admission contract in plan.md is normative for this row. Configuration must be admitted before use; no deployed authority is claimed. Do not invent an owner role-export ID for the separate EG:7 hold. Owner-review proposal: Distinct gap/enhancement types and query match mode are proposed schema additions. Original source record `EG:51`, SHA-256 `ed01ad35731abc6a739b3e1a39ee198549103acf0d30ec51c77316ca7cf75c49`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run capability_gap_and_enhancement_are_queryable through served mutation and generated UnifiedQuery. Record gap from served abstention and enhancement from separate reviewed request. Query two task classes. Restart and repeat. Independently read typed fields, edges, and provenance. Test event deduplication, revision conflict, invalid taxonomy, exact/descendant matching, and denied-tenant pagination. Confirm capability implementation state did not change. In-memory fixtures alone do not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012.8
Bind active policy to reviewed normative files without graph writes
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Bind active policy to reviewed normative files without graph writes.** EG SHALL retain epistemic state and active runtime policy in the graph. It SHALL bind normative sources to reviewed, versioned repository files. Each active binding SHALL record repository/path/commit/blob and candidate-set digest. It SHALL record review actor/receipt digest, invariant generation, and expected active-policy revision. Review SHALL cover exact source and synthesized-rule digests. Missing, stale, rejected, or mismatched review SHALL refuse before active-policy mutation. EG graph mutations and reasoning SHALL NOT overwrite normative files. A source change SHALL use governed SDK writeback and GraphOS approval. EG SHALL reread committed revision and review it before graph-policy activation. A graph-policy edit SHALL NOT rewrite files or make unreviewed files runtime authority. R012.7 invariant guards and generation comparison apply at activation. Production wiring: Link R012.2 policy classification and EG-IDENTITY-R008.4 active policy to R012.7 activation. Bind review/approval to ARBORA-OPS-R050.2/.4 and the concrete SDK source effect. EG has no normative filesystem writer. Owner link: `EG-ORCH-VOCAB-R012.2` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/orchestration-vocabulary/requirements.md:91`. Owner link: `EG-IDENTITY-R008.4` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/engine-identity-and-scope/requirements.md:16`. Owner link: `ARBORA-OPS-R050.2` at `graph-os@069eebc785afb9fb26bbbcc907cf5a2a4bcab5c5:specs/hosted-api-operations/requirements.md:147`. Owner link: `ARBORA-OPS-R050.4` at `graph-os@069eebc785afb9fb26bbbcc907cf5a2a4bcab5c5:specs/hosted-api-operations/requirements.md:149`. No draft consumer dependency is assigned. Explicit hold: The owner must confirm a review-receipt producer and normative-source-effect binding. R050 establishes review/ops boundaries, not the proposed full carrier. Owner-review proposal: Reviewed files remain normative source. EG owns active policy. This does not adopt file-only runtime authority. Original source record `EG:61`, SHA-256 `c5f1dfe7867267169ebc8c75abba87a1d9ed47568a65cbfe1bf6d183b8026e59`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run reviewed_normative_source_activates_without_graph_overwrite through served ingestion/review/activation. Dispatch a decision that records active policy revision. Compare source bytes/Git revision before and after graph mutation/reasoning. A graph-originated normative write has no source effect. Missing/rejected review, modified blob, changed rules, or raced revisions preserve prior policy. Permitted source changes require governed writeback, reread, renewed review, then activation. Direct fixture activation does not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R012.9
Requirement rows become typed nodes
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Requirement rows become typed nodes.** The spec-folder indexer must parse each row of a `requirements.md` table into one `:Requirement` node. The node carries `id`, `parent_id`, `title`, `text_digest`, `spec_id`, `path` and `blob_digest`. A child row links to its parent by `:childOf`. Add the parser in `crates/eg-core/src/spec_folder.rs`. Call it from the non-code branch at `src/server/dispatch/router/source_ingest.rs:24`. A duplicate row ID must refuse that file with `SPEC_ROW_DUPLICATE`. EG-SDLC-R005 reads these nodes. | `crates/eg-core/tests/spec_folder_mapping.rs::requirement_rows_become_nodes` indexes a fixture spec with one rollup, two children and one duplicate ID.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R005.100
Nested inputs use declared projection and shielding
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Nested inputs use declared projection and shielding.** Extend the existing step contract with nested input schema and source-slot/path mapping per field. Before AU dispatch, project declared paths only. Withhold undeclared sibling/nested fields even when the coordinator can read the full ParallelWorkspace. Define the shielded-field policy. Bind projected-payload digest to step ID, schema revision, and source-slot digests. Reuse typed result/schema validation. EG declares projection/shield policy; AU `_dispatch_parallel_batch`/processor applies it before tool dispatch. DTO extra-field rejection alone is not data projection. Preserve `AU-HARNESS-R020.1/.2/.4/.6`. Source AU:33 SHA-256 `1a32741b0a97f0c31cd1a3df4ea31d6eee0069c62c3487c0d8057b1ced4b6cf4`; parent R005 is unchanged. | Planned served workflow includes secret undeclared nested field and declared sibling. The worker receives only its declared projection. Coordinator may synthesize typed outputs. Unknown paths, stale schema, or unauthorized source fields refuse before dispatch. Preserve R020 typed-result and schema-refusal behavior. Owner-source review only; no runtime/test receipt is inferred.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.100
Correlate trace records and export reads
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Correlate trace records and export reads.** Read data binds trace, parent/run, span, child-agent, tool-call, time range, source revision, and redaction profile. Child spans correlate to parent run. Consumers fetch complete export snapshots with pagination/completeness metadata and stable digest. This defines EG correlation/read only. AU owns span export; GraphOS owns MCP transport. AU `default_runtime_capabilities/run_agent` exports spans. GraphOS carries the export. EG supports correlated readback. Preserve R008/R024 ownership and `EG-ORCH-VOCAB-R009` trace fields plus `AU-HARNESS-R008/R024.1-.7`. Source AU:60 SHA-256 `5d53cbdda932456b27c6649360c3051d4ab09f2db42018550b4ee81c785748b4`; parent R009 is unchanged. | Planned served read exports a parent with multiple agents/tool calls. Fetch all correlated records across pages. Confirm stable digest, redaction, and completeness. Detect/refuse missing child, duplicate span, unauthorized read, and truncated pagination. EG read tests do not prove MCP delivery. Owner-source review only; no runtime/test receipt is inferred.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.101
Index, browse, and search harness sessions by tenant and full manifest
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Index, browse, and search harness sessions by tenant and full manifest.** Add `Method::IndexHarnessSessionBatch` and `Method::SearchHarnessSessions` over committed RunTrace nodes and existing graph/UQL index. This is an index projection, not SDK sync or a second trace store. Request binds tenant, manifest ID/revision/digest, SDK sync receipt ID/digest, and source cursor. Each record binds `{harness_id, adapter_revision, source_session_id, run_trace_id, run_trace_revision, trace_digest, source_sequence}`. Search every harness in the supported manifest. Accept bounded text/time/harness filters, page size, and snapshot cursor. Results include indexed revision, declared/received/indexed/unavailable coverage, per-entry status/reason, watermark, and cursor. A missing source stays in the denominator. Optional cost binds R010.101 accounting revision and currency/minor-unit exponent. Return totals with measured/unknown state and coverage. Missing attribution/price is never zero. Identical manifest/receipt/content replay is idempotent across restart. Changed content, unsupported manifest, stale cursor, or cross-tenant ref refuses without leakage. Attach to durable RunTrace/AddNode readback and existing UQL. GraphOS serves the adapter; its exact requirement ID remains a coordinator hold. Consumer: `WEBUI-APPS-R006.4`. Source WEBUI:3 SHA-256 `38936b5f2136263c40c29fe639c984243fed8be6dbb9a6d836f40d7b7672116e`. | Serve an SDK receipt for two declared harnesses and independently read referenced traces. Browse/search the full manifest across restart and repeated sync. Cover every manifest entry, including a third unavailable source. Return its reason, cursor paging, and cost currency/unit/unknown fields. Identical replay is idempotent. Refuse altered receipt/content, unsupported adapter, expired cursor, or cross-tenant access. SDK sync and GraphOS adapter tests remain separate dependencies.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R010.100
Join evolution proposals to measured source traces
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Join evolution proposals to measured source traces.** Add read-only `Method::EvolutionTraceMetrics` keyed by `{tenant_id, proposal_id, proposal_revision, prompt_version_id, prompt_revision, prompt_digest, metric_window_id, metric_window_revision, metric_window_digest}`. Join AU progress and ordered source run IDs to EG RunTrace IDs/revisions/digests and stored outcome/evaluation metrics. Each metric binds `{metric_id, metric_revision, metric_digest, name, value|null, unit, numerator|null, denominator|null, observed_at_ms, state: measured|unknown}`. Progress binds source ID/revision/digest, state, and observation time. Return ordered trace refs, missing IDs, query/window digest, coverage, and complete/partial state. Missing known trace is partial/unknown, never zero. Unknown proposal/prompt revision, stale window, digest mismatch, or tenant mismatch refuses without disclosure. Existing AddNode/ChangeEnvelope writes traces. UQL performs independent readback. GraphOS `runs.get/runs.metrics` serves it; its exact requirement ID awaits coordinator linkage. EG reads but never authors/advances AU state. Consumer: `WEBUI-APPS-R004.7`. Source AU:103 SHA-256 `68bae14976bd3581bc33ee65b153b5ad60f807fb894af09577b9debd19be7557`. AU has not supplied the exact producer schema binding progress to ordered runs. Do not invent that owner contract. | Serve proposal/prompt revision with two pinned traces and metrics. Independently read every trace, metric, and AU progress revision. Confirm joined window/coverage digest. Missing trace is partial/unknown, never zero. Refuse stale revisions, changed digests, and cross-tenant refs. Do not report calibration, coverage, or trace counts as optimization progress. AU producer and GraphOS adapter receipts remain required dependencies. No runtime/owner receipt is claimed.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R010.101
Index project/agent token and cost totals with finite latency
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Index project/agent token and cost totals with finite latency.** Extend immutable RunTrace with project/agent IDs and accounting-profile revision. Add four disjoint integer counters: uncached input, cached input, nonreasoning output, and reasoning output. Derive input/output totals by adding categories once. `RunTraceUsageQueryV1` accepts tenant, bounded window, model/project/agent grouping, currency, page size, and snapshot cursor. Return category totals, source coverage, index watermark, and accounting revision. Costs use pinned PriceTableV1 and currency-minor-unit revisions. Each rate is an integer minor-unit numerator per one million tokens, keyed by model/category. Sum exact rational numerators per group/category. Round once per final group/category using pinned currency exponent and half-even. Do not round per trace or intermediate group. Unknown price/attribution returns unknown with reason, never zero. Keep cross-currency groups separate unless pinned FX revision exists. Convert the exact aggregate and round once at final output. Profile binds both table revisions, currency, minor-unit exponent, and algorithm. Measure p95 ≤500 ms from authenticated handler entry to serialized response. Use 1,000,000 indexed traces, 32 readers, and 1,000 fixed-window grouped queries. Record data/index/cache-policy revisions. Preserve `harness_cost_per_solved_task`. Consumer: `WEBUI-APPS-R004.8`; GraphOS `handle_runs_metrics` and WebUI ObservabilityView serve it. Source WEBUI:4 SHA-256 `dd790b40c92758d720375c78ccd4278845b8d348022b4d69b978cba049461237`. | Serve all four categories under a pinned profile. Reconcile grouped totals with an independent reference ledger. Verify split-trace invariance, half-even boundaries, all price/currency revisions, unknown attribution/price, mixed-currency separation, and final FX rounding. Refuse stale profile/watermark, currency mismatch, or cross-tenant query. Measure the stated p95 boundary and dataset through GraphOS `handle_runs_metrics`. A helper benchmark does not count. No runtime/owner receipt is claimed.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R616
Agent, team, prompt and workflow specs are graph facts synthesized from capability search (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Agent, team, prompt and workflow specs are graph facts synthesized from capability search (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R616.1
Model
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Model.** `crates/eg-types/src/orchestration.rs` defines AgentSpec, TeamSpec, PromptSpec, WorkflowSpec, Synthesis. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R616.2
Behavior
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Behavior.** Specs are typed graph nodes with the capability facts they were built from. Synthesis picks skills and tools by capability search under a context budget. It composes a team or workflow. It evolves prompts from outcome evidence. Workflow graphs found in code facts convert to workflow specs. Teams export and import as OWL. Ecosystem packages and architecture layers become typed nodes with dependency edges. | Unit tests cover each rule with positive and boundary cases.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R616.3
Wiring
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Wiring.** Authority for composition remains graph.assemble() of EG-DECISION-ENGINE-R036; synthesis proposes, assemble decides. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R616.4
Refusal
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refusal.** A spec that fails its SHACL shape is refused at publish. The stable code is `SPEC_SHAPE_INVALID`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R616.5
Evidence
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Evidence.** Per synthesis: capabilities used, budget, shape result. | Test reads the trace or metrics after one success and one refusal.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R616.6
Hot-path proof
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Hot-path proof.** Synthesis over a 10k-skill catalog has p99 under 250 ms. The benchmark is `benches/r616_orchestration_vocabulary.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R750
Organization runtime, agent market, digital twin and lifecycle records (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Organization runtime, agent market, digital twin and lifecycle records (rollup).** Rust-native in `crates/eg-types/src/orchestration`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R750.750
Model: Organization runtime, agent market, digital twin and lifecycle records
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Model: Organization runtime, agent market, digital twin and lifecycle records.** The ontology defines these as typed graph nodes. They are roles, staffing, recruitment, work-item graphs, per-role experience, market bids and allocations. They also include point-in-time agent twins with pinned versions. They include persistent agent instances with mailboxes and activation sources. They include shared team todo lists. Types: `OrgChart`, `RoleSpec`, `EmployeeSpec`, `OrgPlanItem`, `Bid`, `Allocation`, `AgentTwin`, `AgentLifecycleState`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R750.751
Behavior: Organization runtime, agent market, digital twin and lifecycle records
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Behavior: Organization runtime, agent market, digital twin and lifecycle records.** A recruiter choice is an engine decision over role requirements. Counterfactual replay of a twin runs on the engine's replay path against pinned versions. Instance registration, drain and termination are state transitions in the statechart crate with durable history. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R750.752
Refusal: Organization runtime, agent market, digital twin and lifecycle records
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refusal: Organization runtime, agent market, digital twin and lifecycle records.** The engine refuses a twin that lacks a version pin. It refuses an allocation that exceeds its bids. It refuses an unknown lifecycle transition. It refuses an instance without a registered definition. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R750.753
Hot-path proof: Organization runtime, agent market, digital twin and lifecycle records
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Hot-path proof: Organization runtime, agent market, digital twin and lifecycle records.** Criterion benchmark `twin_capture` for 1k-node agent graphs. The p50 is under 8 ms and the p99 is under 20 ms. Memory stays under 16 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R751
Team composition, evolution, specialization discovery and social systems (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Team composition, evolution, specialization discovery and social systems (rollup).** Rust-native in `crates/eg-plan/src/teams`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R751.750
Model: Team composition, evolution, specialization discovery and social systems
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Model: Team composition, evolution, specialization discovery and social systems.** The engine composes teams from graph records and promotes proven teams. It discovers new specialists from execution traces. It also stores multi-agent social interaction records. All of these are engine facts and choices. Types: `TeamConfig`, `SpecialistProposal`, `PopulationOutcome`, `SocialInteraction`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R751.751
Behavior: Team composition, evolution, specialization discovery and social systems
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Behavior: Team composition, evolution, specialization discovery and social systems.** A proposed specialist enters as a claim with its trace evidence and is promoted only through the guarded promotion path. Trace-learned team scoring is a fixed-point computation over stored outcomes. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R751.752
Refusal: Team composition, evolution, specialization discovery and social systems
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refusal: Team composition, evolution, specialization discovery and social systems.** The engine refuses a proposal without trace evidence. It refuses a team that duplicates a stored configuration digest. It refuses a promotion that skips the guard. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R751.753
Hot-path proof: Team composition, evolution, specialization discovery and social systems
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Hot-path proof: Team composition, evolution, specialization discovery and social systems.** Criterion benchmark `team_score` over 10k stored teams. The p50 is under 6 ms and the p99 is under 15 ms. Memory stays under 12 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R800
Agent definitions, prompt templates and workflow patterns as graph facts (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Agent definitions, prompt templates and workflow patterns as graph facts (rollup).** `crates/eg-types` and `crates/eg-plan` hold agent definitions, prompt templates, reusable workflow patterns, spec-driven task graphs and compiled skill procedures. They hold them as typed graph facts, not packaged files. The decision ladder composes them by query. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R800.1
Model
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Model.** `AgentDefinition{id, role, prompt_ref, tools, guardrails}` and `PromptTemplate{id, version, slots, digest}` plus `WorkflowPattern{id, steps, preconditions}` in `crates/eg-types/src/orchestration/`. | Planned: `crates/eg-types/tests/orchestration_defs.rs::unfilled_slot_is_refused`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R800.2
Behavior
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Behavior.** Template rendering fills typed slots only and is O(template length). Pattern selection is a graph query over preconditions and prior outcomes. It is not a file lookup. | Planned: `crates/eg-types/tests/orchestration_defs.rs::wrong_slot_type_is_refused`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R800.3
Wiring
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Wiring.** Definitions are imported once through the typed-pack importer. `graph.assemble()` of R036 reads them. An edit creates a new version. It never mutates a published one. | Planned: `crates/eg-types/tests/orchestration_defs.rs::published_version_is_immutable`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R800.4
Refusal
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refusal.** The engine refuses four inputs. The first is a template with an unfilled slot. The second is a slot value of the wrong type. The third is a pattern that names an unknown step. The fourth is an edit that reuses a published version. | Planned: `crates/eg-types/tests/orchestration_defs.rs::pattern_unknown_step_is_refused`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R800.5
Evidence
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Evidence.** Evidence is a version history per definition and a render-digest golden per template. | Planned: `crates/eg-types/tests/orchestration_defs.rs::render_digest_golden`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R800.6
Hot-path proof
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Hot-path proof.** Hot-path proof: a Criterion benchmark renders 100000 templates. The p50 stays under 10 microseconds. The p99 stays under 50 microseconds. Allocation per render stays under 4 KiB. | Planned: `crates/eg-types/tests/orchestration_defs.rs::render_bench_within_budget`.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R004.700
Policy and rule documents ingest as guardrail scope: model and behavior
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Policy and rule documents ingest as guardrail scope: model and behavior.** A constitution-style policy document parses into typed policy and rule nodes with scope, severity and source digest. A bundled mini-markdown rule set parses the same way. Re-ingest is idempotent. A removed rule is withdrawn. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R004.701
Policy and rule documents ingest as guardrail scope: refusal, evidence and hot-path proof
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Policy and rule documents ingest as guardrail scope: refusal, evidence and hot-path proof.** A rule without scope is refused; a document over the size bound is refused. Test `tests/orchestration/test_policy_ingest_served.py::test_reingest_is_idempotent_and_withdraws_removed_rules`; benchmark `benches/policy_ingest.rs` p50 under 8 ms and p99 under 40 ms per document, memory under 32 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.700
Durable execution units mirror into the run-trace vocabulary: model and behavior
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Durable execution units mirror into the run-trace vocabulary: model and behavior.** The engine mirrors a durable run unit of the harness as a typed run-trace node. The node has a stable unit id, produced-artifact links, and a list query by status. A resumed run finds its history. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R009.701
Durable execution units mirror into the run-trace vocabulary: refusal, evidence and hot-path proof
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Durable execution units mirror into the run-trace vocabulary: refusal, evidence and hot-path proof.** A unit without a run id is refused. Test `tests/orchestration/test_durable_units_served.py::test_resume_finds_produced_artifacts`; benchmark `benches/durable_units.rs` p50 under 1 ms and p99 under 5 ms, memory under 16 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-ORCH-VOCABSPECIFIEDNo recorded commit/test evidence
EG-ORCH-VOCAB-R801
Versioned harness components as graph facts (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Versioned harness components as graph facts (rollup).** The engine stores the eight harness components as versioned graph facts. A component is one of system_prompt, guardrails, memory, tool_guidance, subagent, skill, script or plugin. Each version carries a content digest, a valid time, a confidence and an evidence link. A new version supersedes the older one by edge. A published version never mutates. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.
requirementEG-ORCH-VOCABVERIFIED70de3b70bbdc
crates/eg-types/src/orchestration/mod.rs:487
crates/eg-types/tests/harness_components.rs:141
crates/eg-types/tests/harness_components.rs:209
crates/eg-types/tests/harness_components.rs:32
crates/eg-types/tests/harness_components.rs:70
EG-ORCH-VOCAB-R801.1
Model
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Model.** Add `HarnessComponentVersion{component_id, kind, content_ref, content_digest, valid_from, valid_to, confidence, evidence_run_id, supersedes_id, applied_to_id}` in `crates/eg-types/src/orchestration/`. `kind` is the closed set named in the rollup. The `PromptTemplate` versioning of `EG-ORCH-VOCAB-R800.1` and the guardrail scope of `EG-ORCH-VOCAB-R004.700` are the reuse base. Planned test: `crates/eg-types/tests/harness_components.rs::component_version_round_trips`. | The serde round trip keeps every field and rejects an unknown kind.
requirementEG-ORCH-VOCABVERIFIED70de3b70bbdc
crates/eg-types/src/orchestration/mod.rs:487
crates/eg-types/tests/harness_components.rs:32
EG-ORCH-VOCAB-R801.2
Behavior
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Behavior.** Writing a new version adds a `:supersedes` edge to the current version. The older version stays readable. The query `current_harness_component(component_id, as_of)` returns the newest valid version at that time. The engine keeps every version readable. | `crates/eg-types/tests/harness_components.rs::newer_version_supersedes_and_old_stays_readable`.
requirementEG-ORCH-VOCABVERIFIED70de3b70bbdc
crates/eg-types/tests/harness_components.rs:70
EG-ORCH-VOCAB-R801.3
Wiring
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Wiring.** The write attaches in the existing ChangeEnvelope and AddNode path at `src/server/handlers/graph_ops/gateway_graph.rs:62`. The bitemporal stamps come from `EG-DURABLE-KERNEL-R078` and `EG-DURABLE-KERNEL-R081`. `graph.assemble()` of `EG-DECISION-ENGINE-R036` reads the current versions. | `src/server/handlers/graph_ops/gateway_graph.rs::tests::harness_component_write_stamps_and_links`.
requirementEG-ORCH-VOCABVERIFIED70de3b70bbdc
src/server/harness_admission/tests.rs:58
EG-ORCH-VOCAB-R801.4
Refusal
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refusal.** A version without `evidence_run_id` refuses with `HarnessVersionWithoutEvidence`. An unknown `kind` refuses with `HarnessKindUnknown`. A confidence outside 0 to 1 refuses with `HarnessConfidenceInvalid`. A write that mutates a published version refuses with `HarnessVersionImmutable`. | `crates/eg-types/tests/harness_components.rs::evidence_kind_confidence_and_immutability_refusals`.
requirementEG-ORCH-VOCABVERIFIED70de3b70bbdc
crates/eg-types/tests/harness_components.rs:141
EG-ORCH-VOCAB-R801.5
Evidence
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Evidence.** The version-history query returns the full supersession chain per component. Each node carries its evidence run id, confidence and valid interval. The content digest recomputes from the content reference. | `crates/eg-types/tests/harness_components.rs::version_history_cites_evidence_and_digests`.
requirementEG-ORCH-VOCABVERIFIED70de3b70bbdc
crates/eg-types/tests/harness_components.rs:209
EG-ORCH-VOCAB-R801.6
Hot-path proof
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Hot-path proof.** The entry point is the generated client write through `ApplyChangeEnvelopes`. The test writes two versions, supersedes, and reads the current one at each valid time. The benchmark `benches/harness_components.rs` stays under 5 ms p99 for a 1k-version chain. | `tests/orchestration/test_harness_components_served.py::test_two_versions_and_bitemporal_read`.
requirementEG-ORCH-VOCABVERIFIED70de3b70bbdc
tests/orchestration/test_harness_components_served.py:63
EG-ORCH-VOCAB-R802
Improvement library: adopted harnesses, contrasts and lessons (rollup)
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Improvement library: adopted harnesses, contrasts and lessons (rollup).** The engine stores the adopted harness, the behavioral contrast and the lesson of one task. A lesson retains only when its evidence shows measurable improvement. The library queries by deficiency, task class and trajectory features. A record without evidence refuses. Children `.1` through `.6` cover model, behavior, retrieval, supersession, refusal and hot-path proof. | See each child.
requirementEG-ORCH-VOCABVERIFIEDa45d1b095bda
crates/eg-types/tests/harness_lessons.rs:176
crates/eg-types/tests/harness_lessons.rs:253
crates/eg-types/tests/harness_lessons.rs:408
crates/eg-types/tests/harness_lessons.rs:568
crates/eg-types/tests/harness_lessons.rs:76
EG-ORCH-VOCAB-R802.1
Model
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Model.** Add `AdoptedHarness{agent_ref, task_class, component_version_refs, decision_ref, contrast_ref}`, `HarnessContrast{task_ref, conditions_digest, run_a_trace_id, run_b_trace_id, retry_delta, tool_selection_delta, eval_score_delta, cost_delta}` and `HarnessLesson{task_class, deficiency, situation, changed_component_kind, what_changed, applicability, confidence, evidence_run_ids, supersedes_id}` in `crates/eg-types/src/orchestration/`. Planned test: `crates/eg-types/tests/harness_lessons.rs::improvement_records_round_trip`. | The serde round trip keeps every field and rejects an unknown field.
requirementEG-ORCH-VOCABVERIFIEDa45d1b095bda
crates/eg-types/tests/harness_lessons.rs:76
EG-ORCH-VOCAB-R802.2
Behavior
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Behavior.** The engine retains a lesson only when its contrast shows measurable improvement. Improvement means fewer retries, better tool selection, a higher evaluation score or lower cost. A lesson cites its evidence runs by trace id. | `crates/eg-types/tests/harness_lessons.rs::lesson_requires_measurable_improvement`.
requirementEG-ORCH-VOCABVERIFIEDa45d1b095bda
crates/eg-types/tests/harness_lessons.rs:176
EG-ORCH-VOCAB-R802.3
Query
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Query.** The query `retrieve_lessons(task_class, deficiency, trajectory_features)` ranks hits by confidence. It reads bitemporally with `AS OF`. It abstains with `NoLessons` when nothing matches. | `crates/eg-types/tests/harness_lessons.rs::retrieval_ranks_by_confidence_and_abstains`.
requirementEG-ORCH-VOCABVERIFIEDa45d1b095bda
crates/eg-types/tests/harness_lessons.rs:253
EG-ORCH-VOCAB-R802.4
Supersession
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Supersession.** A newer lesson supersedes the older one by edge. A superseded lesson stays readable. An adopted harness supersedes the previous adoption of the same agent and task class. | `crates/eg-types/tests/harness_lessons.rs::supersession_keeps_old_readable`.
requirementEG-ORCH-VOCABVERIFIEDa45d1b095bda
crates/eg-types/tests/harness_lessons.rs:408
EG-ORCH-VOCAB-R802.5
Refusal
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Refusal.** A lesson without evidence runs refuses with `LessonWithoutEvidence`. A contrast whose conditions digest differs from its runs refuses with `ContrastConditionsMismatch`. An adopted harness without a decision reference refuses with `AdoptedHarnessNoDecision`. | `crates/eg-types/tests/harness_lessons.rs::evidence_and_condition_refusals`.
requirementEG-ORCH-VOCABVERIFIEDa45d1b095bda
crates/eg-types/tests/harness_lessons.rs:568
EG-ORCH-VOCAB-R802.6
Hot-path proof
Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source
**Hot-path proof.** The entry point is the generated client write through `ApplyChangeEnvelopes`. The test writes one contrast, one adopted harness and one lesson, queries by deficiency, and refuses the three negative cases. The benchmark `benches/harness_lessons.rs` stays under 10 ms p99 for 10k lessons. | `tests/orchestration/test_harness_lessons_served.py::test_contrast_lesson_and_retrieval_served`.
requirementEG-ORCH-VOCABVERIFIEDa45d1b095bda
tests/orchestration/test_harness_lessons_served.py:154
EG-PLACEMENT
EG-PLACEMENT — Placement, worker policy and analytics bound
specNoneSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001
Deployment-placement question and assembled step graph go through the engine decision functionality (rollup)
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Deployment-placement question and assembled step graph go through the engine decision functionality (rollup).** Typed Decide question over in_process/compose/helm/swarm plus a `graph.assemble()` step graph; closes the prerequisite named by `ARBORA-DEPLOY-R017`. Split into `R001.1`-`R001.14`; satisfied only when every child is. Design: plan.md section A. | See each child.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.1
Prerequisite (decision-engine): standalone topology Decide question
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Prerequisite (decision-engine): standalone topology Decide question.** Owned by `EG-DECISION-ENGINE-R111.1`; supplies the standalone typed-question dispatch pattern placement follows. Not re-specified here; blocked until it lands. | Linked row verified by its own test `a_standalone_topology_decide_question_returns_a_typed_decision_record`.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.2
Add the `Placement` question kind
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Add the `Placement` question kind.** Add variant `Placement` to `QuestionKind` in crates/eg-types/src/decision/statistical.rs (snake_case wire name `placement`), documented evaluate-only like its siblings. | Unit test in the same file: serde round trip of `Placement` and that the schema lists it.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.3
Target registry
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Target registry.** New file crates/eg-types/src/decision/statistical/placement.rs: `PlacementTarget{InProcess,Compose,Helm,Swarm}` with `ALL`, `option_id()` (`placement:<name>`) and `from_option_id()`, mirroring ingestion_lane.rs. Systemd has no member. | Unit test: every target round trips through its option id; `placement:systemd` returns None.
requirementEG-PLACEMENTVERIFIED92a78d0a890b
crates/eg-types/src/decision/statistical/placement.rs:107
crates/eg-types/src/decision/statistical/placement.rs:123
crates/eg-types/src/decision/statistical/placement.rs:139
EG-PLACEMENT-R001.4
Typed request body with refusals
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Typed request body with refusals.** Same file: `PlacementRequestBody{subject: PlacementSubject{workload_iri,cpu_millis,memory_bytes,replicas,needs_persistent_volume}, constraints: PlacementConstraints{requires_ha,forbidden_targets,max_relative_cost,capacity_cells,priority}, candidate_targets}` with `check()` refusing empty or duplicate candidates, unknown option ids (`UNSUPPORTED_PLACEMENT_TARGET`), zero replicas and zero demand. | Unit tests, one per refusal, plus one accepted body.
requirementEG-PLACEMENTVERIFIED1c906420efa9
crates/eg-types/src/decision/statistical/placement.rs:180
crates/eg-types/src/decision/statistical/placement.rs:191
crates/eg-types/src/decision/statistical/placement.rs:202
crates/eg-types/src/decision/statistical/placement.rs:214
crates/eg-types/src/decision/statistical/placement.rs:227
EG-PLACEMENT-R001.5
Add the placement vocabulary and shape
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Add the placement vocabulary and shape.** New crates/eg-core/ontology/placement-v1.ttl declares `placement:Target` and datatype properties `placement:supportsHa`, `placement:supportsVolumes`, `placement:maxReplicas` (xsd:nonNegativeInteger), `placement:relativeCost` (xsd:nonNegativeInteger). Placement-v1.shapes.ttl requires all four on every `placement:Target` (sh:minCount 1, sh:maxCount 1). Registered beside swarm_topology in crates/eg-core/src/graph/schema_sources.rs (line ~765). | SHACL test in crates/eg-core: a target missing `placement:relativeCost` fails validation. A complete one passes.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.6
Pure feasibility function
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Pure feasibility function.** In placement.rs: `place(body, facts, headroom) -> PlacementVerdict{feasible: Vec<(PlacementTarget, cost)>, eliminated: Vec<(PlacementTarget, PlacementReason)>}`; hard constraints are HA, volumes, max replicas, forbidden targets, cost cap, capacity headroom. A request can only tighten policy caps (`POLICY_LOOSENING` otherwise). | Table-driven unit tests: each constraint eliminates exactly its targets with the named reason; a loosening request is refused.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.7
Wire the kind into Decide
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Wire the kind into Decide.** New src/server/handlers/decide/stat_placement.rs with `placement_outcome(request) -> Option<Result<StatisticalOutcome,String>>`, modelled on stat_tool_subset.rs and called from the same site in stat_decide.rs. Cheapest feasible target is the top `Advisory` score; ties break by option id. | Server test in src/server/handlers/decide/stat_tests/: a Placement request returns a sealed record naming the cheapest feasible target.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.8
Capacity premise reuse, no lease
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Capacity premise reuse, no lease.** `stat_placement.rs` reads headroom through `capacity_premise::headroom` (src/server/handlers/decide/capacity_premise.rs) at the request priority and records it as Observation premises. Nothing is acquired. | Test: after the decision the capacity ledger is unchanged (no lease), and a priority-lower request sees less headroom.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.9
Why-not for every non-chosen target
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Why-not for every non-chosen target.** Each eliminated or lower-ranked target appears in the record's `why_not`/`eliminated` with a stable reason string (`placement:supportsHa=false`, `costlier than <id> (a > b)`). | Test asserts one why-not entry per non-chosen target with the expected reason.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.10
Typed abstention
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Typed abstention.** When no target is feasible, or capacity facts are unavailable (`CAPACITY_UNAVAILABLE`), the outcome is `StatisticalOutcome::Abstained` with a typed `AbstainReason` naming the binding constraint. No target is guessed. | Tests: infeasible demand abstains naming `lease:<cell>:<class>`. Missing ledger abstains with CAPACITY_UNAVAILABLE.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.11
Served contract test through the real dispatch
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Served contract test through the real dispatch.** One test drives the Placement question through the served `Decide` method (not the pure function) with the example from plan.md and asserts the typed record, resolution kind and evidence class. | src/server/handlers/decide/stat_tests/placement_tests.rs (new).
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.12
Assembled step graph fixture
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Assembled step graph fixture.** Publish a test deployment graph template (slots render-artifact, apply, verify) and three tool components in a test Agent Library. `AgentAssemble` with the chosen target's template returns `Solved` with the nodes in order and a certificate. Production components are published by graph-os (BLOCKED on them; the handler itself is not a stub, `assemble.rs:28-55`). | src/server/handlers/decide/ test `deployment_template_assembles_ordered_steps`.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.13
Assemble abstains rather than invents
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Assemble abstains rather than invents.** With a template whose tool component is not in the tenant library, `AgentAssemble` returns an Abstained record naming the uncovered capability and no graph. | Test in the same file as R001.12.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.14
Cross-repo (graph-os): correct R017 wording
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Cross-repo (graph-os): correct R017 wording.** Proposed edit to `ARBORA-DEPLOY-R017.5` and `R017`: replace "today both are refusal stubs" with "the engine handler is served when the engine is built with the decide feature; it refuses by name otherwise (assemble.rs:134-140); confirm remains the stub", and name the placement kind as `QuestionKind::Placement` (`EG-PLACEMENT-R001.2`). Owner: graph-os. | graph-os tests/deployment/test_deploy_refusal.py asserts distinct refusals for feature-absent engine and unavailable confirm.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002
Ingest-worker policy has one authority: the engine decides, the worker asks and obeys (rollup)
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Ingest-worker policy has one authority: the engine decides, the worker asks and obeys (rollup).** Removes the autosize, floor, routing and depth-limit policy that `EG-INGEST-WORKER-R001.x` placed in the worker and gives it to `EG-DURABLE-KERNEL-R074`-`R077`. Split into `R002.1`-`R002.15`; satisfied only when every child is. Design: plan.md section B. | See each child.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.1
Register carries capacity
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Register carries capacity.** Proposed edit to `EG-DURABLE-KERNEL-R074`: `WorkerRecord` includes `cores`, `memory_bytes` and `lanes_supported`, supplied at register. Add the fields in the eg-types file that defines `WorkerRecord` (created by R074). | R074's heartbeat/expiry test also asserts the fields round trip.
requirementEG-PLACEMENTVERIFIEDe7b0f9f670c9
crates/eg-types/src/worker_registry.rs:192
EG-PLACEMENT-R002.2
Autosize and depth limit live in `SchedulerConfig`
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Autosize and depth limit live in `SchedulerConfig`.** Producer contract owned by `EG-DURABLE-KERNEL-R076.1` (served integration remains R076.2): fields `cores_per_mille` (default 360), `memory_per_worker_bytes` (default 3 GiB) and `max_queue_depth`, beside the lane floors. The over-subscription refusal is unchanged. | R076.1 native serde round-trip tests include defaults 360 and 3 GiB. This row does not claim a served setting.
requirementEG-PLACEMENTVERIFIED57050996421e
crates/eg-types/src/scheduler_config.rs:111
crates/eg-types/src/scheduler_config.rs:126
EG-PLACEMENT-R002.3
Pure grant function
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Pure grant function.** `worker_registry::granted_slots(record, config, WorkerSizingInput, shard_writer_width) -> WorkerSlotGrant` exposes `slots()` and a typed refusal. The explicit input carries an optional caller request ceiling, current available memory and engine-selected write-lane classification (not scheduler policy). Sizing: min(cores x cores_per_mille / 1000, memory / memory_per_worker), never above a request ceiling or the available-memory limit, and write-lane workers never above the R077 width. The floor of 1 applies only when every hard limit permits a worker; otherwise return a zero-slot grant with a typed capacity refusal. | Unit tests: memory-bound, core-bound, ceiling-bound, width-bound, a permitted floor of 1, and zero memory/ceiling/write-width refusing allocation.
requirementEG-PLACEMENTVERIFIEDd94bc10404ce
crates/eg-types/src/worker_registry/grants.rs:116
crates/eg-types/src/worker_registry/grants.rs:135
crates/eg-types/src/worker_registry/grants.rs:188
EG-PLACEMENT-R002.4
Admission returns a grant
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Admission returns a grant.** Proposed edit to `EG-DURABLE-KERNEL-R075`: `AdmitWorkerTask` answers `WorkerGrant{slots, reserved_lane}` or a typed refusal. The reserved lane for a worker is decided by the engine from `SchedulerConfig` floors. | R075 test also asserts a one-worker pool is granted the general lane.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.5
Routing is engine-side
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Routing is engine-side.** `lane_for` and `partition_key` (ingest-worker R001.2/R001.3) are called by the engine claim path only; the claim request carries no lane or partition field a worker could set. | Test: a claim request with a forged lane field is refused by schema (deny_unknown_fields).
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.6
Reword `EG-INGEST-WORKER-R001.2`
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Reword `EG-INGEST-WORKER-R001.2`.** Replace "returning hydration for skill_workflows and capability_hydration, general otherwise" with "returning a lane id from the lane set served in `SchedulerConfig` (R076); the engine, not the worker, calls it. Lane names are not redefined here." | Row text matches after the follow-up edit; ingest-worker spec check passes.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.7
Reword `EG-INGEST-WORKER-R001.3`
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Reword `EG-INGEST-WORKER-R001.3`.** Append "The engine claim path derives claim order from this key; workers never compute or send it." | As R002.6.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.8
Reword `EG-INGEST-WORKER-R001.6`
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Reword `EG-INGEST-WORKER-R001.6`.** Replace with "Prerequisite: worker registry, grants, reserved admission, lane floors, autosize defaults and queue-depth limit (EG-DURABLE-KERNEL-R074-R077 as extended by EG-PLACEMENT-R002.1-R002.4). Every worker-count, floor and limit in this spec is read from those served settings." | As R002.6.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.9
Reword `EG-INGEST-WORKER-R001.10`
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Reword `EG-INGEST-WORKER-R001.10`.** Replace "a lone worker is never fully reserved" with "which lane a worker serves is the `reserved_lane` of its engine `WorkerGrant`. This row only verifies the behaviour through the engine (R075 owns the rule)." | As R002.6.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.10
Reword `EG-INGEST-WORKER-R001.11`
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Reword `EG-INGEST-WORKER-R001.11`.** Replace "above a configured depth" with "above `SchedulerConfig.max_queue_depth` (R076)". | As R002.6.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.11
Reword `EG-INGEST-WORKER-R001.14`
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Reword `EG-INGEST-WORKER-R001.14`.** Append "The runner claims only after registering, uses the granted slot count and lane, and treats an admission refusal as a signal to back off, never to retry another lane." | As R002.6.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.12
Reword `EG-INGEST-WORKER-R001.15`
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Reword `EG-INGEST-WORKER-R001.15`.** Replace the autosize clause with "`--workers` is an optional request ceiling. The default is to register cores and memory and run the `slots` the engine grants. The worker holds no CPU/memory ratio constants." | As R002.6.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.13
Cross-repo (connector SDK repository): no policy constants in the worker
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Cross-repo (connector SDK repository): no policy constants in the worker.** The SDK worker reads no CPU ratio, memory-per-worker, floor or depth value; it sends `cores`, `memory_bytes`, `lanes_supported` and obeys the grant. Owner: connector SDK repository. | SDK test: fake engine grants 3 slots on a 16-core host; the worker runs 3.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.14
Fold the analytics pool knob into the same config
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Fold the analytics pool knob into the same config.** `EG_ANALYTICS_WORKERS` (executor_loop.rs:22-25) becomes a `SchedulerConfig` field read once, so colocated and remote workers share one sizing authority (aligns `EG-DURABLE-KERNEL-R082.9`). | Config test: unset env yields the SchedulerConfig default of 1; value 40 is refused or clamped to 32 exactly as today.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.15
Parity check that no duplicate policy remains
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Parity check that no duplicate policy remains.** A spec check greps `specs/ingest-worker` for the strings `0.36`, `3 GiB` and "reserved floor" outside rows that cite R074-R077 by ID. | Check passes after the rewordings land.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R003
Analytics payload bound is decided and defended (rollup)
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Analytics payload bound is decided and defended (rollup).** Closes the open question of `EG-DURABLE-KERNEL-R082.3`. Split into `R003.1`-`R003.6`; satisfied only when every child is. Design: plan.md section C and decisions D6-D8. | See each child.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R003.1
Name the constant
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Name the constant.** In src/server/handlers/jobs/submit.rs replace the literal `31` (line 289) with `const MAX_ASSOCIATION_DISTINCT_ITEMS: usize = (u32::BITS - 1) as usize;` documented as the rule-enumeration mask width. | Unit test asserts the constant equals 31.
requirementEG-PLACEMENTVERIFIED871e31f80156
src/server/handlers/jobs/submit.rs:453
EG-PLACEMENT-R003.2
Separate refusal for cardinality
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Separate refusal for cardinality.** Split the merged check at submit.rs:285-295 so distinct-item overflow returns its own stable message `association job exceeds the distinct-item limit`, apart from the threshold message. | Table test: over-cap and bad-threshold payloads produce different typed refusals.
requirementEG-PLACEMENTVERIFIED23b021f818a8
src/server/handlers/jobs/submit.rs:464
EG-PLACEMENT-R003.3
Accept at the cap, refuse above
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Accept at the cap, refuse above.** 31 distinct items accepted, 32 refused. | Test in src/server/handlers/jobs/graph_tests.rs.
requirementEG-PLACEMENTVERIFIED05b1cbdf1641
src/server/handlers/jobs/graph_tests.rs:204
EG-PLACEMENT-R003.4
Defence in depth in the kernel
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Defence in depth in the kernel.** In `rules_for_itemset` (crates/eg-compute/src/mining/association.rs:402) return no rules when `k > 31` instead of overflowing `1u32 << k`. | Unit test calls `generate_rules` with a 32-item itemset and gets an empty rule list without panic.
requirementEG-PLACEMENTVERIFIED972d1c80e4bd
crates/eg-compute/src/mining/association.rs:772
crates/eg-compute/src/mining/association.rs:785
EG-PLACEMENT-R003.5
Plain labels are accepted and stored opaque
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Plain labels are accepted and stored opaque.** Proposed edit to `EG-DURABLE-KERNEL-R082.3`: drop "required every item to start with `eg:`" as a refusal. The engine maps labels to opaque refs at submit (submit.rs:266-278). Keep the cap, now `MAX_ASSOCIATION_DISTINCT_ITEMS`, with the 31/32 test above. | Test: a payload of plain labels is accepted and the stored job input contains only `eg:` refs.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R003.6
Cap is counted after hashing; verify deterministic behavior on bounded fixtures
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Cap is counted after hashing; verify deterministic behavior on bounded fixtures.** A repeated label yields the same opaque ref; the chosen distinct-label fixtures remain distinct. This is a regression check, not a proof that hashing is injective. | Test: 31 raw fixture labels yield 31 refs; a repeated label counts once.
requirementEG-PLACEMENTVERIFIEDbc01fdc30bb0
src/server/handlers/jobs/association_hash_tests.rs:33
src/server/handlers/jobs/association_hash_tests.rs:52
EG-PLACEMENT-R004
Heavy compute routes to the host that declares the capability (rollup)
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Heavy compute routes to the host that declares the capability (rollup).** The engine routes a heavy compute job to a worker with a matching declared capability. It chooses from topology facts in the graph. Children `.1` to `.6` deliver it. | See each child.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R004.1
Model
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Model.** Add `HostCapability{host_iri, capability, headroom}` and `RoutingFact{job_class, required_capability}` in `crates/eg-types/src/decision/statistical/placement.rs`. The capability set is closed and declared by the host. Proving test: `crates/eg-types/src/decision/statistical/placement.rs::tests::capability_types_round_trip`. | A serde round trip keeps every field and rejects an undeclared capability.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R004.2
Behavior
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Behavior.** Add `route_heavy_job(job_class, hosts)` returning hosts that declare the required capability, ordered by headroom. Ordering is a named replaceable default `most_headroom_first`. Proving test: `crates/eg-types/src/decision/statistical/placement.rs::tests::route_orders_by_headroom`. | Two capable hosts return in headroom order; an incapable host is absent.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R004.3
Wiring
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Wiring.** The behavior attaches at `crates/eg-jobs/src/store.rs:773` inside `claim_next` (`store.rs:736`), where worker capabilities already filter the ready queue. The production caller `crates/eg-quantum-jobs/src/job.rs:275` passes an empty capability list, so this row passes the declared capabilities from the topology facts. Proving test: `tests/jobs/test_capability_claim_served.py::test_claim_uses_declared_capability`. | A worker with the declared capability claims the job; a worker without it does not.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R004.4
Refusal
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Refusal.** When no host declares the capability, the engine must refuse with `no_capable_host` naming the capability. It must not fall back to any host. Proving test: `crates/eg-jobs/src/store.rs::tests::no_capable_host_refuses`. | The job stays queued and the refusal names the missing capability.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R004.5
Evidence
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Evidence.** Each routing decision must record `required_capability` and the candidate host list. It must also record the topology fact generation. Proving test: `crates/eg-jobs/src/store.rs::tests::routing_premises_name_generation`. | The decision record lists the candidates and the fact generation.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R004.6
Hot-path proof
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Hot-path proof.** The entry point is the served job submit and worker claim wire methods. The test `tests/jobs/test_capability_claim_served.py::test_backtest_job_lands_on_declared_host` submits a heavy job. It passes through the wired `claim_next` and observes the claim on the host that declares the capability. | The served claim returns the job only to the capable host.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R001.15
Capacity adjustment feasibility and applied-state reconciliation boundary
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Capacity adjustment feasibility and applied-state reconciliation boundary.** Define `CapacityAdjustmentProposalV1` with `proposal_id`, `tenant_id`, `resource_class_iri`, and `unit`. Include unsigned `current_capacity:u64`, `proposed_capacity:u64`, `min_capacity:u64`, and `max_capacity:u64`. Also include `measured_load:u64`, `available_headroom:u64`, `window_start_ms:u64`, and `window_end_ms:u64`. Pin `premise_revision` and `policy_revision`. Bind `proposal_digest:sha256`. Define `CapacityAdjustmentVerdictV1` with `proposal_id`, `proposal_digest`, `premise_revision`, and `policy_revision`. Include `verdict`, `reason_code: Option<CapacityRefusalCode>`, `effective_min_capacity`, `effective_max_capacity`, `observed_current_capacity`, and `observed_headroom`. `verdict` is `allow` or `refuse`. `allow` has no reason code. Every refusal has exactly one. `CapacityRefusalCode` is closed to `CAPACITY_PROPOSAL_DIGEST_INVALID`, `CAPACITY_MEASUREMENT_INVALID`, `CAPACITY_PREMISE_STALE`, `CAPACITY_TENANT_MISMATCH`, `CAPACITY_UNIT_MISMATCH`, `CAPACITY_WINDOW_INVALID`, `CAPACITY_LIMIT_INVALID`, `CAPACITY_LIMIT_EXCEEDED`, and `CAPACITY_HEADROOM_EXCEEDED`. The pure operation is `evaluate_capacity_adjustment(proposal, capacity_premise) -> CapacityAdjustmentVerdictV1`. It is read-only and reuses R001.6's placement/headroom premise. Allow only a fresh, tenant-bound premise and a valid SHA-256 proposal digest. Require non-negative measurements. Require `0 <= window_start_ms < window_end_ms`. Require consistent units. Require proposal current capacity and headroom to match graph premises. Require `min_capacity <= current_capacity <= max_capacity`. Require `min_capacity <= proposed_capacity <= max_capacity`. Require proposed increases to stay within observed headroom. Otherwise return the applicable refusal code. Do not mutate graph or host state. GraphOS owns mode, AIMD proposal generation, host actuation, and limits. EG does not add a second controller. Preserve `ARBORA-CAPACITY-R001.1`, `EG-DECISION-ENGINE-R112`, `ARBORA-CAPACITY-R001/R002`, and `EG-PLACEMENT-R001.6`. Owner source hash: `cb17ea03a7344584fed7a9f22a78c1e97c58919616433e7026481606fd0bdccb`. **Hold:** Owner evidence names no Decision method or QuestionKind for this proposal. It names no GraphOS request, actuation, or readback operation. It names no `CapacityAppliedReceiptV1` producer or fields. The typed EG input and verdict remain candidates, not a wired closed loop. Resolve these owner API and receipt bindings before claiming reconciliation. This row remains SPECIFIED. | **Planned acceptance:** A valid proposal within limits and headroom returns `allow` bound to proposal, premise, and policy revisions. Stale or cross-tenant premises, invalid digests or measurements, inconsistent units or windows, and graph-premise mismatches refuse without mutation. Out-of-bounds capacity and increases beyond observed headroom also refuse. GraphOS applies a valid proposal and exposes an independent readback receipt. Bind it to proposal digest, requested/applied capacity, host/resource, policy, and resulting state revision. Hold GraphOS acceptance until its operation and receipt contract are defined. No served end-to-end closure is claimed.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R611
Cluster discovery, placement routes and tenant client pooling follow the engine's placement authority (rollup)
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Cluster discovery, placement routes and tenant client pooling follow the engine's placement authority (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R611.1
Model
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Model.** `crates/eg-client/src/placement.rs` defines ClusterSnapshot, ClusterMember, PlacementRoute, TenantPool, Breaker. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R611.2
Behavior
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Behavior.** The client asks the engine for the member list and the full route of a graph. It rejects stale or divergent snapshots. It never computes a route itself. Per-tenant clients live in a bounded LRU pool. A circuit breaker opens after consecutive failures and half-opens on a timer. Transport selection (local socket, TLS, mTLS) is one function. | Unit tests cover each rule with positive and boundary cases.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R611.3
Wiring
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Wiring.** Extends EG-PLACEMENT-R002; the Python client delegates to these functions through the generated client. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R611.4
Refusal
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Refusal.** A snapshot older than the routing epoch is rejected and refetched. The stable code is `PLACEMENT_STALE`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R611.5
Evidence
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Evidence.** Metrics: breaker state, pool size, evictions, stale rejects. | Test reads the trace or metrics after one success and one refusal.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R611.6
Hot-path proof
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Hot-path proof.** route lookup from cache under 5 us; pool acquire p99 under 100 us. The benchmark is `benches/r611_placement_and_worker_policy.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R002.600
The engine answers reserved-worker admission
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**The engine answers reserved-worker admission.** `AdmitWorkerTask` refuses a claim that starves the hot-spare reserve unless a pending lane has no running worker, as `EG-INGEST-WORKER-R604` defines. | Integration test runs two workers over two lanes and asserts the admit and refuse outcomes.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R750
Admission pacing, priority classes, cognitive scheduling and model capacity control (rollup)
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Admission pacing, priority classes, cognitive scheduling and model capacity control (rollup).** Rust-native in `crates/eg-resource/src/admission`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R750.750
Model: Admission pacing, priority classes, cognitive scheduling and model capacity control
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Model: Admission pacing, priority classes, cognitive scheduling and model capacity control.** The engine owns work priority classes and the pacing of claims under load shedding. It runs a cognitive scheduler with preemption over per-process inference budgets. It sets per-model adaptive concurrency, with additive increase and multiplicative decrease against a latency signal. It also owns endpoint circuit breaking and shared-GPU group budgets. Types: `PriorityClass`, `ClaimPacer`, `InferenceBudget`, `AgentProcess`, `ModelCapacityController`, `CircuitState`, `GpuGroupBudget`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R750.751
Behavior: Admission pacing, priority classes, cognitive scheduling and model capacity control
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Behavior: Admission pacing, priority classes, cognitive scheduling and model capacity control.** Controllers are pure state machines advanced by explicit events with an injected clock, so replay is exact. Foreground work pauses background work through one throttle fact. A tripped breaker narrows capacity and never raises it above the declared ceiling. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R750.752
Refusal: Admission pacing, priority classes, cognitive scheduling and model capacity control
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Refusal: Admission pacing, priority classes, cognitive scheduling and model capacity control.** The engine refuses a concurrency limit above the declared cell ceiling. It refuses a priority class outside the closed set. It refuses a breaker transition without an observed outcome. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R750.753
Hot-path proof: Admission pacing, priority classes, cognitive scheduling and model capacity control
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Hot-path proof: Admission pacing, priority classes, cognitive scheduling and model capacity control.** Criterion benchmark `admission_decide` runs across 64 concurrent classes. The p50 is under 2 microseconds per decision and the p99 is under 10 microseconds. Memory stays under 1 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R751
Unified scheduling, leader election and cost-bounded resource allocation (rollup)
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Unified scheduling, leader election and cost-bounded resource allocation (rollup).** Rust-native in `crates/eg-jobs/src/schedule`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R751.750
Model: Unified scheduling, leader election and cost-bounded resource allocation
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Model: Unified scheduling, leader election and cost-bounded resource allocation.** One schedule engine runs recurring work with cron, interval and one-shot specs. Leader election makes singleton daemons run on one host. Per-process resource budgets use slices. Components get release-channel visibility. Types: `ScheduleSpec`, `ScheduleTick`, `DaemonLeadership`, `ResourceBudget`, `AllocationSlice`, `ReleaseChannel`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R751.751
Behavior: Unified scheduling, leader election and cost-bounded resource allocation
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Behavior: Unified scheduling, leader election and cost-bounded resource allocation.** Ticks are idempotent per schedule and window. Leadership uses the engine's fenced lease so a stale leader cannot act. Allocation slices never sum above the budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R751.752
Refusal: Unified scheduling, leader election and cost-bounded resource allocation
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Refusal: Unified scheduling, leader election and cost-bounded resource allocation.** The engine refuses a tick replayed after acknowledgement. It refuses a leader that acts with an expired fence. It refuses a slice sum above the budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R751.753
Hot-path proof: Unified scheduling, leader election and cost-bounded resource allocation
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Hot-path proof: Unified scheduling, leader election and cost-bounded resource allocation.** Criterion benchmark `schedule_tick` over 100k schedules. The p50 is under 3 ms and the p99 is under 9 ms. Memory stays under 24 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R700
Infrastructure inventory and capacity-bounded placement plans (rollup)
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Infrastructure inventory and capacity-bounded placement plans (rollup).** The engine collects host profiles into the graph. A placement plan assigns service specs to hosts within CPU, memory, storage and capability limits and minimizes movement. The plan is a proposal. It passes through the decision ladder. Implemented in eg-placement. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R700.1
Model
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Model.** `HostCapacity`, `ServiceSpec`, `ServicePlacement` and `PlacementPlan` in `crates/eg-placement`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R700.2
Behavior
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Behavior.** Placement is a bounded 0-1 program solved by the exact solver (R049) with a deterministic node budget (R011). | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R700.3
Wiring
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Wiring.** Extends R001 and R004; inventory arrives as observation-class facts. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R700.4
Refusal
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Refusal.** A service whose required capability no host declares abstains naming it. A plan exceeding any capacity is refused. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R700.5
Evidence
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Evidence.** The plan records the solver certificate. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-PLACEMENT-R700.6
Hot-path proof
Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/placement/test_inventory_placement_served.py::test_capability_gap_abstains` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/placement_plan.rs` must show p50 under 12 ms and p99 under 80 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-PLACEMENTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT
EG-CONTRACT — Public engine contract and reproducible clients
specNoneSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R001
Strict typed Pydantic models for every method and nested type
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Strict typed Pydantic models for every method and nested type.** The Python client exposes generated, strict Pydantic models (extra=forbid) for the request and result of every method. This includes every nested type. The client rejects an unexpected field. Downstream consumers migrate to these generated models instead of hand-written equivalents. | Verified by a typed round trip over every callable method's request and result fixtures. One case injects an unknown nested field and confirms the client rejects it.
requirementEG-CONTRACTSPECIFIED6cd6c7ea0c87
72c7dfa478ba
a1bb9fb9503e
tests/test_generated_models.py:105
tests/test_generated_models.py:122
tests/test_generated_models.py:69
EG-CONTRACT-R002
Served Agent Library tests cover pack import and Decide
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Served Agent Library tests cover pack import and Decide.** The installed Python client SHALL run a served Agent Library journey against a real engine and authorization boundary. The journey publishes, reads, and imports a pack. It then issues Decide. Child R002.1 covers typed Decide request and tenant refusal. Child R002.2 covers authorized Decide and served pack import in the same harness. Child R002.3 covers installed-wheel imports without the source tree. The parent lands when every child lands. | A hosted test starts a disposable engine. It runs authorized and denied Decide through the installed wheel. It confirms no client imports from the source tree.
requirementEG-CONTRACTVERIFIED37a29ee3fe0e
4f364b55e0dc
52f2f3e347a3
c047e6602b42
tests/test_decide_auth_boundary.py:100
tests/test_decide_auth_boundary.py:145
tests/test_decide_auth_boundary.py:81
tests/test_installed_wheel_decision_client_boundary.py:60
EG-CONTRACT-R002.1
Served Decide tenant auth-boundary refusal
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Served Decide tenant auth-boundary refusal.** A served Python test, against the disposable engine the suite's session fixture starts, proves `Decide` refuses a request whose `tenant_id` does not match the verified session's own tenant (`ACCESS_DENIED: Decide tenant must match the verified request tenant`, `src/server/handlers/decide/stat_decide.rs::serve`), through the generated sender (`epistemic_graph.decision_client.DecisionClient`), not an in-process check. | `tests/test_decide_auth_boundary.py::test_decide_refuses_a_request_tenant_that_does_not_match_the_verified_session` passes against the live engine.
requirementEG-CONTRACTVERIFIED37a29ee3fe0e
4f364b55e0dc
52f2f3e347a3
c047e6602b42
tests/test_decide_auth_boundary.py:81
EG-CONTRACT-R002.2
Served Decide authorized-tenant path and pack-import journey
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Served Decide authorized-tenant path and pack-import journey.** A served Python test proves a tenant-matched `Decide` request passes the same tenant check R002.1 refuses on (it then fails later, on an unpublished feature-schema pin, never on `ACCESS_DENIED`), and a second test runs the served Agent Library pack journey -- bind an importer, publish a pack through the Blob CAS, import it, then read its status back -- against the same live engine, reusing `tests/test_connector_pack_planted.py`'s served helpers rather than duplicating them. | `tests/test_decide_auth_boundary.py::test_decide_passes_the_tenant_check_for_a_matching_request_tenant` and `::test_served_pack_publish_import_and_status_journey` pass against the live engine.
requirementEG-CONTRACTVERIFIED37a29ee3fe0e
4f364b55e0dc
52f2f3e347a3
tests/test_decide_auth_boundary.py:100
tests/test_decide_auth_boundary.py:145
EG-CONTRACT-R002.3
Installed-wheel / no-source-tree-import check for the Decide and pack-import client surface
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Installed-wheel / no-source-tree-import check for the Decide and pack-import client surface.** The release workflow's folded-wheel gate installs `epistemic-graph` into a clean throwaway venv (`.gates-wheel-venv`, the same job EG-CONTRACT-R015's wheel-contract check and the NE-249/BUG-PE-002 numeric/engine kernel boundary checks already run in) and proves `epistemic_graph.decision_client`, `epistemic_graph.connector_pack` and `epistemic_graph.client` -- the modules EG-CONTRACT-R002.1/.2's served tests import -- resolve from that installed wheel, not this checkout's source tree, following the same mktemp-cwd shadowing-avoidance discipline as those existing steps. | `tests/test_installed_wheel_decision_client_boundary.py` passes as a release-workflow gates-job step run against the installed wheel from a scratch directory.
requirementEG-CONTRACTVERIFIED37a29ee3fe0e
52f2f3e347a3
tests/test_installed_wheel_decision_client_boundary.py:60
EG-CONTRACT-R003
Privacy scan covers relocated graph-backends documentation
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Privacy scan covers relocated graph-backends documentation.** The documentation privacy suite SHALL scan docs/architecture/graph-backends.md. It SHALL apply the private-network-address, DNS, home-path, and host-alias checks used for other public docs. This preserves privacy coverage after relocation. | tests/test_documentation_privacy.py SHALL include the file in PUBLIC_SURFACES. Planted private-network and path fixtures SHALL fail.
requirementEG-CONTRACTVERIFIED82e1e970c83a
86532dc7e65a
f2398cefb06c
tests/test_documentation_privacy.py:67
EG-CONTRACT-R004
Go and JS clients sign bodies through the shared codec
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Go and JS clients sign bodies through the shared codec.** The Go and JavaScript clients canonicalize and sign the wire request body using the embedded engine codec rather than an independent reimplementation, so the two languages cannot diverge from the Rust signing semantics the way the Python sender's mis-signing defect class did. | Verified by replaying every fixture in contract/fixtures/method_body_vectors.json in each client's test suite and confirming identical signed-body bytes across languages.
requirementEG-CONTRACTVERIFIED6cd6c7ea0c87
a1bb9fb9503e
clients/go/vectors_test.go:123
clients/js/vectors.test.mjs:36
EG-CONTRACT-R005
One generated model per wire shape, with typed SPARQL decode
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**One generated model per wire shape, with typed SPARQL decode.** Hand-written DTO modules such as agent_component and connector_pack re-export types from epistemic_graph/generated/models.py instead of defining competing classes, so each wire shape has exactly one model, and GraphComputeEngine.sparql exposes a typed decode_* result as the first consumer path exercising this convergence. | Verified by a typed round trip confirming one generated class per wire shape, including the SPARQL decode path. Genuine uint8-array schemas accept strict JSON octet arrays and legacy Python bytes. JSON serialization preserves arrays, while Python serialization preserves bytes. Malformed octets and lengths are refused.
requirementEG-CONTRACTVERIFIED37a29ee3fe0e
6cd6c7ea0c87
72c7dfa478ba
924601ce5495
e2b2f1cfa8ee
crates/eg-capabilities/src/contract/python/surfaces/tests.rs:121
tests/test_generated_models.py:123
tests/test_generated_union_variants.py:25
tests/test_generated_union_variants.py:27
EG-CONTRACT-R006
Deterministic, size-budgeted WASM codec artifact
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Deterministic, size-budgeted WASM codec artifact.** The embedded method-codec WASM artifact is produced from source using a pinned binaryen wasm-opt version. The optimized bytes are identical across build environments. Its measured size is tracked against a declared budget. Continued reduction of unused decode paths in eg-types lowers it. | scripts/build_method_codec_wasm.py --check compares normalized bytes from two independent builds. It asserts the measured artifact size against the declared budget.
requirementEG-CONTRACTSPECIFIED2b681e1a159c
6cd6c7ea0c87
EG-CONTRACT-R006.1
Fresh canonical codec export with provenance
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Fresh canonical codec export with provenance.** The existing canonical builder MAY export verified fresh WASM and a source/tree, toolchain, recipe and digest receipt before checking committed copies. Failed builds MUST NOT export cached bytes. CI MUST require a step-scoped fresh-export signal before upload. This child does not qualify reproducibility, size budgets or cross-language client behavior. | `tests/test_build_method_codec_wasm.py` covers export success, failed builds, invalid modules, provenance failures and upload gating while preserving freshness-check failure.
requirementEG-CONTRACTVERIFIED2b8dd458b459
79c49c6fc412
7e09becc533e
a32000c55c4e
b6d6bdedcd35
tests/test_build_method_codec_wasm.py:248
tests/test_build_method_codec_wasm.py:276
tests/test_build_method_codec_wasm.py:297
tests/test_build_method_codec_wasm.py:305
tests/test_build_method_codec_wasm.py:315
EG-CONTRACT-R006.2
Complete canonical WASM qualification
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Complete canonical WASM qualification.** Preserve the full R006 reproducibility and measured-size obligations and EG-T-05/EG-T-06 cross-language acceptance. Export-only tests do not satisfy this row. | Attach two independent canonical-build digests and measured size against the declared budget. Include freshness checks for both committed copies and exact-revision Go/JS vector replay evidence.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R007
Dispatch decomposition test is current and runs in CI
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Dispatch decomposition test is current and runs in CI.** The dispatch decomposition test passes against the current dispatch structure, with its function-count pin updated and justified, and it executes as part of the hosted release workflow rather than only a manually invoked hook. | Verified by a mutation test that introduces a stale dispatch target and confirms the gate rejects it when run as part of the hosted release workflow.
requirementEG-CONTRACTVERIFIED43137cbf0f6b
6cd6c7ea0c87
tests/test_dispatch_decomposition.py:37
tests/test_dispatch_decomposition.py:53
EG-CONTRACT-R008
Repo-parity check validates the resolved checkout
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Repo-parity check validates the resolved checkout.** scripts/check_five_repo_parity.py takes the repository root as an explicit argument. It fails when the resolved directory differs from the requested one. It cannot silently compare against an unintended checkout. | A negative test points the script at a mismatched directory. The test confirms the script fails closed.
requirementEG-CONTRACTVERIFIED1e48414f9e58
72c7dfa478ba
8baee8a94894
fb6841592a83
scripts/tests/test_check_five_repo_parity.py:10
scripts/tests/test_repo_root_parity.py:10
scripts/tests/test_repo_root_parity.py:21
scripts/tests/test_repo_root_parity.py:31
EG-CONTRACT-R008.1
Typed resolved-checkout parity contract (producer-first split of R008)
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Typed resolved-checkout parity contract (producer-first split of R008).** A pure, typed function resolves a requested repository root and an actual checkout path. It raises a dedicated error the moment they diverge. It is the type-level contract ahead of the real scripts/check_five_repo_parity.py CLI (`R008.2`). | A negative test points the function at two distinct resolved directories and asserts it raises. Positive cases cover an identical path and a symlinked checkout of the same repo.
requirementEG-CONTRACTVERIFIED1e48414f9e58
72c7dfa478ba
8baee8a94894
fb6841592a83
scripts/tests/test_repo_root_parity.py:10
scripts/tests/test_repo_root_parity.py:21
scripts/tests/test_repo_root_parity.py:31
EG-CONTRACT-R008.2
check_five_repo_parity.py CLI wires in the typed parity contract
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**check_five_repo_parity.py CLI wires in the typed parity contract.** scripts/check_five_repo_parity.py takes the repository root as an explicit CLI argument. It calls the R008.1 contract and fails closed when the resolved checkout does not match the one requested. | A negative test points the script at a mismatched directory. The test confirms the script fails closed.
requirementEG-CONTRACTVERIFIED72c7dfa478ba
8baee8a94894
fb6841592a83
scripts/tests/test_check_five_repo_parity.py:10
EG-CONTRACT-R009
CI runs the full root Python test suite
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**CI runs the full root Python test suite.** The `ci.yml` workflow compiles the numeric kernel and engine binary. It then runs the complete root Python test suite under tests/ with parallel execution and a per-test timeout. It also runs the crate and duplication census tests. Client, contract and connector-pack regressions cannot reach the default branch unexecuted. The pre-merge gate replica runs the identical suite. | Verified by confirming that the pytest run in `ci.yml` covers the full root suite against the compiled artifacts. The pre-merge gate replica executes the same suite.
requirementEG-CONTRACTVERIFIED26a77bc6a6c4
29021f36eeee
2f4f3a17a5b5
5c5b8c630a52
8baee8a94894
tests/test_release_python_suite_contract.py:104
tests/test_release_python_suite_contract.py:121
tests/test_release_python_suite_contract.py:132
tests/test_release_python_suite_contract.py:360
tests/test_release_python_suite_contract.py:379
EG-CONTRACT-R010
Complexity gate scores exhaustive matches by arm body, not count
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Complexity gate scores exhaustive matches by arm body, not count.** The complexity gate scores an exhaustive match over an enum by the complexity of each arm's body rather than the number of arms, so adding an arm with trivial logic does not fail the gate while an arm with nested branching still does. | Verified by two gate fixtures: adding a trivial-body arm to an exhaustive match passes, and adding a nested-branching arm still fails.
requirementEG-CONTRACTVERIFIED72c7dfa478ba
8baee8a94894
d37f675e56da
tests/test_check_complexity_staged.py:416
tests/test_check_complexity_staged.py:430
EG-CONTRACT-R011
Parallel fan-out for the land gate across build hosts
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Parallel fan-out for the land gate across build hosts.** The land gate's default execution fans work out in parallel across independent host groups with a persistent warm target per group, produces one merged summary, and reserves headroom on each gate host, reducing total wall-clock time compared to running the full gate serially on a single host. | Verified by the fan-out adapter test suite passing in full and its merged summary matching the per-group results it combines.
requirementEG-CONTRACTVERIFIEDa3e3d9924822
tests/test_check_fanout_host_groups.py:118
tests/test_check_fanout_host_groups.py:25
tests/test_check_fanout_host_groups.py:48
tests/test_check_fanout_host_groups.py:75
tests/test_check_fanout_host_groups.py:92
EG-CONTRACT-R011.1
Fan-out host-group manifest is structurally valid before any gate work is dispatched
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Fan-out host-group manifest is structurally valid before any gate work is dispatched.** The land gate's host-group manifest (one warm target per group, a declared headroom-reservation fraction per gate host, and no host assigned to more than one group) is validated by a standalone checker before fan-out dispatch, so a malformed or overlapping manifest fails closed instead of silently serializing or double-booking a host. | Verified by scripts/check_fanout_host_groups.py rejecting a manifest with an overlapping host assignment or a missing headroom reservation, and accepting a disjoint, fully-specified manifest.
requirementEG-CONTRACTVERIFIEDa3e3d9924822
tests/test_check_fanout_host_groups.py:118
tests/test_check_fanout_host_groups.py:25
tests/test_check_fanout_host_groups.py:48
tests/test_check_fanout_host_groups.py:75
tests/test_check_fanout_host_groups.py:92
EG-CONTRACT-R012
Complexity scanner resolves modules declared in inline mod blocks
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Complexity scanner resolves modules declared in inline mod blocks.** The complexity scanner for the KISS census resolves a module declared with mod x; inside an inline mod {} block. It does not abort. The gate pins a patched scanner until the upstream fix is released. | Verified by the complexity census completing without aborting on source containing an inline mod block with a nested module declaration.
requirementEG-CONTRACTVERIFIED78e5f2103219
8baee8a94894
tests/test_kiss_fork.py:54
EG-CONTRACT-R013
KISS config keys avoid a silently dropped section
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**KISS config keys avoid a silently dropped section.** The repository KISS config at .config/kiss.toml SHALL use current key names. It SHALL place renamed orphan detection under its new section. Unknown keys SHALL NOT drop the global section or inflate advisory counts. Derive thresholds deliberately. Do not add a blanket rebaseline. | The complexity census returns to its expected low baseline after migration. No blanket rebaseline file is introduced.
requirementEG-CONTRACTVERIFIED72c7dfa478ba
78e5f2103219
b8aac182d679
tests/test_kiss_config_keys.py:19
EG-CONTRACT-R014
Generated error catalog has stable auth-mismatch codes
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Generated error catalog has stable auth-mismatch codes.** Generate contract/errors.json from Rust ErrorCode declarations. Include code, class, retryable flag, and HTTP status hint. Include stable AUTH_TENANT_MISMATCH, AUTH_AUDIENCE_MISMATCH, and AUTH_POLICY_VERSION_MISMATCH codes. Each method error_set SHALL cover every error it can produce. | Regenerate contract/errors.json and compare bytes. Negative tests confirm each auth mismatch returns its declared code.
requirementEG-CONTRACTVERIFIED15acf1a959e5
19d0663aaf5c
2a4982e949a3
2f8fb1af4fac
394f82a01e83
crates/eg-capabilities/src/contract/errors.rs:494
crates/eg-capabilities/src/error_routing.rs:376
crates/eg-types/src/governed_change/tests.rs:183
src/server/auth.rs:2053
src/server/transport/tests.rs:145
EG-CONTRACT-R014.1
Authentication refusals name a safe cause class
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Authentication refusals name a safe cause class.** Every transport that verifies a request context, including QoS admission, returns the same typed refusal. A wrong audience returns AUTH_AUDIENCE_MISMATCH and names the deployment's expected audience. A signature that does not verify returns AUTH_BAD_SIGNATURE. A timestamp outside the clock-skew window returns AUTH_EXPIRED. A principal that is not the verified identity subject returns AUTH_UNKNOWN_PRINCIPAL. Each class is a fixed engine sentence with no secret, nonce or request value. Only a bad signature is decided before the signature verifies. Any other failure stays the generic AUTHENTICATION_REQUIRED refusal. | Unit tests confirm each class returns its declared code, and that other failures stay redacted. A QoS-admission test confirms a wrong-audience context returns AUTH_AUDIENCE_MISMATCH with the expected audience. The catalog lists each code.
requirementEG-CONTRACTVERIFIED2f8fb1af4fac
789efa66dea1
896e0af67310
ef81c8ba3a08
src/server/auth.rs:2053
src/server/transport/tests.rs:145
EG-CONTRACT-R015
Wheel ships the method, error and scope contract with callability flags
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Wheel ships the method, error and scope contract with callability flags.** The Python wheel packages epistemic_graph/contract/{methods,errors,scopes}.json and their schemas as installed data, and each method entry in methods.json exposes an is_wire_callable flag so a consumer can discover which methods are actually callable without importing server internals. | Verified by installing the packaged wheel in a clean virtual environment outside the checkout and confirming the loader returns the same digest and is_wire_callable values as the source revision.
requirementEG-CONTRACTVERIFIED26a77bc6a6c4
37a29ee3fe0e
5738b6093ea7
5b9a62ad05e9
tests/test_ontology_package.py:14
tests/test_wheel_contract_surface.py:475
EG-CONTRACT-R015.1
Wheel ships the core ontology, shapes and catalog
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Wheel ships the core ontology, shapes and catalog.** The `epistemic-graph` wheel packages every `crates/eg-core/ontology/*.ttl` file under `epistemic_graph/ontology/`. That set holds the modules, the SHACL shapes and `catalog-v1.ttl`. Git holds one copy. The build backend folds the source files into the wheel with `scripts/inject_ontology.py`. The build fails unless the packaged set equals the source set by name and bytes. The module `epistemic_graph.ontology` reads the files through `importlib.resources`. It exposes `files()`, `read()`, `names()`, `shape_names()`, `catalog()`, `catalog_order()` and `module_files()`. `catalog_order()` returns module IRIs in `owl:imports` order. A consumer needs no source tree. | Unpacking the built wheel lists every source `.ttl` file under `epistemic_graph/ontology/` with identical bytes. The API returns the same set. `tests/test_ontology_package.py` binds this row.
requirementEG-CONTRACTVERIFIED5b9a62ad05e9
tests/test_ontology_package.py:14
EG-CONTRACT-R016
Consumer-profile allowlist covers all generated PolicyEvolution senders
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Consumer-profile allowlist covers all generated PolicyEvolution senders.** The static consumer-profile audit's allowlist includes every generated PolicyEvolution typed operation sender that the Rust typed-adapter registry and contract publish. A correctly published sender is not flagged as unaudited. | Verified by tests.test_generated_client_contract passing for all declared PolicyEvolution senders.
requirementEG-CONTRACTVERIFIEDad14dd57f95b
f2398cefb06c
tests/test_generated_client_contract.py:234
EG-CONTRACT-R017
Dispatch census pins cover the current compiler-declared modules
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Dispatch census pins cover the current compiler-declared modules.** The dispatch decomposition census pins a tracked source file list plus function, control-flow, test and assertion fingerprints. They include the current compiler-declared elevation, policy-evolution and telemetry dispatch modules. Its ownership checks run instead of failing on stale pins. Its existing known-bad mutation proofs still catch the defects they were written for. | The dispatch decomposition test suite passes against the current module set. Its mutation-proof tests still fail on a planted defect.
requirementEG-CONTRACTVERIFIED43137cbf0f6b
b8aac182d679
tests/test_dispatch_decomposition.py:36
EG-CONTRACT-R018
Release feature matrix includes the motif Cargo feature
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Release feature matrix includes the motif Cargo feature.** The release workflow's crates job enumerates the eg-numeric motif feature alongside the other Python-exposed features, so it is compiled and tested instead of silently missing from the supported feature matrix. | Verified by the crates release gate running with motif included and the Python CI replica's feature-matrix consistency check passing.
requirementEG-CONTRACTVERIFIED43200ff368b9
b8aac182d679
cfd03dda1ef7
d556e4d0895e
tests/test_release_feature_matrix.py:266
tests/test_release_feature_matrix.py:87
EG-CONTRACT-R019
Dispatch reachability gate follows the current FOREIGN paths
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Dispatch reachability gate follows the current FOREIGN paths.** The static dispatch-reachability check follows FOREIGN method dispatch through exec/dispatch.rs and the bound-registry refusal through federation_opt/run.rs, matching the actual served code paths. A correct fail-closed refusal is not reported as a reachability failure. | The reachability gate passes against the current file layout. A mutation test confirms a pass-through regression in either file still fails it.
requirementEG-CONTRACTVERIFIEDa8cfd0978c58
b8aac182d679
tests/test_current_only_architecture.py:68
EG-CONTRACT-R020
Topology test names avoid version-number suffixes
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Topology test names avoid version-number suffixes.** Test and component names describe what they verify rather than carrying a numeric version suffix such as _v1. The topology schema test is named for the schema concept it covers, with its original test body preserved. | Verified by the naming-convention check passing for the renamed test and the test itself continuing to pass unchanged.
requirementEG-CONTRACTVERIFIED40b49253d3b9
f2398cefb06c
tests/test_no_version_suffixes.py:185
EG-CONTRACT-R021
Failed-connect test checks its own teardown, not process counts
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Failed-connect test checks its own teardown, not process counts.** The failed-connection test asserts that the event loop, thread and selector that the dial created are closed. It does not compare process-wide file-descriptor and thread counts. Unrelated concurrent test activity then cannot make a correctly closed connection appear to leak. | Verified by the connection-lifecycle test suite passing when run concurrently with unrelated tests that change process-wide resource counts.
requirementEG-CONTRACTVERIFIED1bd79a8991ea
72c7dfa478ba
tests/test_sync_client_lifecycle.py:107
EG-CONTRACT-R022
Zero new duplicate-code pairs across the combined source tree
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Zero new duplicate-code pairs across the combined source tree.** The jscpd scan finds newly introduced duplicate-code pairs across the combined source tree. The author removes each pair by consolidating the shared implementation into one owned location. The author adds no scanner suppressions or baseline exceptions. | Verified by running the duplication gate against origin/main. It reports zero new pairs. The change adds no suppression comments or baseline file changes.
requirementEG-CONTRACTVERIFIEDa3e3d9924822
tests/test_check_duplication_no_suppression.py:27
tests/test_check_duplication_no_suppression.py:42
EG-CONTRACT-R023
Pre-commit hooks pass clean without bypass flags
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Pre-commit hooks pass clean without bypass flags.** Tracked WASM assets stay within the pre-commit size limit, Dupehound review pins reflect the current duplicate-ownership state, every test file has a recognized owner, and the privacy scan has no outstanding findings, so the full configured pre-commit suite passes without a skip or bypass flag. | Verified by running pre-commit run --config .config/pre-commit.yaml --all-files to completion with exit code zero and no hooks skipped.
requirementEG-CONTRACTVERIFIED2598a0697e5a
85ce2ac73a96
a3e3d9924822
tests/test_check_registry_test_ownership_completeness.py:24
tests/test_check_registry_test_ownership_completeness.py:31
EG-CONTRACT-R023.1
Every tracked test file has a recognized component-registry owner
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Every tracked test file has a recognized component-registry owner.** scripts/check_registry_test_ownership.py's completeness check, run against this repository's current component-registry.yml and tracked tests/ tree, finds zero unowned test files, so the pre-commit suite's test-ownership hook cannot fail on an unclaimed file. | Verified by scripts/check_registry_test_ownership.py reporting zero unowned paths against the current registry and tracked tests/ tree.
requirementEG-CONTRACTVERIFIED2598a0697e5a
85ce2ac73a96
a3e3d9924822
tests/test_check_registry_test_ownership_completeness.py:24
tests/test_check_registry_test_ownership_completeness.py:31
EG-CONTRACT-R024
Pre-commit and codespell configuration finalized and locked
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Pre-commit and codespell configuration finalized and locked.** The repository's .config/pre-commit.yaml and .config/codespell.ignore reflect the final merged configuration, with release runtime dependency installation and all config-consuming gates pointing at them. | Verified by the configuration validation, lock-consistency, YAML/AST and public-surface checks all passing with no diff against the committed configuration.
requirementEG-CONTRACTLANDEDc65a2566a170
EG-CONTRACT-R025
UDS bind-error test uses a short, environment-independent path
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**UDS bind-error test uses a short, environment-independent path.** The Unix domain socket bind-error test constructs a short socket path that does not depend on the ambient temporary-directory path length, so the test exercises the intended bind-error behavior instead of failing on the socket path length limit under a long build directory. | Verified by src/server/transport/tests.rs::uds_setup_propagates_bind_errors_without_entering_accept_loop passing regardless of the ambient temporary-directory path length.
requirementEG-CONTRACTVERIFIEDb43f33569dd4
src/server/transport/tests.rs:371
EG-CONTRACT-R026
Combined quality-gate script runs all staged scanners together
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Combined quality-gate script runs all staged scanners together.** A single script runs the staged CCCC, KISS and Dupehound checks plus a jscpd scan of the current changes and the privacy scan together, giving one combined pass or fail result for the full quality-gate set. | Verified by running the combined quality-gate script on a clean tree and confirming it exits zero only when every included scanner passes.
requirementEG-CONTRACTLANDEDa1bb9fb9503e
EG-CONTRACT-R027
Exhaustive dispatch matches pass the complexity gate via extraction
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Exhaustive dispatch matches pass the complexity gate via extraction.** Dispatch functions that exhaustively match over an enum keep their exhaustive match with no catch-all arm, while each arm's body is extracted into its own function to reduce measured complexity, so the complexity classifier itself does not need a special case for exhaustive matches. | Verified by the complexity gate reporting zero actionable findings for the affected dispatch functions while the existing functional test suite continues to exercise each one.
requirementEG-CONTRACTLANDEDb43f33569dd4
EG-CONTRACT-R028
SQLite-format and speech-recognition differential tests run in CI
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**SQLite-format and speech-recognition differential tests run in CI.** The eg-sqlite-format differential test and the eg-asr-whisper test execute as part of a CI job, rather than existing in the tree without any job invoking them. | Verified by the release-qualification test matrix showing both test targets executed with a recorded pass result.
requirementEG-CONTRACTVERIFIED7798ab372b1e
9ed0560ea093
tests/test_release_python_suite_contract.py:768
EG-CONTRACT-R029
Build runner keeps TMPDIR short enough for Unix socket paths
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Build runner keeps TMPDIR short enough for Unix socket paths.** The automated build runner sets TMPDIR to a short, fixed-length directory rather than a long per-run path, so a tool that places a Unix domain socket under it, such as a compiler cache server or a native dependency's cmake step, does not fail against the 108-byte sun_path limit. | Verified by the build runner's TMPDIR length staying within the socket-path budget regardless of the run's identifying name length, using the same test class as the UDS bind-error fix.
requirementEG-CONTRACTVERIFIED2a0d6eae0918
4342dc5bc1c6
tests/test_push_gate_evidence.py:256
EG-CONTRACT-R030
Unconstrained build step is not CPU-affinity restricted
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Unconstrained build step is not CPU-affinity restricted.** The constrained-parallelism contract gate's first step, which compiles before timing begins, runs with full CPU availability rather than inheriting the CPU-affinity restriction that applies only to the gate's constrained execution step, so compiling dependencies does not consume the time budget intended for the constrained run; the constrained step's time bound is not relaxed to compensate. | Verified by the gate log showing full CPU availability during the unconstrained build step and the constrained step completing within its declared time bound.
requirementEG-CONTRACTLANDEDa1bb9fb9503e
EG-CONTRACT-R031
Complexity, duplication and architecture censuses pass at zero backlog
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Complexity, duplication and architecture censuses pass at zero backlog.** The CCCC tracked-tree complexity census reports zero actionable backlog, and the jscpd and Dupehound advisory censuses, the Rust dependency advisory gate, the architecture gates and the documentation contract check all pass on the same tree, with clippy and formatting also clean. | Verified by the complexity census's require-zero mode exiting zero and an independent run reproducing a clean clippy -D warnings and formatting result.
requirementEG-CONTRACTSPECIFIED2b1bcdda23e6
924601ce5495
a0da67babeae
be0f1acb05c6
cd7bf0364ebd
tests/test_ci_change_scope.py:215
EG-CONTRACT-R031.1
Lint runner provisions the manifest-selected formatter
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Lint runner provisions the manifest-selected formatter.** Install the repository toolchain and rustfmt unconditionally before pre-commit and the explicit formatting step. | `tests/test_ci_change_scope.py::test_lint_installs_manifest_rustfmt_before_all_formatting_steps` checks manifest-based installation and ordering.
requirementEG-CONTRACTVERIFIED733e1766936b
tests/test_ci_change_scope.py:216
EG-CONTRACT-R031.2
Complete zero-backlog quality-gate acceptance
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Complete zero-backlog quality-gate acceptance.** The full complexity, duplication, dependency, architecture and documentation censuses plus independent clippy and formatting checks pass on the same tree. Formatter setup coverage alone does not satisfy this requirement. | Publish the complete same-tree hosted census and independent clippy/formatting evidence before binding this acceptance child.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R032
Write-classifier functions compile cleanly under the slim profile
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Write-classifier functions compile cleanly under the slim profile.** src/server/access/write_classification.rs's requires_write_native_surface, requires_write_query_surface, requires_write_mining_surface and requires_write_learning_surface compile without an unused-parameter warning under the slim server feature profile, through a structural fix to what each classifier returns or whether it compiles in under that profile, rather than by suppressing the warning on the parameter. | Verified by the slim-server clippy profile passing with -D warnings.
requirementEG-CONTRACTVERIFIED5bf5b719de7e
9ed0560ea093
tests/test_release_feature_matrix.py:329
EG-CONTRACT-R033
Wire acceptance stays aligned with classifier and dispatch support
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Wire acceptance stays aligned with classifier and dispatch support.** crates/eg-capabilities's Cargo.toml enables an eg-types wire method feature for a server build only when the corresponding facade feature that gates its classifier and dispatch arms is also enabled, so the wire cannot accept a method that the write classifier or dispatcher is not compiled to handle under a given feature profile; the affected query-language classifiers fail closed when their feature is absent. | Verified by compiling each supported feature profile and confirming every wire-callable method under that profile has a matching classifier and dispatch arm, with no unused-parameter warnings.
requirementEG-CONTRACTLANDED5bf5b719de7e
EG-CONTRACT-R034
Complexity test derives its residual from the dispatch arm count
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Complexity test derives its residual from the dispatch arm count.** test_complexity_terms_keeps_accepted_dispatch_visible_and_zero_gate_passes computes its expected complexity residual from the compiler-visible arm count of dispatch_kind instead of a fixed value, so the fixture stays a meaningful positive residual as the exhaustive match grows, while still asserting the dispatch stays exhaustive and visible to the gate. | Verified by the test passing with a residual value computed from source and remaining nonzero after arms are added to dispatch_kind.
requirementEG-CONTRACTVERIFIEDcba884075803
tests/test_scanner_wrappers.py:428
EG-CONTRACT-R035
Release workflow executes end to end with all declared targets
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Release workflow executes end to end with all declared targets.** The release workflow's gates job runs to completion as a whole, including its eg-compute solve test step, and an audit confirms every test target declared in the workflow is the one actually executed, closing any gap between declared and executed coverage such as source that no entry point ever compiles. | Verified by a completed end-to-end run of the release workflow's gates job and a coverage audit matching declared test invocations to executed ones.
requirementEG-CONTRACTVERIFIED0000ded7b740
16c35404ef56
4342dc5bc1c6
4d1920f636e7
66e652687765
tests/test_ci_change_scope.py:497
tests/test_ci_change_scope.py:846
tests/test_release_gates_test_target_coverage.py:62
EG-CONTRACT-R036
Pinned-reference gate anchors each layer to its own admission step
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Pinned-reference gate anchors each layer to its own admission step.** scripts/check_pinned_reference_resolution.py matches each layer's entry points using a word-boundary anchor scoped to that layer's own admission step, instead of a substring match that lets one layer satisfy the check using another layer's entry points, so a removed library- or template-pin resolver is detected as missing. | Verified by tests/test_pinned_reference_resolution.py planting a library-resolver removal and a template-resolver removal and confirming the gate fails on each.
requirementEG-CONTRACTVERIFIEDb43f33569dd4
f2398cefb06c
tests/test_pinned_reference_resolution.py:169
tests/test_pinned_reference_resolution.py:180
tests/test_pinned_reference_resolution.py:99
EG-CONTRACT-R037
Clippy is warning-free across every release profile
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Clippy is warning-free across every release profile.** Running clippy with -D warnings against every supported release feature profile produces zero warnings, not only the default profile. | Verified by running clippy -D warnings for each declared release feature profile in the release workflow's feature matrix.
requirementEG-CONTRACTVERIFIED04a134298236
4342dc5bc1c6
cbad9fe59fba
tests/test_release_feature_matrix.py:219
EG-CONTRACT-R038
Contract receipt freshness is checked before merge
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Contract receipt freshness is checked before merge.** The contract receipt is regenerated and checked for staleness whenever source that affects it changes, including a new SCHEMA_VERSION occurrence or a change to the Python client, so a drifted receipt digest cannot reach the default branch even when the regenerated catalogs and schemas are otherwise byte-identical to what was already committed. | Verified by a blocking review check that regenerates the receipt and fails on any digest difference from the committed one.
requirementEG-CONTRACTLANDED2688cddd2f7f
EG-CONTRACT-R039
Duplication gate runs against the full combined diff, not per-change
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Duplication gate runs against the full combined diff, not per-change.** The duplication (jscpd) gate runs against the full accumulated change set compared to origin/main, matching what the release workflow checks, so a duplicate pair split across separate incremental changes against their own earlier state cannot escape detection; shared logic extracted during a handler decomposition, such as the sqlite file and key-value dispatch handlers, is factored into one common helper rather than duplicated. | Verified by running the duplication gate over the complete combined tree against origin/main and confirming zero new duplicate pairs.
requirementEG-CONTRACTLANDED57a12eb06632
EG-CONTRACT-R040
Privacy scanner excludes its own documented example patterns
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Privacy scanner excludes its own documented example patterns.** scripts/check_tracked_privacy.py's credential-pattern documentation does not itself trigger a false credential-history finding, and its entropy-candidate detection does not flag ordinary identifiers and constants as secrets, while a genuinely planted secret still fails the scan. | Verified by check_tracked_privacy.py --self-check catching a planted secret, and a live scan of the tracked history returning zero findings.
requirementEG-CONTRACTVERIFIED137b6e3a7898
c27abf3e6425
tests/test_documentation_privacy.py:128
tests/test_documentation_privacy.py:144
EG-CONTRACT-R041
Privacy gate detects host paths across the tracked tree
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Privacy gate detects host paths across the tracked tree.** scripts/check_tracked_privacy.py detects a host-path pattern anywhere in tracked source, including architecture/component-registry.yml, scripts/eg_coverage_report.sh, tests/test_check_complexity_staged.py, and .cargo/config.toml, and architecture/component-registry.yml cites only evidence files that are actually present in the repository. | A planted host-path literal in documentation or source fails scripts/check_tracked_privacy.py, and a live scan of the tracked tree returns zero findings.
requirementEG-CONTRACTVERIFIED2a0d6eae0918
4342dc5bc1c6
tests/test_documentation_privacy.py:100
tests/test_documentation_privacy.py:87
EG-CONTRACT-R042
Quantum hardware macro feature-gated to match its consumers
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Quantum hardware macro feature-gated to match its consumers.** In crates/eg-quantum-hardware/src/registry.rs, the impl_hardware_backend macro, its re-export, and the HardwareResult alias are compiled under a feature gate matching their actual consumers (the ibm, braket, and azure provider adapters), the same pattern used for EG-CONTRACT-R033, so a default build excluding quantum-hardware features does not misreport them as dead code while a build with any of those features keeps all three adapters compiling. | clippy run with no quantum-hardware feature enabled reports no dead-code warning for these symbols, and the crate's provider test suite passes with ibm, braket, and azure each enabled.
requirementEG-CONTRACTVERIFIED5bf5b719de7e
9ed0560ea093
tests/test_quantum_hardware_provider_feature_gates.py:44
EG-CONTRACT-R043
Test fixtures carry no credential-shaped literals
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Test fixtures carry no credential-shaped literals.** Fixtures needing PostgreSQL connection strings SHALL use non-credential-shaped literals. The full-range secret-history scan SHALL find zero credential hits before acceptance. | The full commit-range secret-history scan reports zero credential hits.
requirementEG-CONTRACTVERIFIED5dfcc96174bf
5f7fda0efcec
a5a05406fe38
e63a9e5ff1f2
tests/test_secret_history_full_range.py:106
EG-CONTRACT-R044
Contract gate discovers Method variants structurally
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Contract gate discovers Method variants structurally.** The contract-registry test discovers every Method variant by reading the mod method_<N> declarations in the protocol module's mod.rs rather than pattern-matching a literal enum block, so it keeps working when Method is assembled from multiple macro-generated files, and it fails when a variant and its descriptor diverge in either direction. | A mutation test confirms the gate fails when a variant is added without a descriptor and when a descriptor is added without a variant, and passes once either is reverted to match.
requirementEG-CONTRACTVERIFIEDacc9d32155b3
f2398cefb06c
tests/test_contract_method_reachability.py:52
tests/test_contract_method_reachability.py:80
EG-CONTRACT-R045
Method enum size pinned and proven stable
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Method enum size pinned and proven stable.** A compile-time size assertion pins size_of::<Method>() to its measured value, and adding new boxed Method variants does not increase that size because each new variant holds a boxed payload rather than an inline large payload. | A static assertion test fails if size_of::<Method>() changes from its pinned value, proven by comparing the measurement before and after the added variants.
requirementEG-CONTRACTVERIFIEDa1bb9fb9503e
f2398cefb06c
crates/eg-types/tests/contract_wave.rs:255
EG-CONTRACT-R046
Slim-server build compiles with broker feature disabled
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Slim-server build compiles with broker feature disabled.** Compiling epistemic-graph with --no-default-features --features server succeeds cleanly: the match over Method in src/server/mutation_batch/canonical.rs is cfg-scoped so broker-only variants are excluded from, or handled in, its arms whenever the broker feature is disabled. | The slim-server release check compiles that profile with --no-default-features --features server and exits zero.
requirementEG-CONTRACTVERIFIED4342dc5bc1c6
5bf5b719de7e
tests/test_release_feature_matrix.py:308
EG-CONTRACT-R047
Main publishes a rolling engine wheel for consumer CI
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Main publishes a rolling engine wheel for consumer CI.** Each code push to main builds the folded Linux x86_64 wheel. The wheel replaces the assets of the `engine-main` GitHub prerelease. The release targets the source commit and carries a SHA256SUMS file. Consumer CI installs this wheel because the wheel exceeds the PyPI size limit. | The release workflow `engine-main-wheel` job smoke-tests the wheel and publishes it; `gh release download engine-main -p '*.whl'` returns that wheel.
requirementEG-CONTRACTLANDED9084e9343bf4
EG-CONTRACT-R048
Generated work-claim and evidence DTOs refuse coerced, empty and duplicate inputs
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Generated work-claim and evidence DTOs refuse coerced, empty and duplicate inputs.** `ClaimWorkItemRequest` refuses a blank `tenant_ref`, a zero `lease_ms`, a numeric string `now_ms` and a `max_tenant_in_flight` outside 1..4096. `EvidenceBundle` refuses a blank `bundle_id`, a non-boolean `resolved` and duplicate `policy_exclusions`. The Rust schema source declares each constraint. The generator emits it. | `tests/test_generated_dto_strictness.py` raises `ValidationError` for each of the eight AU PR #22 probe inputs. `gen_contract --check` reproduces the models.
requirementEG-CONTRACTVERIFIED37a29ee3fe0e
677e430cb3bc
a5b4a1f1f638
tests/test_generated_dto_strictness.py:42
tests/test_generated_dto_strictness.py:58
tests/test_generated_dto_strictness.py:74
EG-CONTRACT-R049
The Python client retries an idempotent read once on a dropped connection
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**The Python client retries an idempotent read once on a dropped connection.** `epistemic_graph/client.py`'s `cypher_read` transparently retries exactly once when its connection is dropped mid-call, since a read is idempotent and safe to replay. A non-idempotent write method never retries on a dropped connection and instead surfaces the error to the caller. | A test injects a closed connection on `cypher_read` and asserts the call still succeeds via the transparent retry. A corresponding negative test on a write method asserts no retry occurs and the dropped-connection error propagates.
requirementEG-CONTRACTVERIFIED6bfd47cbcebc
tests/test_cypher_read_retry.py:35
tests/test_cypher_read_retry.py:42
tests/test_cypher_read_retry.py:50
EG-CONTRACT-R050
Generated client ingests OTLP logs
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Generated client ingests OTLP logs.** The generated client exposes an OTLP log ingestion method with strict DTO bounds. Unblocks AU-SEMANTIC-R019.3.1 and R019.3.2. | A client test ingests a log batch and a malformed batch raises `ValidationError`.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R051
Generated client ingests RunTrace
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Generated client ingests RunTrace.** The generated client exposes a RunTrace ingestion method that refuses a blank trace id. Unblocks AU-SEMANTIC-R019.3.3 and R019.3.4. | A client test ingests a RunTrace and asserts the blank-id refusal.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R051.1
Client ingest carries harness fields
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Client ingest carries harness fields.** The generated client RunTrace ingestion method must accept `terminationReason`, the six counters, `costUsd`, `runModel`, `runTaskClass` and `appliedHarnessConfig`. It must refuse a termination reason outside the five values before sending. Vocabulary: `EG-ORCH-VOCAB-R009`. Touches the generated client under `epistemic_graph/`. | A client test ingests an overflow trace and asserts the refusal of an unknown termination reason.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R052
Current architecture documentation (rollup)
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Current architecture documentation (rollup).** The contract must describe existing module owners, dependency direction, shared contracts, and artifact boundaries. Children R052.1–R052.4 define separate documentation units. They must preserve all existing release acceptance requirements. | EG-T-12.1–EG-T-12.4 review the source-linked map in `plan.md`. Documentation alone gives no runtime proof.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R052.1
Module ownership model
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Module ownership model.** `plan.md` must group manifest-listed crates by responsibility and derive membership from `Cargo.toml`. It must distinguish declared dependencies, intended ownership, and implemented enforcement. | EG-T-12.1 compares the map with manifests and the architecture-check configuration. Missing members and unsupported enforcement claims fail review.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R052.2
Build, package, and deployment behavior
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Build, package, and deployment behavior.** `plan.md` must separate Cargo features, wheel composition, Python extras, and runtime activation. `docs/architecture/tiers.md` must describe the server-specific extension boundary. | EG-T-12.2 checks both wheel recipes, default features, and extras against source. Divergent recipes must remain explicit.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R052.3
Shared-contract wiring
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Shared-contract wiring.** `plan.md` must trace identity, provenance, transaction, and query contracts to existing owners and call sites. Direct native operations must remain distinct from planned queries. | EG-T-12.3 checks referenced symbols and owning requirements. Replacing an owner or claiming universal planner traversal fails review.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R052.4
Runtime evidence and refusal
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Runtime evidence and refusal.** `test-spec.md` must define evidence for the real entry points documented by R052.3. `plan.md` must mark missing coverage without inferring implementation absence. | EG-T-12.4 rejects documentation, feature declarations, or generated status as execution proof. Existing EG-C-07/08 and EG-T-10 acceptance remains mandatory.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R001.1
Generated types throughout the AU lifecycle
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Generated types throughout the AU lifecycle.** EG SHALL export strict generated request, result, identity, and decision models. The export SHALL include the complete nested type closure. The manifest SHALL include contract revision, schema digest, and exported type identifiers. The pinned generated schema SHALL govern construction, deserialization, and serialization. Validation SHALL reject unknown nested fields, invalid enums, incompatible revisions, and invalid scalar types. Validation SHALL refuse before dispatch or persistence and return the field path. AU owns AgentLifecycleState and its transition rules. The AU state composes EG-generated types with HarnessRequest, phase, tool requests/results, and RunOutcome. EG SHALL NOT define another AU lifecycle state machine. EG SHALL NOT allow an unvalidated dictionary to replace an admitted value. Rehydration SHALL validate the persisted schema revision and each nested generated value before another step. Production wiring: Extend the EG contract generator and generated-model manifest. AU HarnessRequest and run_agent SHALL consume those exports and proposed AU AgentLifecycleState. Tests SHALL cross generated-client and AU execution/persistence boundaries. Owner link: `EG-CONTRACT-R001` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/public-engine-contract-and-release/requirements.md:5`. Owner link: `AU-HARNESS-R007` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/harness-evolution/requirements.md:12`. Owner link: `AU-HARNESS-R008` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/harness-evolution/requirements.md:13`. Draft dependency `AU-HARNESS-R007.40` remains `draft_unmerged` at `50c313ab01871ff7e10aee2a9d0254fa55d71f07`. It is not a merged producer or implementation receipt. Its path is `specs/harness-evolution/requirements.md`. Explicit hold: AU-HARNESS-R007.40 remains unmerged. AU owns lifecycle state, transitions, persistence, and consumer integration. EG exports alone cannot close AU:109. Owner-review proposal: A schema/type manifest is a proposed export contract. It does not prove an implemented manifest. Original source record `AU:109`, SHA-256 `c0d92285a141dcaac6817bcac25ffa438517afeba50be716211751f3a37a31c2`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run lifecycle_generated_types_survive_run_and_restart through the generated client and real AU run_agent. Transition through tool request/result to RunOutcome. Persist, restart, and resume with the same typed values. Unknown nested fields, wrong scalar types, stale schema revisions, and malformed persisted values SHALL refuse before the next step. AU separately refuses illegal phase transitions. Read persisted/resumed values independently and compare every field. A generated-model unit round trip alone does not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R001.2
Canonical blueprint disk round trip
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Canonical blueprint disk round trip.** EG SHALL bind each exported prompt blueprint to blueprint/schema revision and generated-model revision. It SHALL also bind semantic digest and canonical-byte digest. The versioned JSON profile SHALL use UTF-8 without a BOM and sorted object keys. It SHALL use two-space indentation, LF line endings, and one final newline. It SHALL include declared default/null fields and preserve array order. It SHALL reject NaN and Infinity. Parsing SHALL reject unknown fields and scalar coercion. Schema-defined numbers and Unicode scalar values SHALL survive without rounding or normalization. Export, SDK disk write, disk read, strict validation, and re-export SHALL preserve typed values and canonical bytes. A mismatch SHALL report the first differing JSON pointer/value or byte offset. A mismatch SHALL fail acceptance. EG owns blueprint semantics and validation. SDK and GraphOS governed source-effect contracts own filesystem effects. Production wiring: Use EG-TYPED-PACKS-R094.2/.3/.5/.7 for served admin export/import and durable persistence. Use SDK-GOVERNED-WRITEBACK-R004.5-.12 and ARBORA-FLEET-R003.4-.10 for filesystem effects. Reuse those contracts. EG adds no filesystem writer. Owner link: `EG-CONTRACT-R001` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/public-engine-contract-and-release/requirements.md:5`. Owner link: `EG-TYPED-PACKS-R094.2` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/typed-packs-and-catalog/requirements.md:149`. Owner link: `EG-TYPED-PACKS-R094.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/typed-packs-and-catalog/requirements.md:150`. Owner link: `EG-TYPED-PACKS-R094.5` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/typed-packs-and-catalog/requirements.md:152`. Owner link: `EG-TYPED-PACKS-R094.7` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/typed-packs-and-catalog/requirements.md:154`. Owner link: `AU-CONTROL-R025` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:30`. Draft dependency `AU-CONTROL-R025.40` remains `draft_unmerged` at `50c313ab01871ff7e10aee2a9d0254fa55d71f07`. It is not a merged producer or implementation receipt. Its path is `specs/agent-control-plane/requirements.md`. Explicit hold: AU-CONTROL-R025.40 remains unmerged. The formatter must pin an exact number encoder/profile version. Do not claim arbitrary JSON parsers preserve numeric spelling. Owner-review proposal: The formatting profile matches an AU draft proposal. It is a proposed cross-owner contract, not an existing receipt. Original source record `AU:121`, SHA-256 `98b7ad1186ec2a385b334ffa0ad1b28888157ed6b51c6ed4172eeb7b7ef6768e`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run blueprint_canonical_disk_roundtrip_has_no_difference with served R094 export and governed SDK disk write/read. Import and re-export after restart. Include nested defaults, nulls, ordered arrays, Unicode, and schema-boundary numeric values. Compare exact canonical bytes and schema-typed values. Lost fields, unknowns, coerced numbers, changed array order, and changed final newline SHALL fail. Capture source-effect receipt. A serializer-only test does not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R053
Split distribution: one server executable, an executable-free wheel (rollup)
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Split distribution: one server executable, an executable-free wheel (rollup).** The engine ships as one executable, `epistemic-graph-server`, in its own package `epistemic-graph-server`. The public `epistemic-graph` wheel carries no executables, so it fits the PyPI per-file limit. Children R053.1–R053.13 define separate units. They preserve R015 and R047. | R053.1–R053.8 are verified by their own rows. Documentation alone gives no proof.
requirementEG-CONTRACTSPECIFIEDNo recorded commit/test evidence
EG-CONTRACT-R053.1
One executable with subcommands
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**One executable with subcommands.** `epistemic-graph-server restore`, `migrate-shards`, `epistemic-graph-rf019-observe` and `lake-fixture-export` run the former separate tools and exit. With no subcommand the process serves, so existing invocations keep working. `nemesis` stays a separate harness binary. | A test reads `Cargo.toml` and refuses any `[[bin]]` other than `epistemic-graph-server` and `nemesis`. A test confirms each subcommand name is dispatched in `src/offline_tools.rs` and `src/main.rs` calls it before argument parsing.
requirementEG-CONTRACTSPECIFIEDtests/test_server_split.py:23
EG-CONTRACT-R053.2
The wheel carries no executables
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**The wheel carries no executables.** `build_backend.py` removes every `*.data/scripts/*` member and regenerates RECORD. The wheel carries the `engine` and `numeric` extension modules, Python sources and the contract. The wheel gate refuses any executable member. | The build-backend test composes a wheel from a skeleton that carries a server binary and finds no script member and a valid RECORD. The wheel-completeness test refuses a wheel carrying the server binary.
requirementEG-CONTRACTSPECIFIEDtests/test_build_backend.py:137
tests/test_check_wheel_completeness.py:215
EG-CONTRACT-R053.3
The `server` extra pins the server package in lockstep
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**The `server` extra pins the server package in lockstep.** `[project.optional-dependencies] server` is `epistemic-graph-server==<version>`, and `.config/bumpversion.cfg` moves it with the engine version. | A test compares the extra with the `Cargo.toml` package version and with the bump configuration.
requirementEG-CONTRACTSPECIFIEDtests/test_server_split.py:38
EG-CONTRACT-R053.4
Server binary lookup names the install hint
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Server binary lookup names the install hint.** Code that runs the server from the installed package resolves `epistemic_graph_server.binary_path()` when importable, then `shutil.which("epistemic-graph-server")`, else raises `ServerBinaryNotFoundError` naming `pip install "epistemic-graph[server]"`. | A unit test covers the three outcomes with the package absent, present and on PATH.
requirementEG-CONTRACTSPECIFIEDtests/test_server_split.py:49
EG-CONTRACT-R053.5
The `release-server` profile sizes the standalone server
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**The `release-server` profile sizes the standalone server.** `[profile.release-server]` inherits `release` with opt-level `s`, fat LTO, one codegen unit, `panic = "unwind"` and strip. | A test parses `Cargo.toml` and compares each profile key. The PR records the measured binary and wheel size.
requirementEG-CONTRACTSPECIFIEDtests/test_server_split.py:66
EG-CONTRACT-R053.6
Callers of the old binary names use the subcommands
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Callers of the old binary names use the subcommands.** Documentation, scripts, tests and CI refer to `epistemic-graph-server <subcommand>`, never to the retired executables. | A test refuses the retired names as commands in `docs/`, `scripts/` and `tests/`.
requirementEG-CONTRACTSPECIFIEDtests/test_server_split.py:79
EG-CONTRACT-R053.7
A tag publishes only a commit main CI already passed
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**A tag publishes only a commit main CI already passed.** `ci.yml` runs every test, gate, feature build and benchmark on pull requests and main pushes. A newer push cancels the older run for the same PR or ref. `release.yml` runs on `v*` tags and manual dispatch only. Its `guard` job refuses to proceed unless `ci.yml` concluded `success` on main for the tagged commit. The dispatch input `force_untested` (default false) overrides the guard and the run log records the override. The tag pipeline then builds, checks and publishes only. | A test reads both workflows. It confirms the triggers, the guard query and refusal, that every build job needs the guard, and that `release.yml` holds no gate job.
requirementEG-CONTRACTSPECIFIEDtests/test_release_full_wheel_contract.py:750
EG-CONTRACT-R053.8
The public wheel compiles only the extension modules; each platform publishes independently
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**The public wheel compiles only the extension modules; each platform publishes independently.** `[tool.maturin]` builds the `eg-pyengine` crate (`manifest-path`, no `bindings = "bin"`), so the wheel base is the `epistemic_graph.engine` extension plus the Python package, and `build_backend.py` and `.github/actions/folded-wheel` fold in `epistemic_graph.numeric`. No server crate or bin target compiles in any wheel path. The strip step stays as a safety net and the completeness check still refuses executables. In `release.yml` each build leg, the Linux x86_64 job and the sdist job upload their own artifact to PyPI with `twine upload --skip-existing` right after their completeness and smoke checks, behind `guard`; a final job only verifies that every expected file reached PyPI. The compile cache uses `Swatinem/rust-cache` with `shared-key: eg-wheel-<target>`, saved only by the `ci.yml` main-push `wheel-cache` job and restored on tag builds. | A test reads `pyproject.toml`, `build_backend.py`, the folded-wheel action and both workflows. It confirms the manifest path and absent bin bindings, one numeric component build, the per-leg publish steps and their order, no single publish-all job, and the cache key and save condition.
requirementEG-CONTRACTVERIFIEDd969ffcfaaad
tests/test_wheel_extensions_only.py:23
tests/test_wheel_extensions_only.py:41
tests/test_wheel_extensions_only.py:63
tests/test_wheel_extensions_only.py:90
EG-CONTRACT-R053.9
The server wheel builds and publishes from this repository
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**The server wheel builds and publishes from this repository.** `packaging/epistemic-graph-server/pyproject.toml` declares maturin `bindings = "bin"` over the root manifest's `epistemic-graph-server` binary with the `full` and `ast-extended` features. `release.yml` job `build-server` builds it with `--profile release-server` natively on linux x86_64 (`ubuntu-latest`) and linux aarch64 (`ubuntu-24.04-arm`), smoke-tests `epistemic-graph-server --help` and `binary_path()`, and uploads each wheel with `twine upload --skip-existing` right after its own smoke test, behind `guard`. The compile cache is `Swatinem/rust-cache` with `shared-key: egs-<arch>`, saved only by the `ci.yml` main-push `server-wheel-cache` job. `verify-pypi` checks the server files too. The x86_64 leg also builds the package's one sdist from the same version-pinned source (pipelines `PIPE-RELEASE-R008`). An isolated `pip wheel` rebuild of that sdist must yield a working `epistemic-graph-server --help` before the leg uploads the sdist with `twine upload --skip-existing`. `verify-pypi` requires and verifies that sdist with the server wheels. `[tool.maturin]` lists every path crate as an sdist `include`. Each entry covers the full crate tree. maturin drops path crates that only unselected optional features reach. Examples are `eg-asr-whisper` and `eg-tts-piper`. `cargo metadata` still loads their manifests, so the isolated rebuild needs them. The list is the path-dependency closure of the root manifest plus the workspace members. maturin rejects `..` in include patterns. So `packaging/epistemic-graph-server/crates` is a symlink to the workspace `crates` directory. The patterns are relative to it. | A test reads the package `pyproject.toml`, the build action and both workflows. It confirms the bin bindings and manifest path, the two native legs, the smoke steps, the per-leg upload behind `guard`, the cache key and save condition, the sdist build, rebuild proof and upload order, and the server files and sdist in `verify-pypi`. It also confirms that every transitive path crate and workspace member is an sdist include. The PR records the measured wheel size.
requirementEG-CONTRACTVERIFIEDbaf9a680a4c4
dede203bdd50
tests/test_server_package.py:190
tests/test_server_package.py:246
tests/test_server_package.py:34
tests/test_server_package.py:47
tests/test_server_package.py:88
EG-CONTRACT-R053.10
`binary_path()` locates the installed executable
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**`binary_path()` locates the installed executable.** `epistemic_graph_server.binary_path()` returns the executable in the interpreter scripts directory, else on `PATH`, else raises `BinaryNotFoundError`, a `FileNotFoundError` subclass whose message names the `pip install` command. The package carries exactly one executable. | `packaging/epistemic-graph-server/tests/test_binary_path.py` covers the scripts directory, the `PATH` fallback and the typed error. The release smoke step counts one script member.
requirementEG-CONTRACTSPECIFIEDtests/test_server_package.py:107
EG-CONTRACT-R053.11
The server image is built from the server wheel
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**The server image is built from the server wheel.** `docker/Dockerfile` installs the per-architecture server wheel staged in `docker/wheels` and copies only the binary to a slim runtime with a non-root user, ports 9100 and 9101 on loopback by default, and a TCP health check. It refuses a non-numeric `EGS_VERSION`. `release.yml` job `server-image` pushes one image per architecture by digest and job `server-manifest` creates the `linux/amd64` plus `linux/arm64` tags `<version>` and `latest` under the `epistemic-graph-server` image name. | A test reads the Dockerfile and the two jobs. It confirms the runtime stage, the version refusal, the push by digest and the `imagetools create` manifest.
requirementEG-CONTRACTSPECIFIEDtests/test_server_package.py:117
EG-CONTRACT-R053.12
The server version moves with the engine and a tagged version can be packaged later
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**The server version moves with the engine and a tagged version can be packaged later.** `.config/bumpversion.cfg` covers the package `pyproject.toml`, its `__version__` and the Dockerfile `EGS_VERSION`. A `workflow_dispatch` input `source_ref` (a `v<version>` tag) with `packages=server` builds the server package from that tag's source and publishes it. The build pins the package version to the source `Cargo.toml` version and refuses a tag that differs. `guard` still requires a successful `ci.yml` run on the commit that tag names. `guard` refuses `source_ref` with `packages=all`. | A test compares the package version fields with `Cargo.toml` and the bump configuration, and reads `release.yml` for the inputs, the guard resolution and the refusal.
requirementEG-CONTRACTSPECIFIEDtests/test_server_package.py:139
tests/test_server_package.py:157
EG-CONTRACT-R006.3
Export fresh typed contracts for parity repair
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Export fresh typed contracts for parity repair.** Hosted CI may export canonical generator output after parity fails. The export names the source commit and tree, toolchain, build command, recipe hashes and every artifact hash. Only generated contract paths may be uploaded. Failed generation, dirty source, symlinks and mismatched hashes refuse export. The original parity failure remains blocking. | `test_export_canonical_contract.py` covers bounded paths, provenance, failed generation, hash refusal and unchanged blocking workflow semantics. Native execution and full release qualification remain separate.
requirementEG-CONTRACTVERIFIED2a1515f6e252
2b8dd458b459
7e09becc533e
82c10dffe69e
8b5cbc59e851
tests/test_export_canonical_contract.py:11
EG-CONTRACT-R053.13
Retain the validated wheel for installed acceptance
Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source
**Retain the validated wheel for installed acceptance.** CI exports the exact folded wheel only after its completeness, privacy and installed-wheel tests pass. A pre-install digest must match the exported wheel. The bounded archive includes source commit/tree, build-recipe hashes and all file hashes. Missing, ambiguous, symlinked or stale artifacts and source mismatches refuse export. Native validation uses Ubuntu 24.04 and separate target/compiler cache namespaces, not a moving libc baseline. This artifact is not a package release. | `tests/test_ci_change_scope.py` verifies validation ordering, success-only upload, bounded paths, artifact hashes and fail-closed packaging.
requirementEG-CONTRACTVERIFIED42376299456f
701e8e498e07
88b8c1a73156
b286edc1b3bf
be072c1cf996
tests/test_ci_change_scope.py:649
tests/test_ci_change_scope.py:693
tests/test_ci_change_scope.py:822
EG-REPO-INGEST
EG-REPO-INGEST — Repository index and native ingestion
specNoneSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R001
Reconcile mode re-admits stranded semantic intents
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Reconcile mode re-admits stranded semantic intents.** SourceIngest's reconcile mode (admit_sql_source_dirty_reconcile) re-admits semantic intents that were stranded when their originating topic was retired, rather than leaving them permanently unprocessed. | An integration test retires a topic with pending stranded intents, runs a reconcile-mode SourceIngest pass, and confirms the stranded intents are re-admitted and committed.
requirementEG-REPO-INGESTLANDED06a13bef2738
ac5638477288
EG-REPO-INGEST-R002
SourceIngest is sole owner of migrated ingestion capabilities
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**SourceIngest is sole owner of migrated ingestion capabilities.** EG's SourceIngest is the sole implementation of the ingestion and derivation capabilities previously named envelope_ingest, change_envelope, evidence_spine, semantic_event_model, object_centric_derivation, process_conformance, embedding_admission, gpu_slot_scheduler, promotion, supersession, dead_letter, hydration_manifest, skill_workflow_ingest, and governed_documentation, each committed as part of its typed observation and receipt contract. | A consumer test confirms each listed capability is reachable only through SourceIngest and that no duplicate writer for the same capability remains in EG.
requirementEG-REPO-INGESTSPECIFIED06a13bef2738
f17f47ab300f
EG-REPO-INGEST-R003
EG is sole home for remaining migrated ingestion modules (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for remaining migrated ingestion modules (rollup).** Split into one child per migrating legacy-module root: `EG-REPO-INGEST-R003.1`–`EG-REPO-INGEST-R003.11`. This parent is satisfied only when every child below is satisfied. | See each child requirement's own verification.
requirementEG-REPO-INGESTLANDED0554e82ae743
06a13bef2738
72c7dfa478ba
77fa741ee191
a17a6c5ded2f
EG-REPO-INGEST-R003.1
EG is sole home for migrated standardization processing (excluding drift detection)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated standardization processing (excluding drift detection).** EG is the sole implementation for the ingestion-adjacent standardization processing (excluding drift detection) capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated standardization processing (excluding drift detection) capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDED06a13bef2738
72c7dfa478ba
ae0f93b6bf70
e72ee15e11bb
EG-REPO-INGEST-R003.2
EG owns the migrated infrastructure processing implementation
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG owns the migrated infrastructure processing implementation.** EG SHALL implement the capability that migrates from its legacy module. Consumers reach it through EG typed interface, not a duplicate implementation. | A consumer test calls the capability through EG interface only. It confirms the retiring source module no longer duplicates the computation.
requirementEG-REPO-INGESTLANDED06a13bef2738
72c7dfa478ba
f70de8c33b4f
EG-REPO-INGEST-R003.3
EG is sole home for migrated quantum processing
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated quantum processing.** EG is the sole implementation for the ingestion-adjacent quantum processing capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated quantum processing capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDEDa17a6c5ded2f
EG-REPO-INGEST-R003.4
EG is sole home for migrated security processing
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated security processing.** EG is the sole implementation for the ingestion-adjacent security processing capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated security processing capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDEDa17a6c5ded2f
EG-REPO-INGEST-R003.5
EG is sole home for migrated enterprise protocol handling
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated enterprise protocol handling.** EG is the sole implementation of the ingestion-adjacent enterprise protocol handling capability. The capability migrates out of its legacy module. Callers reach it through EG's own typed interface, not a duplicate. | A consumer test confirms the migrated enterprise protocol handling capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDEDa17a6c5ded2f
EG-REPO-INGEST-R003.6
EG is sole home for migrated ecosystem concept extraction
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated ecosystem concept extraction.** EG is the sole implementation for the ingestion-adjacent ecosystem concept extraction capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated ecosystem concept extraction capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDED06a13bef2738
72c7dfa478ba
f70de8c33b4f
EG-REPO-INGEST-R003.7
EG is sole home for migrated trace-ontology observability
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated trace-ontology observability.** EG is the sole implementation for the ingestion-adjacent trace-ontology observability capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated trace-ontology observability capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDED0554e82ae743
72c7dfa478ba
fb19bf6ab789
EG-REPO-INGEST-R003.8
EG is sole home for migrated self-ingestion observability
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated self-ingestion observability.** EG is the sole implementation for the ingestion-adjacent self-ingestion observability capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated self-ingestion observability capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDED77fa741ee191
EG-REPO-INGEST-R003.9
EG is sole home for migrated audit-logging observability
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated audit-logging observability.** EG is the sole implementation for the ingestion-adjacent audit-logging observability capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated audit-logging observability capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDED77fa741ee191
EG-REPO-INGEST-R003.10
EG is sole home for migrated relational-authority governance
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated relational-authority governance.** EG is the sole implementation for the ingestion-adjacent relational-authority governance capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated relational-authority governance capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDED77fa741ee191
EG-REPO-INGEST-R003.11
EG is sole home for migrated placement-mining research
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**EG is sole home for migrated placement-mining research.** EG is the sole implementation for the ingestion-adjacent placement-mining research capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated placement-mining research capability is callable only through its EG interface and that the retiring source module no longer performs the same computation.
requirementEG-REPO-INGESTLANDED0554e82ae743
72c7dfa478ba
ae0f93b6bf70
fb19bf6ab789
fd9e20bc998d
EG-REPO-INGEST-R004
Derived series maintained incrementally with lineage
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Derived series maintained incrementally with lineage.** EG's timeseries handlers support a SeriesDefine{name, expr, sources} mutation that creates a derived series incrementally maintained from each source's prior append history; a revision replay only appends new series values, never mutates past ones, and the graph records DerivedSeries derivedFrom Series lineage together with the defining expression's digest. Row-level security on a derived series is the most restrictive policy among its sources, a cyclic source definition is refused, and maintenance work is bounded by an explicit budget. | An integration test defines a derived series, appends to its sources, confirms incremental maintenance matches full recomputation, and negative tests confirm a cyclic definition is refused and an over-budget maintenance run is bounded.
requirementEG-REPO-INGESTVERIFIED0554e82ae743
2b8c0364ebb7
crates/eg-tsdb/src/derive/maintain_tests.rs:45
src/server/handlers/timeseries/derived_tests.rs:159
src/server/handlers/timeseries/derived_tests.rs:206
EG-REPO-INGEST-R005
Replay-protection nonces commit in batches for throughput
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Replay-protection nonces commit in batches for throughput.** src/server/request_replay.rs SHALL batch or group-commit replay-protection nonces. Alternatively, it may use a bounded memory window backed by a durable epoch. Per-request durable commit overhead SHALL NOT dominate served-request latency. Replay protection remains intact. | A benchmark compares served throughput before/after at matching concurrency. A replay-attack negative test continues to pass.
requirementEG-REPO-INGESTVERIFIED0374378eb9db
7d1bf0006b94
src/server/request_replay.rs:418
src/server/request_replay.rs:428
src/server/request_replay.rs:486
EG-REPO-INGEST-R006
Native ingestion commits fast; heavy enrichment deferred
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Native ingestion commits fast; heavy enrichment deferred.** Indexing a repository or other source completes natively within seconds: parsing, symbol resolution, and statistical analysis run inside EG as batched durable commits, while classical ML, embeddings, and LLM-based enrichment never block the commit and are instead enqueued as durable, budgeted work items with an admission verdict, drained by background workers, plus bounded on-demand enrichment when a query needs it. | An end-to-end benchmark against real public repositories records commit latency for the native stages and confirms the deferred-enrichment work items are admitted, enqueued, and completed asynchronously without blocking the index commit.
requirementEG-REPO-INGESTSPECIFIED0554e82ae743
6bb88b0a90cc
EG-REPO-INGEST-R007
Large ingestion batches refuse atomically with a stable code
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Large ingestion batches refuse atomically with a stable code.** SourceIngest refuses an over-limit batch atomically with a stable REPOSITORY_BATCH_TOO_LARGE-class error code before any graph mutation, and a large-batch regression test exercises this refusal path. | A regression test submits a batch past the configured limit and confirms the atomic refusal, the stable error code, and that no partial graph mutation occurred.
requirementEG-REPO-INGESTVERIFIED0554e82ae743
33c5c6459154
src/server/handlers/repository_index_tests.rs:228
EG-REPO-INGEST-R008
Oversized batches return a stable retry code
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Oversized batches return a stable retry code.** When a repository batch exceeds the 64 MiB write-byte ceiling, EG SHALL refuse it. Return stable REPOSITORY_BATCH_TOO_LARGE code and bounded detail. This lets connector SDK halve and resend the batch. It avoids a generic internal error. | Submit a batch above the 64 MiB ceiling. Confirm stable error code and successful halve-and-resend retry.
requirementEG-REPO-INGESTLANDED504e3109b2b0
72c7dfa478ba
EG-REPO-INGEST-R009
Repository hydration links into the specification bridge
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Repository hydration links into the specification bridge.** EG's repository hydration maps indexed repository entities into the semantic bridge that links them to their source, test, specification, and release relationships, so a query can follow from a hydrated code entity to its governing specification without a duplicate graph writer. | An integration test hydrates a sample repository and confirms its entities are reachable through the documented source-to-specification relationship chain.
requirementEG-REPO-INGESTLANDED1bb3ca5fed33
1f5ba9350abb
EG-REPO-INGEST-R009.1
Edge identity is the `(source, target, relation_type)` triple
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Edge identity is the `(source, target, relation_type)` triple.** EG's `eg-core` graph treats an edge's identity as the `(source_id, target_id, relation_type)` triple rather than the bare `(source_id, target_id)` pair, so multiple relation types between the same two endpoints coexist as distinct addressable edges instead of silently colliding. An untyped legacy edge migrates deterministically onto this scheme by reading its stored blob's `type`/`label` field as `relation_type`, falling back to `related_to` when neither is present; a collision between two untyped edges that migrate to the same triple is resolved by a deterministic collapse rule (keep one, emit a collision receipt) rather than by dropping either silently. | A collision test adds two untyped edges between the same pair that migrate onto the same `relation_type`, confirms the deterministic collapse and its collision receipt, and a typed-edge test confirms distinct relation types between the same pair are independently addressable, retrievable and removable.
requirementEG-REPO-INGESTVERIFIED1bb3ca5fed33
1f5ba9350abb
crates/eg-core/src/graph/core_edge_queries.rs:271
EG-REPO-INGEST-R009.2
Semantic-bridge projection of the nine relations onto typed triples
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Semantic-bridge projection of the nine relations onto typed triples.** The semantic bridge's nine relations project onto the `(source, target, relation_type)` triple scheme from `EG-REPO-INGEST-R009.1` — each relation is stored and queried as its own typed edge between the same two endpoints, never collapsed into a shared untyped edge. | An integration test projects a sample hydration carrying multiple semantic-bridge relations between the same two entities and confirms each relation is independently retrievable by its own `relation_type`.
requirementEG-REPO-INGESTLANDED1f5ba9350abb
EG-REPO-INGEST-R010
Tree-sitter grammar coverage expands to 18 more languages
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Tree-sitter grammar coverage expands to 18 more languages.** EG's native parser (parser/tree_sitter.rs) adds tree-sitter grammar support for Swift, Kotlin, Objective-C, Zig, Julia, Elixir, Groovy, PowerShell, Fortran, Pascal, Verilog, CUDA, HTML, CSS, JSON, Terraform/HCL, and DreamMaker, alongside its existing C, C++, C#, Go, Rust, Python, JavaScript, TypeScript, React, Java, Scala, Ruby, PHP, Lua, Bash, and SQL support; DreamMaker, lacking a maintained tree-sitter grammar, uses a custom extractor. | A grammar-expansion test suite parses a representative fixture for each newly added language and confirms a successful parse outcome for each.
requirementEG-REPO-INGESTLANDED2a0d6eae0918
EG-REPO-INGEST-R011
Ingestion community detection uses pure Leiden
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Ingestion community detection uses pure Leiden.** Use pure Leiden partitioning through the shared graph_algos/leiden.rs driver. Wire it through algorithms.rs and features.py. Do not use a Louvain/Leiden hybrid. This avoids trusting badly connected or disconnected communities as valid modules. | A test confirms the ingestion path calls Leiden refinement. No committed community in the test graph is internally disconnected.
requirementEG-REPO-INGESTVERIFIED69411a23a248
b5fe3c140c21
crates/eg-compute/src/algorithms/tests.rs:133
EG-REPO-INGEST-R002.1
Compile a skill document into a typed plan
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Compile a skill document into a typed plan.** SourceIngest skill_workflow_ingest SHALL compile procedural steps in a pinned SKILL.md into typed TaskPlan. It SHALL NOT require a separate workflow file. Each step SHALL bind a unique step ID, source span, instruction digest, capability ID, typed inputs/outputs, and dependencies. The compiler SHALL resolve capabilities and bindings before it emits a plan. It SHALL order independent steps by source order. It SHALL refuse missing/duplicate IDs, unresolved dependencies/capabilities, cycles, unsupported types, or missing spans. The receipt SHALL bind skill-directory reference, document revision/digest, grammar revision, and plan revision/digest. The receipt SHALL also bind tool and type digests. The graph SHALL store the directory reference and compilation provenance, not a document copy. A changed document or capability/type digest SHALL invalidate the binding before execution. Unstructured prose SHALL NOT silently become a plan step. Production wiring: Attach compilation to existing SourceIngest skill_workflow_ingest. Proposed AU-CONTROL-R037.30 binds through graph_orchestrate, gap/plan selection, and `execute_workflow`. Do not add a parallel document executor. Owner link: `EG-REPO-INGEST-R002` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:6`. Owner link: `AU-HARNESS-R022.2` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/harness-evolution/requirements.md:111`. Owner link: `AU-CONTROL-R037.3` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:59`. Owner link: `AU-CONTROL-R037.5` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:61`. Draft dependency `AU-CONTROL-R037.30` remains `draft_unmerged` at `50c313ab01871ff7e10aee2a9d0254fa55d71f07`. It is not a merged producer or implementation receipt. Its path is `specs/agent-control-plane/requirements.md`. Explicit hold: Owners must publish the versioned SKILL.md procedural grammar. Owners must publish authoritative capability/type lookup. AU-CONTROL-R037.30 remains unmerged. The SourceIngest capability name alone does not prove document compilation. Owner-review proposal: Step fields, source-order tie breaking, and compilation receipt are proposed details. No Markdown grammar is claimed as already selected. Original source record `AU:23`, SHA-256 `3f7e133169a76ce2680ec667c28ea2c5543354ed8874d258c432e65346f2e529`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Exercise `skill_document_alone_compiles_and_executes` with a skill directory containing SKILL.md and permitted assets. Provide no separate workflow file. Invoke real SourceIngest and fetch the plan through AU graph_orchestrate. Call `execute_workflow`. Inspect independently observed step effects and data bindings. Mutate the document between compilation and invocation. Refuse before the affected step. Test duplicate IDs, cycles, unknown capabilities, wrong binding types, and missing spans. Confirm the graph stores directory reference/receipt, not copied document text. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R006.1
Measure the daily paper target and admit bounded maintenance
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Measure the daily paper target and admit bounded maintenance.** EG SHALL count distinct canonical paper IDs completed through every required ingestion stage. Count them in half-open rolling UTC window [window_end - 86400 seconds, window_end). The target SHALL be 2000 completed papers per window. Stage receipts SHALL record stage/revision, attempted IDs, distinct completed IDs, duplicate count, elapsed time, and source/commit evidence. Retries SHALL NOT increase the completed-paper count. A partial or stale window SHALL remain unknown and SHALL NOT be compared as a full day. Below target, the committed decision SHALL name count, shortfall, and stage-bottleneck evidence. The decision SHALL assess safe maintenance candidates before allocating remaining declared budget across identified goals. A purge candidate SHALL be terminal, unleased, and non-authoritative. It SHALL retain durable source and decision receipts. Active work, authoritative records, and the last source copy SHALL be ineligible. Each action SHALL carry owner authorization, expected revision, cost ceiling, and admission verdict. Missing authority or policy inputs SHALL refuse before effects. Production wiring: Read stage/work-item receipts from native SourceIngest and deferred work under R006. EG decides shortfall and per-goal allocation. AU observes the result. GraphOS performs admitted maintenance. Keep operation ID and producer/export binding as owner dependencies. Owner link: `EG-REPO-INGEST-R006` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:21`. Owner link: `AU-RETIRE-R005` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/au-engine-duplicate-retirement/requirements.md:14`. No draft consumer dependency is assigned. Explicit hold: The reviewed source does not select the required stage set or window-freshness policy. It also omits per-goal allocation objective/tie-break and the GraphOS maintenance operation/authorization contract. Do not invent IDs, budget defaults, or a purge executor. Owner-review proposal: Distinct end-to-end completions and the exact window define a proposed throughput oracle. Stage telemetry remains separate from the completed-paper numerator. Original source record `AU:70`, SHA-256 `902f964dd909186f3a31d1f8a84d146b715446e64dfeec62480c8151baa06996`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run paper_shortfall_drives_admitted_maintenance through real 24-hour stage completion and durable work queues. Include duplicate attempts, failures, and boundary timestamps. Independently count 1999 then 2000 unique completions. Confirm trigger/no-trigger decisions. Inspect goal allocations and their aggregate budget bound. Use actual GraphOS maintenance route and read its result receipt. Active leases, changed revisions, last source copy, missing authorization, and stale telemetry SHALL prevent purge. An incomplete window is unknown. Queue-only/planner-only fixtures do not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R006.2
Apply importance resistance in the deferred re-embed worker
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Apply importance resistance in the deferred re-embed worker.** After a successful sync commit, EG SHALL queue a durable re-embed job. The job SHALL bind committed source revision, embedding space/model revision, old-vector digest, and importance-policy revision. The worker SHALL form an importance-regularized candidate outside the routing loop. Proposed profile squared_l2_anchor_v1 uses objective `L(z)=sum((z_i-p_i)^2)+lambda*sum(w_i*(z_i-o_i)^2)`. Here p is the proposed vector and o is the old vector. Each coordinate weight SHALL be finite and nonnegative. Lambda SHALL be finite and strictly positive. The coordinate result is `(p_i+lambda*w_i*o_i)/(1+lambda*w_i)`. Vectors and weights SHALL share one declared dimension and coordinate system. The profile SHALL NOT silently rescale or normalize the result. Missing/stale importance evidence or incompatible spaces SHALL refuse promotion. Nonfinite values or superseded source/vector revisions SHALL refuse before promotion. The candidate SHALL remain shadow data until the existing recall gate passes. A failed gate SHALL retain the prior active version. Query routing SHALL NOT perform consolidation or its embedding/model calls. Production wiring: Queue through EG-FEDERATED-QUERY-R077.3. Gate promotion through EG-UNIFIED-DATA-PLANE-R040.2/.3 before EmbeddingVersionStore::tag_batch. Read the embedding binding in the existing worker path. R040.3 records that the production tag caller must be created. EG-FEDERATED-QUERY-R040.3 is not this gate. Owner link: `EG-REPO-INGEST-R006` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:21`. Owner link: `AU-CONTEXT-R002` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-context-and-finance/requirements.md:6`. Owner link: `EG-FEDERATED-QUERY-R077.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/federated-query-and-reasoning/requirements.md:95`. Owner link: `EG-UNIFIED-DATA-PLANE-R040.2` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/unified-data-plane/requirements.md:153`. Owner link: `EG-UNIFIED-DATA-PLANE-R040.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/unified-data-plane/requirements.md:154`. No draft consumer dependency is assigned. Explicit hold: The source does not identify the authoritative per-coordinate importance producer or revisioned export. The compatible embedding-space policy is also unbound. The squared-L2 profile remains an owner-review proposal. Do not claim the source specified or implemented this math. Owner-review proposal: squared_l2_anchor_v1 is a precise proposed penalty, not a paper-derived claim. A different owner-selected profile must publish an exact objective and monotonic resistance oracle. Generic importance weighting is insufficient. Original source record `AU:92`, SHA-256 `771acc731a6e25746641adf30cde9ec91f4eb56edd6597f2d308a42947a3abb3`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. The generated status has no receipt arrays. No implementation or served receipt is claimed. | Exercise sync_importance_penalty_is_async_and_gate_bound through real sync and deferred worker. Compare equal proposed coordinate displacements at low/high importance. Higher importance produces less displacement. Compare exact candidate math, provenance, idempotent jobs, and existing gate before tag_batch. Stale jobs, absent importance evidence, or failed recall probes leave active binding unchanged. Instrument served routing. Prove zero consolidation/embedding calls while pending and after completion. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R006.3
Serve revision-bound structured code maps
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Serve revision-bound structured code maps.** The existing UnifiedQuery surface SHALL accept a typed code-map query. The query SHALL include tenant, repository identity, and current source revision. It SHALL identify behavior text or a symbol, requested relation kinds, and bounded page limits. The result SHALL bind map generation, source-inventory revision/digest, query digest, and authorization scope. It SHALL include module/symbol IDs, language, path, source span, and source revision. It SHALL expose typed contains, calls, and depends_on edges. Behavior matches SHALL resolve to indexed entities and cited spans. Unsupported or unresolved relations SHALL be marked incomplete, not invented. Authorization SHALL precede results, counts, and cursors. Each page SHALL compare map binding with authoritative current repository revision. A changed or unknown revision SHALL refuse as stale before serving data. This rule also covers unchanged symbols from older generations. Each cursor SHALL bind the same map, query, and authorization revisions. Production wiring: Produce maps through native IndexRepository/SourceIngest. Serve them through Method::UnifiedQuery and its existing execution path. Add a typed code-map query/result mode there. Do not add a separate search service or treat LLM answers as authoritative code-map evidence. Owner link: `EG-REPO-INGEST-R006` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:21`. Owner link: `EG-REPO-INGEST-R009` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:24`. Owner link: `EG-FEDERATED-QUERY-R017` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/federated-query-and-reasoning/requirements.md:21`. No draft consumer dependency is assigned. Producer binding: The proposed typed authority/admission contract in plan.md is normative for this row. Configuration must be admitted before use; no deployed authority is claimed. Any historical query must be explicit. It cannot satisfy the current-map guarantee. Owner-review proposal: Request/result carrier and cursor bindings are proposed query additions. They are not current implemented API claims. Original source record `EG:54`, SHA-256 `e69e6fa3a5c26ae763809d600cb7d264d028b9ce0d80f8ca6141e1a40cf0638e`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run current_code_map_locates_behavior_and_refuses_old_generation through served indexing and generated UnifiedQuery. Query behavior and a symbol. Independently inspect modules, symbols, call/dependency edges, and source spans. Change one source file so one indexed symbol behavior/span changes while another remains unchanged. Until a complete new map generation publishes, queries for either symbol and the old cursor SHALL refuse against the stale map. Reindex. Query both symbols. The changed symbol SHALL expose its current source revision and span. The unchanged symbol SHALL retain its logical ID. It SHALL bind to the new map generation and current revision. Inspect changed, deleted, and renamed entities against current files. Test unauthorized tenants, changed authorization, bounded pagination, and unresolved relations. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R006.4
Bound incremental indexing and declare semantic-type support
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Bound incremental indexing and declare semantic-type support.** IndexRepository SHALL apply authorized added/modified/deleted/renamed file deltas against exact base and target revisions. A mismatched base SHALL refuse before index mutation. Unchanged files SHALL reuse parse/index artifacts. The target generation SHALL omit entities/edges for deleted files and rebind renamed ones. Each job SHALL receive positive max_working_bytes within its host grant. It SHALL account all job-owned parser/index buffers and worker allocations. The job SHALL reserve each allocation before use. It SHALL backpressure or refuse before exceeding the grant. Existing per-batch atomic refusal remains required. Only a complete target generation may become the current code map. Completion, cancellation, and failure SHALL release job buffers, handles, and workers. The shared engine SHALL remain usable. Optional semantic typing SHALL use a versioned language/parser/resolver support table. Unsupported semantic mode SHALL refuse or return explicitly requested syntax-only output. Grammar availability SHALL NOT imply semantic-type support. Production wiring: Attach deltas to SourceIngest/IndexRepository and SDK-SOURCE-INGEST-R004. Retain R007 batch admission and native/deferred separation under R006. Extend existing parser/index workers and owner resource accounting. Owner link: `EG-REPO-INGEST-R006` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:21`. Owner link: `EG-REPO-INGEST-R007` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:22`. Owner link: `EG-REPO-INGEST-R010` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:27`. Owner link: `SDK-SOURCE-INGEST-R004` at `agent-connector-sdk@5babc4cc48ad73928468b243842f219f51e2cca1:specs/SDK-SOURCE-INGEST/requirements.md:8`. No draft consumer dependency is assigned. Explicit hold: The owner must publish the initial semantic-language/resolver matrix and exact host resource-grant binding. Do not substitute grammar counts or an arbitrary language list. Resource evidence must include native parser/worker allocations, not only language-runtime heap counters. Owner-review proposal: The limit covers job-owned working memory. The host accounts shared engine memory separately. This is not a whole-process RSS limit. The initial semantic-language roster remains a source-decision hold. Original source record `EG:55`, SHA-256 `340c1817f2a52dc6da4c9c13d93d215debbeb9fefd8b84b8d2400b86541d4d81`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Exercise incremental_index_respects_memory_and_releases_resources through actual indexing. Exercise add/modify/delete/rename delta. Count parser calls and independently inspect the target map. Instrument allocator/workers. Peak job-owned bytes SHALL stay within the grant. Reject an over-limit reservation before allocation. No partial map becomes current. The prior map remains usable after failure. On success, cancellation, and parser failure, release job allocations/handles to baseline. Submit a subsequent job. Test every advertised semantic table row and reject unsupported modes. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R002.100
Require independent readback before ingestion success
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Require independent readback before ingestion success.** Extend the existing SourceIngest result-persistence contract. Each write receipt SHALL bind run ID, tenant, query digest, ordered result IDs/content digests, graph revision, and source provenance. After writing, the consumer SHALL issue a separately authorized read-only query. It SHALL bind its principal/grant revision and selector to the receipt. It SHALL compare every expected result ID, digest, and revision. A run SHALL report success only after a matching readback receipt. Missing, partial, stale, denied, or mismatched readback SHALL return typed non-success. EG SHALL NOT add a second graph writer. Producer/consumer: EG owns durable graph read/write. AU owns execution-success reporting. Reuse SourceIngest and existing query authorization. Preserve existing coverage: `EG-REPO-INGEST-R002`; `EG-DURABLE-KERNEL-R002`. Source record `AU:118` SHA-256 `e8ad0c2417b7fa6ce53c46899f1adf8e925977becd0bd1813db6b62d3786af11`. Explicit open AU prerequisite: No exact reviewed AU companion requirement binds execution success to this EG receipt. Leave the AU consumer ID unassigned. Treat consumer evidence as missing; do not infer an ID. Status remains SPECIFIED; implementation and served evidence remain pending. Planned served acceptance: persist a multi-result search through the served path. Read it through a separately authorized query and compare every result ID, digest, and revision. Independently read back the durable result records and both persisted receipts: the write receipt and readback receipt. Confirm the write receipt binds run, tenant, query digest, ordered result IDs/digests, graph revision, and source provenance. Confirm readback binds principal/grant revision, selector, and returned result IDs/digests/revisions. Report success only after all values match. Refuse denied, partial, stale, or mismatched data or receipts; keep success unset.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R002.101
Bind graph-loaded workflow execution to durable hydration readback
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Bind graph-loaded workflow execution to durable hydration readback.** Bind the graph-loaded workflow ID and revision. Bind the committed EG plan/decision digest and AU execution run/output digests. Bind the SourceIngest write receipt, resulting graph revision, and separately authorized readback receipt. The acceptance path SHALL use the real AU `graph_orchestrate` → `find_workflow_gaps`/`fill_workflow_gaps` → `execute_workflow` consumer. It SHALL use EG graph load/decision and SourceIngest. A separate authorized graph query SHALL read back hydrated content. Its digest SHALL match before the gate reports success. Fake engines/catalogs and generic handoff receipts do not satisfy this contract. Missing/stale workflows, execution mismatches, write failures, or denied/partial readback SHALL return non-success. Producer/consumer boundary: EG owns workflow graph load/decision and durable SourceIngest. AU owns graph orchestration/execution. SDK owns the source-effect runner. Pipelines owns the gate; it does not add a runtime orchestrator. Explicit open AU prerequisite: No exact reviewed AU companion requirement binds AU success to this EG hydration readback. Leave the AU consumer ID unassigned. Treat execution-success evidence as missing. Pipelines gate coverage does not establish the AU consumer. Preserve existing coverage: `EG-REPO-INGEST-R002`. Source record `PIPE:10` SHA-256 `e0c431512565acb1a8ae00e09b63ec6fb7c8f9e81ef9c786a0fd7b26b2239455`. Status remains SPECIFIED; implementation and served evidence remain pending. Planned served acceptance: Run the real graph-loaded workflow through AU. Perform hydration. Read the result through a separate authorized query. Before success, compare exact workflow revision, run, output, and graph revision bindings. Refuse stale workflows, plan mismatch, hydration-digest mismatch, and denied/partial readback.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R002.102
Successive batches to one stream chain one content version
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Successive batches to one stream chain one content version.** Every SourceIngest batch to a stream advances one content-version object. That object is keyed by the stream's live-set marker identity (tenant, connector and stream), not by the per-batch receipt id. A batch chains from the digest stored under that object. A stream with no stored version chains from none, including a stream whose earlier batches were committed under per-batch ids. A second delta batch to the same stream, with an advanced checkpoint, commits. It never meets the `STALE_CONTENT_VERSION` refusal for a missing prior version. A batch whose stated previous digest no longer matches the stored one is still refused with `STALE_CONTENT_VERSION`. | Served test `a_second_batch_to_the_same_stream_chains_its_content_version` in `src/server/handlers/admin/connector_pack/tests/scale.rs`. It ingests two delta batches to one stream and asserts both commit. It asserts the stream's stored content version holds the second batch digest, chained from the first.
requirementEG-REPO-INGESTVERIFIED2a47417c6cfc
src/server/handlers/admin/connector_pack/tests/scale.rs:278
EG-REPO-INGEST-R600
Code enrichment turns parsed repositories into typed code, test and feature facts (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Code enrichment turns parsed repositories into typed code, test and feature facts (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R600.1
Model
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model.** `crates/eg-enrich/src/code.rs` defines CodeEntity, TestEntity, EnrichmentEdge{rung}, PatternHit, Feature. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R600.2
Behavior
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior.** Enrichment consumes the parser's structural facts. It emits typed entities and rung-ranked edges. A lower rung never overwrites a higher one. It also emits design-pattern hits per class and function. It emits feature clusters from call-graph communities. It emits a test-quality verdict from fixed metric thresholds. Queries answer which tests need work, how a symbol works and which code uses a pattern. | Unit tests cover each rule with positive and boundary cases.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R600.3
Wiring
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring.** SourceIngest calls `enrich_repository` after the fast commit and before the deferred semantic stages, reusing the community detector of EG-REPO-INGEST-R011. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R600.4
Refusal
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal.** The engine refuses and counts an edge that overwrites a higher-rung edge. It never applies it. The stable code is `ENRICH_RUNG_CONFLICT`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R600.5
Evidence
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence.** Per run: entities, edges by rung, patterns, features and tests flagged. | Test reads the trace or metrics after one success and one refusal.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R600.6
Hot-path proof
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof.** The enrich_repository call over a 200k-symbol fixture is linear in edges. It has p50 under 2 s, p99 under 5 s and peak memory under 512 MiB. The benchmark is `benches/r600_repository_index_and_ingestion.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R601
Commit history becomes a graph of commits, authors, files and change coupling (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Commit history becomes a graph of commits, authors, files and change coupling (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R601.1
Model
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model.** `crates/eg-enrich/src/history.rs` defines CommitRecord, FileChange, ChurnAggregate, CouplingEdge{support, confidence}. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R601.2
Behavior
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior.** A repository's commits, authors and per-file changes become nodes and edges once per commit digest. Churn aggregates per file and per author. Two files that change together above a support and confidence floor receive a coupling edge. Re-runs add only unseen commits. | Unit tests cover each rule with positive and boundary cases.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R601.3
Wiring
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring.** The repository hydration path of EG-REPO-INGEST-R009 calls `ingest_history` with the commit-digest set already stored. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R601.4
Refusal
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal.** A history above the configured commit bound is truncated at a commit boundary and reported, never half-applied. The stable code is `HISTORY_BOUND_EXCEEDED`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R601.5
Evidence
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence.** Per run: commits added, commits skipped, coupling edges written. | Test reads the trace or metrics after one success and one refusal.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R601.6
Hot-path proof
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof.** ingest_history of 100k commits: linear, p50 under 3 s, p99 under 8 s, coupling pass memory bounded by the file-pair cap. The benchmark is `benches/r601_repository_index_and_ingestion.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R602
Infrastructure definitions, HTTP routes and business capabilities link to the service that owns the code (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Infrastructure definitions, HTTP routes and business capabilities link to the service that owns the code (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R602.1
Model
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model.** `crates/eg-enrich/src/links.rs` defines IacResource, HttpRoute, ServiceLink, CapabilityRealization. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R602.2
Behavior
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior.** Infrastructure-as-code files yield resource nodes, HTTP route declarations yield route nodes, and both link to the owning service node. Code features resolve to business capabilities by lexical and vector evidence with a score floor. | Unit tests cover each rule with positive and boundary cases.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R602.3
Wiring
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring.** Called from `enrich_repository` of EG-REPO-INGEST-R600 after feature discovery. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R602.4
Refusal
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal.** Two services tie for one resource: no link is written and the tie is returned for review. The stable code is `LINK_AMBIGUOUS_SERVICE`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R602.5
Evidence
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence.** Per run: resources, routes, links written, ambiguous ties. | Test reads the trace or metrics after one success and one refusal.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R602.6
Hot-path proof
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof.** link pass over 50k routes: p50 under 400 ms, p99 under 1.2 s. The benchmark is `benches/r602_repository_index_and_ingestion.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R603
Structural fingerprints keep incremental re-indexing to real structural change (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Structural fingerprints keep incremental re-indexing to real structural change (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R603.1
Model
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model.** `crates/eg-enrich/src/fingerprint.rs` defines StructuralFingerprint, ChangeLevel{None, Cosmetic, Structural}, BlastRadius, CodeMap. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R603.2
Behavior
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior.** Each file has a content hash and a structure hash over signatures. Equal content is None, equal structure is Cosmetic, otherwise Structural. Only Structural files re-enter enrichment. Blast radius counts symbol usages with definition lines excluded and flags low-usage symbols. A code map is a hierarchical outline of nodes and edges. | Unit tests cover each rule with positive and boundary cases.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R603.3
Wiring
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring.** SourceIngest reads the stored fingerprint before enrichment and skips None and Cosmetic files. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R603.4
Refusal
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal.** A file that fails to parse is classed Structural so it is never silently skipped. The stable code is `FINGERPRINT_UNPARSEABLE`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R603.5
Evidence
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence.** Per run: files by level and symbols flagged low-usage. | Test reads the trace or metrics after one success and one refusal.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R603.6
Hot-path proof
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof.** fingerprint of 10k files: p50 under 300 ms, p99 under 900 ms; blast radius of one symbol over 100k files under 150 ms. The benchmark is `benches/r603_repository_index_and_ingestion.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R800
Agent-session transcript sources and scheduled feed intake (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Agent-session transcript sources and scheduled feed intake (rollup).** `crates/eg-document` ingests agent-session transcripts (line-delimited JSON from the supported coding-agent formats). It also ingests scheduled feed and file-change sources, and the research and world-model intake pipelines. Each is a declared source with checkpoints. Every transcript turn and feed item becomes a provenance-bearing record. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R800.1
Model
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model.** `TranscriptTurn{session_id, ordinal, role, content_digest, tool_calls, ts}` and `SourceCheckpoint` reuse; one declarative parser table maps each transcript dialect to the same turn record. | Planned: `crates/eg-document/tests/transcript_sources.rs::dialects_map_to_one_turn_record`.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R800.2
Behavior
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior.** Parsing streams line by line in O(bytes) with bounded line length. Checkpoints are the last ordinal and file digest. A changed prefix restarts the session from the first differing ordinal. | Planned: `crates/eg-document/tests/transcript_sources.rs::changed_prefix_restarts_from_first_difference`.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R800.3
Wiring
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring.** Intake runs as an `eg-jobs` scheduled source under the placement and worker policy. File-change triggers coalesce within a declared window. The window uses the engine clock. | Planned: `crates/eg-document/tests/transcript_sources.rs::overlong_line_is_quarantined`.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R800.4
Refusal
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal.** The engine quarantines four inputs with a typed reason. The first is a line over the length bound. The second is an unknown dialect. The third is a role outside the closed set. The fourth is a session whose prefix digest changed without a restart marker. A quarantine does not advance the checkpoint. | Planned: `crates/eg-document/tests/transcript_sources.rs::unknown_role_is_refused`.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R800.5
Evidence
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence.** Evidence is the quarantine count, the per-session digest and a replay that yields an identical turn sequence. | Planned: `crates/eg-document/tests/transcript_sources.rs::replay_is_identical`.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R800.6
Hot-path proof
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof.** Hot-path proof: a Criterion benchmark ingests a 1 GiB transcript set. Throughput stays above 200 MiB per second. The per-line p99 stays under 20 microseconds. Memory stays under 64 MiB. | Planned: `crates/eg-document/tests/transcript_sources.rs::ingest_bench_within_budget`.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R650
Baseline hydration, delta manifests and big-repository planning (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Baseline hydration, delta manifests and big-repository planning (rollup).** After the first start, EG hydrates an empty store from the configured prompt library, skill library and workspace repositories. A durable delta manifest lets it skip unchanged content. It splits very large repositories into parallel structural work items. It classifies non-source files and tracks coverage of expected sources. The Rust home is `crates/eg-durable/src/hydration.rs`. Satisfied only when children `EG-REPO-INGEST-R650.1`-`EG-REPO-INGEST-R650.6` are satisfied. | See each child.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R650.1
Model
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model.** Add `BaselinePlan`, `DeltaManifest{(graph,category,uri)->content_hash}`, `RepoSplitPlan`, `FileClass`, `CoverageReport`, `StagedStage{Fetch,Parse,Enrich,Write,Reason}` in `crates/eg-durable/src/hydration.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R650.2
Behavior
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior.** Plan baseline work items with a cap per scope. Split by directory weight to balance work in O(files). Classify files by extension and magic bytes. Commit the manifest in the same transaction as the content, so a crash neither loses nor repeats work. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R650.3
Wiring
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring.** Scheduled by `eg-jobs` at engine boot; results land through SourceIngest per `EG-REPO-INGEST-R002`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R650.4
Refusal
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal.** EG refuses a scope over the cap. It refuses a manifest write without its content commit. It refuses a plan for an unreachable source. Each refusal has a stable code. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R650.5
Evidence
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence.** Record plan digest, split weights, skipped and changed counts and coverage per source class. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R650.6
Hot-path proof
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof.** Benchmark `baseline_plan_and_delta` (50k files, 5% changed): p50 10 ms, p99 60 ms, peak memory 48 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-durable baseline_plan_and_delta` against the stored baseline.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R651
External graph, event and package ingestion adapters (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**External graph, event and package ingestion adapters (rollup).** EG ingests registered external property graphs and GraphQL document sources through discovery and mapping proposals. It maps change-data-capture envelopes. It projects object-centric event logs and their exchange format. It extracts research references. It harvests skills and prompts exposed by fleet children and classifies skills. It auto-extends the graph when a package is installed. The Rust home is `crates/eg-durable/src/adapters.rs`. Satisfied only when children `EG-REPO-INGEST-R651.1`-`EG-REPO-INGEST-R651.6` are satisfied. | See each child.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R651.1
Model
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model.** Add `ExternalGraphProfile`, `MappingProposal`, `CdcEnvelopeMap`, `EventLogProjection`, `OcelDocument`, `ReferenceLink`, `HarvestedSkill`, `PackageInstallEvent` in `crates/eg-durable/src/adapters.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R651.2
Behavior
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior.** Discover a source schema with a bounded read-only probe. Propose a mapping that the owner approves. Map CDC envelopes to ChangeEnvelope one to one. Project events to case traces in O(events). Derive directly-follows and object states incrementally. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R651.3
Wiring
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring.** Each adapter produces ChangeEnvelope batches into SourceIngest; durable configuration holds only references to credentials. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R651.4
Refusal
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal.** EG refuses a discovery probe past its row or time cap. It refuses a mapping applied without approval. It refuses an envelope with an unknown source. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R651.5
Evidence
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence.** Record probe bounds, proposal digest, envelope-to-fact counts and projection hashes. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R651.6
Hot-path proof
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof.** Benchmark `cdc_envelope_map_batch` (10k envelopes): p50 1.5 ms, p99 9 ms, peak memory 24 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-durable cdc_envelope_map_batch` against the stored baseline.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R652
Document chunking, section trees and processed-document records (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Document chunking, section trees and processed-document records (rollup).** EG turns a document into chunks with stable spans, a verified section tree, extracted links and a processed-document record. Retrieval can then address any passage. The Rust home is `crates/eg-document/src/processing.rs`. Satisfied only when children `EG-REPO-INGEST-R652.1`-`EG-REPO-INGEST-R652.6` are satisfied. | See each child.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R652.1
Model
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model.** Add `ChunkingConfig`, `ChunkSpan`, `SectionNode`, `ProcessedDocument`, `SectionTreeCheck` in `crates/eg-document/src/processing.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R652.2
Behavior
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior.** Chunk with sentence-aware windows and overlap in O(n). Build the section tree from headings or page structure. Confirm that spans nest and cover the text. Extract links with their anchors. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R652.3
Wiring
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring.** Called by SourceIngest document path; the tree feeds `EG-FEDERATED-QUERY-R653`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R652.4
Refusal
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal.** EG refuses a document over the size ceiling. It refuses a tree that breaks the nesting rule. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R652.5
Evidence
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence.** Record chunk count, span coverage and tree verification result. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R652.6
Hot-path proof
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof.** Benchmark `document_chunk_tree` (1 MiB markdown): p50 3 ms, p99 15 ms, peak memory 2x document size. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-document document_chunk_tree` against the stored baseline.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R002.650
Model: Hot-path contract for the migrated ingestion capabilities
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model: Hot-path contract for the migrated ingestion capabilities.** Pin the Rust types for the capabilities R002 names. They are `ChangeEnvelope` and `EnvelopeReceipt` (`eg-durable`), `EvidenceArtifact`/`Fragment` with a stable fragment address (content digest plus span), `SemanticEvent` with object-centric, temporal and proposal variants, `EmbeddingAdmission{class,verdict}`, `GpuSlotLease`, `PromotionRequest`/`PromotionVerdict`, `Supersession`, `DeadLetterItem`, `HydrationManifest` (signed) and `GovernedDocumentationProjection`. Every type is serde-stable and covered by the contract digest. | A contract test lists each type in `contract/methods.json` and fails if a field changes without a digest bump.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R002.651
Behavior: Hot-path contract for the migrated ingestion capabilities
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior: Hot-path contract for the migrated ingestion capabilities.** Commit an envelope atomically in one redb transaction in O(records), with idempotent replay by envelope ID. Classify embedding admission deterministically from content class. Arbitrate GPU slots with a fenced single-holder lease. Advance a claim promotion only through the validator. Write a supersession edge in the same transaction. Park a failing item in the dead-letter table and drain it by explicit request. Mine process conformance as token-replay fitness on the directly-follows footprint. | Property tests replay each envelope twice and assert identical state. A conformance test asserts fitness 1.0 for a conforming trace. It asserts fitness below 1.0 for a deviating one.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R002.652
Wiring: Hot-path contract for the migrated ingestion capabilities
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring: Hot-path contract for the migrated ingestion capabilities.** SourceIngest handlers in `src/server` serve every capability. The process-mining projections read the committed events. The OCEL exchange imports and exports the same store. It is never a second event store. | A wiring test shows a served handler calls each capability. It also shows that the OCEL round trip preserves object and event counts.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R002.653
Refusal: Hot-path contract for the migrated ingestion capabilities
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal: Hot-path contract for the migrated ingestion capabilities.** Refuse an envelope with no source identity. Refuse a promotion without validator evidence. Refuse a supersession of an unknown fact. Refuse a lease request while a live lease exists. Refuse a manifest whose signature does not verify. Each refusal has a stable code and mutates nothing. | A refusal test per case asserts the code and that the store digest is unchanged.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R002.654
Evidence: Hot-path contract for the migrated ingestion capabilities
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence: Hot-path contract for the migrated ingestion capabilities.** Record envelope ID, record count and receipt digest. Record admission verdict inputs and lease epoch. Record promotion verdict inputs, supersession pair, dead-letter reason and manifest digest. | A served-path test reads each record back through a separately authorized query.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R002.655
Hot-path proof: Hot-path contract for the migrated ingestion capabilities
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof: Hot-path contract for the migrated ingestion capabilities.** Benchmark `change_envelope_commit` at p50 1 ms and p99 6 ms for 1000 records. Peak memory stays under 24 MiB with 8 concurrent writers. Benchmark `dead_letter_drain` at p99 2 ms. The CI bench gate fails on a 10% regression. | `cargo bench -p eg-durable change_envelope_commit` against the stored baseline.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R700
Periodic code-health sweep finds dead pathways (rollup)
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Periodic code-health sweep finds dead pathways (rollup).** A bounded, model-free sweep runs over indexed repositories. It reports unreachable symbols and dead pathways from the code graph. It files them as findings on a schedule. Implemented in eg-repo-index. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R700.1
Model
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Model.** `CodeHealthFinding { repo, symbol, kind, evidence }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R700.2
Behavior
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Behavior.** Reachability is a graph traversal from declared entry points, O(symbols + references), bounded by a per-repo time budget. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R700.3
Wiring
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Wiring.** Runs from the indexing pipeline after a branch-aware index (typed-packs R069). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R700.4
Refusal
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Refusal.** A repository without declared entry points reports `unknown`, never `dead`. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R700.5
Evidence
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Evidence.** Each finding lists the entry points that were tried. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-REPO-INGEST-R700.6
Hot-path proof
Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/repo_index/test_code_health_served.py::test_no_entry_points_reports_unknown` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/code_health.rs` must show p50 under 30 ms and p99 under 200 ms with peak memory under 128 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-REPO-INGESTSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH
EG-SRC-AUTH — Source authority: the ontology says which connected source answers a concept
specNoneSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R001
Authority vocabulary (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Authority vocabulary (rollup).** A `vg:SourceAuthority` row states source, concept, optional facet, rank, scope, freshness, contract kind and materialisation policy. LANDED only when every child is. | Every child is LANDED.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R001.1
Add class `vg:SourceAuthority` with `vg:authoritativeSource`, `vg:authorityFor`, `vg:authorityRank`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Add class `vg:SourceAuthority` with `vg:authoritativeSource`, `vg:authorityFor`, `vg:authorityRank`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. Names match `EG-CQ-XSRC-R001.1`. | Test `the_authority_terms_are_in_the_core_vocabulary` in `src/server/graph_schema/virtual_graph_tests.rs` loads the core source and finds the class and three properties.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R001.2
Add `vg:authorityFacet` and `vg:authorityMapping`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Add `vg:authorityFacet` and `vg:authorityMapping`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_authority_facet_and_mapping_terms_exist`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R001.3
Add `vg:scopeTenant`, `vg:scopePartition`, `vg:freshnessMaxAgeSeconds`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Add `vg:scopeTenant`, `vg:scopePartition`, `vg:freshnessMaxAgeSeconds`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_authority_scope_and_freshness_terms_exist`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R001.4
Add `vg:authorityContract` and `vg:allowFallback`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Add `vg:authorityContract` and `vg:allowFallback`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_authority_contract_and_fallback_terms_exist`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R001.5
Add `vg:materialisation` and `vg:materialisationReason`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Add `vg:materialisation` and `vg:materialisationReason`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_materialisation_terms_exist`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R001.6
Add `vg:foreignSourceName` on `vg:SourceConnection`; widen the domain of `vg:approved` to `vg:SourceAuthority`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Add `vg:foreignSourceName` on `vg:SourceConnection`; widen the domain of `vg:approved` to `vg:SourceAuthority`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_foreign_source_name_and_widened_approved_exist`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R002
Authority shapes (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Authority shapes (rollup).** SHACL refuses malformed and contradictory rows. | Every child is LANDED.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R002.1
Shape: required cardinalities and node kinds
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Shape: required cardinalities and node kinds** (source, concept, mapping exactly one; rank positive integer; contract in the five values). Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixture test in `src/server/graph_schema/virtual_graph_tests.rs`: a valid row passes; one fixture per missing property fails with its message.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R002.2
Shape: mapping belongs to the named source and maps the named class
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Shape: mapping belongs to the named source and maps the named class.** Two `sh:sparql` constraints (`OPTIONAL ... FILTER(!BOUND)`). Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixtures: mapping from another source fails; mapping of another class fails.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R002.3
Shape: a facet must be projected by the mapping
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Shape: a facet must be projected by the mapping.** Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixture: facet absent from the mapping's predicate-field pairs fails.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R002.4
Shape: contract kind agrees with the connection's source kind
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Shape: contract kind agrees with the connection's source kind.** Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixture: `api` row on an `mcp` connection fails; `virtual-graph` on `sql` passes.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R002.5
Shape: accelerated materialisation needs reason, freshness bound and connection capability `copy`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Shape: accelerated materialisation needs reason, freshness bound and connection capability `copy`.** Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixtures: missing reason, missing freshness, missing `copy` each fail; `virtual` with none passes.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R002.6
Shape: equal-rank claims by different sources on one (class, facet, scope) are refused inside one graph
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Shape: equal-rank claims by different sources on one (class, facet, scope) are refused inside one graph.** Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixture: two sources, same rank, fails; different ranks passes.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R003
Who may assert authority (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Who may assert authority (rollup).** Operator approval only; connectors propose. Reuses the governed two-person change and `AttachApproved`. | Every child is LANDED.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R003.1
Declare kind `governed.source-authority` with approver scope `governance:approve-source-authority` in `GOVERNED_KINDS`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Declare kind `governed.source-authority` with approver scope `governance:approve-source-authority` in `GOVERNED_KINDS`.** Touches `crates/eg-types/src/governed_change.rs`. Depends on the generated scope registry (`EG-IDENTITY-R004`, owner epistemic-graph identity). | Unit test `source_authority_kind_has_exact_scopes` asserts `kind_scopes`; scope-registry generation test lists the new scope as class `approver`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R003.2
Attach refuses `vg:approved true` inside a `Pack` or `Ingestion` origin schema source
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Attach refuses `vg:approved true` inside a `Pack` or `Ingestion` origin schema source.** Touches `crates/eg-core/src/graph/schema_sources.rs` (attach validation). | Test attaches a pack source with an approved mapping and an approved authority row. Both refused with a typed code. The same text under `Operator` origin attaches.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R003.3
`AttachApproved` accepts an authority candidate. The approval lease binds its digest
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**`AttachApproved` accepts an authority candidate. The approval lease binds its digest.** Touches `src/server/graph_schema/approved.rs`. Depends on `R003.1`. | Test: approval for digest X attaches X. A changed byte is refused with `ApprovalMismatch`. An approver equal to the proposer is refused.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R003.4
Planner derives effectiveness from origin, not from the flag
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Planner derives effectiveness from origin, not from the flag.** Add `fn row_is_effective(origin, row)` in `crates/eg-rdf/src/source_selection.rs`. Depends on `R003.2`. | Unit test: a row with the flag true under `Pack` origin is not effective; under `Approved` origin it is.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R003.5
Proposed rows are listed, never selected
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Proposed rows are listed, never selected.** Add `not_used` entries with reason `Proposed`. Touches `crates/eg-rdf/src/source_selection.rs`. | Unit test: a proposed rank-1 row beside an approved rank-2 row selects rank 2 and lists the proposal.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R004
Selection reads authority (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Selection reads authority (rollup).** `select_sources` names the winner and alternates per class or facet. Cross-repo join point with `EG-FEDERATED-QUERY-R072`. | Every child is LANDED.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R004.1
Add `AuthorityRow` and `with_authority` to `CoverageFixture`; replace the silent `insert` overwrite by a list per class
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Add `AuthorityRow` and `with_authority` to `CoverageFixture`; replace the silent `insert` overwrite by a list per class.** Touches `crates/eg-rdf/src/source_selection.rs`. Depends on `EG-FEDERATED-QUERY-R072.1`. | Unit test: two mappings on one class are both kept (the old behaviour kept only the last).
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R004.2
`Premise::Authority` with row, source, class, facet, rank, scope, origin, generation
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**`Premise::Authority` with row, source, class, facet, rank, scope, origin, generation.** Touches `crates/eg-rdf/src/source_selection.rs`. | Unit test: a covered class carries the authority premise.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R004.3
`Covered` gains `alternates`; order candidates by rank
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**`Covered` gains `alternates`; order candidates by rank.** Touches `crates/eg-rdf/src/source_selection.rs`. | Two-source fixture: rank 1 chosen, rank 2 listed as alternate.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R004.4
Superclass authority is inherited; a subclass row overrides it
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Superclass authority is inherited; a subclass row overrides it.** Touches `crates/eg-rdf/src/source_selection.rs`. Same rule as `EG-CQ-XSRC-R001.3`. | Fixture: `:Incident` inherits from `:ApplicationEvent`; adding an `:Incident` row overrides.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R004.5
Live read: parse authority rows from the composed graph schema sources
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Live read: parse authority rows from the composed graph schema sources.** Touches `crates/eg-rdf/src/source_selection.rs` and `crates/eg-core/src/graph/schema_sources.rs`. Owner of the join: `federated-query-and-reasoning` (the live ontology search child of `EG-FEDERATED-QUERY-R072`). | Integration test: attach the vocabulary plus two rows as schema sources and `select_sources` returns the same verdicts as the fixture.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R004.6
Build the `ConnectedSources` view from the owner-scoped foreign catalog
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Build the `ConnectedSources` view from the owner-scoped foreign catalog.** Touches `crates/eg-plan/src/federation.rs`. Uses `vg:foreignSourceName` (`R001.6`). | Test: a source registered under another principal is absent from the view (`EG-FEDERATED-QUERY-R013` refusal kept).
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R004.7
Facet-aware selection: a question reading property `p` uses the facet row for `p` before the class row
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Facet-aware selection: a question reading property `p` uses the facet row for `p` before the class row.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture: `:Host` identity from a CMDB, `:Host` `temperature` facet from a hardware connector; each property selects its own source.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R005
Tie-breaking (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Tie-breaking (rollup).** A total, documented order; an unresolvable tie abstains. | Every child is LANDED.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R005.1
Order: facet over class over nearest superclass
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Order: facet over class over nearest superclass.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture covering each pair.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R005.2
Scope specificity: matching tenant and partition beat unscoped
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Scope specificity: matching tenant and partition beat unscoped.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture: tenant-scoped row beats an unscoped lower rank number.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R005.3
Equal everything, different sources: `Abstained::Ambiguous` listing both rows; never choose by name
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Equal everything, different sources: `Abstained::Ambiguous` listing both rows; never choose by name.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture across two schema sources; swapping their names leaves the verdict unchanged.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R005.4
`Premise::Tiebreak { winner, loser, rule }` records the deciding step
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**`Premise::Tiebreak { winner, loser, rule }` records the deciding step.** Touches `crates/eg-rdf/src/source_selection.rs`. | Unit test per rule.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R006
Typed abstention (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Typed abstention (rollup).** An unconnected, unapproved, stale, mismatched or ambiguous authority yields a typed verdict or a declared fallback. | Every child is LANDED.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R006.1
Add `CoverageResult::Abstained { class, facet, reason, source, premises }` and the reason enum `Unconnected | UnapprovedMapping | Stale | ContractMismatch | Ambiguous`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Add `CoverageResult::Abstained { class, facet, reason, source, premises }` and the reason enum `Unconnected | UnapprovedMapping | Stale | ContractMismatch | Ambiguous`.** Touches `crates/eg-rdf/src/source_selection.rs` and its callers. | Unit test builds one verdict per reason.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R006.2
Unconnected rank-1 authority abstains naming source and concept
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Unconnected rank-1 authority abstains naming source and concept.** Touches `crates/eg-rdf/src/source_selection.rs`. Satisfies the `.3` children of `EG-CQ-ORCH-R001` to `R007`. | Test: the authority names a source absent from the catalog; the verdict names both; other classes still report.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R006.3
`allowFallback` tries the next ordered alternate and records `FallbackFrom`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**`allowFallback` tries the next ordered alternate and records `FallbackFrom`.** Touches `crates/eg-rdf/src/source_selection.rs`. | Test: with the flag the rank-2 source answers; without it the verdict abstains.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R006.4
Freshness: a stale copy falls back to live; stale and no live route abstains `Stale`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Freshness: a stale copy falls back to live; stale and no live route abstains `Stale`.** Touches `crates/eg-rdf/src/source_selection.rs`; reads `AccelerationPolicy::resolve_mode` in `crates/eg-types/src/metadata_acceleration.rs`. | Test: watermark older than `freshnessMaxAgeSeconds` gives live mode or `Stale`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R006.5
No authority row: one approved mapping serves with `Premise::Implicit`; several abstain `Ambiguous`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**No authority row: one approved mapping serves with `Premise::Implicit`; several abstain `Ambiguous`.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture for each case.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R007
Audit trail (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Audit trail (rollup).** Every answer carries "sources used and why" from the premises. | Every child is LANDED.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R007.1
Add `AuthorityAudit` and `AuditEntry` types
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Add `AuthorityAudit` and `AuditEntry` types.** Touches `crates/eg-types/src/authority_audit.rs` (new) and registers it in the contract schema. | Serde round-trip test and contract-schema snapshot.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R007.2
Build the audit from verdicts and premises only
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Build the audit from verdicts and premises only.** Add `fn audit_from(verdicts)` in `crates/eg-rdf/src/source_selection.rs`. | Test: the audit entries equal the premises of the verdicts, none added.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R007.3
Audit lists `not_used` rows with reason (including `Proposed`)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Audit lists `not_used` rows with reason (including `Proposed`).** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture with a proposed row and a stale row.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R007.4
Wire the audit into the cross-source report's `sources_used`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Wire the audit into the cross-source report's `sources_used`.** Touches `crates/eg-types/src/supply_chain_report.rs` (owner `EG-CQ-XSRC-R006.1`). Depends on `R007.1` and `EG-CQ-XSRC-R006.1`. | Report test: `sources_used` equals the audit entries.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R007.5
Print the block in the served intent tool
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Print the block in the served intent tool.** Owning repository: graph-os. Depends on `R007.1`. | graph-os test asserts the block is present in the tool result.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R008
Materialisation policy (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Materialisation policy (rollup).** Virtual by default; a copy needs a reason. | Every child is LANDED.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R008.1
Selection reports `mode: live` for a `virtual` row and refuses a copy route for it
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Selection reports `mode: live` for a `virtual` row and refuses a copy route for it.** Touches `crates/eg-rdf/src/source_selection.rs`. | Test: a virtual row never resolves to a copy mode.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R008.2
An `accelerated` row resolves through `AccelerationPolicy` and carries its reason into the audit
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**An `accelerated` row resolves through `AccelerationPolicy` and carries its reason into the audit.** Touches `crates/eg-rdf/src/source_selection.rs`. | Test: the audit entry shows mode `accelerated` and the stored reason.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R009
Consumers and acceptance (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Consumers and acceptance (rollup).** The competency specs state their authority rows against this vocabulary. | Every child is LANDED.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R009.1
Fixture: ServiceNow rank 1 and PagerDuty rank 2 for `:Incident`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Fixture: ServiceNow rank 1 and PagerDuty rank 2 for `:Incident`.** Files: `crates/eg-rdf/tests/source_authority_fixture.rs`. | Fixture parses, passes the shapes, selects rank 1.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R009.2
Decisive test: swapping two ranks changes `sources_used` with equal query text
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Decisive test: swapping two ranks changes `sources_used` with equal query text.** Same file. Satisfies `EG-CQ-XSRC-R007.4`. | The test asserts both audits and equal query text.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R009.3
Re-point `EG-CQ-XSRC-R001.1` and `R001.2` to this spec and mark them delivered by `R001.*` and `R002.*`
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Re-point `EG-CQ-XSRC-R001.1` and `R001.2` to this spec and mark them delivered by `R001.*` and `R002.*`.** Touches `specs/cross-source-competency/requirements.md` and `tasks.md` (coordinate with that spec's owner). | `spec-decomposition` hook prints clean; no term is defined in two specs.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R010
Source trust role and live-truth preference (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Source trust role and live-truth preference (rollup).** The platform tracks one trust role per data source: `live_truth`, `historical_context` or `inspiration`. When sources conflict on one concept, source selection must prefer live truth. Children `.1` to `.6` deliver it. | See each child.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R010.1
Model
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Model.** Add `vg:sourceRole` on `vg:SourceConnection` in `crates/eg-core/ontology/virtual_graph-v1.ttl`, with closed values `live_truth`, `historical_context` and `inspiration`. Add `SourceRole` in `crates/eg-rdf/src/source_selection.rs`. The authority rank at `source_selection.rs:172` (`select_sources`) orders sources but does not grade their trust. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::source_role_round_trips`. | The vocabulary test finds the term. A serde round trip rejects an unknown role.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R010.2
Behavior
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Behavior.** Add `role_order` in `source_selection.rs`. The default order is `live_truth`, then `historical_context`, then `inspiration`. It is a named replaceable default. On a conflict for one class, facet and scope, the higher role wins before rank applies. `EG-SRC-AUTH-R005.1` documents the later tie-break steps. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::live_truth_beats_historical_on_conflict`. | Two sources with different roles select the live-truth source whatever their rank.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R010.3
Wiring
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Wiring.** `role_order` attaches in `select_sources` at `crates/eg-rdf/src/source_selection.rs:172`. No production caller of `select_sources` exists today; every call is in its own tests. This row creates the call site in `crates/eg-plan/src/federation.rs`, where `EG-SRC-AUTH-R004.6` builds the `ConnectedSources` view for the served federated query. Proving test: `crates/eg-plan/src/federation.rs::tests::plan_applies_source_role`. | The federated plan builder calls `select_sources` with roles loaded from the schema sources.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R010.4
Refusal
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Refusal.** A question that needs current state must not be answered from an `inspiration` source. Selection must return `Abstained` with reason `RoleInsufficient` naming the class and the source. This extends the reason enum of `EG-SRC-AUTH-R006.1`. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::inspiration_only_abstains_role_insufficient`. | The verdict names class and source and no answer is produced.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R010.5
Evidence
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Evidence.** Add `Premise::Role{source, role, preferred_over}` beside `Premise` at `crates/eg-rdf/src/source_selection.rs:26`. The audit of `EG-SRC-AUTH-R007` must list the preferred and the displaced source with their roles. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::role_premise_names_both_sources`. | The audit entry names both roles and the rule that decided.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R010.6
Hot-path proof
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Hot-path proof.** The entry point is the served cross-source report operation. The test attaches two sources that conflict on one concept: one `live_truth`, one `historical_context`. The test passes through the wired call site in `federation.rs`. It observes that `sources_used` names the live source and lists the other as displaced. Proving test: `tests/federated/test_source_role_served.py::test_live_truth_wins_conflict`. | The report names the live source and the displaced one.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R011
Untrusted taint mark on content that enters a run (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Untrusted taint mark on content that enters a run (rollup).** EG marks content that enters a run as untrusted and stores the mark as a fact. The harness carries the mark with the content. Children `.1` to `.6` deliver it. | See each child.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R011.1
Model
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Model.** Add `vg:trustMark` on content nodes in `crates/eg-core/ontology/virtual_graph-v1.ttl`, with closed values `trusted` and `untrusted`. Add `TrustMark` in `crates/eg-rdf/src/source_selection.rs` beside `SourceRole` of `EG-SRC-AUTH-R010.1`. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::trust_mark_round_trips`. | A serde round trip rejects an unknown mark. The vocabulary test finds the term.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R011.2
Behavior
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Behavior.** Add `mark_for_origin(origin, role) -> TrustMark`. The default marks content from a tool result, a retrieved document or an upload as `untrusted`. Content from a `live_truth` source with an approved mapping is `trusted`. Derived content is `untrusted` when any input is `untrusted`. Each rule is a named replaceable default. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::derived_content_inherits_untrusted`. | A derived node with one untrusted input is untrusted.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R011.3
Wiring
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Wiring.** `mark_for_origin` attaches in `select_sources` at `crates/eg-rdf/src/source_selection.rs:172` for source content, and in the `AddNode` arm at `src/server/handlers/graph_ops/gateway_graph.rs:62` for content written by a run. No production caller of `select_sources` exists today, and `EG-SRC-AUTH-R010.3` creates that call site. This row adds the `AddNode` call. Proving test: `src/server/handlers/graph_ops/gateway_graph.rs::tests::add_node_stamps_trust_mark`. | A node written from a tool result reads back as untrusted.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R011.4
Refusal
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Refusal.** A write that lowers a mark from `untrusted` to `trusted` must be refused with `TRUST_MARK_DOWNGRADE_REFUSED` unless it carries an operator approval identifier. The refusal names the node and the missing approval. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::downgrade_without_approval_refused`. | The mark stays untrusted and the code names the node.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R011.5
Evidence
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Evidence.** Each stored mark must carry `:markedBy` (the rule name) and `:markedAtGeneration`. A read of the content must return the mark with it. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::mark_carries_rule_and_generation`. | The read shows the rule name and the generation.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R011.6
Hot-path proof
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Hot-path proof.** The entry point is the served graph write operation, the `AddNode` wire method. The test writes a node from a tool result, reads it back, then tries a downgrade. The call passes through `src/server/handlers/graph_ops/gateway_graph.rs:62`. It observes `untrusted` on the read and the typed refusal. Proving test: `tests/federated/test_trust_mark_served.py::test_tool_result_is_untrusted_and_sticky`. | The read shows untrusted and the downgrade is refused.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R800
Concept id allocation, lineage and relational authority registry (rollup)
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Concept id allocation, lineage and relational authority registry (rollup).** `crates/eg-core` allocates hierarchical concept ids. It records lineage between superseded and successor concepts. It holds the relational-authority table that names the sole writer of each domain term. This extends R094, so every repository consumes one allocator. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R800.1
Model
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Model.** `ConceptId{path:[u32;D]}`, `Reservation{id, owner, expires}` and `AuthorityEntry{term, owner_repo}` in `crates/eg-types/src/concept.rs`. | Planned: `crates/eg-core/tests/concept_registry.rs::out_of_range_id_is_refused`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R800.2
Behavior
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Behavior.** Allocation is a compare-and-set on the parent's next-child counter, O(depth). Lineage is a DAG with cycle detection in O(edges touched). Authority lookup is a hash probe. | Planned: `crates/eg-core/tests/concept_registry.rs::expired_reservation_is_refused`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R800.3
Wiring
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Wiring.** The allocator is a served method behind an admin scope. The authority gates described in this spec read the registry. | Planned: `crates/eg-core/tests/concept_registry.rs::lineage_cycle_is_refused`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R800.4
Refusal
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Refusal.** The engine refuses four inputs. The first is an id outside the parent's range. The second is a reservation past expiry. The third is a lineage edge that creates a cycle. The fourth is a second owner for a term. The refusal names the existing owner. | Planned: `crates/eg-core/tests/concept_registry.rs::second_owner_is_refused`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R800.5
Evidence
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Evidence.** Evidence is the allocation audit line and a reproducible dump of the registry digest. | Planned: `crates/eg-core/tests/concept_registry.rs::registry_digest_is_reproducible`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SRC-AUTH-R800.6
Hot-path proof
Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source
**Hot-path proof.** Hot-path proof: a Criterion benchmark allocates 100000 ids under 8 concurrent writers. The p50 stays under 20 microseconds. The p99 stays under 200 microseconds. No id repeats. | Planned: `crates/eg-core/tests/concept_registry.rs::concurrent_allocation_bench_has_no_duplicates`.
requirementEG-SRC-AUTHSPECIFIEDNo recorded commit/test evidence
EG-SCM
EG-SCM — Source changesets as the source of truth
specNoneSPECIFIEDNo recorded commit/test evidence
EG-SCM-R001
Content-addressed blob store
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Content-addressed blob store.** Model: each file version is a sealed blob record. The record is keyed by its SHA-256 digest. Identical bytes store once. The blob is compressed. A read takes a digest and returns the bytes. Behavior: a second write of the same bytes returns the same digest. It adds no new storage. A changeset path points to a blob by digest only. Wiring: compose the existing content-addressed chunk store (`src/server/blob/store.rs`) and its bounded streaming facade (`src/server/blob/stream.rs`). Reuse the sealed create-only record guard of EG-DURABLE-KERNEL-R057. Refusal: the store refuses an overwrite of an existing digest. It refuses an unreadable digest with a typed error. Evidence: identical bytes return one digest. A digest readback equals the original bytes. | `tests/test_scm_blob.py::test_blob_stored_once_and_read_by_digest` stores two identical versions. It reads the blob back by digest.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R002
Changeset record
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Changeset record.** Model: a changeset is `Changeset{id, repo, parents, author_principal, message, changed_paths, created_at, gate_verdicts}`. `changed_paths` is a list of `{path, op, old_blob, new_blob, mode}`. The op is add, modify, delete, or rename. The record stores only the paths that changed against the first parent. It costs O(change), never O(repository). Behavior: an append to a branch chain adds one record. A changeset with a parent names the parent head. The append is atomic with the branch head advance. Wiring: add the record type to `crates/eg-types` as `source_changeset.rs`. Append through the branch commit path of EG-BRANCH-MERGE-R002. Refusal: the engine refuses a changeset with an empty path list. It refuses a parent not on the target branch chain. It refuses a digest the blob store cannot read. Every refusal leaves the chain unchanged. Evidence: a two-path changeset stores exactly two path entries. The chain readback returns the record unchanged. | `tests/test_scm_changeset.py::test_changeset_stores_only_changed_paths` writes a three-file repository state. It changes two files. It asserts one changeset with two path entries.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R002.1
Structured trailers on a changeset
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Structured trailers on a changeset.** The changeset record must carry `trailers{spec_ids, fixes, withdraw, withdraw_reason}` as typed fields in `crates/eg-types/src/source_changeset.rs`. The git import of R010 parses the `Spec:`, `Fixes:` and `Spec-Withdraw:` trailers into these fields. The git export writes them back unchanged. EG-SDLC-R001 and EG-SDLC-R005 read these fields. | `tests/test_scm_changeset.py::test_trailers_round_trip_through_git` imports a commit with three trailer kinds and exports it with an identical commit id.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R003
Lock-free acceptance
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Lock-free acceptance.** Model: concurrent changesets on one branch are judged by their path sets. Disjoint path sets are accepted in parallel. Overlapping path sets trigger a server-side decision. Behavior: two writers on disjoint paths both land. No global lock gates either write. On overlap, the server rebases the late changeset on the new head. The rebase uses a file-level three-way merge at line granularity. It reuses the merge pass of EG-BRANCH-MERGE-R004. A clean rebase lands as the new head. An unclean overlap is refused with the stable `SOURCE_CONFLICT{paths}` code. The refusal lists every conflicting path. Wiring: compose the version-checked write path of EG-DURABLE-KERNEL-R084. Reuse the branch chain append of EG-BRANCH-MERGE-R002. Refusal: the engine refuses a changeset whose base left the branch chain. The refusal names the stale base. It never rebases silently. Evidence: two disjoint writers both land. Two overlapping writers land one and conflict the other. | `tests/test_scm_accept.py::test_disjoint_writers_land_and_overlap_rebases_or_conflicts` drives two concurrent writers on disjoint paths. It drives two on one shared path. It asserts one landing plus one typed conflict.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R004
Tree materialization by query
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Tree materialization by query.** Model: a tree is `Tree(repo, rev, prefix, depth)`. It returns entries of `{path, blob_digest, mode}`. The tree is computed from the changeset chain. Periodic snapshot checkpoints bound the replay length. Behavior: a subtree read at any revision returns the entries at that revision. The read costs O(subtree), never O(history). A prefix read returns only that prefix. A depth bound limits the walk. Wiring: add the tree query to `crates/eg-compute` as `source_tree.rs`. Reuse the snapshot checkpoint path of EG-DURABLE-KERNEL-R023. Refusal: the engine refuses a revision not on the repository chain. It refuses a cross-tenant tree read. Both refusals are typed. Evidence: a tree read at revision N equals the full replay of changesets up to N. The checkpoint path returns the same entries. | `tests/test_scm_tree.py::test_tree_at_revision_matches_full_replay` builds a ten-revision chain. It reads a subtree at each revision. It asserts equality against a full replay.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R005
Derived history indexes
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Derived history indexes.** Model: four derived indexes serve history. Path history lists the changesets that touched a path. Blame maps each line to its last changeset. Ancestry skip lists accelerate merge-base and ancestor queries. Change coupling pairs files that change together. Behavior: each index updates incrementally as changesets land. A revision replay appends and never rewrites. Every index carries a version and a rebuild recipe. A rebuild from the changeset chain reproduces the index byte-for-byte. Wiring: add `crates/eg-compute/src/source_history.rs`. Reuse the incremental derived-series machinery of EG-REPO-INGEST-R004. Reuse the commit and change-coupling graph of EG-REPO-INGEST-R601. Refusal: the engine refuses an index read at a version past the index head. It refuses a cross-tenant history read. Evidence: incremental index state equals a from-scratch rebuild. A rebuild after corruption restores identical entries. | `tests/test_scm_history.py::test_incremental_indexes_equal_rebuild` applies a changeset sequence incrementally. It rebuilds the same indexes from scratch. It asserts byte-identical output.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R006
Code graph stays live with changesets
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Code graph stays live with changesets.** Model: an accepted changeset is an input to the code graph. Only structurally changed files re-enter the pipeline. Behavior: the engine re-parses each structurally changed file. It updates fingerprints per EG-REPO-INGEST-R603. It updates symbols and tests per EG-REPO-INGEST-R600. It recomputes Leiden communities per EG-REPO-INGEST-R011. The community pass runs on the affected subgraph only. `code_context` and UQL answer from the new state as soon as the changeset lands. Wiring: attach to the incremental indexing boundary of EG-REPO-INGEST-R006.4. Reuse the existing enrichment and community-detector callers. Refusal: the engine refuses an indexing job whose base revision does not match. It follows the existing incremental-index refusal. Evidence: a one-file change updates only that file symbols. A structural no-op change updates nothing. | `tests/test_scm_code_graph.py::test_one_file_change_updates_only_its_symbols` lands a one-file changeset. It asserts the symbol graph updates for that file only.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R007
Path-scoped access control
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Path-scoped access control.** Model: a permission binds a path prefix, a principal, and a tenant. The permission carries separate read and write bits. Behavior: a read resolves the most specific prefix grant. A write requires a write grant on the path. The grant applies to tree, blob, changeset, and derived-index reads alike. Wiring: extend the universal read-RLS gate of EG-DURABLE-KERNEL-R029 with a path-prefix predicate. Reuse the existing tenant and principal resolution. Refusal: the engine refuses a read under a prefix with no read grant. It refuses a write with no write grant. It refuses a grant on a path outside the tenant scope. Evidence: a prefix grant filters reads to the prefix. A write outside the prefix is refused with a typed code. | `tests/test_scm_path_access.py::test_prefix_grant_filters_reads_and_refuses_writes` grants a prefix to one principal. It reads inside and outside the prefix. It attempts a write outside the prefix.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R008
Gate verdicts are records
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Gate verdicts are records.** Model: a gate run records a verdict against a changeset. The record is `GateVerdict{changeset, gate_id, input_digest, verdict, evidence_digest, duration}`. The input digest binds the exact tree the gate read. Behavior: a landing policy reads the verdicts before it lands a changeset. A failed verdict blocks the landing. A verdict is sealed once written. Wiring: reuse the typed verdict model of EG-DURABLE-KERNEL-R089.1. Store the verdict under the sealed create-only guard of EG-DURABLE-KERNEL-R057. Refusal: the engine refuses a verdict whose input digest does not match the changeset tree. It refuses an overwrite of a sealed verdict. Evidence: verdict records read back byte-identically. A mismatched digest is refused. | `tests/test_scm_gate_verdict.py::test_verdict_records_are_sealed_and_read_back` records a pass verdict and a fail verdict. It reads both back. It attempts an overwrite and asserts the refusal.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R009
Bisect and revert decisions
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Bisect and revert decisions.** Model: a failed post-landing gate opens a bisect. The bisect walks the changeset chain from the failure back to the last good verdict. It uses recorded verdicts and on-demand gate runs. Behavior: the bisect identifies the culprit changeset. The engine then records a decision. The decision is a changeset revert or a fix-forward task. The decision record carries the evidence that produced it. Wiring: reuse the deterministic replay of committed decision records (EG-DECISION-ENGINE-R007). Store the decision with the existing decision-record authority. Refusal: the engine refuses a bisect whose chain lacks verdict coverage. It refuses a revert that later changesets depend on. Evidence: a bisect over a seeded chain names the seeded culprit. The recorded decision replays byte-identically. | `tests/test_scm_bisect.py::test_bisect_finds_culprit_and_replays_decision` seeds a failing change mid-chain. It bisects. It replays the recorded decision.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R010
Git import and export fidelity
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Git import and export fidelity.** Model: a changeset maps one-to-one to a git commit. The export re-creates the commit with the same tree hash. An external git commit imports as a changeset. Behavior: an export of the full chain produces a git history. The history matches the changeset order and messages. A git import of that history reproduces the changeset chain. The round trip is lossless on commit ids and tree ids. Wiring: add `crates/eg-compute/src/source_git_objects.rs`. It builds git objects from the tree entries. Refusal: the engine refuses an export whose tree read fails mid-stream. It refuses an import whose commit graph is malformed. Evidence: export then import preserves every commit id and tree id. | `tests/test_scm_git_round_trip.py::test_export_import_preserves_commit_and_tree_ids` exports a chain of twenty changesets. It imports the archive. It asserts identical commit and tree ids.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R011
Simulation harness
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Simulation harness.** Model: a hermetic simulation drives the accept path under stress. The simulation owns its clock and its failure injection. Behavior: the harness simulates concurrent writers with overlapping paths. It simulates a server rebase on a dirty base. It simulates a crash mid-accept and a full replay. It simulates export round trips at random intervals. It fuzzes changeset sequences against the same invariants. Wiring: add `tests/simulation/source_changesets.rs`. Drive the real accept, rebase, and tree paths. Refusal: the harness refuses a fuzz seed that fails to seed. A refused seed records no state. Evidence: every invariant holds across the full simulation matrix. A seeded regression fails the harness. | `tests/simulation/source_changesets.rs::simulate_concurrent_accept_crash_and_replay` drives concurrent accepts with crash and replay. It asserts chain invariants after every step.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R012
Agent-only principals and run provenance
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Agent-only principals and run provenance.** Model: an agent principal binds to a run. The binding is the RunTrace id of the run that produced the changeset. The changeset also records the agent identity. Behavior: an agent changeset carries both ids on acceptance. A human principal may omit the run trace id. The record is queryable by run, by agent, and by changeset. Wiring: attach to the changeset accept path of EG-SCM-R002. Reuse the RunTrace record authority already served by the engine. Refusal: the engine refuses an agent changeset with no run trace id. The refusal is typed. Evidence: an agent changeset reads back with its run trace id. A principal without a run id is refused. | `tests/test_scm_provenance.py::test_changeset_links_to_run_trace` submits an agent changeset with a run trace id. It reads the binding back. It submits one without and asserts the refusal.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R013
Graph-native code edits (rollup)
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Graph-native code edits (rollup).** An agent must edit code as graph entities. It names a symbol and the new text. The engine projects the edit to file bytes and one changeset. A re-parse must confirm the round trip before the changeset lands. Children `.1` to `.7` deliver it. | See each child.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R013.1
Model
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Model.** Add `SymbolEdit{repo, branch, base_rev, ops, message, run_trace_id}` in `crates/eg-types/src/source_symbol_edit.rs`. Each op is `{kind, symbol_id, anchor_span_digest, new_text}`. `kind` is a closed set: `replace_symbol`, `replace_body`, `insert_before`, `insert_after`, `delete`. | `crates/eg-types/tests/source_symbol_edit.rs::edit_round_trips_and_kinds_are_closed` round-trips an edit and refuses an unknown kind.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R013.2
Projection
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Projection.** Add `project_symbol_edit` in `crates/eg-compute/src/source_symbol_edit.rs`. It resolves each symbol at `base_rev` to its path, blob digest and byte span. It applies the ops of one file in descending span order. Bytes outside the edited spans stay identical. It writes each new file version through R001 and builds one changeset of R002. | `crates/eg-compute/tests/source_symbol_edit.rs::bytes_outside_spans_are_unchanged` edits one function and compares every other byte.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R013.3
Round-trip check
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Round-trip check.** The engine re-parses each changed file with `parse_file` at `crates/eg-compute/src/parser/tree_sitter.rs:249`. The edited symbol must resolve with its qualified name and kind, unless the op is `delete`. Each untouched symbol must keep its structure hash of EG-REPO-INGEST-R603. An inserted symbol must be present. | `crates/eg-compute/tests/source_symbol_edit.rs::reparse_confirms_edit_and_untouched_symbols` applies each op kind and checks the re-parse.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R013.4
Wiring
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Wiring.** Add the served method `SubmitSymbolEdit` beside `SubmitChangeset`. It calls `project_symbol_edit`, then the R003 accept path. The R006 re-index and the EG-SDLC-R001 derivation run on accept. arbora serves it as `source.edit_symbol` through `ARBORA-OPS-R848.4`. | `tests/test_scm_symbol_edit_served.py::test_symbol_edit_lands_and_reindexes` edits one symbol and reads the new `code_context` answer.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R013.5
Refusal
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Refusal.** A span digest that differs from the symbol at `base_rev` must refuse with `EDIT_BASE_STALE`. Overlapping ops in one file must refuse with `EDIT_OPS_OVERLAP`. A file that fails to re-parse must refuse with `EDIT_UNPARSEABLE`. A round-trip mismatch must refuse with `EDIT_ROUNDTRIP_MISMATCH{path, symbol}`. A refusal lands nothing. | `tests/test_scm_symbol_edit_served.py::test_symbol_edit_refusals` asserts each code and an unchanged branch head.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R013.6
Evidence
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Evidence.** The changeset records the `SymbolEdit` digest. Each op records the old and new span digests and the re-parse verdict. A readback must equal the written record. | `tests/test_scm_symbol_edit_served.py::test_symbol_edit_evidence_reads_back` compares every field.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SCM-R013.7
Hot-path proof
Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `SubmitSymbolEdit`. The benchmark `benches/source_symbol_edit.rs` edits one symbol in a 5,000-line file, including the re-parse. The p99 stays under 30 ms. Peak memory stays under 32 MiB. | `cargo bench --bench source_symbol_edit` fails on a 10 percent regression.
requirementEG-SCMSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB
EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabulary
specNoneSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R001
Physical and commercial supply chain terms (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Physical and commercial supply chain terms (rollup).** Supplier, item, asset and host chain. Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R001.1
Shared supplier and item vocabulary (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Shared supplier and item vocabulary (rollup).** Preserve the original declarations and native entailment acceptance across R001.1.1–R001.1.2. | Every child is LANDED.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R001.1.1
Declare shared supplier and item terms
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Declare shared supplier and item terms.** New `crates/eg-core/ontology/supply_chain-v1.ttl` declares `kg:Supplier rdfs:subClassOf kg:Vendor`, `kg:SupplyChainItem` and `kg:suppliesItem` with supplier domain and item range. Reuse the ERPNext IRIs and do not redeclare `kg:suppliedBy`. | Native production parser loads the exact file. Tests assert class declarations, subclass triples, labels, property domain/range and absence of a `suppliedBy` redeclaration.
requirementEG-SUPPLY-VOCABVERIFIEDee2a3497659c
crates/eg-rdf/tests/supply_chain_declarations.rs:14
crates/eg-rdf/tests/supply_chain_declarations.rs:46
crates/eg-rdf/tests/supply_chain_declarations.rs:64
EG-SUPPLY-VOCAB-R001.1.2
Install shared terms in the core catalog and prove native entailment
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Install shared terms in the core catalog and prove native entailment.** Register `supply_chain-v1.ttl` in `GraphSchemaSources`. Preserve existing catalog and procurement semantics. Depends on R001.1.1. | Actual default catalog loads and validates the file. Native reasoner proves Supplier entails Vendor and suppliesItem domain/range types. A Vendor alone does not entail Supplier.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R001.2
Add `:realizedByAsset` and `:assetHost`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:realizedByAsset` and `:assetHost`.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `kg:realizedByAsset` (item to `kg:AssetInstance`) and `kg:assetHost` (asset to `infra:Host`). Depends on `R001.1`. | Test lists both with domain and range.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R001.3
Add `:suppliesService` with the physical chain axiom
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:suppliesService` with the physical chain axiom.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `kg:suppliesService` (supplier to `infra:Service`) with `infra:serviceRunsOn` (Service to Host, subproperty of infra:runsOn, mapped only from independently typed Service records) and `owl:propertyChainAxiom (suppliesItem realizedByAsset assetHost [inverseOf infra:serviceRunsOn])`. Depends on `R001.2`. | Reasoner fixture infers `suppliesService` from a four-edge service path. A container-only or pod-only runsOn path neither infers suppliesService nor retypes its endpoint as Service.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R001.4
SHACL shapes for supplier and item
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**SHACL shapes for supplier and item.** `crates/eg-core/ontology/supply_chain-v1.shapes.ttl`: `SupplierShape` and `SupplyChainItemShape`, each requiring a label. Depends on `R001.1`. | Fixtures accept valid and refuse nameless supplier and item.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R002
Software supply chain terms (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Software supply chain terms (rollup).** Component, version, image, workload, vulnerability. Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R002.1
Add `:SoftwareComponent`, `:ComponentVersion`, `:versionOf` and `:versionString`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:SoftwareComponent`, `:ComponentVersion`, `:versionOf` and `:versionString`.** `crates/eg-core/ontology/supply_chain-v1.ttl`. | Test lists the terms; a version without `versionOf` is refused by R002.6.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R002.2
Declare `infra:ContainerImage` a `kg:SoftwareComponent`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Declare `infra:ContainerImage` a `kg:SoftwareComponent`.** One `rdfs:subClassOf` triple in `crates/eg-core/ontology/infrastructure-v1.ttl`. Depends on `R002.1`. | Reasoner fixture: an image entails `SoftwareComponent`.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R002.3
Add `:containsComponent` and `:publishedBy`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:containsComponent` and `:publishedBy`.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `containsComponent` (image to version), `publishedBy` (component to `kg:Supplier`). Depends on `R002.1`, `R001.1`. | Test lists both with domain and range.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R002.4
Add `:usesImage` and `:deployedAs`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:usesImage` and `:deployedAs`.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `kg:usesImage` (same IRI as `container.ttl:83`, domain `infra:Container` or `infra:Workload`) and `kg:deployedAs` (`infra:Service` to `infra:Workload`). | Test lists both; IRI equals the container-manager ontology IRI.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R002.5
Add `:usesComponent` with the runtime chain axiom
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:usesComponent` with the runtime chain axiom.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `kg:usesComponent` with `owl:propertyChainAxiom (deployedAs usesImage containsComponent)`. Depends on `R002.3`, `R002.4`. | Reasoner fixture infers `usesComponent` from service, workload, image, version.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R002.6
Add `:Vulnerability` with `:cveId`, `:severity`, `:fixedInVersion`, `:affectsComponent` and `:hasVulnerability`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:Vulnerability` with `:cveId`, `:severity`, `:fixedInVersion`, `:affectsComponent` and `:hasVulnerability`.** `crates/eg-core/ontology/supply_chain-v1.ttl`; `hasVulnerability` keeps the dockerhub IRI. Leave `trm-v1.ttl` `vulnerabilityCount` unchanged. Depends on `R002.1`. | Test lists the terms; `vulnerabilityCount` still present.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R002.7
SHACL shapes for component version, vulnerability and `usesComponent`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**SHACL shapes for component version, vulnerability and `usesComponent`.** `crates/eg-core/ontology/supply_chain-v1.shapes.ttl`: `ComponentVersionShape`, `VulnerabilityShape` (severity `sh:in`), `UsesComponentShape`. Depends on `R002.5`, `R002.6`. | Fixtures refuse versionless component, bad severity, `usesComponent` from a non-service.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003
Commercial and capability terms (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Commercial and capability terms (rollup).** Customer, contract, covered service, affected service, capability link. Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.1
Add `:Customer`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:Customer`.** New `crates/eg-core/ontology/commercial-v1.ttl`: `kg:Customer rdfs:subClassOf kg:Organization, kg:BusinessActor` (same IRI as `erpnext.ttl`). | Test lists the class; `Customer` entails `Organization`.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.2
Add `:CustomerContract`, `:contractCustomer`, `:coversService`, `:contractStatus` and `:contractEnd`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:CustomerContract`, `:contractCustomer`, `:coversService`, `:contractStatus` and `:contractEnd`.** `crates/eg-core/ontology/commercial-v1.ttl`. Depends on `R003.1`. | Test lists the terms with domain and range.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.3
Add `:affectsService`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:affectsService`.** `crates/eg-core/ontology/commercial-v1.ttl`: `kg:affectsService` from `kg:Incident` or `kg:Change` to `infra:Service`. Reuses `kg:Change` (`archimate-v1.ttl:33`); no `:ChangeRequest` is added. | Test asserts no `ChangeRequest` class exists and `affectsService` has the declared domain.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.4
Add `:supportsCapability`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:supportsCapability`.** `crates/eg-core/ontology/commercial-v1.ttl`: `infra:Service` to `kg:BusinessCapability` (decision D1). Do not reuse `kg:supports`. | Test lists the term; a fixture using `kg:supports` is not accepted by the shape in R003.5.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.5
SHACL shapes for contract and capability link
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**SHACL shapes for contract and capability link.** `crates/eg-core/ontology/commercial-v1.shapes.ttl`: `CustomerContractShape` (one customer, at least one covered service) and `SupportsCapabilityShape`. Depends on `R003.2`, `R003.4`. | Fixtures refuse a contract with no customer, no service, and a capability link from a non-service.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.6
Record the amendment to `EG-CQ-XSRC-R008.3.1`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Record the amendment to `EG-CQ-XSRC-R008.3.1`.** Note in `specs/cross-source-competency/plan.md` Decisions that `:ChangeRequest` is replaced by `kg:Change` and `:suppliedBy` by `kg:suppliesItem`. Touches another spec's text, so it lands after both PRs. | `spec-decomposition` clean; the note names this spec.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.7
Declare party links on `kg:Organization` (no `:Party` class)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Declare party links on `kg:Organization` (no `:Party` class).** `kg:Organization` (`core-foundation-v1.ttl:660`) already serves as the super-class, so no `:Party` class is added. `crates/eg-core/ontology/commercial-v1.ttl` must declare `kg:Supplier rdfs:subClassOf kg:Organization` beside `kg:Customer` (R003.1) if `kg:Vendor` does not entail it. Depends on `R003.1`. | Test asserts both `Customer` and `Supplier` entail `Organization` and no `:Party` class exists.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.8
Add `:PurchaseOrder`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:PurchaseOrder`.** `crates/eg-core/ontology/commercial-v1.ttl`: `kg:PurchaseOrder` with `kg:suppliesItem` lines. `R005.3` names it, but `grep -rn PurchaseOrder crates/eg-core/ontology` finds no declaration. | Test lists the class; the grep finds exactly one declaration.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.9
Add `:PurchaseInvoice`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:PurchaseInvoice`.** `crates/eg-core/ontology/commercial-v1.ttl`: `kg:PurchaseInvoice` and `kg:invoiceSupplier` to `kg:Supplier`. Depends on `R003.8`. | Test lists the class and property with domain and range.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.10
Add `:Opportunity`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:Opportunity`.** `crates/eg-core/ontology/commercial-v1.ttl`: `kg:Opportunity` with `kg:opportunityCustomer` to `kg:Customer`. Depends on `R003.1`. | Test lists the class and property with domain and range.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.11
Reuse `:Person` for `:Contact` and declare the link
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Reuse `:Person` for `:Contact` and declare the link.** `:Person` exists (`core-foundation-v1.ttl:671`) and no `:Contact` term exists. `crates/eg-core/ontology/commercial-v1.ttl` must add `kg:contactOf` from `kg:Person` to `kg:Customer` and no `:Contact` class. Depends on `R003.1`. | Test lists `contactOf` with domain and range; no `Contact` class exists.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.12
Add `:lastActivityAt`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `:lastActivityAt`.** `crates/eg-core/ontology/commercial-v1.ttl`: datatype property `kg:lastActivityAt`, domain `kg:Customer`, range `xsd:dateTime`. The shapes file `commercial-v1.shapes.ttl` should refuse a non-dateTime value. Depends on `R003.1`. | Test lists the property; a fixture with a plain string is refused.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.13
Register the commercial module
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Register the commercial module.** Create or reuse `crates/eg-core/ontology/commercial-v1.ttl` with its ontology header, core imports and canonical prefix block. Register `commercial` v1 once in `crates/eg-core/src/graph/schema_sources.rs`; regenerate `catalog-v1.ttl`. Reuse the R003.1 module. Do not create `commerce-v1.ttl`. | `commercial_vocabulary::commercial_module_loads`: Load through CoreSpec; assert module and catalog registration. Reject a missing or duplicate registration.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.14
Register the commercial shapes companion
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Register the commercial shapes companion.** Create or reuse `crates/eg-core/ontology/commercial-v1.shapes.ttl`. Wire its existing CoreSpec shapes field in `crates/eg-core/src/graph/schema_sources.rs`. Preserve R003.5 shapes. Depends on EG-SUPPLY-VOCAB-R003.13. | `commercial_vocabulary::commercial_shapes_load`: Load the registered companion and existing contract/capability shapes. Reject missing registration or overwritten existing shapes.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.15
Preserve canonical commercial namespaces
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Preserve canonical commercial namespaces.** In `crates/eg-core/ontology/commercial-v1.ttl`, use `http://knuckles.team/kg#` and import shared terms. Reuse Supplier, Customer and core classes. Do not add a CommerceFile class or narrow shared suppliedBy/ownedBy domains. Depends on EG-SUPPLY-VOCAB-R003.13. | `commercial_vocabulary::commercial_shared_namespace`: Check exact IRIs; reject duplicate incompatible declarations and accidental domain narrowing. Existing supplier and customer fixtures remain valid.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.16
Declare the Opportunity date property
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Declare the Opportunity date property.** In `crates/eg-core/ontology/commercial-v1.ttl`, declare or reuse `kg:closeDate` with xsd:dateTime range. Do not narrow an existing shared property domain. Depends on EG-SUPPLY-VOCAB-R003.15. | `commercial_vocabulary::commercial_close_date_declared`: Assert canonical property IRI, datatype-property type and dateTime range. Reject an incompatible existing declaration before adding a shape.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R003.17
Restore the Opportunity date constraint
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Restore the Opportunity date constraint.** In `crates/eg-core/ontology/commercial-v1.shapes.ttl`, require kg:closeDate with minCount 1 and xsd:dateTime datatype on kg:Opportunity. Preserve existing shapes and shared property domains. Depends on EG-SUPPLY-VOCAB-R003.10, EG-SUPPLY-VOCAB-R003.14 and EG-SUPPLY-VOCAB-R003.16. | `commercial_vocabulary::commercial_opportunity_date_shape`: Load the registered shape. Accept a valid dated opportunity; reject missing closeDate and an invalid date datatype.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R004
Host limit terms (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Host limit terms (rollup).** Normalized reading and limit rows. Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R004.1
Add `infra:HostLimit`, `:limitOf`, `:limitKind`, `:readingValue`, `:limitValue`, `:limitUnit`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add `infra:HostLimit`, `:limitOf`, `:limitKind`, `:readingValue`, `:limitValue`, `:limitUnit`.** `crates/eg-core/ontology/infrastructure-v1.ttl`. No stored `OverLimit` class. | Test lists the terms; no `OverLimit` class.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R004.2
SHACL shape for `HostLimit`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**SHACL shape for `HostLimit`.** `crates/eg-core/ontology/infrastructure-v1.shapes.ttl` (new if absent): one `limitOf`, one `limitKind` in `{temperature, disk, memory, cpu}`, one reading, one limit. Depends on `R004.1`. | Fixtures refuse a missing limit and an unknown kind.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R004.3
Declared-threshold fixture for capacity limits
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Declared-threshold fixture for capacity limits.** `crates/eg-core/tests/fixtures/host_limit_thresholds.ttl`: declared limits for disk, memory and cpu (decision D6). Depends on `R004.1`. | Fixture passes `HostLimitShape`.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005
Virtual mappings: procurement, commercial, change and capability sources (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Virtual mappings: procurement, commercial, change and capability sources (rollup).** One `vg:VirtualMapping` fixture per source concept. Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005.1
Mapping fixture: erpnext `Supplier` to `kg:Supplier`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: erpnext `Supplier` to `kg:Supplier`.** `crates/eg-core/tests/fixtures/vm_erpnext_supplier.ttl` using access contract `supplierAccess`; key `name`, label field `supplier_name`. | Fixture passes `vg:VirtualMapping` shape; maps the class.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005.2
Mapping fixture: erpnext `Item` and `Purchase Order` to `kg:SupplyChainItem` and `kg:suppliesItem`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: erpnext `Item` and `Purchase Order` to `kg:SupplyChainItem` and `kg:suppliesItem`.** `crates/eg-core/tests/fixtures/vm_erpnext_item_po.ttl`; the PO line items need `get_document` per order (decision D2). | Fixture passes the shape; the lines field is declared as a child fetch.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005.3
Resolve erpnext manifest classes (cross-repo: agent-packages `erpnext-agent`)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Resolve erpnext manifest classes (cross-repo: agent-packages `erpnext-agent`).** In `erpnext-agent/connector_manifest.yml` set `Supplier`, `Item`, `PurchaseOrder`, `Customer` `ontology_class` to the eg-core classes via the generator, not by hand (manifest is machine-generated). | Connector manifest gate passes; no `UNRESOLVED` for the four.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005.4
Mapping fixture: leanix `Provider` to `kg:Supplier` (rank 2) and `supports` to `kg:supportsCapability`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: leanix `Provider` to `kg:Supplier` (rank 2) and `supports` to `kg:supportsCapability`.** `crates/eg-core/tests/fixtures/vm_leanix.ttl` using `leanix_source_factsheets`. | Fixture passes the shape.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005.5
Mapping fixture: servicenow `Incident`, `Change` and CI relation to `kg:affectsService`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: servicenow `Incident`, `Change` and CI relation to `kg:affectsService`.** `crates/eg-core/tests/fixtures/vm_servicenow.ttl` using `get_change_request_ci` and `get_cmdb_instances`. | Fixture passes the shape.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005.6
Mapping fixture: salesforce `Account` to `kg:Customer` and `Contract` to `kg:CustomerContract`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: salesforce `Account` to `kg:Customer` and `Contract` to `kg:CustomerContract`.** `crates/eg-core/tests/fixtures/vm_salesforce.ttl` via `salesforce_soql`; `Contract` is read by SOQL, not by a declared connector class. | Fixture passes the shape.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005.7
Add the Salesforce `Contract` class and access contract (cross-repo: agent-packages `salesforce-agent`)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add the Salesforce `Contract` class and access contract (cross-repo: agent-packages `salesforce-agent`).** `salesforce_agent/ontology/` declares `Contract` and an SOQL access contract; the connector ontology has none today. | Connector ontology certification passes.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005.8
Mapping fixture: twenty `Company` to `kg:Customer` (rank 2)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: twenty `Company` to `kg:Customer` (rank 2).** `crates/eg-core/tests/fixtures/vm_twenty.ttl`. Twenty has no contract object, so no contract mapping is declared (decision D4). | Fixture passes the shape; a contract query against twenty only yields a typed abstention.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R005.9
Record the `coversService` source (BLOCKED, owner: operator plus salesforce-agent)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Record the `coversService` source (BLOCKED, owner: operator plus salesforce-agent).** Name the custom field or curated link that carries contract to service. Until then the row is a BLOCKED register entry `tasks.md` note, and the report abstains `Uncovered`. | The blocked-register test (R008.3) lists `coversService` with reason.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R006
Virtual mappings: software, runtime and host sources (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Virtual mappings: software, runtime and host sources (rollup).** Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R006.1
Add the container-manager access contract (cross-repo: agent-packages `container-manager-mcp`)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add the container-manager access contract (cross-repo: agent-packages `container-manager-mcp`).** Add `ac:AccessContract` rows for pods, containers and images under `container_manager_mcp/ontology/` using `cm_k8s_workloads list_pods`, container `list_containers`, `cm_image_operations list_images`. None exists today. | Connector ontology certification passes.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R006.2
Add the uptime-kuma access contract (cross-repo: agent-packages `uptime-kuma-agent`)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Add the uptime-kuma access contract (cross-repo: agent-packages `uptime-kuma-agent`).** Access contract for `UptimeMonitor` (`uptime_kuma_monitors get_monitors`) and `HeartbeatStat` (`uptime_kuma_status get_heartbeats`). | Connector ontology certification passes.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R006.3
Mapping fixture: container-manager workload and image to `kg:deployedAs` and `kg:usesImage`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: container-manager workload and image to `kg:deployedAs` and `kg:usesImage`.** `crates/eg-core/tests/fixtures/vm_container_manager.ttl`. | Fixture passes the shape.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R006.4
Mapping fixture: uptime monitor to service health
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: uptime monitor to service health.** `crates/eg-core/tests/fixtures/vm_uptime.ttl`; monitor resolves to `infra:Service` by the URL host key. | Fixture passes the shape.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R006.5
Mapping fixture: dockerhub image, SBOM and Scout CVEs to `containsComponent` and `Vulnerability`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: dockerhub image, SBOM and Scout CVEs to `containsComponent` and `Vulnerability`.** `crates/eg-core/tests/fixtures/vm_dockerhub.ttl` using `hub_scout` actions `sbom`, `cves`. | Fixture passes the shape.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R006.6
Mapping fixture: gitlab `dependencies` and github Dependabot alerts (rank 2)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: gitlab `dependencies` and github Dependabot alerts (rank 2).** `crates/eg-core/tests/fixtures/vm_gitlab_github.ttl` using `gitlab_vulnerabilities` and `github_dependabot`. | Fixture passes the shape.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R006.7
Mapping fixture: fan-manager and systems-manager to `infra:HostLimit`
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Mapping fixture: fan-manager and systems-manager to `infra:HostLimit`.** `crates/eg-core/tests/fixtures/vm_host_limits.ttl`: `TemperatureReading.celsius` with `FanControlPolicy.maxTemperature`; `capacityBytes` and `freeBytes` with the declared thresholds of `R004.3`. | Fixture passes the shape; a `HostLimit` row has both values.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R007
Entity resolution blocking keys (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Entity resolution blocking keys (rollup).** Cites `EG-UNIFIED-DATA-PLANE-R030`; adds only keys. Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R007.1
Blocking-key fixture for supplier, service, host, image and customer
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Blocking-key fixture for supplier, service, host, image and customer.** `crates/eg-core/tests/fixtures/supply_chain_blocking_keys.ttl` holds the table in plan.md. | Fixture parses; each concept lists at least two keys.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R007.2
Test: a digest key is exact; a name-only key is a proposal
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Test: a digest key is exact; a name-only key is a proposal.** `crates/eg-core/tests/` test over the fixture and `EntityLinkProposal::assert_same_as` (`R030.1`). Depends on `R007.1`. | Name-only match refused until approved; digest match still needs approval.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R008
Impact traversal and acceptance (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Impact traversal and acceptance (rollup).** Rollup: LANDED only once every child is. | Every child is LANDED.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R008.1
Class-only impact query fixture
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Class-only impact query fixture.** `crates/eg-core/tests/fixtures/supply_chain_impact.rq` from plan.md: parses and uses only classes of this vocabulary and `infra:Service`. | Query parses; no connector name appears.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R008.2
Recorded-response fixture: one row per source concept
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Recorded-response fixture: one row per source concept.** `crates/eg-core/tests/fixtures/supply_chain_recorded/` with one recorded response per connector operation in plan.md D4. | Fixture set covers every row of the D4 table that is not marked not available.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R008.3
Blocked-register test
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Blocked-register test.** The test reads the D4 table. It asserts each concept has an authority row or a typed abstention reason (twenty contracts, `coversService`). | No concept is silently uncovered.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R009
Ecosystem packages carry transitive dependency and risk (rollup)
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Ecosystem packages carry transitive dependency and risk (rollup).** Ecosystem packages are ontology classes with transitive dependency. A finding in one package reaches every dependent package. Children .1-.6. | Rollup closes when children .1-.6 pass.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R009.1
Model
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Model.** Add `:EcosystemPackage` and the property `:affectsPackage` to `crates/eg-core/ontology/supply_chain-v1.ttl`. Package dependency reuses `:dependsOn`, declared transitive in `crates/eg-core/ontology/software-v1.ttl:53`. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::package_class_and_dependency_declared`.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R009.2
Behavior
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Behavior.** Add `propagate_package_risk(graph, package, finding) -> Vec<PackageImpact>` in `crates/eg-core/src/ecosystem.rs`. Each rule is a named, replaceable default: follow `:dependsOn` in reverse to a depth of 8 and keep the worst severity per dependent. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::finding_reaches_transitive_dependents`.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R009.3
Wiring
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Wiring.** Call `propagate_package_risk` from `handle_impact` at `src/server/handlers/mining/impact.rs:264` when the request names a package. The server dispatches that handler in production. The package branch creates the call site. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::served_impact_lists_dependents`.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R009.4
Refusal
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Refusal.** `propagate_package_risk` must return the typed refusal `PackageRefusal::UnknownPackage` for a package absent from the graph. It must not return an empty impact list. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::unknown_package_is_refused`.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R009.5
Evidence
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Evidence.** Each `PackageImpact` must carry the dependency path from the changed package to the dependent. A reader replays why a dependent is affected. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::impact_carries_dependency_path`.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-SUPPLY-VOCAB-R009.6
Hot-path proof
Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source
**Hot-path proof.** Entry point: the served impact operation naming one package of a fixture dependency chain. The test passes through `impact.rs:264` and observes every transitive dependent with its path and severity. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::served_impact_over_dependency_chain`.
requirementEG-SUPPLY-VOCABSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS
EG-TYPED-PACKS — Typed packs and catalog authority
specNoneSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001
Connector pack contract types and golden digest vectors
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Connector pack contract types and golden digest vectors.** Rollup: every child below is required; the original acceptance remains mandatory. EG defines typed ConnectorPackIndex, entry, section, annotation, ConnectorPackOp, and AgentComponent.Content operations. EG computes framed SHA-256 digests from golden vectors in `contract/fixtures/connector_pack_digest_vectors.json`. Generated clients share this wire contract. | Contract and unit tests compare fixture digest output with published golden vectors byte-for-byte.
requirementEG-TYPED-PACKSSPECIFIEDb43f33569dd4
d116b7dbfd27
tests/test_connector_pack_client.py:137
EG-TYPED-PACKS-R001.1
Original pack index and entry types
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original pack index and entry types.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-types/src/connector_pack/index.rs`. Refusal: No prompt result substitutes for this proof. Evidence: Round-trip every original index and entry field. | Proposed test: `tests/test_connector_pack_contract.py::test_pack_index_entry_contract`. Round-trip every original index and entry field. Unknown kinds and malformed index fields refuse.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001.2
Original section and annotation types
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original section and annotation types.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-types/src/connector_pack/annotations.rs`. Refusal: No prompt result substitutes for this proof. Evidence: Round-trip every section and annotation field without changing existing semantics. | Proposed test: `tests/test_connector_pack_contract.py::test_pack_section_annotation_contract`. Round-trip every section and annotation field without changing existing semantics. Invalid section bounds and malformed typed annotations refuse.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001.3
Original pack and content operations
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original pack and content operations.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-types/src/connector_pack/ops.rs`. Refusal: No prompt result substitutes for this proof. Evidence: Preserve ConnectorPackOp and AgentComponent.Content operation and result shapes. | Proposed test: `tests/test_connector_pack_contract.py::test_pack_content_operation_contract`. Preserve ConnectorPackOp and AgentComponent.Content operation and result shapes. Missing operations and incompatible result shapes fail qualification.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001.4
Original framed digest vectors
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original framed digest vectors.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-types/src/connector_pack/digest.rs`. Refusal: No prompt result substitutes for this proof. Evidence: Every published connector_pack_digest_vectors.json sample matches byte-for-byte. | Proposed test: `tests/test_connector_pack_contract.py::test_original_framed_digest_vectors`. Every published connector_pack_digest_vectors.json sample matches byte-for-byte. Changing a framed input or expected digest fails.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001.5
All generated clients share the pack contract
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**All generated clients share the pack contract.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-capabilities/src/bin/gen_contract.rs`. Refusal: No prompt result substitutes for this proof. Evidence: The complete generated-client inventory shares the original wire shapes and golden bytes. | Proposed test: `tests/test_connector_pack_contract.py::test_all_clients_share_pack_contract`. The complete generated-client inventory shares the original wire shapes and golden bytes. A stale client, omitted client or changed field fails.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001.6
Versioned prompt graph identity
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Versioned prompt graph identity.** Model: A SystemPrompt component pins tenant, component ID, entry revision, schema revision, body digest and provenance. Behavior: Represent the blueprint as a native graph entity with links to its schema and engine-owned body. Wiring: Extend `crates/eg-types/src/agent_component.rs` and its existing component types. Refusal: Unsupported versions, invalid IDs and missing required pins refuse. Evidence: A typed object round-trips all identity and revision fields. | Proposed test: `crates/eg-types/src/agent_component.rs::tests::prompt_blueprint_identity`. A typed object round-trips all identity and revision fields. Changing a schema or body pin cannot preserve the old definition identity.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001.7
Prompt payload validation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Prompt payload validation.** Model: The bounded blueprint profile in plan.md declares core fields and preserved extension values. Behavior: Validate the full object against its exact supported schema before publication or rendering. Wiring: Extend `crates/eg-types/src/agent_component/facts.rs` and reuse the bounded JSON admission authority. Refusal: Malformed fields, duplicate keys, unsupported schema rules and exceeded limits refuse. Evidence: Nested valid objects retain every admitted field and extension value. | Proposed test: `crates/eg-types/src/agent_component/facts.rs::tests::prompt_blueprint_schema_refusals`. Nested valid objects retain every admitted field and extension value. Missing task, wrong field types, nonfinite numbers and oversized objects refuse.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001.8
Deterministic runtime rendering
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Deterministic runtime rendering.** Model: The input binds one validated prompt revision and one validated variable object. Behavior: Resolve only declared variables and serialize the resulting typed object using the versioned rendering policy. Wiring: Intended source: `crates/eg-compute/src/assemble/prompt.rs`; reuse the existing compute crate. Refusal: Missing variables, unknown variables, unresolved pins and exceeded output bounds refuse. Evidence: Repeated identical inputs produce the same bytes and render digest. | Proposed test: `crates/eg-compute/src/assemble/prompt.rs::tests::prompt_render_vectors`. Repeated identical inputs produce the same bytes and render digest. A changed variable changes the result; invalid input produces no render result.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001.9
Generated prompt operation contract
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Generated prompt operation contract.** Model: Typed prompt admission, render and blueprint envelopes extend the existing component operation family. Behavior: Generate descriptors, method/result shapes and client projections from Rust authority. Wiring: Use `crates/eg-types/src/agent_component.rs` and `crates/eg-capabilities/src/bin/gen_contract.rs`. Refusal: Unsupported operation/schema versions and stale generated projections fail. Evidence: Generated clients encode and decode every declared request, result and typed refusal. | Proposed test: `tests/test_prompt_blueprint_contract.py::test_generated_prompt_contract`. Generated clients encode and decode every declared request, result and typed refusal. Missing render provenance or an untyped fallback fails.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002
Engine-owned body storage with guarded refcounts and reconciliation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Engine-owned body storage with guarded refcounts and reconciliation.** Rollup: every child below is required; the original acceptance remains mandatory. EG stores engine-owned component bodies in content-addressed storage. SHA-256 keys identify each body. Guarded holder-row refcounts track liveness. AgentComponent.Content serves verified bytes. A reconciler reclaims unheld bodies after the grace window. | Integration tests cover holder counts for unchanged, revised, and withdrawn components. A fault test covers orphan reclamation after the grace window.
requirementEG-TYPED-PACKSSPECIFIED022736782512
023b482a38d3
dcc5d53c04f9
f6bd64b35e00
src/server/handlers/admin/connector_pack/tests/admin.rs:242
EG-TYPED-PACKS-R002.1
Original engine body staging
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original engine body staging.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/blob/engine_bodies.rs`. Refusal: No prompt-only test closes this original obligation. Evidence: Staged bytes use their verified SHA-256 address. | Proposed test: `tests/test_connector_pack_storage.py::test_body_staging`. Staged bytes use their verified SHA-256 address. A digest mismatch refuses; staging alone exposes no component.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.2
Original unchanged holder transition
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original unchanged holder transition.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/persistence/connector_pack/`. Refusal: No prompt-only test closes this original obligation. Evidence: An unchanged import keeps exact holder/refcount values. | Proposed test: `tests/test_connector_pack_storage.py::test_unchanged_holder`. An unchanged import keeps exact holder/refcount values. Repeated identical import cannot increment or decrement a holder.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.3
Original revised holder transition
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original revised holder transition.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/persistence/connector_pack/`. Refusal: No prompt-only test closes this original obligation. Evidence: A revised component binds its new body and preserves historical revision holders. | Proposed test: `tests/test_connector_pack_storage.py::test_revised_holder`. A revised component binds its new body and preserves historical revision holders. A changed revision cannot orphan a body held by history.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.4
Original withdrawn holder transition
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original withdrawn holder transition.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/persistence/connector_pack/`. Refusal: No prompt-only test closes this original obligation. Evidence: A withdrawn component retains body access through a valid historical pin. | Proposed test: `tests/test_connector_pack_storage.py::test_withdrawn_holder`. A withdrawn component retains body access through a valid historical pin. Withdrawal cannot reclaim a held historical body.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.5
Original orphan grace and fault recovery
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original orphan grace and fault recovery.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/handlers/admin/connector_pack/reconcile.rs:112`. Refusal: No prompt-only test closes this original obligation. Evidence: A fault before owner commit leaves an orphan reclaimed only after its grace window. | Proposed test: `tests/test_connector_pack_storage.py::test_orphan_grace_fault`. A fault before owner commit leaves an orphan reclaimed only after its grace window. An unexpired orphan or held body survives reconciliation and restart.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.6
Original verified body serving
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original verified body serving.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/handlers/admin/component_content.rs:55`. Refusal: No prompt-only test closes this original obligation. Evidence: AgentComponent.Content returns the exact body of its pinned component revision. | Proposed test: `tests/test_connector_pack_storage.py::test_verified_body_read`. AgentComponent.Content returns the exact body of its pinned component revision. Corrupt bytes and denied tenants refuse without leaking body data.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.7
Native prompt body persistence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Native prompt body persistence.** Model: A native prompt publication binds a validated body, schema and expected component head. Behavior: Stage the body, then commit revision, head, holder and receipt through the existing admitted owner write. Wiring: Extend `src/server/persistence/agent_component/write.rs:39`; reuse `src/server/blob/engine_bodies.rs`. Refusal: Invalid schema, denied scope or stale head leaves committed owner state unchanged. Evidence: A successful write has one revision and live holder with its exact body digest. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_owner_commit`. A successful write has one revision and live holder with its exact body digest. A fault before owner commit leaves only an unreferenced body subject to the existing grace rule.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.8
Prompt graph projection
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Prompt graph projection.** Model: A graph entity names the exact committed prompt identity, schema pin and body pin. Behavior: Project through existing owner events and graph admission; expose readiness before graph consumers use the revision. Wiring: Reuse `src/server/connector_pack_projection.rs` machinery with explicit native-component support as a prerequisite. Refusal: Stale events, denied graph writes and incomplete projection cannot expose a newer ready revision. Evidence: Independent graph queries read the exact prompt revision and dependency links. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_graph_projection`. Independent graph queries read the exact prompt revision and dependency links. Replaying an old event cannot regress the visible revision.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.9
Served prompt rendering
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Served prompt rendering.** Model: The authenticated request pins tenant, prompt revision, schema and variable input. Behavior: Read verified body bytes, validate, render and return a provenance-bound result through the generated public operation. Wiring: Extend `src/server/handlers/admin/agent.rs:142`; reuse `src/server/handlers/admin/component_content.rs:55` and R001.8. Refusal: Invalid schema, changed pins, denied tenants and unavailable producers return typed refusals. Evidence: A real generated-client request reaches the renderer and returns the pinned revision and expected bytes. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_render_route`. A real generated-client request reaches the renderer and returns the pinned revision and expected bytes. Invalid requests leave graph, body holders, head and render-result publication unchanged.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.10
Refusal before model dispatch
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal before model dispatch.** Model: A render receipt binds prompt, schema, variables, bytes, revisions and request scope. Behavior: The production consumer must validate that receipt before any model transport call. Wiring: R002.9 supplies the engine result; the named AU dispatch consumer is an explicit prerequisite recorded in plan.md. The source-effect contracts referenced by R094.7 do not satisfy that separate dispatch prerequisite. Refusal: Invalid, stale, substituted or wrong-scope prompt objects cause zero model dispatches. Evidence: A valid served journey renders the pinned version and causes one observed model request. | Proposed test: `tests/test_prompt_blueprints_served.py::test_invalid_prompt_prevents_dispatch`. A valid served journey renders the pinned version and causes one observed model request. Each invalid case yields a typed refusal and zero requests at the real model transport boundary.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R002.11
Durable prompt restart proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Durable prompt restart proof.** Model: The fixture pins graph, component, body, schema and source identities. Behavior: Publish through the authenticated public operation, restart the server, then read through a second client. Wiring: Exercise `src/server/handlers/admin/agent.rs:142`, `src/server/persistence/agent_component/write.rs:39` and the existing content route. Refusal: A denied second tenant receives neither prompt metadata nor body bytes. Evidence: Current and historical revisions, graph links and verified body bytes survive restart. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_restart_readback`. Current and historical revisions, graph links and verified body bytes survive restart. A refused stale update leaves the previous durable head intact.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R003
Import boundary enforces archive integrity, importer binding and G1-G21
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Import boundary enforces archive integrity, importer binding and G1-G21.** EG's ConnectorPack.Import handler verifies archive length and digest. It checks the submitted request against the bound importer. It applies validation rules G1 through G21 from architecture.md. It keeps ConnectorPack and the agent-layer write methods LocalOnly until a separately specified clustered writer exists. | Integration and negative tests exercise the Import boundary across each G1-G21 refusal path and an importer-binding mismatch. They confirm zero catalog mutation on any rejection.
requirementEG-TYPED-PACKSVERIFIED022736782512
209d6806510e
db863f1e2afd
f6bd64b35e00
src/server/handlers/admin/connector_pack/tests/admin.rs:441
EG-TYPED-PACKS-R004
Python ConnectorPackClient with a deterministic import key
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Python ConnectorPackClient with a deterministic import key.** The epistemic_graph Python package provides ConnectorPackClient. The client computes deterministic import idempotency keys independent of request IDs. Retries after lost replies reuse the exact key and avoid duplicate imports. | Unit tests confirm transport-loss retries reuse the same generated key. They confirm the client uses generated wire types for status, content, and import results.
requirementEG-TYPED-PACKSVERIFIEDb43f33569dd4
d116b7dbfd27
tests/test_connector_pack_client.py:257
tests/test_connector_pack_client.py:367
EG-TYPED-PACKS-R005
Acceptance suite for pack mutation, crash, authorization and tenancy
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Acceptance suite for pack mutation, crash, authorization and tenancy.** EG's test suite includes a planted-invalid-input mutation test for each validation rule, crash and retry tests over the Import atomic commit path, content-model, authorization, tenancy and clustered-mode tests, and at least one end-to-end connector fixture exercising import through to a served read. | The mapped test suite in test-spec.md passes, combining mutation, crash/retry, tenancy and end-to-end fixture coverage.
requirementEG-TYPED-PACKSVERIFIEDa1bb9fb9503e
f6bd64b35e00
src/server/handlers/admin/connector_pack/tests/admin.rs:543
EG-TYPED-PACKS-R006
Outbox-driven pack projection with a visibility readiness gate
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Outbox-driven pack projection with a visibility readiness gate.** An Agent Library outbox consumer projects the current committed pack head into its reserved graph. It attaches the schema source. It marks records visible through compare-and-swap. Typed catalog and component reads exclude records that fail this gate. Admins can invoke Reproject for failed or stale projections. Reproject preserves later work. | Integration tests cover projection commit order and the visibility compare-and-swap. They test read filtering and forced Reproject after a simulated failure.
requirementEG-TYPED-PACKSVERIFIEDa1bb9fb9503e
f6bd64b35e00
src/server/handlers/admin/connector_pack/tests/outbox.rs:181
EG-TYPED-PACKS-R007
Admin-controlled pack importer binding and entry retirement
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Admin-controlled pack importer binding and entry retirement.** EG's Bind, Unbind, and Retire operations require admin:connector-pack. Bind and Unbind change the authorized importer. Retire permanently retires a pack entry. Later imports that reintroduce retired entries refuse with stable RETIRED_ENTRY_RETURNED. | Authorization and negative tests confirm Bind, Unbind, and Retire require admin:connector-pack. Reintroducing a retired entry returns RETIRED_ENTRY_RETURNED without changing the head.
requirementEG-TYPED-PACKSVERIFIED022736782512
209d6806510e
a1bb9fb9503e
f6bd64b35e00
src/server/handlers/admin/connector_pack/tests/admin.rs:322
EG-TYPED-PACKS-R008
Blob content-addressed store garbage-collection hardening
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Blob content-addressed store garbage-collection hardening.** EG's blob store reseeds cursor identifiers safely. It computes an accurate live set during garbage collection. It expires abandoned uploads. It enforces a grace period before it reclaims unreferenced bodies. It applies holder-row refcount updates idempotently, so repeated writes never over- or under-count references. | The blob store test suite covers grace-period reclamation, garbage-collection live-set correctness, cursor reseeding and idempotent holder-refcount updates.
requirementEG-TYPED-PACKSVERIFIEDb43f33569dd4
f6bd64b35e00
src/server/blob/store/tests.rs:344
EG-TYPED-PACKS-R009
Projection readiness gates reader visibility
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Projection readiness gates reader visibility.** Readers see a pack record only after graph projection completes and visibility is marked. A committed catalog write alone does not grant visibility. | Integration tests confirm committed-but-unprojected records stay out of catalog and component reads until visibility is marked.
requirementEG-TYPED-PACKSVERIFIEDa7fb03fc503f
db863f1e2afd
src/server/handlers/admin/connector_pack/tests/outbox.rs:127
EG-TYPED-PACKS-R010
Import is a single atomic operation, not a staged protocol
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Import is a single atomic operation, not a staged protocol.** ConnectorPack import validates, stages and commits a pack through one Import operation. EG does not expose separate Prepare, Commit or Abort steps for pack admission. | Contract tests confirm ConnectorPackOp exposes only the single Import method for pack admission, with no prepare, commit or abort variants.
requirementEG-TYPED-PACKSVERIFIEDa7fb03fc503f
bcbbe51307d8
crates/eg-types/src/connector_pack/ops.rs:249
EG-TYPED-PACKS-R011
Incompatible Agent Library storage is refused, not upgraded
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Incompatible Agent Library storage is refused, not upgraded.** When EG finds an existing Agent Library store in a format it does not recognize, it refuses to open it with a named AGENT_LIBRARY_FORMAT_UPGRADE_REQUIRED error instead of reading or migrating it, and no version performs an automatic offline upgrade of that layout. | A negative test opens an incompatible store and asserts the exact AGENT_LIBRARY_FORMAT_UPGRADE_REQUIRED refusal with no partial read or write.
requirementEG-TYPED-PACKSVERIFIED9bc78efe95b3
a7fb03fc503f
src/server/persistence/store_upgrade/tests.rs:424
EG-TYPED-PACKS-R012
Pack and agent-layer write methods are local-only in clustered mode
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Pack and agent-layer write methods are local-only in clustered mode.** ConnectorPack and its four agent-layer write methods are LocalOnly. They refuse clustered execution until a clustered writer is separately specified. A method-inventory test enumerates this exact set. | An inventory test asserts the exact LocalOnly method set. A clustered-mode integration test confirms every listed method refuses.
requirementEG-TYPED-PACKSVERIFIED321e6ae98be4
d116b7dbfd27
src/server/mutation.rs:2396
EG-TYPED-PACKS-R013
Capability IRI validation distinguishes native errors from claims
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Capability IRI validation distinguishes native errors from claims.** EG rejects capability or modality IRIs that misuse the native eg: namespace. It accepts well-formed foreign absolute IRIs as recorded claims, not verified native facts. Govern native vocabulary extensions. | Validation tests cover mistyped native IRI refusal, foreign IRI acceptance as a claim, and malformed IRI refusal.
requirementEG-TYPED-PACKSVERIFIEDa7fb03fc503f
db863f1e2afd
src/server/handlers/admin/connector_pack/import/annotations.rs:198
EG-TYPED-PACKS-R014
Absent entries become reversible Withdrawn, not retired
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Absent entries become reversible Withdrawn, not retired.** When a reimported pack omits a previously published entry, EG sets that component's lifecycle to Withdrawn. A later import of the same entry restores it. EG does not retire it permanently. | An integration test removes then restores an entry across two imports. It asserts the entry becomes Withdrawn and later republishes under the same ID.
requirementEG-TYPED-PACKSVERIFIEDa7fb03fc503f
ac5638477288
src/server/handlers/admin/connector_pack/tests/content_model.rs:549
EG-TYPED-PACKS-R015
Importer authority is admin-bound, with environment value as bootstrap only
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Importer authority is admin-bound, with environment value as bootstrap only.** Pack-import source authorization uses an admin-bound importer identity. An environment-configured importer applies only as the initial bootstrap default, before an administrator binds an importer. | A test confirms the environment importer applies only before admin Bind. A later binding supersedes that default.
requirementEG-TYPED-PACKSVERIFIEDa7fb03fc503f
db863f1e2afd
src/server/handlers/admin/connector_pack/tests/admin.rs:47
EG-TYPED-PACKS-R016
Server pin follows declared contract, not package version
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Server pin follows declared contract, not package version.** The server-entry pin binds declared contract version, server name, and instructions. Package version is provenance only. It never determines pin equality or compatibility. | A unit test confirms package-only version changes preserve pin equality. Changing contract version, name, or instructions produces a new pin.
requirementEG-TYPED-PACKSVERIFIED8aca452dd012
daa948722eca
crates/eg-types/src/agent_component.rs:1298
EG-TYPED-PACKS-R017
Release scope excludes an offline Agent Library upgrade path
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Release scope excludes an offline Agent Library upgrade path.** This capability covers the full design in this specification. Offline upgrade of an incompatible Agent Library store remains out of scope. | Review success criteria and test-spec mapping to confirm no offline-upgrade test is required for acceptance.
requirementEG-TYPED-PACKSVERIFIED34b9f502483d
crates/eg-storage/src/owner/agent_library_upgrade/tests.rs:107
EG-TYPED-PACKS-R018
Body reads use AgentComponent.Content, not a pack-specific method
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Body reads use AgentComponent.Content, not a pack-specific method.** Verified component body bytes are read exclusively through the existing AgentComponent.Content method. EG does not expose a separate ConnectorPack-specific body-read operation. | A contract inventory test confirms ConnectorPackOp has no body-read variant and that AgentComponent.Content serves pack-sourced body bytes.
requirementEG-TYPED-PACKSVERIFIED71533e899d52
crates/eg-types/src/connector_pack/ops.rs:275
src/server/handlers/admin/connector_pack/tests/admin.rs:241
EG-TYPED-PACKS-R019
Only SKILL.md is imported as skill content
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Only SKILL.md is imported as skill content.** Import admits only SKILL.md as skill content. Supporting files require a separate bounded contract and remain unimported. | A validation test confirms supporting-file references do not fail import. It confirms those files are not stored as body content.
requirementEG-TYPED-PACKSVERIFIED0893c1c9cef2
a1bb9fb9503e
src/server/handlers/admin/connector_pack/tests/content_model.rs:656
EG-TYPED-PACKS-R020
A tenant-profile administrative capability defect is out of EG scope
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**A tenant-profile administrative capability defect is out of EG scope.** Tenant-profile defects granting administrative graph capability belong to the tenant-profile dependency. EG pack/catalog code makes no corresponding change. | Review confirms pack-write paths do not depend on this fix. The owning dependency tests prove its correctness.
requirementEG-TYPED-PACKSVERIFIED08a2b1958cc3
tests/test_connector_pack_planted.py:216
EG-TYPED-PACKS-R021
Cross-cutting import-safety defects are release-gate obligations
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Cross-cutting import-safety defects are release-gate obligations.** Cross-system pack-import safety defects must pass this release gate. The tenant-profile administrative capability fix is the sole exception; its repository owns its gate. | The test-spec release mapping includes a regression test for each cross-cutting import-safety defect before acceptance.
requirementEG-TYPED-PACKSVERIFIED96a4c42888e7
f121d03dab8c
tests/test_connector_pack_planted.py:217
EG-TYPED-PACKS-R022
Pack index well-formedness validation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Pack index well-formedness validation.** EG validates that a ConnectorPackIndex declares a supported schema version and a valid connector name, lists entries sorted by unique URI, uses only the closed set of entry kinds, matches each entry's declared URI scheme, and contains exactly one server entry, refusing otherwise with MALFORMED_INDEX or UNKNOWN_ENTRY_KIND. | Negative tests plant each malformed-index condition and assert the matching MALFORMED_INDEX or UNKNOWN_ENTRY_KIND refusal with zero catalog mutation.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:218
EG-TYPED-PACKS-R023
Pack size bounds across index, entries, archive and body
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Pack size bounds across index, entries, archive and body.** EG enforces size bounds on every pack component: index at most 1 MiB, at most 1024 entries, at most 64 references or list items, archive at most 16 MiB, body at most 2 MiB, schema at most 1 MiB, import record at most 4 MiB, and batch size within the kernel budget, refusing any violation with PACK_TOO_LARGE. | A mutation test plants an oversized value for each bound and asserts the PACK_TOO_LARGE refusal.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:219
EG-TYPED-PACKS-R024
Archive presence, length and digest integrity
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Archive presence, length and digest integrity.** EG requires the pack archive to be present and checks its declared length and SHA-256 against the received bytes, refusing with ARCHIVE_MISSING when absent or ARCHIVE_DIGEST_MISMATCH when the hash does not match. | Negative tests submit a missing archive and a tampered archive and assert the respective ARCHIVE_MISSING and ARCHIVE_DIGEST_MISMATCH refusals.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:220
EG-TYPED-PACKS-R025
Archive section layout and offset correctness
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Archive section layout and offset correctness.** EG validates that every archive section's offset and length use checked arithmetic, cover the uncompressed archive exactly once with no overlap, and that the archive itself is stored uncompressed, refusing a malformed layout with MALFORMED_SECTIONS. | A mutation test plants overlapping, out-of-bounds and compressed-archive section layouts and asserts the MALFORMED_SECTIONS refusal.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:221
EG-TYPED-PACKS-R026
Section, entry and pack digest recomputation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Section, entry and pack digest recomputation.** EG recomputes section SHA-256, every entry_digest, and pack_digest from received bytes. It refuses mismatches with PACK_DIGEST_MISMATCH. | Golden-vector and mutation tests confirm recomputed digests match published vectors. A one-byte tamper produces PACK_DIGEST_MISMATCH.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:222
EG-TYPED-PACKS-R027
Text body UTF-8 validity without a byte-order mark
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Text body UTF-8 validity without a byte-order mark.** Every text-typed body must be valid UTF-8 without a byte-order mark. EG refuses violations with MALFORMED_BODY. | A negative test submits invalid UTF-8 and a leading byte-order mark. Both cases must return MALFORMED_BODY.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:223
EG-TYPED-PACKS-R028
Bounded JSON body and schema validation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Bounded JSON body and schema validation.** EG parses every JSON-typed body and schema with a bounded parser that rejects excess depth, size overflow and duplicate keys, refuses NaN and Infinity values, and requires a tool's input schema to have an object-typed root, refusing a violation with MALFORMED_BODY. | A negative test submits excessive JSON depth, duplicate keys and a non-object tool schema root and asserts the MALFORMED_BODY refusal for each.
requirementEG-TYPED-PACKSVERIFIEDb43f33569dd4
d116b7dbfd27
tests/test_connector_pack_planted.py:224
EG-TYPED-PACKS-R029
SKILL.md front-matter validation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**SKILL.md front-matter validation.** EG parses a skill entry's SKILL.md front matter against a restricted YAML subset that rejects anchor and alias expansion, and requires the declared name to match the entry name, refusing a violation with MALFORMED_BODY. | A negative test submits YAML anchors, aliases, and a mismatched name. It asserts MALFORMED_BODY for each case.
requirementEG-TYPED-PACKSVERIFIEDb43f33569dd4
d116b7dbfd27
tests/test_connector_pack_planted.py:225
EG-TYPED-PACKS-R030
Tool entries require an input schema
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Tool entries require an input schema.** EG requires every tool entry to declare an input schema section, refusing an entry that omits one with MISSING_TOOL_SCHEMA. | A negative test submits a tool entry with no input schema section and asserts the MISSING_TOOL_SCHEMA refusal.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:226
EG-TYPED-PACKS-R031
Empty description falls back to the entry name
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Empty description falls back to the entry name.** EG accepts an empty description and uses the entry name as its effective description. It records an EMPTY_DESCRIPTION warning instead of refusing import. | A test confirms import succeeds with the entry name applied. It also confirms the EMPTY_DESCRIPTION warning.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:227
EG-TYPED-PACKS-R032
Capability, cost, latency and model annotation validation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Capability, cost, latency and model annotation validation.** EG validates capability/modality IRIs, costs, ISO currency, latency bounds, and model facts. Malformed IRIs yield UNKNOWN_CAPABILITY_IRI. Invalid cost, currency, latency, or model values yield INVALID_ANNOTATION or INVALID_FACTS. | A mutation test covers malformed IRI, invalid currency, out-of-bounds latency, and invalid model facts. Each case must return its matching refusal.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:228
EG-TYPED-PACKS-R033
Bounded Turtle parsing for ontology and shapes
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Bounded Turtle parsing for ontology and shapes.** EG parses ontology and shapes Turtle documents with a bounded parser enforcing at most 100000 triples and bounded IRI and literal sizes, rejects any use of @base or a relative IRI, and never fetches owl:imports over the network, refusing a violation with ONTOLOGY_INVALID or SHAPES_INVALID. | A negative test submits oversized documents, @base declarations, and owl:imports references. It asserts the matching refusal without any network fetch.
requirementEG-TYPED-PACKSVERIFIEDb43f33569dd4
d116b7dbfd27
tests/test_connector_pack_planted.py:229
EG-TYPED-PACKS-R034
Shape blank-node scoping and SPARQL-backed constraint rejection
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Shape blank-node scoping and SPARQL-backed constraint rejection.** EG scopes SHACL blank nodes independently per source file. It refuses shapes using sh:sparql or SERVICE constraints with SHAPES_INVALID. | A negative test covers cross-file blank-node references. Another covers sh:sparql SERVICE; both must return SHAPES_INVALID.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:230
EG-TYPED-PACKS-R035
Step-bounded SHACL cross-validation against the ontology
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Step-bounded SHACL cross-validation against the ontology.** EG validates pack shapes against the composed ontology using step-bounded SHACL. Budget exhaustion yields VALIDATION_BUDGET_EXCEEDED. A genuine constraint violation yields SHACL_VIOLATION. | A test covers budget exhaustion and a genuine violation. It asserts VALIDATION_BUDGET_EXCEEDED and SHACL_VIOLATION, respectively.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:231
EG-TYPED-PACKS-R036
Sibling reference resolution without cycles
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Sibling reference resolution without cycles.** EG resolves each entry reference only to a sibling of its declared kind. It rejects reference cycles with UNRESOLVED_REFERENCE or REFERENCE_CYCLE. | A negative test covers wrong-kind sibling references and cycles. Each case must return its matching refusal.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:232
EG-TYPED-PACKS-R037
Server-stamped draft validation before commit
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Server-stamped draft validation before commit.** EG validates every AgentComponentDraft, including its server-stamped fields, through AgentComponentDraft::validate before it can be committed, refusing an invalid draft with INVALID_COMPONENT. | Unit tests exercise AgentComponentDraft::validate directly across valid and invalid field combinations, asserting INVALID_COMPONENT on failure.
requirementEG-TYPED-PACKSVERIFIEDb43f33569dd4
f41725ac0f6f
crates/eg-types/src/agent_component.rs:1337
EG-TYPED-PACKS-R038
Import requires a matching bound importer identity
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Import requires a matching bound importer identity.** EG compares the submitting principal with the target pack's configured or admin-bound importer. A mismatch yields IMPORTER_MISMATCH. | A negative test submits an unbound principal. It asserts IMPORTER_MISMATCH and no catalog mutation.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:233
EG-TYPED-PACKS-R039
Mass-withdrawal guard requires an explicit admin override
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Mass-withdrawal guard requires an explicit admin override.** EG refuses imports that empty a pack or withdraw over half of Published members without explicit admin override. Refusal code is PACK_MASS_WITHDRAWAL. | A test omits over half of Published members without override and asserts PACK_MASS_WITHDRAWAL. The same import succeeds with override.
requirementEG-TYPED-PACKSVERIFIEDac5638477288
b9e2f8389e6f
c09b874a403e
d116b7dbfd27
src/server/handlers/admin/connector_pack/tests/withdrawal.rs:174
tests/test_connector_pack_planted.py:234
EG-TYPED-PACKS-R040
Validation stops at a bounded violation count
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Validation stops at a bounded violation count.** EG's validator stops collecting violations once it reaches 256 or exhausts its step budget, reporting in its response that the result was truncated, via VALIDATION_BUDGET_EXCEEDED. | A test submits a pack with far more than 256 violations and asserts the response is capped with a truncation indicator and VALIDATION_BUDGET_EXCEEDED.
requirementEG-TYPED-PACKSVERIFIEDd116b7dbfd27
db863f1e2afd
tests/test_connector_pack_planted.py:235
EG-TYPED-PACKS-R041
Write-time refusal codes for pack import conflicts
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Write-time refusal codes for pack import conflicts.** ConnectorPack.Import returns PACK_HEAD_CONFLICT when the expected head no longer matches, PACK_PLAN_STALE when the computed import plan was derived from a head that changed before commit, BODY_MISSING when a referenced body was not staged, and RESERVED_COMPONENT_ID when a caller attempts to directly write a pack-reserved component ID. None of these refusals changes the head, members, holders, or outbox. | Covered by the crash/retry and reserved-ID refusal cases that assert unchanged head, members, holders and outbox on every refusal.
requirementEG-TYPED-PACKSLANDEDb43f33569dd4
EG-TYPED-PACKS-R042
Typed capability annotations: provides and requires_capabilities
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Typed capability annotations: provides and requires_capabilities.** Each pack entry carries a provides annotation listing native capability IRIs plus any foreign-namespace declared_capabilities claims, and a requires_capabilities annotation. A malformed native capability IRI is refused, while a foreign absolute IRI is accepted only as an unverified claim with a warning. | Covered by the capability-IRI validation cases asserting refusal of a malformed native IRI versus accepted foreign claim with warning.
requirementEG-TYPED-PACKSVERIFIED042cd2be6b01
481fa6ea2c55
795a1ea18fa6
a0743ba9b542
a1bb9fb9503e
src/server/handlers/admin/connector_pack/import/capability_tests.rs:10
src/server/handlers/admin/connector_pack/import/capability_tests.rs:101
src/server/handlers/admin/connector_pack/import/capability_tests.rs:28
src/server/handlers/admin/connector_pack/import/capability_tests.rs:48
src/server/handlers/admin/connector_pack/import/capability_tests.rs:68
EG-TYPED-PACKS-R042.1
Native capability annotation admission
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Native capability annotation admission.** Validate both typed capability lists. Refuse malformed native terms and invalid absolute schemes. Retain foreign terms only as declared claims with a warning. | Owner: `src/server/handlers/admin/connector_pack/import/annotations.rs::check_annotations` and `src/server/handlers/admin/connector_pack/import/desired.rs::DesiredBuilder::draft`. Tests: `src/server/handlers/admin/connector_pack/import/capability_tests.rs::both_capability_fields_refuse_relative_and_invalid_scheme_claims` and `foreign_terms_warn_and_stay_only_in_the_declared_partition`. The same test module covers native terms, typed lists, and JSON round trips.
requirementEG-TYPED-PACKSVERIFIED042cd2be6b01
src/server/handlers/admin/connector_pack/import/capability_tests.rs:10
src/server/handlers/admin/connector_pack/import/capability_tests.rs:101
src/server/handlers/admin/connector_pack/import/capability_tests.rs:28
src/server/handlers/admin/connector_pack/import/capability_tests.rs:48
src/server/handlers/admin/connector_pack/import/capability_tests.rs:68
EG-TYPED-PACKS-R042.2
Served capability claim and refusal proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Served capability claim and refusal proof.** Import the capability annotations through signed dispatch and read persisted component claims. | Owner: `src/server/handlers/admin/connector_pack/import.rs::run_import` and `src/server/handlers/admin/connector_pack/import/desired.rs::DesiredBuilder::draft`. Native execution pending: `src/server/handlers/admin/connector_pack/tests/admin.rs::a_rejected_import_mutates_nothing_in_the_catalog` with G12 cases and bounded owner snapshots. The test `src/server/handlers/admin/connector_pack/tests/content_model.rs::capability_annotations_remain_declared_after_import` checks persisted claims for warning receipts and persisted native/declared fields. Refusals must preserve head, members, holders, records, body liveness, and outbox.
requirementEG-TYPED-PACKSVERIFIED481fa6ea2c55
795a1ea18fa6
a0743ba9b542
c764285d098c
src/server/handlers/admin/connector_pack/tests/admin.rs:441
src/server/handlers/admin/connector_pack/tests/content_model.rs:599
EG-TYPED-PACKS-R043
Modality annotations on pack entries
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Modality annotations on pack entries.** Each pack entry declares bounded modalities_in and modalities_out IRI lists. Lists record data modalities consumed and produced by tools, prompts, or skills. | Covered by typed annotation validation and digest-vector replay tests. Production owners are `crates/eg-types/src/connector_pack/annotations.rs`, `crates/eg-types/src/connector_pack/digest.rs`, and `src/server/handlers/admin/connector_pack/import/annotations.rs`. Proving tests are `src/server/handlers/admin/connector_pack/import/modality_tests.rs::modality_digest_replay_is_canonical_and_direction_sensitive` and the other R043 regressions in `test-spec.md`. PACK-09 acceptance remains required.
requirementEG-TYPED-PACKSVERIFIED7be444b032de
88931aa3dbef
c08b8d0665e4
src/server/handlers/admin/connector_pack/import/modality_tests.rs:10
src/server/handlers/admin/connector_pack/import/modality_tests.rs:33
src/server/handlers/admin/connector_pack/import/modality_tests.rs:62
src/server/handlers/admin/connector_pack/import/modality_tests.rs:88
tests/test_connector_pack_client.py:457
EG-TYPED-PACKS-R044
EG-computed tool schema digests
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**EG-computed tool schema digests.** EG computes input_schema_digest and output_schema_digest as SHA-256 over the exact received tool schema bytes, independent of any digest the connector SDK separately computes. | Covered by the digest-vector replay asserting a changed schema byte changes the digest while repackaging does not.
requirementEG-TYPED-PACKSVERIFIED7be444b032de
src/server/handlers/admin/connector_pack/import/facts.rs:204
EG-TYPED-PACKS-R045
MCP ToolAnnotations hints captured as pack facts
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**MCP ToolAnnotations hints captured as pack facts.** The importer captures each tool entry's MCP ToolAnnotations hints (readOnly, destructive, idempotent, openWorld). It stores them as typed facts on the pack entry's annotations. It never leaves them as untyped metadata. | Covered by annotation validation and digest-vector replay for pack entries.
requirementEG-TYPED-PACKSSPECIFIEDdb863f1e2afd
EG-TYPED-PACKS-R045.1
Annotation type carries side effects, declarer and schema size
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Annotation type carries side effects, declarer and schema size.** `PackAnnotations` (`crates/eg-types/src/connector_pack/annotations.rs:46`) must gain `side_effects`, `declared_by` and `schema_tokens`, each with `#[serde(default)]`. `side_effects` is the closed set `none`, `workspace_write`, `external_write`, `network`. `declared_by` is `connector`, `mcp_hint` or `certified`. `schema_tokens` is `Option<u32>`. The SDK publishes these facts in `SDK-CONNECTOR-CONTROL-R045.1` to `.11`. | Test: `crates/eg-types/src/connector_pack/annotations.rs::tests::new_fields_roundtrip`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R045.2
Absent facts take safe defaults, never zero
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Absent facts take safe defaults, never zero.** An absent `read_only_hint` must read as `false`, absent `side_effects` as `external_write`, absent `declared_by` as `connector`, and absent `schema_tokens` as absent. A default method on `PackAnnotations` must expose these. No code path may turn an absent `schema_tokens` into 0. | Test: `crates/eg-types/src/connector_pack/annotations.rs::tests::absent_facts_take_safe_defaults`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R045.3
The annotation digest covers the new fields without moving old vectors
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The annotation digest covers the new fields without moving old vectors.** `annotations_digest` (`crates/eg-types/src/connector_pack/digest.rs:135`) must hash the three fields only when present. An entry without them must keep its existing golden digest vector. | Test: `crates/eg-types/src/connector_pack/digest.rs::tests::absent_new_fields_keep_golden_vectors`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R045.4
Admission refuses an unknown side-effect or declarer value
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Admission refuses an unknown side-effect or declarer value.** `check_annotations` (`src/server/handlers/admin/connector_pack/import/annotations.rs:34`) must refuse an unknown `side_effects` or `declared_by` value, or a `schema_tokens` of 0, with a typed annotation refusal naming the field. | Test: `src/server/handlers/admin/connector_pack/import/annotations.rs::tests::unknown_side_effect_is_refused`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R045.5
Admission records an unproven read-only claim
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Admission records an unproven read-only claim.** `tool_facts` (`src/server/handlers/admin/connector_pack/import/facts.rs:21`) must copy the three fields into `AgentComponentFacts::Tool` (`crates/eg-types/src/agent_component/facts.rs:198`). When `read_only_hint` is true and `declared_by` is `mcp_hint`, the stored fact must mark the claim unproven. The `effect` mapping at `facts.rs:25` must then yield `ToolEffect::Write`. | Test: `src/server/handlers/admin/connector_pack/import/facts.rs::tests::mcp_hint_read_only_is_unproven`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R045.6
The tool-subset path abstains for a tool with no size
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The tool-subset path abstains for a tool with no size.** `token_cost` (`src/server/handlers/decide/stat_tool_subset.rs:91`) now returns 0 for an undeclared cost, which treats the tool as free. It must return no value instead. `request_body` (`stat_tool_subset.rs:99`) must read each candidate's `schema_tokens` as its `token_cost` and must abstain on the `tool_subset` part for any candidate without one. It must not assume a size. This feeds `EG-DECISION-ENGINE-R045.2` and `EG-DECISION-ENGINE-R128.9`. | Test: `src/server/handlers/decide/stat_tests/tool_subset_tests.rs::missing_schema_tokens_abstains`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R045.7
No decision premise treats an unproven read-only claim as certified
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**No decision premise treats an unproven read-only claim as certified.** The `HarnessConfig` handler (`EG-DECISION-ENGINE-R128.8`) and the capability rules (`crates/eg-rdf/src/rules/capability.rs:384`) must treat `read_only` as certified only when `declared_by` is `certified` or `connector`. A premise built from an `mcp_hint` claim must carry the label unproven. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::mcp_hint_read_only_premise_is_unproven`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R045.8
The generated contract and Python client carry the new fields
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The generated contract and Python client carry the new fields.** `gen_contract --check` (`crates/eg-capabilities/Cargo.toml:102`) must pass after regeneration. The Python `PackAnnotations` model (`crates/eg-capabilities/src/contract/python/surfaces.rs:12`) must expose the three fields, so the SDK can import them. | Test: `crates/eg-capabilities/src/contract/python/surfaces/tests.rs::pack_annotations_expose_harness_tool_facts`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R045.9
End-to-end proof: a two-tool pack yields a budget-respecting subset
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**End-to-end proof: a two-tool pack yields a budget-respecting subset.** A served test must import a pack with two tools of known `schema_tokens` through the import path. It must then call `Decide` with `HarnessConfig` (`EG-DECISION-ENGINE-R128`) and a budget that fits one tool. The answer's tool subset must stay within that budget. A tool with no `schema_tokens` must produce an abstention. | Test: `tests/harness_config_tool_facts_served.rs::two_tool_pack_subset_respects_budget`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R046
Cost annotation on pack entries
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Cost annotation on pack entries.** A pack entry may declare a cost annotation naming its currency and per-call, per-input-token and per-output-token cost in micros. An invalid currency or cost value is refused. | Covered by the invalid-cost-value validation case.
requirementEG-TYPED-PACKSVERIFIED347ce471e2c9
db863f1e2afd
src/server/handlers/admin/connector_pack/import/annotations.rs:256
EG-TYPED-PACKS-R047
Latency annotation on pack entries
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Latency annotation on pack entries.** A pack entry may declare a latency annotation giving its stated p50 and p95 response times. An out-of-bounds latency value is refused. | Covered by the invalid-latency-value validation case.
requirementEG-TYPED-PACKSVERIFIED347ce471e2c9
db863f1e2afd
src/server/handlers/admin/connector_pack/import/annotations.rs:257
EG-TYPED-PACKS-R048
ModelProfile cost, latency, modality and capability facts
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**ModelProfile cost, latency, modality and capability facts.** A model_profile pack entry carries provider, model identity, context window, maximum output tokens and supports_* capability facts alongside its cost, latency and modality annotations. | Covered by the model-fact validation cases and the digest-vector replay for pack entries.
requirementEG-TYPED-PACKSSPECIFIEDdb863f1e2afd
EG-TYPED-PACKS-R048.1
Context window is a named model fact
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Context window is a named model fact.** `crates/eg-types/src/agent_component/facts.rs` already carries `context_window_tokens` on `ModelProfile`. EG must expose it as `contextWindowTokens` in the ontology projection and the Python DTO. The pack validator must reject a value of 0. | Test: `crates/eg-types/src/agent_component/facts.rs::tests::context_window_zero_is_refused`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R048.2
A measured fact cites the evaluation run that produced it
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**A measured fact cites the evaluation run that produced it.** `facts.rs` must define `MeasuredFact<T>` holding a `value` and an `evaluation_run_ref: ObservationRef`, reusing the `ObservationRef` type that `latency_observed_ref` uses. A measured fact without a run reference must fail validation. | Test: `crates/eg-types/src/agent_component/facts.rs::tests::measured_fact_requires_run_ref`
requirementEG-TYPED-PACKSVERIFIEDa565bdb085f2
crates/eg-types/src/agent_component/facts.rs:514
EG-TYPED-PACKS-R048.3
Shell proficiency is a measured model fact
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Shell proficiency is a measured model fact.** `facts.rs` must define `ShellProficiency` (`low`, `medium`, `high`) and add `shell_proficiency: Option<MeasuredFact<ShellProficiency>>` to `ModelProfile` with `#[serde(default)]`. The ontology projection must name it `shellProficiency`. An absent value must leave the existing digest vectors unchanged. | Test: `crates/eg-types/src/agent_component.rs::tests::absent_shell_proficiency_keeps_digest`
requirementEG-TYPED-PACKSVERIFIED3a23459ceec7
crates/eg-rdf/src/rules/capability/tests.rs:234
crates/eg-types/src/agent_component.rs:1459
crates/eg-types/src/agent_component.rs:1510
crates/eg-types/src/agent_component.rs:1549
EG-TYPED-PACKS-R048.4
Stopping behaviour is a measured model fact
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Stopping behaviour is a measured model fact.** `facts.rs` must define `StoppingBehaviour` (`stops_early`, `balanced`, `over_verifies`) and add `stopping_behaviour: Option<MeasuredFact<StoppingBehaviour>>` to `ModelProfile` with `#[serde(default)]`. The ontology projection must name it `stoppingBehaviour`. The digest function at `agent_component.rs:748` must hash both measured facts when present. | Test: `crates/eg-types/src/agent_component.rs::tests::measured_model_facts_change_digest`
requirementEG-TYPED-PACKSVERIFIED3a23459ceec7
crates/eg-rdf/src/rules/capability/tests.rs:235
crates/eg-types/src/agent_component.rs:1460
crates/eg-types/src/agent_component.rs:1511
crates/eg-types/src/agent_component.rs:1550
EG-TYPED-PACKS-R048.5
Pack import round-trips the new model facts
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Pack import round-trips the new model facts.** A signed pack entry carrying `contextWindowTokens`, `shellProficiency` and `stoppingBehaviour` must import and read back unchanged. An entry with an unknown enum value must be refused with a typed error. | Test: `tests/typed_packs/test_model_harness_facts.py::test_model_profile_round_trip`
requirementEG-TYPED-PACKSVERIFIED03fd1d10476f
20f92260b576
35c16b482e05
4d345c857f13
6be6da12f970
crates/eg-types/src/connector_pack/digest.rs:302
tests/typed_packs/test_model_harness_facts.py:36
EG-TYPED-PACKS-R049
contract_pin is carried as an opaque SDK claim
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**contract_pin is carried as an opaque SDK claim.** EG stores and returns the connector SDK's contract_pin value as a carried claim attribute on the server pin without independently recomputing or verifying the SDK's own schema normalization. | Covered by the server-pin digest vectors confirming EG treats the pin as declared rather than recomputed.
requirementEG-TYPED-PACKSVERIFIED0b9445099b24
db863f1e2afd
crates/eg-types/src/connector_pack/digest.rs:348
EG-TYPED-PACKS-R050
Per-entry contract_version replaces package-version pinning
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Per-entry contract_version replaces package-version pinning.** Each server pin binds the entry's declared contract_version, name and instructions. The connector's package version is carried as provenance only and never determines pin compatibility. | Covered by the import test case showing a contract-version change cascades pins while a package-only version change does not.
requirementEG-TYPED-PACKSVERIFIED347ce471e2c9
db863f1e2afd
src/server/handlers/admin/connector_pack/tests/content_model.rs:103
src/server/handlers/admin/connector_pack/tests/content_model.rs:265
EG-TYPED-PACKS-R051
Composable per-graph schema source sets
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Composable per-graph schema source sets.** A graph owns a bounded ordered map of named GraphSchemaSource entries, each carrying its own shapes and ontology bytes, origin and revision. The composed digest and policy are derived from the union, and conflict and consistency rules govern attach, detach and pack projection. | Covered by the schema-source composition and conflict-rule test cases.
requirementEG-TYPED-PACKSLANDEDf17f47ab300f
EG-TYPED-PACKS-R052
No pack-specific stand-in for pending schema authority
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**No pack-specific stand-in for pending schema authority.** A capability that depends on a general typed schema or ontology authority that does not yet exist is not shipped as a pack-specific placeholder; it is delivered only once the general authority exists. | Covered by the generated-type parity and migration check required before any duplicate type is removed.
requirementEG-TYPED-PACKSVERIFIED3eb80ef31218
src/server/handlers/admin/connector_pack/tests/outbox.rs:68
EG-TYPED-PACKS-R053
Visible-staleness snapshot for non-pack schema attach
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Visible-staleness snapshot for non-pack schema attach.** Attaching a pack's schema to a graph other than its reserved projection graph copies a static snapshot whose staleness is visible to readers. Automatic following of later pack updates into that graph is not performed until a separately specified durable target-list design exists. | Covered by the static-attachment staleness-reporting test case.
requirementEG-TYPED-PACKSLANDEDf17f47ab300f
EG-TYPED-PACKS-R054
One topic per Agent Library outbox consumer
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**One topic per Agent Library outbox consumer.** Each Agent Library outbox consumer subscribes to exactly one topic; a projection consumer never mixes multiple unrelated topics in a way that would require skipping an acknowledgment. | Covered by the outbox crash and redelivery test cases asserting idempotent, topic-scoped redelivery.
requirementEG-TYPED-PACKSVERIFIED3eb80ef31218
ceec54145720
crates/eg-transaction/src/tests/outbox.rs:1466
EG-TYPED-PACKS-R055
Outbox retry never collateral dead-letters unrelated events
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Outbox retry never collateral dead-letters unrelated events.** Retry failed outbox events a bounded number of times (for example, 16). Then dead-letter each failed event alone. Treat failure as durable, visible data-loss risk, not a stall. Healthy unrelated events never dead-letter with it. | Covered by stale/failed-event tests that assert later events are not collateral-dead-lettered.
requirementEG-TYPED-PACKSVERIFIED3eb80ef31218
7704b8d7294f
crates/eg-transaction/src/tests/outbox.rs:2262
EG-TYPED-PACKS-R056
Owner-layout refusal happens at the manifest read
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Owner-layout refusal happens at the manifest read.** An incompatible Agent Library owner-file layout is refused by a named error at the manifest read, through OwnerManifest validation, not later during any table-level scan. | Covered by the incompatible-layout refusal case exercised alongside the owner-transaction crash and recovery tests.
requirementEG-TYPED-PACKSLANDEDa1bb9fb9503e
EG-TYPED-PACKS-R057
Ontology withdrawal removes a whole source, not per-triple
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Ontology withdrawal removes a whole source, not per-triple.** Because the composed TBox is a derived cache and not stored authority, withdrawing a source's ontology contribution is performed by detaching that named GraphSchemaSource under the schema conflict rules, not by tracking provenance on individual triples. | Covered by the attach-detach-attach composition test cases.
requirementEG-TYPED-PACKSVERIFIEDf17f47ab300f
src/server/graph_schema/compiled_tests.rs:93
EG-TYPED-PACKS-R058
One shared derivation-step budget bounds EL+/RL reasoning
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**One shared derivation-step budget bounds EL+/RL reasoning.** A single bounded derivation-step budget for EL+ and RL classification is enforced once in the shared RDF reasoning component and reused by both pack ontology validation and graph schema source composition, so admission never invokes exponential tableau reasoning. | Covered by the derivation-budget-exhaustion case and the step-bounded classification test case.
requirementEG-TYPED-PACKSLANDED0d5be273ab86
80c865971ea8
EG-TYPED-PACKS-R059
Schema attach validates only newly introduced data
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Schema attach validates only newly introduced data.** IcvConfigure and GraphSchema.Attach validate the staged schema document and the writes it introduces. They never retroactively scan or revalidate data already present in the graph. | Covered by the attach-without-retroactive-scan assertion in the schema composition tests.
requirementEG-TYPED-PACKSLANDED2c04520d740f
EG-TYPED-PACKS-R060
Manifest-read refusal precedes dependent import paths
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Manifest-read refusal precedes dependent import paths.** The engine refuses to read a manifest with an incompatible owner layout. That refusal exists before any import path relies on it. | Covered by the same incompatible-layout refusal evidence relied on by the owner-transaction recovery tests.
requirementEG-TYPED-PACKSLANDED08a2b1958cc3
EG-TYPED-PACKS-R061
Bounded schema source catalog: 32 sources, 8 MiB
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Bounded schema source catalog: 32 sources, 8 MiB.** Graph schema composition admits at most 32 named sources per graph. Their combined dynamic schema size stays at or under 8 MiB. That bound covers the largest pack's snapshot staging cost. | Covered by the source-count and byte-bound overflow refusal test case.
requirementEG-TYPED-PACKSLANDEDb43f33569dd4
EG-TYPED-PACKS-R062
GraphSchema replicates through the existing GraphState route
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**GraphSchema replicates through the existing GraphState route.** Graph schema state replicates through the existing GraphState catalog record type rather than introducing a new sealed payload variant. | Covered by the composed-schema read and replication test cases.
requirementEG-TYPED-PACKSLANDEDf17f47ab300f
EG-TYPED-PACKS-R063
Agent-layer row types affected by a schema bump are enumerated
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Agent-layer row types affected by a schema bump are enumerated.** Before any shared schema version is bumped, the specific agent-layer record types it changes are explicitly enumerated rather than assumed. | Covered by the generated-contract fixpoint and committed-artifact comparison test.
requirementEG-TYPED-PACKSLANDED08a2b1958cc3
EG-TYPED-PACKS-R064
Output-schema digest recorded on tool pins
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Output-schema digest recorded on tool pins.** A tool's server pin carries an output_schema_digest alongside its input-schema digest, computed by EG over the exact received schema bytes. | Covered by the digest-vector replay test for pack entries.
requirementEG-TYPED-PACKSVERIFIED7be444b032de
src/server/handlers/admin/connector_pack/import/facts.rs:205
EG-TYPED-PACKS-R065
EG does not recompute the SDK's contract-pin normalization
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**EG does not recompute the SDK's contract-pin normalization.** EG does not independently validate or recompute the connector SDK's normalized contract-pin schema. EG only carries the pin as a declared claim, and that normalization is proved by the SDK's own conformance suite. | Covered by the server-pin claim-handling assertions in the digest and import replay tests.
requirementEG-TYPED-PACKSLANDEDdb863f1e2afd
EG-TYPED-PACKS-R066
OWL/rule classification over model and capability facts
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**OWL/rule classification over model and capability facts.** ModelProfile and capability metadata are classified using the same bounded OWL and rule-based reasoning used for pack ontology validation, within the shared derivation-step budget. | Covered by the bounded ontology-consistency and classification test cases.
requirementEG-TYPED-PACKSSPECIFIEDf50555aa6421
EG-TYPED-PACKS-R066.1
SHACL shapes validate the measured model facts
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**SHACL shapes validate the measured model facts.** A new shapes file `crates/eg-core/ontology/harness-v1.shapes.ttl` must require `shellProficiency` and `stoppingBehaviour` to be one of their enum values. It must require an `evaluationRun` link whenever a value is present. It must require `contextWindowTokens` to be at least 1. | Test: `crates/eg-core/tests/harness_shapes.rs::model_fact_shapes_reject_missing_run`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R066.2
The task class carries a shell-centric fact
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The task class carries a shell-centric fact.** `crates/eg-core/ontology/swarm_topology-v1.ttl` must declare the boolean property `swarm:shellCentric` on `swarm:TaskShape` (line 80 area owns `swarm:DecomposableTask`). The matching shape in `swarm_topology-v1.shapes.ttl` must require a boolean datatype and at most one value. | Test: `crates/eg-shacl/tests/swarm_topology_shapes.rs::shell_centric_must_be_boolean`
requirementEG-TYPED-PACKSVERIFIEDfa0de58b4e2e
crates/eg-shacl/tests/swarm_topology_shapes.rs:17
crates/eg-shacl/tests/swarm_topology_shapes.rs:30
crates/eg-shacl/tests/swarm_topology_shapes.rs:47
EG-TYPED-PACKS-R066.3
The shell-centric fact is inherited by task subclasses
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The shell-centric fact is inherited by task subclasses.** A task class with no own `swarm:shellCentric` value must read the value of its nearest ancestor through `agent_ontology::broader_chain`. When no ancestor states it, the reader must return an absent value, never `false`. | Test: `crates/eg-core/tests/swarm_topology_shapes.rs::shell_centric_inherits_or_is_absent`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R067
Coordinated contract regeneration for new library methods
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Coordinated contract regeneration for new library methods.** A feature that adds library API methods regenerates the shared wire, client and receipt artifacts. It commits them in the same change. It never lands library code ahead of its contract. | Covered by the generated-contract fixpoint and committed-artifact comparison test.
requirementEG-TYPED-PACKSLANDED339e26cbbbca
EG-TYPED-PACKS-R068
Contract regeneration packages the complete generated set
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Contract regeneration packages the complete generated set.** Regenerating the pack contract produces and commits the complete generated artifact set together, including the contract directory, the generated client package, the generated capabilities documentation, and the Rust catalog digest and method catalog files, so the committed catalog digest can never drift from the committed receipt digest while a byte-size-only comparison would miss a content-only change. | Covered by a committed-artifact content comparison that checks bytes and digests rather than file size alone.
requirementEG-TYPED-PACKSVERIFIEDa1bb9fb9503e
crates/eg-capabilities/src/catalog.rs:82
EG-TYPED-PACKS-R069
Branch-aware, blob-deduplicated repository indexing
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Branch-aware, blob-deduplicated repository indexing.** EG indexes all repository branches using Blob nodes keyed by content SHA. FileVersion nodes bind paths to blobs, and Branch edges point to each FileVersion. Indexing parses each unique blob once, even when many branches share it. | Covered by a repository-ingestion test proving each unique blob is parsed once across branches that share history.
requirementEG-TYPED-PACKSSPECIFIEDa1bb9fb9503e
EG-TYPED-PACKS-R070
Committed contract artifacts match generated content, not size
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Committed contract artifacts match generated content, not size.** The committed contract receipt files and the Rust catalog digest file must match what the current registry generates byte-for-byte. A same-size, different-content drift between them is treated as a failure, not ignored. | Proven by crates/eg-capabilities/tests/contract_generated.rs::committed_contract_artifacts_match_the_registry.
requirementEG-TYPED-PACKSVERIFIEDbe0f1acb05c6
crates/eg-capabilities/tests/contract_generated.rs:25
EG-TYPED-PACKS-R071
Generated core ontology corpus as GraphSchema authority
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Generated core ontology corpus as GraphSchema authority.** EG's first schema corpus is generated from typed Rust authority as versioned core module artifacts outside the 32-source dynamic quota, preserves its existing published ontology IRI vocabulary, covers root and core terms plus capability, enterprise and ArchiMate terms and governed shapes, and is checked with combined EL+/RL and tableau reasoning. | Covered by the codegen/check parity and ontology-consistency test cases.
requirementEG-TYPED-PACKSSPECIFIED86787edc8a87
90f5578ae2f4
EG-TYPED-PACKS-R071.1
Versioned core vocabulary crosswalks (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Versioned core vocabulary crosswalks (rollup).** Extend R071 authority with explicit Schema.org mappings for person, event and document metadata. RDF/OWL semantics and upper-ontology disjointness remain authoritative in EG. Children `.1` through `.6` define this contract. | All six children require served acceptance. Existing alignment comments alone do not establish delivery.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R071.1.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `VocabularyCrosswalk` beside `DomainClass` in `crates/eg-types/src/domain_pack.rs`. Carry source and target absolute class IRIs, relation, source revision, target vocabulary revision, origin and content digest. Relations are closed: `SeeAlso`, `SkosExactMatch`, `SkosCloseMatch`, `SkosBroadMatch`, `SkosNarrowMatch`. Store approved target declarations and their categories with the vocabulary revision. | Round-trip all fields. Reject unknown relations, malformed IRIs, absent revisions and empty origins.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R071.1.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Use the exact source/target/relation fixtures in the test specification for EG Person, Event and Document. Their declared relation is `SeeAlso`; Document includes physical documents and must not become `SkosExactMatch` to DigitalDocument. `SkosBroadMatch` means the target is broader than the source. `SkosNarrowMatch` means the target is narrower. Choose each relation explicitly in typed authority. References never imply `owl:sameAs`, class equivalence or new subclass assertions. Preserve continuant, process and temporal-region separation. Use named limits: 4096 source classes, 16384 mappings and 2048 bytes per IRI. | Deterministic fixtures cover all three classes, duplicate input and every bound. Verify exact tuples against pinned source and target declarations. Assert broad/narrow direction with asymmetric fixtures.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R071.1.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Extend `VocabularyModule::to_turtle` at `crates/eg-core/src/ontology_codegen.rs:45` to emit declared crosswalks. Reuse schema composition in `src/server/graph_schema.rs::apply_pack_source` before activation. Extend `OntologyInspection` and `src/server/handlers/rdf/inspect.rs::handle_ontology_inspect` to return crosswalks from composed sources. The production caller is `Method::OntologyInspect` in `src/server/handlers/rdf/dispatch.rs:314`. These crosswalk call sites remain to be implemented. | Generator parity and real served inspection must resolve identical records and composed digests.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R071.1.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** Resolve every source IRI as a class in the pinned source revision and selected source scope before activation. Return `CROSSWALK_SOURCE_UNKNOWN` for an unresolved class, including a property IRI. Return `CROSSWALK_SOURCE_OUT_OF_SCOPE` for a known class outside the authorized selected source set. Include the source IRI, requested revision and scope. Reject unresolved targets, conflicting relations and mappings incompatible with approved target categories before activation. Return `CROSSWALK_TARGET_UNKNOWN`, `CROSSWALK_CONFLICT`, `CROSSWALK_CATEGORY_CONFLICT` or `CROSSWALK_LIMIT_EXCEEDED`, with the offending IRI. Existing schema consistency and disjointness checks still run. Never fetch or silently adopt external definitions during import. | Unknown and out-of-scope sources must refuse even when their target is valid. A Person-to-Event mapping and a conflicting duplicate leave the active schema digest unchanged. Exceeding any bound refuses without truncation.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R071.1.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Return source and target IRIs, relation, both vocabulary revisions, origin, crosswalk digest and committed schema digest. Distinguish inline inspection from committed-source inspection. Bind report evidence to the inspected tenant, graph and source set. | Independent readback matches the committed mapping records and digest. Inline inspection cannot claim activation.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R071.1.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** Entry point: authenticated `ConnectorPack.Import`, followed by schema attachment and served `OntologyInspect` over composed sources. `tests/test_ontology_crosswalk_served.py::test_core_metadata_crosswalks` imports person, event and document fixtures using the real client and server. Query committed classes through `GraphSchemaClasses` and inspect mappings separately. | Assert the exact golden tuples and committed digest, including the declared relation and endpoint direction. Refuse unknown and out-of-scope sources. Submit category conflicts and disjointness violations, then independently read the unchanged prior state.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R072
EG/SDK typed fleet-catalog authority, not SQL tables
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**EG/SDK typed fleet-catalog authority, not SQL tables.** ServerRegistry is the sole liveness authority for fleet servers, and ConnectorPack and AgentComponent are the sole content and lifecycle authority. The connector SDK pulls, builds and imports packs, and GraphOS joins typed reads for serving, with no SQL shadow catalog or independent content authority elsewhere. | Covered by the fleet-catalog join and distinct-authority assertions in the end-to-end connector test.
requirementEG-TYPED-PACKSSPECIFIED2a0d6eae0918
90f5578ae2f4
EG-TYPED-PACKS-R073
Raise the core schema source bound to 64 and split world_model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Raise the core schema source bound to 64 and split world_model.** The core schema source bound, the in-process maximum and the wire contract's maximum source count, is raised from 32 to 64 as one coordinated contract change, and the world_model schema module is split into separate life, environment and nutrition modules with their shapes moved into their own document. | Covered by the raised source-count bound test case and the contract-regeneration check.
requirementEG-TYPED-PACKSVERIFIED90f5578ae2f4
a4c80c2b6f90
src/server/graph_schema/world_model_tests.rs:106
src/server/graph_schema/world_model_tests.rs:248
EG-TYPED-PACKS-R074
Least-privilege, per-pack projection grant with recorded failure
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Least-privilege, per-pack projection grant with recorded failure.** The projection worker writes each pack's reserved graph under a least-privilege grant scoped to that outbox row rather than a broad per-graph check that can deny it. Any write failure is recorded as a durable failed outbox status and surfaced for dead-letter and retry rather than only logged. | Covered by the graph-grant-denial and durable-failed-status test cases.
requirementEG-TYPED-PACKSLANDED90f5578ae2f4
d76ac1402723
EG-TYPED-PACKS-R075
Landing gate runs the full integration test suite
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Landing gate runs the full integration test suite.** The release gate runs the complete Rust test suite, including integration binaries such as admission-saga result contracts and transaction recovery. It does not run unit tests only. These cases are gated before merge. | The full-suite gate requires a complete nextest run, including integration binaries, with zero omissions.
requirementEG-TYPED-PACKSLANDED90f5578ae2f4
b43f33569dd4
EG-TYPED-PACKS-R076
Signal-killed test binaries are detected and rerun in isolation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Signal-killed test binaries are detected and rerun in isolation.** If a test binary is killed by a signal partway through a run, the gate detects the signal death and reruns that binary under per-test process isolation so every test receives a pass or fail verdict instead of being silently skipped. A durability test pair that depends on sibling-test process state is diagnosed and isolated so it does not depend on run order. | Covered by the full-suite gate requirement to account for every test when a binary dies by signal.
requirementEG-TYPED-PACKSLANDED90f5578ae2f4
a1bb9fb9503e
EG-TYPED-PACKS-R077
GraphSchemaClasses exposes canonical class and property names
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**GraphSchemaClasses exposes canonical class and property names.** EG exposes a GraphSchemaClasses read returning the committed composed graph schema's classes and properties together with its composition digest, so a consumer can verify a referenced class name against the canonical schema. | Covered by the GraphSchemaClasses comparison test case.
requirementEG-TYPED-PACKSVERIFIED2068ec01a667
90f5578ae2f4
src/server/graph_schema/terms.rs:201
src/server/graph_schema/terms.rs:231
EG-TYPED-PACKS-R078
Proven retrieval plan templates keyed by task class and digest
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Proven retrieval plan templates keyed by task class and digest.** EG records RetrievalPath entries as proven plan templates keyed by task class and the composed graph schema digest, exposing them as candidates to EG-DECISION-ENGINE-R029 along with topology-to-skill edges used to assemble a plan. | Covered by a retrieval-plan-candidate test asserting the recorded template is keyed by task class and schema digest.
requirementEG-TYPED-PACKSLANDED90f5578ae2f4
e429630278b8
EG-TYPED-PACKS-R079
Typed OHLCV bar-series contract
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Typed OHLCV bar-series contract.** EG defines a typed OHLCV bar-series contract covering bar rollup, trading-calendar alignment, finalized-versus-provisional bar status, and bar revision handling. | Covered by a bar-series contract test asserting rollup, calendar alignment, provisional-to-finalized transition and revision replay.
requirementEG-TYPED-PACKSLANDED532418b7e55b
90f5578ae2f4
EG-TYPED-PACKS-R080
Exhaustive OpKind/PredKind printer and parser contract
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Exhaustive OpKind/PredKind printer and parser contract.** A single macro generates each OpKind and PredKind enum together with its complete variant list. A walk prints, parses and canonicalizes every variant against an empty builder-only allowlist, backed by a 512-case property round-trip test and a fuzz target asserting the same round trip. | Covered by the printer/parser round-trip, property and fuzz test cases.
requirementEG-TYPED-PACKSLANDED1b4fc2558151
90f5578ae2f4
EG-TYPED-PACKS-R081
Ontology object model migrated into EG's kg/ontology package
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Ontology object model migrated into EG's kg/ontology package.** The epistemic-graph kg/ontology package owns the core ontology object model migrated out of agent-utilities: object_set, property_types, derived_properties, links, the functions, edits, and indexing modules, classification_claims, permissioning, document_processing, schema_graph, ops_causal_crosswalk, repository_provenance, style_lint, and the generic object-path and object-collection utilities. The sync_conflict and leanix_metamodel modules remain outside this package as connector-SDK concerns. | A focused unit-test run over the migrated kg/ontology modules passes with no behavior regression against the prior agent-utilities implementation.
requirementEG-TYPED-PACKSLANDED64b30a5187f3
90f5578ae2f4
EG-TYPED-PACKS-R082
EG-generated types replace hand-written graph-schema DTOs
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**EG-generated types replace hand-written graph-schema DTOs.** epistemic-graph's generated contract types replace agent-utilities' hand-written DTOs for models/knowledge_graph, models/schema_definition, models/evidence_bundle, models/knowledge_pack, models/codemap, models/graph, models/knowledge_base, and the schema_pack and schema_packs modules. The kg/domain_packs module migrates to the same generated types once AU-SEMANTIC-R005 removes its separate pack_loader path. | Unit tests comparing callers against the EG-generated types confirm behavioral parity for each migrated model module.
requirementEG-TYPED-PACKSLANDED08a2b1958cc3
90f5578ae2f4
EG-TYPED-PACKS-R083
Schema-drift SHACL rendering and contract store move into EG
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Schema-drift SHACL rendering and contract store move into EG.** EG owns schema-drift SHACL rendering, contract_store, and activation modules, replacing the prior agent-utilities implementation. The connector-SDK sync runner invokes EG's drift gate between drain and apply. EG covers detection, shaping, classification, and reporting. The SDK does not render SHACL. | Integration tests drive connector-SDK sync through drain and apply. They assert EG's drift gate and SHACL rendering run as dependencies. No SHACL generation remains in agent-utilities.
requirementEG-TYPED-PACKSLANDED90f5578ae2f4
97e9074f0467
EG-TYPED-PACKS-R084
Request deadlines propagate into long-running pack operations
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Request deadlines propagate into long-running pack operations.** A pack import, classification, or derivation observes the client's request deadline and cancellation signal and releases the tenant's pack lock on cancellation rather than continuing to hold it once the deadline has passed, so later pack operations for that tenant are not blocked behind abandoned work. | An integration test cancels an in-flight import at its deadline and asserts the next bind for the same tenant proceeds without waiting on the abandoned lock.
requirementEG-TYPED-PACKSVERIFIED147959ad6f13
90f5578ae2f4
src/server/handlers/admin/connector_pack/tests/ontology.rs:87
EG-TYPED-PACKS-R085
Identity domain operations with Argon2id and redacted views
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Identity domain operations with Argon2id and redacted views.** A family of identity operations covering user, credential, session, token, MFA, API key, role, group, identity-provider, link, audit, and throttle actions is implemented in crates/eg-types/src/identity/ and dispatched through src/server/dispatch/router/identity_store.rs and crates/eg-capabilities/src/domains/security.rs. Credential verification uses argon2id inside EG, pgwire views expose identity data redacted, and the kernel exposes an identity catalog supporting DDL export and import. | Unit and integration tests exercise each identity operation, assert redaction in the pgwire view, and confirm the identity catalog's DDL export and import round-trip.
requirementEG-TYPED-PACKSSPECIFIED0035f9fac382
90f5578ae2f4
EG-TYPED-PACKS-R085.1
Durable session record projection
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Durable session record projection.** Existing Resolve adds optional session_record with opaque stored reference, creation-bound deployment tenant, principal, idle/absolute expiry and nullable MFA timestamp. Legacy/unbound and API-key resolutions omit it. Credential validation, pending-MFA behavior and authority remain unchanged; Arbora owns admission. | Native persistence/replay and post-touch tests, omitted legacy/API-key metadata, unchanged refusal tests, and caller-stamp replacement. No served admission qualification is claimed.
requirementEG-TYPED-PACKSSPECIFIEDcrates/eg-core/src/isolation/identity_store_tests.rs:463
crates/eg-core/src/isolation/identity_store_tests/session_evidence.rs:5
crates/eg-types/src/identity/tests/session_evidence.rs:128
crates/eg-types/src/identity/tests/session_evidence.rs:142
crates/eg-types/src/identity/tests/session_evidence.rs:34
EG-TYPED-PACKS-R085.3
Served session-liveness check by opaque session reference
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Served session-liveness check by opaque session reference.** A served identity operation takes the opaque session reference from `EG-TYPED-PACKS-R085.1`. It returns exactly one of `live`, `revoked` or `expired`. It judges from stored expiry and revocation state. It never takes, returns or logs the raw token. A reference outside the caller's deployment tenant gets the typed refusal for an unknown reference. API-key and external-identity callers with no session get a defined `not_session_bound` answer. That answer differs from `revoked` and `expired`. The check never touches the session. It does not extend idle expiry. Arbora consumes this check in `ARBORA-IDENTITY-R029.6`. | A live session answers `live`. After revoke and revoke_all it answers `revoked`. After idle and absolute expiry under a fake clock it answers `expired`. API-key and external-identity callers answer `not_session_bound`. Unknown and cross-tenant references get refused. The wire carries no token text. Idle expiry stays unchanged.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R085.2
Remaining identity-domain qualification
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Remaining identity-domain qualification.** Preserve the parent R085 acceptance beyond the narrow durable session projection: exercise every existing identity operation, redacted pgwire views, and identity catalogue DDL export/import round trips. The R085.1 storage fixtures do not qualify served authentication, host admission or browser lifecycle; those remain Arbora integration obligations. | Execute the parent operation, pgwire-redaction and catalogue round-trip suites against the qualifying implementation; retain explicit pending status until that evidence exists.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R085.7
Rollup through R085.7.1–R085.7.3
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Rollup through R085.7.1–R085.7.3.** **Original session reference inspection.** Resolve an exact stored opaque reference through the existing identity store. Require the stamped owner, matching tenant, active principal and live completed session. Return durable facts without touching expiry or issuing credentials. Refuse ambiguous references and delegated callers. | Native owner/refusal and durable reopen tests. Contract generation and native execution remain pending until qualified.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R085.4
Rollup through R085.4.1–R085.4.3
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Rollup through R085.4.1–R085.4.3.** **Idle session renewal uses global authority CAS.** Inspect returns facts and the global identity/RBAC revision from one snapshot. Renewal requires that exact revision at the existing durable commit boundary. Require the same owner, tenant and scopes, with an active principal and live completed session. Capture effective scopes at session creation. Renewal scopes must remain within that original ceiling; missing legacy evidence refuses. Extend idle expiry only within the unchanged absolute expiry. Refuse stale revisions, scope changes and expired or revoked sessions. No credential or approval is renewed. | Native durable CAS/reopen tests cover stale revisions, scope mismatch, expiry and revocation without resurrection. Native execution and generated contract qualification remain pending.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R086
Planted derivation-budget and malformed-path cases are refused
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Planted derivation-budget and malformed-path cases are refused.** A connector pack import that would require an unbounded derivation budget completes within its declared budget or refuses with a typed error rather than timing out, and an import containing a malformed path is refused rather than imported. | Planted-fixture tests for the derivation-budget and malformed-path cases each assert the correct refusal or typed-error outcome.
requirementEG-TYPED-PACKSLANDED334a69c2e3de
90f5578ae2f4
EG-TYPED-PACKS-R087
Stable error codes for auth-boundary refusals
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Stable error codes for auth-boundary refusals.** An authorization refusal raised in auth::claims::validate_deployment_binding for a tenant, audience, or policy-version mismatch returns a stable error code, such as AUTH_TENANT_MISMATCH, in Response.error, with the descriptive free-text message retained only as supplementary detail. | Unit tests assert each auth-boundary refusal path returns its documented stable error code rather than only a free-text message.
requirementEG-TYPED-PACKSLANDED48746fc0e5ac
90f5578ae2f4
EG-TYPED-PACKS-R088
Embedded engine enforces graph-level access control
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Embedded engine enforces graph-level access control.** The in-process engine (crates/eg-pyengine, EmbeddedTransport) enforces the same graph-level read authority as the served engine, refusing GetNodeProperties for another principal with ACCESS_DENIED instead of returning data filtered only per caller property, or explicitly refuses multi-principal use. Embedded transport methods beyond CreateGraph, AddNode, GetNodeProperties, HasNode, and NodeCount are added through one table-driven result-contract mapping so parity with the served engine holds by construction. | tests/parity/test_parity_graph_ops.py::test_get_node_properties_rls_isolation and related parity tests assert embedded and served access-control behavior match.
requirementEG-TYPED-PACKSVERIFIED88499bb6424b
90f5578ae2f4
tests/parity/test_parity_graph_ops.py:74
EG-TYPED-PACKS-R089
Blob-layout table for pack body holder rows
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Blob-layout table for pack body holder rows.** The owner storage layout includes a connector_pack_body_holders table, defined in crates/eg-storage/src/owner/registry.rs as part of OwnerLayout::Blob, to hold pack body holder rows. | crates/eg-storage/src/owner/tests.rs::owner_layout_registry_has_frozen_cardinality pins the OwnerLayout::Blob table count so an untracked addition or removal fails the test.
requirementEG-TYPED-PACKSVERIFIED90f5578ae2f4
b43f33569dd4
crates/eg-storage/src/owner/tests.rs:18
EG-TYPED-PACKS-R090
Canonical ontology and SHACL artifacts generated from Rust
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Canonical ontology and SHACL artifacts generated from Rust.** The canonical ontology and SHACL shape artifacts are generated deterministically from the typed Rust vocabulary, which owns the core ontology and shape corpus as the single source of truth, and regeneration reproduces identical output across runs. Rollup: delivered by its child requirements, in order. | A regeneration test re-emits the ontology and SHACL artifacts from the Rust vocabulary and diffs them against the checked-in output for byte equality.
requirementEG-TYPED-PACKSLANDED080677a31fdd
90f5578ae2f4
EG-TYPED-PACKS-R090.1
A typed-vocabulary-to-Turtle generator reproduces checked-in output byte-for-byte
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**A typed-vocabulary-to-Turtle generator reproduces checked-in output byte-for-byte.** One typed Rust vocabulary module declares its classes and properties in a fixed order and renders canonical Turtle text; regenerating from the same declaration twice, and against the checked-in fixture, is byte-identical. This proves the generation mechanism before the existing `crates/eg-core/ontology/*.ttl` corpus migrates onto it in later child requirements. | A unit test regenerates the module's Turtle twice and against a checked-in fixture and asserts byte equality, plus a negative test confirming a changed module does not match the fixture.
requirementEG-TYPED-PACKSLANDED080677a31fdd
EG-TYPED-PACKS-R091
Food composition and nutrient reference types
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Food composition and nutrient reference types.** USDA FoodData Central and FoodOn source data map into FoodTerm, FoodCompositionRecord, and NutrientAmount records, with FDC nutrient identifiers mapped through a ChEBI crosswalk table, and DRI, EFSA, and NRC reference tables map into NutrientReferenceIntake records. | Unit tests validate the FDC-to-ChEBI nutrient mapping and confirm imported records conform to the FoodTerm, FoodCompositionRecord, NutrientAmount, and NutrientReferenceIntake schemas.
requirementEG-TYPED-PACKSLANDED90f5578ae2f4
a1bb9fb9503e
EG-TYPED-PACKS-R092
Python client idempotency key excludes the request ID
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Python client idempotency key excludes the request ID.** The Python client's default idempotency key for a connector pack import is derived from the connector, content digest, and expected head, and excludes the request ID, so a retried request after a transport loss reuses the identical import operation key rather than generating a new one. | tests/test_connector_pack_client.py::test_transport_loss_retry_reuses_the_exact_import_operation_key asserts a retried import reuses the identical idempotency key after simulated transport loss.
requirementEG-TYPED-PACKSVERIFIED90f5578ae2f4
b43f33569dd4
f097533e52c8
tests/test_connector_pack_client.py:366
tests/test_connector_pack_client.py:411
EG-TYPED-PACKS-R093
Turtle parser blank-node identities do not collide
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Turtle parser blank-node identities do not collide.** Each Turtle parse produces blank-node identities scoped to that parse, so unioning the results of independently parsed graphs introduces no blank-node identity collision. | Blank-node isolation tests covering the reproject path assert no identity collision when independently parsed graphs are unioned.
requirementEG-TYPED-PACKSVERIFIED481fa6ea2c55
90f5578ae2f4
a60419de4cf7
c764285d098c
f17f47ab300f
crates/eg-rdf/src/mapping/parsing.rs:172
src/server/handlers/admin/connector_pack/tests/outbox.rs:181
EG-TYPED-PACKS-R093.1
Public Turtle parse identity locality
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Public Turtle parse identity locality.** Bounded and unbounded public Turtle parses allocate independent blank-node identities while retaining within-document references. Existing catalogue composition preserves explicit source labels before applying its own namespace. | Bound native parser tests union repeated labels from independent parses, include anonymous nodes, verify repeated references, and retain bounded refusal behavior.
requirementEG-TYPED-PACKSVERIFIEDa60419de4cf7
crates/eg-rdf/src/mapping/parsing.rs:172
EG-TYPED-PACKS-R093.2
Reproject-path blank-node isolation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Reproject-path blank-node isolation.** Verify independently parsed connector-pack members through the served reproject path, preserving deterministic catalogue identity and eliminating cross-member blank-node collisions. | Execute a served reproject regression that unions reused member labels and verifies isolated identities and repeatable composed digests.
requirementEG-TYPED-PACKSVERIFIED481fa6ea2c55
c764285d098c
src/server/handlers/admin/connector_pack/tests/outbox.rs:181
EG-TYPED-PACKS-R094
AgentComponent.content serves pack body bytes directly
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**AgentComponent.content serves pack body bytes directly.** Rollup: every child below is required; the original acceptance remains mandatory. AgentComponent.content returns verified body bytes for a Stable, Python-visible method rather than a METHOD_NOT_YET_SERVED refusal once pack-body content serving is implemented. Because the reachability gate only permits a refusal-only arm for an Internal or no-consumer method, this method's compliance is not mechanically enforced and must be verified directly. | An integration test calls AgentComponent.content on the Stable method and asserts it returns verified body bytes rather than METHOD_NOT_YET_SERVED.
requirementEG-TYPED-PACKSSPECIFIED90f5578ae2f4
a1bb9fb9503e
EG-TYPED-PACKS-R094.1
Original Stable content route
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Original Stable content route.** Model: The existing Python-visible AgentComponent.Content method remains Stable. Behavior: Return verified pack body bytes through the real method. Wiring: Exercise `src/server/handlers/admin/component_content.rs:55` from authenticated public dispatch. Refusal: METHOD_NOT_YET_SERVED is not a successful result for this method. Evidence: A generated Python client reads exact verified pack body bytes. | Proposed test: `tests/test_connector_pack_content.py::test_stable_content_returns_body`. A generated Python client reads exact verified pack body bytes. A refusal-only dispatch arm fails this acceptance.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R094.2
Pinned native blueprint export
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Pinned native blueprint export.** Model: The export envelope carries identity, exact revision, schema, complete payload, provenance and body digest. Behavior: Read one pinned version and export every admitted field without a second prompt authority. Wiring: Extend `src/server/handlers/admin/agent.rs:142` and reuse the verified content reader. Refusal: Mixed-revision reads, unresolved pins and denied scope refuse. Evidence: Export preserves nested extension values, nulls, arrays and exact numeric values. | Proposed test: `tests/test_prompt_blueprints_served.py::test_lossless_blueprint_export`. Export preserves nested extension values, nulls, arrays and exact numeric values. An omitted field, changed revision or lost numeric precision fails.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R094.3
Modified native blueprint import
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Modified native blueprint import.** Model: A modified envelope names the same component identity and exact expected base revision. Behavior: Validate and persist a new revision through R002.7 after the existing publication policy admits it. Wiring: Extend `src/server/handlers/admin/agent.rs:142` and `src/server/persistence/agent_component/write.rs:39`. Refusal: Stale bases, malformed envelopes, changed identity and denied tenants refuse without mutation. Evidence: Changing one field creates one new revision and preserves every other field. | Proposed test: `tests/test_prompt_blueprints_served.py::test_modified_blueprint_import`. Changing one field creates one new revision and preserves every other field. Concurrent writers cannot overwrite a newer head; reserved pack identities require pack admission.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R094.4
Blueprint retry identity
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Blueprint retry identity.** Model: The operation identity binds tenant, component, base revision and submitted content digest. Behavior: A lost-reply retry returns the same receipt; unchanged content follows the existing no-op contract. Wiring: Reuse `src/server/persistence/agent_component/write.rs:39` and existing owner replay. Refusal: Reusing the operation identity with different content refuses. Evidence: Replay produces no extra revision, holder or outbox event. | Proposed test: `tests/test_prompt_blueprints_served.py::test_blueprint_retry_identity`. Replay produces no extra revision, holder or outbox event. A conflicting retry preserves the prior committed result.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R094.5
Served lossless round trip
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Served lossless round trip.** Model: The fixture includes nested values, extensions, nulls, Unicode and exact numbers. Behavior: Export, modify, reimport, restart and independently read the native blueprint. Wiring: Exercise the generated public operations through `src/server/handlers/admin/agent.rs:142` and verified content serving. Refusal: Any field loss, silent schema migration or unauthorized mutation fails. Evidence: The new revision contains the one intended change and all unchanged values. | Proposed test: `tests/test_prompt_blueprints_served.py::test_blueprint_roundtrip_restart`. The new revision contains the one intended change and all unchanged values. Stale import and denied-tenant cases preserve both historical and current readback.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R094.6
Optimization proposals carry no authority
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Optimization proposals carry no authority.** Model: A proposal pins the source revision, proposed payload digest and comparison evidence. Behavior: Store or export a proposal without treating it as publication authority or a repository write grant. Wiring: Extend `crates/eg-types/src/agent_component.rs`; consume existing policy admission in `src/server/handlers/admin/agent.rs:142`. Refusal: A proposal cannot supply its own approval, actor scope or permission. Evidence: Authorized graph adoption uses the normal publication boundary and records the source revision. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_proposal_has_no_authority`. Authorized graph adoption uses the normal publication boundary and records the source revision. A proposal alone causes no active-head change, model dispatch or external write.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R094.7
Approved repository-source effect dependency
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Approved repository-source effect dependency.** Model: The external effect binds repository, path, base revision, payload digest, approved actor and receipt. Behavior: Retain SDK execution and GraphOS authorization as prerequisites; never implement a filesystem writer inside EG. Wiring: R094.2 supplies the export. Consume SDK-GOVERNED-WRITEBACK-R004.5 through R004.12 and ARBORA-FLEET-R003.4 through R003.10; plan.md pins both merged definitions. Refusal: Missing approval, stale source base, path escape and unbound receipts prevent an external effect. Evidence: A real authorized producer journey writes only the approved source and returns a bound receipt. | Proposed test: `tests/test_prompt_blueprints_served.py::test_approved_source_effect_dependency`. A real authorized producer journey writes only the approved source and returns a bound receipt. Absent producers leave this acceptance unfulfilled; graph persistence cannot substitute.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R095
GraphSchema attach exposes snapshot staleness
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**GraphSchema attach exposes snapshot staleness.** Attaching a graph schema to another graph produces a snapshot, and the schema's staleness relative to its source is visible to readers rather than silently assumed current. | A contract test attaches a graph schema, mutates the source, and asserts the staleness indicator reflects the divergence.
requirementEG-TYPED-PACKSLANDED90f5578ae2f4
f4744679fab0
EG-TYPED-PACKS-R096
Connector-pack reprojection with bounded, isolated aggregates
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Connector-pack reprojection with bounded, isolated aggregates.** handlers/admin/connector_pack/reproject.rs and the persistence/connector_pack, persistence/connector_pack/commit, and persistence/connector_pack/projection modules reproject a connector pack's committed head with bounded per-document aggregates and blank-node isolation across reprojected documents, and a reprojection survives a restart without losing a prior commit or looping. | Restart-replay and no-loop tests covering the reproject and persistence modules assert bounded aggregation, blank-node isolation, and idempotent recovery after restart.
requirementEG-TYPED-PACKSLANDED90f5578ae2f4
d76ac1402723
EG-TYPED-PACKS-R097
Domain vocabularies ship as typed domain packs
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Domain vocabularies ship as typed domain packs.** Human-resources, legal, medical and government domain vocabularies — classes, enumerations, properties and their alignment to upper ontologies — are published as typed, versioned domain packs through the pack import boundary, so any agent or connector reads one governed definition from the engine instead of carrying its own model classes. Agent Utilities' `domains/hr`, `domains/law`, `domains/medical`, `domains/government` and `models/domains` modules are the source material and are deleted there once the packs are published and their callers read the packs. Rollup: delivered by its child requirements, one per domain plus the cutover. | Pack validation and import tests pass for each domain pack, a round-trip test shows the published classes and enumerations match the source declarations, and a caller census shows no remaining import of the retired model modules.
requirementEG-TYPED-PACKSSPECIFIED6a1a0e46d99f
90f5578ae2f4
EG-TYPED-PACKS-R097.1
HR domain vocabulary ships as a typed domain pack
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**HR domain vocabulary ships as a typed domain pack.** The human-resources domain vocabulary — classes, enumerations, properties and alignment to an upper ontology — is modeled as one typed, versioned `DomainPack`, drawn from `crates/eg-core/ontology/hr-v1.ttl`. The pack validates its own internal consistency (no empty, duplicate or dangling-reference declarations) before any later wiring through the pack import boundary. | A validation test proves a well-formed HR pack passes and each malformed case (no classes, duplicate class, dangling property domain) is refused, and a round-trip test shows the published classes and enumerations match the source declarations.
requirementEG-TYPED-PACKSLANDED6a1a0e46d99f
EG-TYPED-PACKS-R097.2
Domain crosswalks and exact unmapped-class reports (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Domain crosswalks and exact unmapped-class reports (rollup).** Extend R097 with medical, technology and labor crosswalks to SKOS and Schema.org. Reuse R071.1 records and keep ontology authority inside EG. Children `.1` through `.6` define this contract. | All six children require served acceptance. Domain model validation alone does not close this rollup.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R097.2.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Extend `DomainPack` with versioned crosswalks and `CrosswalkCoverage{declared,mapped,unmapped,source_digest}`. Each unmapped item carries its class IRI and `NoDeclaredMapping` reason. Add `Technology` to `DomainPackKind`; labor uses existing `Hr`, and medical uses existing `Medical`. Preserve the existing HR model and its validation. | Round-trip the three domain fixtures. Unknown domain kinds and coverage entries outside the declared class set refuse.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R097.2.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Compute coverage over every class declared by the selected pack revision. A class is mapped only when it has a validated declared crosswalk. Return the exact sorted set difference as unmapped classes. Missing mappings never infer equivalence or import external authority. Reuse R071.1 bounds and typed vocabulary generation. | Medical, software/technology and HR/labor fixtures each include mapped and unmapped classes. Reordering input preserves coverage and generated bytes.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R097.2.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Extend `validate_and_commit` in `src/server/handlers/admin/connector_pack/import.rs:45` before publishing a pack head. Its production caller is `serve_import` in `src/server/handlers/admin/connector_pack.rs:132`. Validate crosswalks again at `src/server/graph_schema.rs::apply_pack_source` before activating schema. Extend the existing served `OntologyInspect` result with revision-bound coverage. The domain-to-import crosswalk path does not exist today; this row creates the call site. | A signed domain pack reaches import, schema attachment and inspection. Reports must match the imported revision, not a separate helper fixture.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R097.2.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** Missing mappings produce explicit unmapped results and never count as full coverage. Invalid mappings use R071.1 typed refusals and block pack publication or schema activation. Source resolution uses the selected pack revision, not the global class catalog. Unknown or out-of-scope sources never become unmapped entries. Reject stale vocabulary revisions and caller-forged origin or coverage with `CROSSWALK_REVISION_MISMATCH` or `CROSSWALK_EVIDENCE_INVALID`. | Refused imports preserve pack heads, receipts and active schema digests. An unmapped class stays declared and appears once in coverage.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R097.2.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Bind coverage to tenant, graph, pack digest, pack revision, target vocabulary revision and committed schema digest. Return exact mapped and unmapped class sets with reasons and declared totals. Source connectors only supply candidate data; EG validates and records authority. | Independent pack-status and schema reads agree with coverage. A caller cannot substitute a report from another tenant or revision.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R097.2.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** Entry point: authenticated `ConnectorPack.Import`, schema attachment, `OntologyInspect` and `GraphSchemaClasses` through the generated client. `tests/test_ontology_crosswalk_served.py::test_domain_coverage_and_refusals` loads medical, technology and labor fixtures. It exercises unmapped results, unknown and out-of-scope source classes, conflicting mappings, stale revisions, category violations and restart readback. | The real server returns exact coverage and declared mappings. Independent reads prove rejected imports cannot change committed state. No helper-only result establishes acceptance.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R098
Ontology inspection method and inline data triples for validation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Ontology inspection method and inline data triples for validation.** The engine serves a read-only OntologyInspect method that parses caller-supplied or composed schema sources and returns a typed inspection report of the classes, properties and shapes they declare, and ShaclValidate accepts data triples supplied inline in the request so a caller can validate triples it holds without first writing them to a graph. Both are part of the generated wire contract and available from the Python client. | Handler tests cover inline, composed and source-filtered inspection and a malformed-source refusal; a validation test proves inline data triples are validated without any graph write; the read-classification partition test includes the new method; a Python client test calls both through the generated sender.
requirementEG-TYPED-PACKSLANDED90f5578ae2f4
cc6536f05e17
EG-TYPED-PACKS-R099
Best-matching prototype by cosine similarity in the numeric kernel
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Best-matching prototype by cosine similarity in the numeric kernel.** The in-process numeric extension exposes best_cosine_prototype(query, prototypes), returning nothing when no prototype has a strictly positive cosine with the query and otherwise the index of the first prototype with the maximum positive cosine together with that score. Empty and zero vectors yield no match, a prototype whose length differs from the query is refused with a shape error unless it is all zero, non-finite inputs follow the numeric kernel's existing policy, and the binding enforces the kernel's aggregate input bounds. It is an in-process function, not an engine wire method. | Rust unit tests cover first-wins positive maximum, empty, zero and negative cases and ragged shapes; installed-binding Python tests cover the same behaviours, the aggregate input limits and the call shape used by the downstream semantic client.
requirementEG-TYPED-PACKSVERIFIED157b4417eb24
3fe75684934d
90f5578ae2f4
crates/eg-numeric/src/prototype.rs:45
crates/eg-numeric/src/prototype.rs:60
crates/eg-numeric/src/prototype.rs:70
EG-TYPED-PACKS-R100
Skill packages are rendered on demand from graph content (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Skill packages are rendered on demand from graph content (rollup).** The engine renders a skill package from the content and ontology references held in the graph, so the package tracks the latest ingest. Children .1-.6. | Rollup closes when children .1-.6 are verified.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `RenderedSkillPackage` in new file `crates/eg-types/src/fleet_catalog/rendered.rs`. It carries the skill uri, the content digest, the ontology references used and the graph revision it was rendered from. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::rendered_package_round_trip`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Add `render_skill_package(entry, graph) -> RenderedSkillPackage` in `src/server/dispatch/consensus/fleet_catalog/rendered.rs`. Each rule is a named, replaceable default: include the skill body, the ontology terms it references, and the code delta since the last render. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::render_reflects_latest_ingest`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Call `render_skill_package` from `skill_row` at `src/server/dispatch/consensus/fleet_catalog/project.rs:271`. The fleet catalog listing calls `skill_row` for every skill in production. The package is rendered on read and never cached. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::catalog_listing_renders_current_content`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** `render_skill_package` must return the typed refusal `RenderRefusal::DanglingOntologyRef` when a referenced term is absent from the graph. The row must stay listed without a package. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::dangling_reference_is_refused`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each rendered package must carry the graph revision and the content digest. A reader tells whether two renders came from the same revision. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::render_carries_revision_and_digest`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** Entry point: the fleet catalog list wire method. The test ingests a skill, lists it, changes the referenced code, ingests again and lists again. It must observe a new digest and revision on the second listing. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::list_after_reingest_returns_new_digest`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.7
Exact rendered-package validation gate
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Exact rendered-package validation gate.** Extend the existing `render_skill_package`/fleet-catalog `skill_row` path: before a rendered candidate is exposed as publishable, bind a `RecordedRunValidationV1` to `{tenant_id, skill_iri, candidate_revision, package_content_digest, graph_revision, validation_policy_ref:{policy_iri, policy_revision}, run_set_complete, run_set_digest, run_refs:[{run_ref, package_content_digest, graph_revision, policy_revision, outcome, evidence_digest}], verdict, evaluator_ref}`. `run_refs` are unique and sorted by `run_ref`; `run_set_digest` hashes their canonical encoding. Every run must attest the same package digest/graph revision and policy revision; `run_set_complete` must be true. A missing, failed, stale, cross-tenant, partial, or mismatched receipt returns a typed refusal and no publishable package; preserve R100 dangling-reference behavior and do not duplicate the existing rendered package revision/digest. `skill_row` remains the existing projection/attach point; AU `record_outcome`/`SkillGraphPipeline` is the candidate source, while EG checks receipt binding. Preserve `AU-HARNESS-R022.2/.5/.6`, `AU-HARNESS-R004.1`, and `EG-TYPED-PACKS-R100.1/.5/.6`. Owner source hash: `96ff38761f9e21d52f608ba593c902aff4c93ca7b1ed13088ad39efd3e968a3a`. **Hold:** those AU rows do not define a recorded-run validation operation, exact receipt producer/fields, or the policy's pass criterion/run-set selection. AU must publish that producer contract before a positive publication path can be closed; absent receipt already refuses. This row remains SPECIFIED. | Planned acceptance: an exact-package passing receipt admits the catalog candidate; absent receipt and each digest/revision/policy/tenant mismatch, partial run set, or failing verdict suppresses the package with a typed refusal. Verify R100.4 dangling ontology behavior remains. The positive AU producer journey is held until its exact owner operation and validation rubric are defined; no runtime or served receipt is claimed.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R097.2.7
Directional external-schema import and complete unmapped-term report
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Directional external-schema import and complete unmapped-term report.** Extend `ConnectorPack.Import::validate_and_commit` before pack-head commit and `apply_pack_source` before schema activation for the external-to-platform direction. A pinned `ExternalTermMappingV1` binds `{source_schema_digest, source_revision, external_iri, external_kind, platform_iri, platform_kind, mapping_revision}`. The closed supported source kinds are `Class`, `ObjectProperty`, `DatatypeProperty`, `AnnotationProperty`, and `NamedIndividual`; an enumeration is represented by its class plus named individuals. The importer identity is server-stamped from the authorized `ConnectorPack.Import` request; only a declared mapping with kind-compatible platform target is adopted, and it preserves the original external IRI/kind as provenance. `ExternalOntologyCoverageV1` is `{source_schema_digest, source_revision, pack_revision, schema_revision, mapping_revision, platform_vocabulary_revision, terms, coverage_digest}`; `terms` are sorted `{external_iri, kind, result: Mapped{platform_iri, provenance_digest} | Unmapped{reason: NoDeclaredMapping}}` for every declared term; unmapped terms are reported and not added as platform terms, while a pack with partial coverage may still commit under existing R097.2 rules. Refuse malformed/duplicate terms, incompatible mappings, unknown kinds, forged or stale revisions, and mappings outside the pinned source schema before mutation. Serve full per-term coverage from existing `OntologyInspect`; independently read `GraphSchemaClasses` to verify adopted classes and that unmapped classes were not activated. This is directional ingestion; R071.1's EG-class-to-external-vocabulary links do not imply reverse normalization and remain unchanged. Preserve `EG-TYPED-PACKS-R051`, `EG-UNIFIED-DATA-PLANE-R005/R037`, `EG-TYPED-PACKS-R071.1.1-.6`, and `EG-TYPED-PACKS-R097.2.1-.6`. Owner source hash: `318723aee15c476039eca669a3230b206532c0c704b37efad5a7c49690bbb9c2`. This remains SPECIFIED. | Planned acceptance: import a pinned schema with mapped and unmapped instances of every supported kind; independently inspect the committed revision and verify exact sorted coverage, mapped target and source provenance, with unmapped terms absent from active schema. Refuse unsupported kind, duplicate IRI, kind mismatch, stale map/schema, out-of-scope source and forged report with no change to pack head or active schema. Reordered inputs produce identical coverage and digest. No runtime or served result is claimed.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.8
Lossless versioned workflow RDF export/import
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Lossless versioned workflow RDF export/import.** Define `WorkflowRdfDocumentV1` as `{workflow_iri, skill_iri, workflow_revision, workflow_version, stored_version_ref, graph_revision, ontology_revision, canonical_nquads, dataset_digest, serializer_id, serializer_version}` and expose `ExportWorkflowRdfV1(workflow_iri, requested_workflow_version, stored_version_ref) -> WorkflowRdfDocumentV1` plus `ImportWorkflowRdfV1(document) -> WorkflowImportReceiptV1{workflow_iri, committed_workflow_revision, graph_revision, dataset_digest, importer_id}` in the existing skill-package owner. Export serializes every workflow statement, named-graph identity, literal datatype/language and referenced ontology IRI as canonical N-Quads using the document-pinned serializer; `dataset_digest` is SHA-256 of those canonical UTF-8 bytes. Import validates that digest and graph isomorphism, then restores the exported dataset without dropping unknown workflow predicates. Attach the export to the existing R100 skill rendering/catalog path; import is admitted through the existing graph write boundary and returns the committed workflow revision. An export-time version check must refuse when the exported workflow version is not strictly newer than the stored workflow version. Preserve `EG-TYPED-PACKS-R051/R090/R100.1-.6`. Owner source hash: `620b1ae05d8e35696c7522f207672ef6f374525004d5488fe62fb4b27fc6cf5a`. **Hold:** reviewed evidence does not identify which persisted workflow/version record is the comparison baseline, the version ordering grammar, or the existing R100 consumer operation that imports these documents. Keep the export-time comparison requirement; do not move it to import. The row remains SPECIFIED pending that owner decision and exact attach-point link. | Planned acceptance: round-trip a workflow containing named graphs, typed and language-tagged literals, ontology references and an unknown workflow predicate; compare canonical dataset digest and graph isomorphism. Tampered digest, malformed RDF, unresolved references and unsupported serializer version refuse without graph mutation. At export, equal/older versions refuse and newer passes once the stored-version baseline/order is resolved. The version-baseline/consumer-link cases remain held; no implementation or receipt is claimed.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R069.100
Semantic fingerprint separates cosmetic from structural repository changes
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Semantic fingerprint separates cosmetic from structural repository changes.** Define `FingerprintIdentityV1` as repository id, branch/ref id, normalized path, commit/source revision, blob/raw digest, language id, parser implementation/version, normalization-policy revision and grammar digest. The versioned profile registry lists each supported language and trivia/comment forms removed from its canonical token stream; strings, literals, token order and all non-trivia tokens are preserved. Hash canonical tokens together with language/parser/profile versions. Unsupported languages use raw-content digest and are never classified as cosmetic. A full no-op is allowed only when the complete identity and profile revision match an already committed binding. Same bytes at a new branch, path or source revision are a new binding and must update source revision/provenance; parsed tokens may be reused only if language/parser/profile identity matches. Parser/profile revision changes force reparse and recompute before deciding graph mutation; always persist the new source binding even when semantics are unchanged. SDK transports raw revision/digest only; EG owns semantic classification. Producer/consumer boundary: RepositorySnapshotProvider -> SDK transport -> generated `IndexRepository` -> EG parser/index mutation; R079 embedding dedupe is not structural-mutation suppression. Preserve existing parent obligations `EG-TYPED-PACKS-R069`, `EG-REPO-INGEST-R006`, `SDK-SOURCE-INGEST-R004`. Source record AU:69 SHA-256 `8ca81dc16448fefc73440f2eb9ea07b2e433f7e38075563f86800071029846e9`; parent R069 remains unchanged. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_repository_fingerprint_identity_served.py::test_source_identity_profile_drives_mutation_decision`, `tests/typed_packs/test_repository_fingerprint_identity_served.py::test_unsupported_language_uses_raw_digest_only`. | Planned served acceptance: Same full identity/profile is idempotent. Same blob at a new branch or path creates the new source binding and provenance while reusing parse output only under identical parser/profile. A changed parser/profile reparses and re-fingerprints even when raw bytes match. Cosmetic-only change updates source revision/provenance without semantic graph mutation; structural change mutates semantic graph. Planned tests separately assert source-binding and semantic-graph revisions for each case; no implementation or runtime receipt is claimed.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.100
Lossless SKILL.md frontmatter and step editing round trip
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Lossless SKILL.md frontmatter and step editing round trip.** Define an edit representation bound to the original SKILL.md byte digest, source revision, frontmatter field spans, step spans, line endings and unknown/custom-field spans. Apply edits as bounded source-range patches; do not parse and reserialize the entire document. Preserve all untouched bytes, ordering, spacing, comments, line endings and unknown frontmatter fields; emit new content digest and source provenance. Continue to enforce R019 SKILL.md-only import and R029 restricted YAML validation. Producer/consumer boundary: EG owns skill parse/admission and R100 rendering; SDK owns source transport/edit write-back edge. No prompt blueprint or whole-document normalization path is substituted. Preserve existing parent obligations: `EG-TYPED-PACKS-R019; R029; R100.1-.6; SDK source-ingestion owner`. Source record `AU:90` SHA-256 `1b717c4a284896dbf8c7b4fb1f00ebba80fa6a75e930a020c5bc01706634f582`; parent `R100` remains unchanged. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_skill_lossless_edit_served.py::test_frontmatter_and_step_edits_preserve_unmodified_bytes`, `tests/typed_packs/test_skill_lossless_edit_served.py::test_stale_or_ambiguous_edit_refuses_before_write`. | Planned served acceptance: Served export/edit/reimport test changes one frontmatter value and one step while asserting all non-target byte ranges, custom fields, comments, spacing, ordering and CRLF/LF style are identical. Malformed anchors, overlapping patches, stale source digest and unknown edit spans refuse without write. Prompt-blueprint JSON roundtrip is not accepted as evidence. Owner-source review only; no runtime/test receipt is inferred.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R100.101
Skill consumer compatibility and declared-migration admission
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Skill consumer compatibility and declared-migration admission.** Define an admission record bound to prior/new skill content digests, consumer-declared input/output behavior contract revisions, observed consumer cohort, compatibility verdict, migration id/digest and admission revision. Compatibility is checked against consuming-code behavior, not package version equality, contract-pin equality, endpoint certification or dependency digest alone. A breaking change is refused before publication/invocation unless a declared migration is bound to the exact old/new digests and consumer contract and its migration receipt passes. Producer/consumer boundary: EG skill package read/admission -> GraphOS invoke certification and consumer code; GraphOS owns its invocation gate. Do not equate existing version/dependency pins with compatibility. Preserve existing parent obligations: `EG-TYPED-PACKS-R100.1-.6; ARBORA-FLEET-R034.7-.10`. Source record `AU:98` SHA-256 `531cb0ba1accd9e88833249fb253a9f5f7a3c1a911f653b3c9a5bfc42341f978`; parent `R100` remains unchanged. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_skill_compatibility_admission_served.py::test_breaking_upgrade_requires_exact_consumer_migration`, `tests/typed_packs/test_skill_compatibility_admission_served.py::test_changed_consumer_contract_invalidates_admission`. | Planned served acceptance: Serve compatible upgrade, breaking upgrade without migration (refused before effects), and breaking upgrade with exact declared migration. Changing a consumer contract, package digest or migration receipt invalidates admission. Keep historical package readable and read back the admitted new version only after validation. Owner-source review only; no runtime/test receipt is inferred.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R001.100
Versioned nested prompt/tool schemas with incremental compatibility
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Versioned nested prompt/tool schemas with incremental compatibility.** Extend existing ConnectorPack prompt and tool definition entries with explicit schema version, nested field schema, required/optional status and compatibility revision. Incremental evolution records base digest, changed paths and compatibility verdict; additive optional fields may be admitted only when consumer policy says compatible, while removed/changed required fields refuse before publication. Pack index/entry digest rules remain canonical. SDK owns tool execution/schema compatibility authority; EG records and serves the versioned declaration and does not authorize SDK calls. Producer/consumer boundary: EG ConnectorPack typed authority -> generated public pack APIs; SDK retains tool compatibility and execution authority. Preserve R001 index/entry/section/annotation and digest contract. Preserve existing parent obligations: `EG-TYPED-PACKS-R001.1-.5; SDK-CONNECTOR-CONTROL-R003; ARBORA-FLEET-R002.3-.6`. Source record `AU:52` SHA-256 `e03b25156a4f84d27c4afba63d0cd9e526b549b5905994a53664d193416d048c`; parent `R001` remains unchanged. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_connector_nested_schema_served.py::test_nested_schema_evolution_preserves_digest`, `tests/typed_packs/test_connector_nested_schema_served.py::test_incompatible_nested_schema_refuses_before_dispatch`. | Planned served acceptance: Round-trip nested schemas and version metadata through generated clients and canonical digest vectors. Test additive optional-field evolution, required-field removal, incompatible type change, stale base digest and unknown nested fields. Verify SDK authority remains separate and no tool dispatch occurs from pack admission. Owner-source review only; no runtime/test receipt is inferred.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R072.100
Workflow registration and invocation through typed registry
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Workflow registration and invocation through typed registry.** Extend the typed fleet catalog with workflow registration identity, version/content digest, owner/tenant scope, schema and lifecycle state. Registration is persisted through the existing SourceIngest authority; invocation resolves by registry id and exact admitted revision rather than a caller-supplied body. Unknown, withdrawn, stale or unauthorized workflow ids refuse before execution. Engine/client initialization remains lazy at the AU first-use boundary and is not performed at registration or process startup. Producer/consumer boundary: EG typed registry and SourceIngest R002 own durable registration; AU owns lazy client initialization/execution; preserve ARBORA-HOST-R022 workflow-store semantics. Preserve existing parent obligations: `EG-TYPED-PACKS-R072; EG-REPO-INGEST-R002; AU-CONTROL-R037.5; ARBORA-HOST-R022`. Source record `AU:97` SHA-256 `f73767d1a3fdba29a702254ed1db2c9904158b6136f6f4b38a3c9a0d3e4fcb03`; parent `R072` remains unchanged. Owner prerequisite: AU-CONTROL-R037.5 only fills a requirement gap; it does not define lazy initialization timing, the first-use operation, or the execution receipt. No exact AU companion requirement ID is identified. Keep that consumer as an explicit hold until its owner publishes the operation and receipt; no invocation evidence is claimed. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_workflow_registry_served.py::test_registration_is_lazy_and_invokes_exact_revision`, `tests/typed_packs/test_workflow_registry_served.py::test_unknown_withdrawn_or_stale_registry_id_refuses`. | Planned served acceptance: Served registry tests register/read a workflow, prove no eager AU engine initialization, prove one initialization on first invocation, invoke by registry id, and refuse unknown/withdrawn/stale ids with no run. Read back registry and invocation receipt independently. Owner-source review only; no runtime/test receipt is inferred.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R071.100
Canonical shared hierarchical concept paths across repositories
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Canonical shared hierarchical concept paths across repositories.** Define one versioned concept-path grammar and canonicalization rule shared by EG vocabulary producers, with stable segment identity, parent path and canonical concept IRI. Admission resolves the entire path against the pinned vocabulary revision and checks repository-wide uniqueness plus parent/child consistency. Duplicate aliases, a path that contradicts an existing parent/child relationship, or two IRIs for the same canonical path refuse with the conflicting ids; existing published ontology IRIs remain unchanged and are crosswalked rather than rewritten. Producer/consumer boundary: EG vocabulary validation owns canonical identity; repository producers submit proposed paths. Preserve existing published IRIs and federated query vocabulary. Preserve existing parent obligations: `EG-TYPED-PACKS-R071 existing generated ontology corpus; EG-DATAPLAT-VOCAB-R001.1/.4; EG-FEDERATED-QUERY-R011`. Source record `EG:8` SHA-256 `525e39d1d194ac8a820bbd741a1c261ceab0c7d564981c33c731c06c1eb641d8`; parent `R071` remains unchanged. Owner decision hold: the canonical segment grammar is not approved for separators/escaping, Unicode normalization, case, or whitespace. Keep admission SPECIFIED until the vocabulary owner publishes one versioned grammar shared by producers; preserve existing published IRIs. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_concept_path_admission_served.py::test_owner_approved_path_grammar_is_shared`, `tests/typed_packs/test_concept_path_admission_served.py::test_duplicate_or_conflicting_paths_refuse_without_iri_changes`. | Planned served acceptance: Cross-repository fixtures admit a new unique path and refuse duplicate canonical path, alias collision, incompatible parent assignment and stale vocabulary revision. Read back canonical path and unchanged published IRIs; retain R071 generated ontology authority and R001.4 digest vectors. Owner-source review only; no runtime/test receipt is inferred.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R101
Ingest mappings come from the connector's declaration and the pack ontology (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Ingest mappings come from the connector's declaration and the pack ontology (rollup).** Source ingestion reads schema mappings from the pack's `connector://resources` entry. It reads relations from the pack ontology's object properties. Children `.1` and `.2` define the vocabulary and shapes. Children `.9` to `.11` deliver resolution, the tenant key and the refusals. Children `.3` to `.8` are retired. | Rollup closes when every live child passes its proving test.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R101.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add the core schema source `crates/eg-core/ontology/connector_pack-v1.ttl` under namespace `http://knuckles.team/kg/connector-pack#` (prefix `cp:`). It imports `virtual_graph-v1`. It declares `cp:IngestContract` as a subclass of `vg:MetadataContract`, and `cp:SourceObject` as a subclass of `vg:VirtualMapping`. It declares `cp:FieldMapping` as a subclass of `vg:PredicateFieldPair`. It also declares `cp:KeyRule`, `cp:CursorPolicy`, `cp:AccessPolicy`, `cp:PrivacyClass` and `cp:ProvenanceRequirement`. The properties are `cp:contractOf`, `cp:contractVersion`, `cp:contractDigest`, `cp:hasSourceObject`, `cp:hasKeyRule`, `cp:hasCursorPolicy`, `cp:cursorKind`, `cp:hasAccessPolicy`, `cp:defaultAcl`, `cp:aclField`, `cp:tenantField`, `cp:readRole`, `cp:privacyClass`, `cp:requiresProvenance` and `cp:governedBy`. `cp:governedBy` links an ingested node to its contract. The catalog `catalog-v1.ttl` and the CoreSpec registry list the new module. Owner: epistemic-graph. | `crates/eg-core/tests/connector_pack_vocabulary.rs::contract_terms_resolve_with_domain_and_range`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R101.2
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `crates/eg-core/ontology/connector_pack-v1.shapes.ttl` with one node shape per contract class. A contract must name exactly one connector, one version and one digest. Each source object must name exactly one ontology class and one key rule. Each field mapping must name one source field and one predicate of the composed schema. `cp:cursorKind` must be one of `opaque`, `timestamp`, `commit`, `offset` or `page_token`. `cp:defaultAcl` must be one of `quarantine`, `inherit` or `public`. `cp:privacyClass` must be one of `public`, `internal`, `personal` or `secret`. Each provenance requirement must name at least one required field. Owner: epistemic-graph. | `crates/eg-shacl/tests/connector_pack_shapes.rs::each_contract_shape_accepts_valid_and_refuses_invalid`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R101.9
One tenant key for pack heads
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**One tenant key for pack heads.** `SourceIngest` must resolve the connector pack under the same tenant key that `ConnectorPack.Import` and `ConnectorPack.Status` use. All three call `persistence::connector_pack::pack_tenant_key`, which returns the verified `tenant_id`. `SourceIngest` never uses the opaque carrier tenant scope of its graph route for a pack lookup. Proving test: `src/server/handlers/admin/connector_pack/tests/scale.rs::an_imported_pack_maps_source_ingest_records_of_the_same_tenant`. | A served test imports a pack whose `connector://resources` declaration holds a `schema_mappings` entry through `ConnectorPack.Import`. It then submits one record under that mapping through `SourceIngest`, which must accept it.
requirementEG-TYPED-PACKSVERIFIEDba925ecbb9b6
c4a73f6d5a74
src/server/handlers/admin/connector_pack/tests/scale.rs:93
EG-TYPED-PACKS-R101.10
Mappings come from the connector's declaration
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Mappings come from the connector's declaration.** A connector on agent-connector-sdk 0.4.2 or later serves its data sources and record-type mappings as JSON at `connector://resources`. The pack holds that body as the `resource` entry with that URI. The entry carries a content schema, as every resource entry must. Import decodes its `schema_mappings` (record type to ontology class and field map) with a closed JSON decoder. A body that is not a JSON object, or holds an unknown mapping key, is refused with `MALFORMED_BODY`. Import reads relations from the pack ontology's `owl:ObjectProperty` declarations. The `rdfs:domain` local name is the source resource. The property local name is the relation. The `rdfs:range` local name is the target. A property without one named domain and one named range declares no relation. `SourceIngest` resolves `connector:<connector>#mappings/<type>` against the declared mappings. It resolves `connector:<connector>#relations/<resource>/<relation>` against the ontology relations. The bare `connector:<connector>` form names a declaration with one mapping. The engine accepts no other scheme. The entry kind set has no manifest kind, and the engine reads no YAML. Owner: epistemic-graph. | `src/server/handlers/admin/connector_pack/tests/scale.rs::the_selector_resolves_to_the_declared_class_and_field_map`; `src/server/handlers/admin/connector_pack/tests/scale.rs::relations_resolve_from_the_pack_ontology`; `src/server/persistence/connector_pack/declaration.rs::refuses_a_malformed_or_open_mapping`.
requirementEG-TYPED-PACKSVERIFIED1441a36e7b30
81059c6ca5db
crates/eg-rdf/src/pack/tests.rs:186
crates/eg-types/src/connector_pack/index.rs:140
src/server/handlers/admin/connector_pack/tests/scale.rs:140
src/server/handlers/admin/connector_pack/tests/scale.rs:203
src/server/persistence/connector_pack/declaration.rs:101
EG-TYPED-PACKS-R101.11
Undeclared mappings are refused by type
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Undeclared mappings are refused by type.** `SourceIngest` refuses a mapping reference with `UNKNOWN_MAPPING_REFERENCE` when its scheme is not `connector:`. It refuses the same way when the declaration does not name its record type. A pack with no `connector://resources` entry is refused with `CONNECTOR_SCHEMA_MAPPING_UNAVAILABLE`. A refusal commits no record, cursor or checkpoint. Owner: epistemic-graph. | `src/server/handlers/admin/connector_pack/tests/scale.rs::an_undeclared_type_is_refused_with_a_typed_error`.
requirementEG-TYPED-PACKSVERIFIED81059c6ca5db
src/server/handlers/admin/connector_pack/tests/scale.rs:153
EG-TYPED-PACKS-R102
Connector surface and domain relationships are native graph relationships (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Connector surface and domain relationships are native graph relationships (rollup).** Each pack states its connector, features, tools, prompts and skills as triples. These triples link the surface to domain classes. The engine projects them beside the ingest contract of `EG-TYPED-PACKS-R101`. Children `.1` to `.7` deliver it. | Rollup closes when every child `.1` to `.7` passes its proving test.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R102.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Extend `connector_pack-v1.ttl` with `cp:Connector`, `cp:Feature`, `cp:Tool`, `cp:Prompt` and `cp:Skill`. The properties are `cp:providesFeature`, `cp:realizedBy`, `cp:hasContract`, `cp:operatesOn`, `cp:produces`, `cp:executes`, `cp:appliesTo`, `cp:providesCapability` and `cp:componentId`. `cp:executes` links a tool to the domain method class it runs. `cp:appliesTo` links a skill or prompt to a domain class. Extend the shapes file: each tool has one component id and at least one `cp:operatesOn` or `cp:providesCapability`. Each feature has at least one `cp:realizedBy` member. Owner: epistemic-graph. | `crates/eg-shacl/tests/connector_pack_shapes.rs::surface_shapes_accept_valid_and_refuse_invalid`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R102.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Projection must write one node per published tool, prompt, skill and server member of the pack head. Each node carries the declared surface triples from the contract entry. The engine stamps `cp:componentId` and the entry revision. A withdrawn member keeps its node with `cp:lifecycle "withdrawn"`. A later import restores it, as `EG-TYPED-PACKS-R014` states. The projection is native Rust and runs inside the existing outbox consumer. Owner: epistemic-graph. | `src/server/connector_pack_projection/surface_tests.rs::surface_nodes_follow_pack_head`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R102.3
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** A pack ontology entry may extend core classes with subclass and property axioms. Import must refuse an entry that redeclares a core class IRI with conflicting axioms. The refusal code is `ONTOLOGY_CORE_CONFLICT`. A pack ontology must reuse a core class by IRI and must not copy it. Owner: epistemic-graph. | `src/server/handlers/admin/connector_pack/import/contract_tests.rs::core_class_redeclaration_is_refused`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R102.4
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Surface projection attaches in `project` (`src/server/connector_pack_projection.rs:220`) through `project_head` (`src/server/handlers/admin/connector_pack/reproject.rs:72`). Reads use the SPARQL handler (`src/server/handlers/rdf/sparql.rs:30`). Capability designation consumes the surface through `EG-DECISION-ENGINE-R172.12`. Owner: epistemic-graph. | `src/server/connector_pack_projection/surface_tests.rs::outbox_consumer_writes_surface_nodes`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R102.5
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** Import must refuse a surface triple that names a component absent from the pack with `UNRESOLVED_REFERENCE`. It must refuse a domain class absent from the composed schema with `CONTRACT_SHACL_VIOLATION`. It must refuse a surface claim about another connector with `IMPORTER_MISMATCH`. No refusal changes the head or the graph. Owner: epistemic-graph. | `src/server/handlers/admin/connector_pack/import/contract_tests.rs::surface_refusals_leave_state_unchanged`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R102.6
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each surface node must carry the pack digest and entry revision. Each SPARQL answer over the pack graph must return the graph revision it read. Owner: epistemic-graph. | `src/server/connector_pack_projection/surface_tests.rs::surface_nodes_carry_pack_digest`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R102.7
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method. The test imports a two-tool pack whose tools operate on one domain class. A served SPARQL query for tools on that class must return both component ids. After a reimport that withdraws one tool, the query must return one active tool. Owner: epistemic-graph. | `tests/typed_packs/test_connector_surface_rdf_served.py::test_surface_query_follows_pack_head`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R103
Served runtime ontology import, revision and withdrawal (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Served runtime ontology import, revision and withdrawal (rollup).** A connector imports its domain ontology at runtime through one served method. The engine validates it with SHACL, scopes it to the tenant and keys it by content digest. It supports revision and withdrawal. Children `.1` to `.6` deliver it. | Rollup closes when every child `.1` to `.6` passes its proving test.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R103.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Extend `GraphSchemaOp` (`crates/eg-types/src/graph_schema.rs:47`) with `ImportOntology` and `WithdrawOntology`. `ImportOntology` carries connector, ontology IRI, version, ontology Turtle, optional shapes Turtle, content digest and expected prior revision. `WithdrawOntology` carries connector, ontology IRI and expected revision. Add `ontology:` to `RESERVED_SCHEMA_SOURCE_PREFIXES`. The source key is `ontology:<connector>/<ontology IRI>`. The result returns the revision, the content digest and the composed digest. Owner: epistemic-graph. | `crates/eg-types/src/graph_schema.rs::tests::ontology_import_ops_round_trip`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R103.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Import must parse with the bounded Turtle parser (R033) and validate with step-bounded SHACL against the composed schema (R035). It must commit one tenant-scoped graph schema source revision. A request with the same digest as the current revision must return that revision and write nothing. A new digest must create the next revision and keep earlier revisions readable. Withdrawal must detach the source as a whole (R057). The code is native Rust. Owner: epistemic-graph. | `src/server/graph_schema/ontology_import_tests.rs::import_is_idempotent_by_digest_and_revises`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R103.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** `handle_gateway` (`src/server/graph_schema.rs:191`) must match `ImportOntology` and `WithdrawOntology` beside `AttachPack`. The gateway route reaches it at `src/server/handlers/graph_ops/gateway_graph_routes.rs:656`. The generated contract and Python client must expose both operations. Owner: epistemic-graph. | `src/server/graph_schema/ontology_import_tests.rs::gateway_routes_ontology_import`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R103.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** Import must refuse malformed Turtle with `ONTOLOGY_INVALID` and a shape violation with `SHACL_VIOLATION`. It must refuse a digest that does not match the body with `ONTOLOGY_DIGEST_MISMATCH`. It must refuse a stale expected revision with `ONTOLOGY_REVISION_CONFLICT`. It must refuse a conflicting core class redeclaration with `ONTOLOGY_CORE_CONFLICT`. It must refuse a caller who is not the bound importer with `IMPORTER_MISMATCH`. It must refuse a cross-tenant write with `TENANT_DENIED`. No refusal changes the composed schema. Owner: epistemic-graph. | `src/server/graph_schema/ontology_import_tests.rs::ontology_import_refusals_leave_schema_unchanged`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R103.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each revision must record connector, ontology IRI, version, content digest, importer principal and composed digest. `GraphSchemaClasses` (R077) must report the classes each revision adds. A reader can tell which revision declared a class. Owner: epistemic-graph. | `src/server/graph_schema/ontology_import_tests.rs::revision_records_digest_importer_and_classes`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R103.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `GraphSchema` method with `ImportOntology`. The test imports a domain ontology, repeats the import with the same digest, then imports a revision. A served SPARQL query must see the new class after the revision. After `WithdrawOntology`, the query must not see it. A second tenant must never see the ontology. Owner: epistemic-graph. | `tests/typed_packs/test_runtime_ontology_import_served.py::test_import_revise_withdraw_end_to_end`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R104
Connect-time seed graph import, idempotent by content digest (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Connect-time seed graph import, idempotent by content digest (rollup).** A connector serves a seed graph beside its ontology pack. The seed graph holds instance identity, the object catalog and reference or index triples. It holds no bulk data. The engine validates the seed graph with SHACL and stores native relationships. A repeated digest writes nothing. A changed part re-imports alone. Runtime ontology import is `EG-TYPED-PACKS-R103`. Contract triples are `EG-TYPED-PACKS-R101`. Children `.1` to `.6` deliver it. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R104.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `SeedGraphImport{connector, instance_iri, pack_digest, parts, content_digest}` and `SeedPart{key, turtle, digest}` in `crates/eg-types/src/connector_pack/seed_graph.rs`. `parts` is a `BTreeMap<SeedPartKey, SeedPart>`. Closed `SeedPartKey` values are `identity`, `catalog` and `references`. Add `crates/eg-core/ontology/connector_seed-v1.ttl` and its shapes file under prefix `seed:`. Proving test: `crates/eg-types/src/connector_pack/seed_graph.rs::tests::seed_import_round_trips`. | A serde round trip keeps every field and rejects an unknown part key.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R104.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Import parses each part with the bounded Turtle parser of `EG-TYPED-PACKS-R033`. It validates each part against the composed schema with step-bounded SHACL. The part digest is SHA-256 over canonical N-Quads. An equal `content_digest` returns `unchanged`. A changed part replaces only its own triples in one commit. The limit is 50,000 triples and 8 MiB per seed graph. Engine time must stay under 200 ms per 10,000 triples. Proving test: `src/server/handlers/admin/connector_pack/seed_tests.rs::changed_part_reimports_alone`. | A second import with one changed part replaces that part and leaves the other two byte-identical.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R104.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** The seed body enters `run_import` at `src/server/handlers/admin/connector_pack/import.rs:63` beside the pack head. Projection commits through `project_head` at `src/server/handlers/admin/connector_pack/reproject.rs:72`. No production caller imports a seed graph today. Proving test: `src/server/handlers/admin/connector_pack/seed_tests.rs::served_import_projects_seed`. | A served import with a seed body reaches `project_head` and writes the seed triples.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R104.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** Import must refuse a seed graph over the limit with `SEED_TOO_LARGE`. It must refuse a predicate outside the identity, catalog and reference shapes with `SEED_BULK_DATA`. It must refuse a shape violation with `SEED_SHACL_VIOLATION` and name the focus node. It must refuse a wrong digest with `SEED_DIGEST_MISMATCH`. A refusal writes nothing. Proving test: `src/server/handlers/admin/connector_pack/seed_tests.rs::seed_refusals_write_nothing`. | Each case returns its code and the graph revision stays unchanged.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R104.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** `SeedImportReceipt` must carry connector, content digest, one outcome per part and the graph revision. Closed outcome values are `inserted`, `replaced` and `unchanged`. Each seed subject carries `seed:fromSeed` to its seed revision node. Proving test: `src/server/handlers/admin/connector_pack/seed_tests.rs::receipt_names_part_outcomes`. | A served SPARQL read finds the receipt and the `seed:fromSeed` link of one catalog object.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R104.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method with a seed body. The test imports a seed graph and repeats the same digest. It then changes the catalog part. A served SPARQL query must read the new catalog objects. Proving test: `tests/connector_pack/test_seed_graph_served.py::test_seed_idempotent_and_partial_reimport`. | The repeat returns `unchanged`, the change replaces only `catalog`, and the query sees the new objects.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R105
A connector ontology joins the parent graph on import
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**A connector ontology joins the parent graph on import.** This applies to ConnectorPack import and to `ImportOntology` of `EG-TYPED-PACKS-R103`. The engine must resolve each `ontology-import:<iri>` requirement against the parent catalog `http://knuckles.team/kg`. It must resolve each `owl:imports` the same way. It must record the import edge in the tenant schema. It must record each `rdfs:subClassOf` edge from a connector class to a parent class. A class query over a parent class then returns the connector subclasses. An orphan ontology imports no parent IRI. An orphan also includes a declared class with no subclass path to a parent class. The engine must refuse an orphan with `ONTOLOGY_ORPHAN`. The refusal names each unlinked class. A request marked `standalone` is admitted and flagged instead. `GraphSchemaClasses` of `EG-TYPED-PACKS-R077` reports the flag per class. The pack keeps its components under the fleet name of the connector. | A served test imports a linked connector ontology. It reads the connector class through a parent-class query. It imports an orphan and receives `ONTOLOGY_ORPHAN` with the unlinked classes. It imports the orphan as `standalone`. It reads the flag from `GraphSchemaClasses`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R105.1
Stage one: record the parent link and flag orphans
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Stage one: record the parent link and flag orphans.** ConnectorPack import resolves an `ontology-import:` requirement that names the parent catalog `http://knuckles.team/kg` or one of its modules. It reports no unresolved claim for it. A pack ontology may also `owl:imports` the parent catalog directly. The attached ontology keeps its `rdfs:subClassOf` edges in the composed tenant schema. The engine computes each declared class with no subclass path to a parent-catalog class. The `EPISTEMIC_GRAPH_ONTOLOGY_ORPHANS` switch selects `warn` or `refuse`, and `warn` is the default. Under `warn` the pack imports and the receipt carries one `ONTOLOGY_ORPHAN` warning that names the unlinked classes. Under `refuse` the import is rejected with `ONTOLOGY_ORPHAN`. | Unit tests cover the parent import policy, the orphan computation and the requirement resolution. A served import of a pack whose classes subclass a parent class carries no orphan warning. A served import with an orphan class imports and names that class in `ONTOLOGY_ORPHAN`.
requirementEG-TYPED-PACKSVERIFIED8e2634dd4ee7
crates/eg-rdf/src/pack/tests.rs:143
crates/eg-rdf/src/pack/tests.rs:158
src/server/handlers/admin/connector_pack/import/annotations.rs:232
src/server/handlers/admin/connector_pack/tests/ontology.rs:154
src/server/handlers/admin/connector_pack/tests/ontology.rs:161
EG-TYPED-PACKS-R105.2
Stage two: the import edge, parent-class reads and enforcement
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Stage two: the import edge, parent-class reads and enforcement.** The engine records the resolved import as an `owl:imports` edge in the tenant schema. It does so even when the pack builder lifted the import into a requirement. A class query over a parent class returns the connector subclasses. `GraphSchemaClasses` reports the orphan flag per class, and a `standalone` request is admitted and flagged. When the fleet's connector vocabularies are linked, the default switches to `refuse`. | A served test reads a connector class through a parent-class query and reads the flag from `GraphSchemaClasses`. A served test confirms that the `refuse` default rejects an orphan and admits it as `standalone`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R105.3
The parent catalog declares the recurring connector concepts
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The parent catalog declares the recurring connector concepts.** A review of the connector fleet found 209 class roots with no fitting parent class. The parent catalog declares one vendor-neutral class for each recurring concept. Each class sits under an existing upper class. Each class has a label, a comment and `skos:altLabel` aliases taken from connector class names. `core-foundation-v1.ttl` declares `Collection` (under `bfo:0000031`), `Folder` and `ResourceGroup` (under `Collection`), `Category` (under `Concept`), and `Template`, `Message`, `Order` and `Metric` (under `bfo:0000031`). `software-v1.ttl` declares `Repository` (under `Collection`), `Branch` and `Release` (under `bfo:0000031`). `sdlc_lifecycle-v1.ttl` declares `Job` (under `bfo:0000015`) and `Runner` (under `bfo:0000004`). `company-v1.ttl` declares `Iteration` (under `bfo:0000015`) and `Milestone` (under `bfo:0000031`). `infrastructure-v1.ttl` declares `Namespace`, `Volume` and `Network` (under `bfo:0000004`). `supply_chain-v1.ttl` declares `Vulnerability` (under `bfo:0000031`). Its properties stay with `EG-SUPPLY-VOCAB-R002.6`. No class names a vendor or a product. No existing class changes parent. | `crates/eg-rdf/tests/connector_parent_classes.rs::recurring_connector_concepts_sit_under_their_upper_classes` loads the modules. It asserts each class, its label, its comment, one alias and its direct parent. It asserts the reasoner finds the catalog consistent with no unsatisfiable class.
requirementEG-TYPED-PACKSVERIFIED0b2f084f5f52
52dbb35d88bb
6048a5ca398c
9b4cb81fe847
e93c5f6ed76c
crates/eg-rdf/tests/connector_parent_classes.rs:36
EG-TYPED-PACKS-R105.4
The parent catalog holds a service-operations core aligned to the Open Group IT4IT data objects
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The parent catalog holds a service-operations core aligned to the Open Group IT4IT data objects.** The module `service_operations-v1.ttl` is the core source `core:service_operations@1`, and the catalog lists it. It holds the Detect to Correct and Service Model records that every service-management connector maps to. Work items: `Issue` and `Ticket` (`sdlc_lifecycle-v1.ttl`) sit under `WorkItem`. `Problem` and `Change` sit under `Ticket`, `ChangeRequest` under `Change`, and the existing `Incident` under `Ticket`. Configuration: `ConfigurationItem` sits under `AssetInstance`, which now sits under `bfo:0000004`. `Application`, `BusinessApplication`, `BusinessService` and `Server` sit under `ConfigurationItem`. `AssignmentGroup` sits under `Organization`. Technology: `TRMStandard` sits under `TechnologyStandard` and `TRMPhase` under `Concept`. Work: `Task` sits under `bfo:0000015` and `Prompt` under `bfo:0000031`. Each edge has a domain and a range. `affects` links Incident, Problem or Change to ConfigurationItem. `touches` links ChangeRequest to ConfigurationItem. `usesTechnology` links ConfigurationItem to TechnologyStandard. `hostedOn` links Application or BusinessService to Server. `relatedTo` is symmetric over Repository, WorkItem and Application. `systemPromptFor` links Prompt to Task. `canHandle` links Skill, Agent or Prompt to Task or Incident, and the adapter vocabulary's `appliesTo` keeps its own domain and range. The datatype property `state` has domain `WorkItem` and range `xsd:string`. `hasPhase` links TechnologyStandard to TRMPhase in the shared namespace, apart from the infrastructure module's own `hasPhase`. The existing `priority` (domain `Requirement`) becomes an `owl:unionOf` of `Requirement` and `WorkItem`, so the shared property stays unintersected. No class or property names a vendor or a product. No IRI has two different parents. | `crates/eg-rdf/tests/service_operations_classes.rs::service_operations_classes_exist_with_their_parents` and `::competency_question_edges_declare_domain_and_range` load the modules. They assert each class, its direct parent, the domain and range of each edge, and that the reasoner finds the union consistent with no unsatisfiable class.
requirementEG-TYPED-PACKSVERIFIED26446669b39b
67b5923b6f57
7b71f99332ea
867b42f93737
9e170f2e27fa
crates/eg-rdf/tests/service_operations_classes.rs:112
crates/eg-rdf/tests/service_operations_classes.rs:71
EG-TYPED-PACKS-R105.5
The competency-question paths are complete on the engine side
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The competency-question paths are complete on the engine side.** Every hop of the exit-criteria competency questions that the engine owns resolves in the composed ontology. That covers the edge, its domain and range, and the property on the class that carries it. The competency questions come from `connector-ontology-map graph-check` (`pipelines_hooks/hygiene/ontology_cqs.json`). Self-contained modules join the main component through the core classes they specialise. `swarm:TopologyTemplate` is a `Template`, and `vg:MetadataContract` is a `Document`. Three files carry no class: `catalog-v1.ttl` (import-only, no term by `EG-ORCH-VOCAB-R008.2`), `concepts-v1.ttl` (individuals of `GovernedConcept` only) and the code-generation fixture `codegen_selftest-v1.ttl`. Validator configuration skips them in the connectedness check, and the engine does not bridge them. Hops that name one system's own record types stay in that connector's pack. | `crates/eg-rdf/tests/service_operations_classes.rs::self_contained_modules_align_to_the_core` asserts the alignments. `connector-ontology-map graph-check --eg-extra-ref <branch>` reports every engine-owned competency-question hop as passing.
requirementEG-TYPED-PACKSVERIFIED67b5923b6f57
867b42f93737
9e170f2e27fa
crates/eg-rdf/tests/service_operations_classes.rs:113
crates/eg-rdf/tests/service_operations_classes.rs:207
EG-TYPED-PACKS-R751
Specialist registry, provider discovery, transactional install and capability contract (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Specialist registry, provider discovery, transactional install and capability contract (rollup).** Rust-native in `crates/eg-types/src/registry`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R751.750
Model: Specialist registry, provider discovery, transactional install and capability contract
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model: Specialist registry, provider discovery, transactional install and capability contract.** Specialist packages, services and plugins register as catalog nodes. Their provider assets are content-addressed. Install generations are immutable and carry a bounded marker. One capability contract unifies a skill resource and a tool. Frontend contribution descriptors complete the set. Types: `SpecialistPackage`, `ProviderAsset`, `GenerationMarker`, `CapabilityContract`, `FrontendContribution`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R751.751
Behavior: Specialist registry, provider discovery, transactional install and capability contract
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior: Specialist registry, provider discovery, transactional install and capability contract.** Install is transactional per provider root: a new generation becomes current by one atomic marker swap. Discovery reads the catalog, not the filesystem. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R751.752
Refusal: Specialist registry, provider discovery, transactional install and capability contract
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal: Specialist registry, provider discovery, transactional install and capability contract.** The engine refuses an asset whose digest differs from its marker. It refuses an unbounded marker. It refuses a contribution without a declared read model. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R751.753
Hot-path proof: Specialist registry, provider discovery, transactional install and capability contract
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof: Specialist registry, provider discovery, transactional install and capability contract.** Criterion benchmark `catalog_resolve` runs over 20k packages. The p50 is under 1.5 ms and the p99 is under 5 ms. Memory stays under 32 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R650
Property types, value types, links, interfaces and object sets (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Property types, value types, links, interfaces and object sets (rollup).** The typed model of the ontology covers property and value types with constraints and coercion. It covers link types with cardinality and junctions. It covers interfaces with link constraints and implementation reports. It also covers derived properties, object functions, object sets with filter, aggregation and pivot, and shortest object paths. The Rust home is `crates/eg-core/src/ontology/object_model.rs`. Satisfied only when children `EG-TYPED-PACKS-R650.1`-`EG-TYPED-PACKS-R650.6` are satisfied. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R650.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `PropertyType`, `ValueType{constraints}`, `LinkType{cardinality}`, `Interface`, `DerivedProperty{backing}`, `ObjectFunction`, `ObjectSet{kind,filters}`, `ObjectPath` in `crates/eg-core/src/ontology/object_model.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R650.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Coerce and validate values by constraint table. Check link cardinality at commit. Evaluate an interface implementation report in O(types). Compute derived properties lazily with a revision-keyed cache. Evaluate object sets as lazy plans. Find shortest paths by bidirectional search. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R650.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Compiled from packs by `ontology_codegen.rs` and enforced by `eg-shacl` at commit; served `ObjectSetQuery`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R650.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** EG refuses a value that violates its constraint, a link beyond its cardinality and an interface left unimplemented. Each refusal names the violated rule. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R650.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Record rule IDs, offending values, plan digest and path hops. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R650.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** Benchmark `object_set_filter_aggregate` (1M objects, 3 filters): p50 2 ms, p99 10 ms, peak memory 32 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-core object_set_filter_aggregate` against the stored baseline.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R651
Governed edits, reverts, write-back and sync conflict resolution (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Governed edits, reverts, write-back and sync conflict resolution (rollup).** Every ontology edit lands in an append-only ledger and inverts exactly. It routes to its sink. It passes a per-field conflict check before any source write-back. Repository provenance, lifecycle of graph schemas, contextual enrichment, schema graphs and naming lint complete the surface. The Rust home is `crates/eg-core/src/ontology/edits.rs`. Satisfied only when children `EG-TYPED-PACKS-R651.1`-`EG-TYPED-PACKS-R651.6` are satisfied. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R651.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `Edit{type,object,before,after}`, `EditLedger`, `Inversion`, `WriteBackRoute`, `FieldConflict{policy}`, `NamingFinding` in `crates/eg-core/src/ontology/edits.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R651.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Append edits with a hash chain. Invert by swapping before and after. Revert an object by replaying inversions newest first. Resolve conflicts per field by declared policy and fail closed. Lint names against the naming convention in O(names). | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R651.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Ledger on the durable kernel; write-back through the source write path with an approval verdict from graph-os admission. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R651.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** EG refuses a write-back without a passing conflict check. It refuses a revert past a sealed edit. It refuses a schema attach that fails composition. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R651.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Record chain head, inversions, conflict decisions and lint findings. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R651.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** Benchmark `edit_append_and_revert` (10k edits, revert last 100): p50 60 us, p99 400 us, peak memory 2 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-core edit_append_and_revert` against the stored baseline.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R652
Markings, classification claims and restricted views (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Markings, classification claims and restricted views (rollup).** Markings classify objects, propagate along edges, and produce restricted views per actor clearance. Classification claims carry multiple categories with provenance and a promotion lifecycle. The Rust home is `crates/eg-core/src/isolation/markings.rs`. Satisfied only when children `EG-TYPED-PACKS-R652.1`-`EG-TYPED-PACKS-R652.6` are satisfied. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R652.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `Marking`, `MarkingStore`, `ActorClearance`, `RestrictedView`, `ClassificationClaim{categories,provenance,state}` in `crates/eg-core/src/isolation/markings.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R652.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Propagate markings by monotone closure in O(V+E). Redact on read by clearance. Promote a claim only through legal states with evidence. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R652.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Joins the row-visibility ladder in `eg-core::isolation`; admission of the actor stays with graph-os. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R652.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** A read without clearance returns the redacted view; a claim promoted without evidence is refused. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R652.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Record marking sets before and after propagation and the clearance used. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R652.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** Benchmark `marking_propagate_redact` (100k objects, 5 markings): p50 1.5 ms, p99 8 ms, peak memory 24 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-core marking_propagate_redact` against the stored baseline.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R700
Skill-graph packs validate against an open knowledge-bundle format (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Skill-graph packs validate against an open knowledge-bundle format (rollup).** The engine validates a skill-graph pack before import. It checks front matter, hashes, directory index and open knowledge-bundle conformance. It then imports the pack as pack entries. Propose-only skill candidates distilled from connector processes render as atomic or workflow skill documents on demand. Implemented in eg-packs. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R700.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** `SkillGraphManifest`, `ConformanceReport` and `SkillCandidate` in `crates/eg-packs`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R700.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Validation is a single pass with a violation cap (R040); hashes use SHA-256 over canonical text. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R700.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Import is the existing atomic pack import (R010); rendering is R100. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R700.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** A pack with a bad hash or missing index is refused with the failing path. A candidate is never published automatically. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R700.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** The conformance report lists every checked rule. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R700.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/packs/test_skill_graph_pack_served.py::test_bad_hash_refused_and_conformant_pack_imports` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/skill_graph_validate.rs` must show p50 under 4 ms and p99 under 25 ms with peak memory under 48 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R097.700
Domain pack manifest, mapping language, loader and promotion bridge: model and behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Domain pack manifest, mapping language, loader and promotion bridge: model and behavior.** A domain pack manifest declares typed mappings (columns, front matter, tables, headings, links, JSON fields) and evaluation cases. The engine evaluates the mapping to proposed entities and relationships. It loads packs from a registry with an integrity hash and previews a run. It sends facts only through the governed promotion path. Markdown is fragmented into the evidence spine's fragments. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R097.701
Domain pack manifest, mapping language, loader and promotion bridge: refusal, evidence and hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Domain pack manifest, mapping language, loader and promotion bridge: refusal, evidence and hot-path proof.** A mapping error, an integrity-hash mismatch or a class absent from the ontology is refused. Test `tests/packs/test_domain_pack_run_served.py::test_preview_then_run_promotes_only_through_envelope`; benchmark `benches/domain_pack_mapping.rs` p50 under 10 ms and p99 under 60 ms per 1,000 rows, memory under 64 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R710
Schema drift classification, containment, repair proposal and activation: model and behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Schema drift classification, containment, repair proposal and activation: model and behavior.** Extends `EG-TYPED-PACKS-R083`. The engine infers a record shape and digest per delivery. It classifies drift against the approved contract (compatible, widening, narrowing, rename, breaking). It applies the operator-declared evolution policy (default: quarantine). It proposes a repair verified on a shadow graph. It activates an approved candidate only after two-person approval (DK R027). The report is observation-class evidence. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-TYPED-PACKSVERIFIED4e402b2ec8bf
cfe7d38376a4
dc810128a66d
crates/eg-types/src/graph_schema/drift.rs:645
crates/eg-types/src/graph_schema/drift.rs:681
crates/eg-types/src/graph_schema/drift.rs:712
crates/eg-types/src/graph_schema/drift.rs:752
crates/eg-types/src/graph_schema/drift.rs:776
EG-TYPED-PACKS-R712
Schema drift classification, containment, repair proposal and activation: refusal, evidence and hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Schema drift classification, containment, repair proposal and activation: refusal, evidence and hot-path proof.** Extends `EG-TYPED-PACKS-R083`. A drifted delta is quarantined, never applied; an unapproved candidate is never activated. Test `tests/packs/test_schema_drift_served.py::test_breaking_drift_quarantines_and_activation_needs_approval`; benchmark `benches/schema_drift_classify.rs` p50 under 0.5 ms and p99 under 3 ms per 1,000-field contract, memory under 16 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-TYPED-PACKSVERIFIED0305cbd4457e
912a39a98afe
cfe7d38376a4
tests/packs/test_schema_drift_served.py:169
EG-TYPED-PACKS-R711
Process, lifecycle, temporal and harness shape artifacts are generated: model and behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Process, lifecycle, temporal and harness shape artifacts are generated: model and behavior.** Extends `EG-TYPED-PACKS-R090`. The build generates the harness, process-intelligence, software-lifecycle and temporal shape files and the ontology lock from Rust definitions. It drift-checks them, like the other canonical artifacts. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R713
Process, lifecycle, temporal and harness shape artifacts are generated: refusal, evidence and hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Process, lifecycle, temporal and harness shape artifacts are generated: refusal, evidence and hot-path proof.** Extends `EG-TYPED-PACKS-R090`. A hand-edited artifact fails the freshness check. Test `crates/eg-types/tests/shape_artifacts_fresh.rs::generated_equals_committed`; benchmark `benches/shape_render.rs` p50 under 5 ms and p99 under 20 ms, memory under 16 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R714
Delivery-path wiring of drift classification
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Delivery-path wiring of drift classification.** Extends `EG-TYPED-PACKS-R710`. The engine record delivery path calls `graph_schema::drift::classify` for each delivery to a source with an approved contract. It uses the contract in force and the operator evolution policy. The delivery result carries the `DriftReport`. | Planned served test: `tests/packs/test_schema_drift_served.py::test_delivery_reports_drift_class` asserts the returned `DriftClass` and `DriftAction`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R715
Served quarantine of a drifted delivery
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Served quarantine of a drifted delivery.** Extends `EG-TYPED-PACKS-R712`. A delivery that `EG-TYPED-PACKS-R714` classifies as breaking is quarantined under the default policy. The engine applies no part of it. A later read of the target graph shows no delivered record. | Planned served test: `tests/packs/test_schema_drift_served.py::test_breaking_delivery_is_quarantined` asserts the quarantine action and an unchanged graph.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R800
Typed record models for packs, evidence bundles, manifests and goals (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Typed record models for packs, evidence bundles, manifests and goals (rollup).** `crates/eg-types` owns the strict, versioned record models that agent tooling exchanged as loose dictionaries. The models cover knowledge packs, schema packs, evidence bundles, execution manifests, goals, code maps, spec-driven task records and model profiles. Each has a digest and a published schema. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R800.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Each record is a `serde` struct with `deny_unknown_fields`, a `schema_version` and a canonical digest; evidence bundles carry ordered `EvidenceItem{claim, source_ref, class}` entries. | Planned: `crates/eg-types/tests/typed_records.rs::unknown_field_is_refused`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R800.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Encoding is canonical, so equal records have equal digests. Pack loading validates in one pass in O(n) over items. It rejects duplicates by id. | Planned: `crates/eg-types/tests/typed_records.rs::equal_records_have_equal_digests`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R800.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Records are written through the typed-pack importer already owned here. The generated client reads them. No consumer defines its own copy. | Planned: `crates/eg-types/tests/typed_records.rs::schema_downgrade_is_refused`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R800.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** The engine refuses four inputs with a typed error that names the field. They are an unknown field, a downgrade of `schema_version`, a duplicate id, and an evidence item without a source reference. | Planned: `crates/eg-types/tests/typed_records.rs::duplicate_id_is_refused`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R800.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Evidence is a golden digest file per record type and a published JSON schema checked by the contract freshness gate. | Planned: `crates/eg-types/tests/typed_records.rs::golden_digests_match`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R800.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** Hot-path proof: a Criterion benchmark decodes and validates a 10000-item pack. The p50 stays under 5 ms. The p99 stays under 15 ms. Peak memory stays under 2 times the encoded size. | Planned: `crates/eg-types/tests/typed_records.rs::pack_validation_bench_within_budget`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R801
Business glossary as SKOS concept schemes (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Business glossary as SKOS concept schemes (rollup).** The engine must hold business terms as SKOS concepts in versioned concept schemes. A term links to ontology classes, properties, datasets and columns. A term moves through a review lifecycle. Children `.1` to `.7` deliver it. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R801.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `GlossaryTerm{scheme, pref_label, alt_labels, definition, broader, related, status}` in `crates/eg-types/src/glossary.rs`. `status` is a closed set: `draft`, `in_review`, `approved`, `deprecated`. Map each field to `skos:` terms in `crates/eg-core/ontology/glossary-v1.ttl`. | `crates/eg-types/tests/glossary.rs::term_round_trips_and_maps_to_skos` round-trips a term and validates its SKOS shape.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R801.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** A term binds to an asset through `:definesAsset`. A label search matches preferred and alternative labels in every language tag. A deprecated term names its replacement. | `crates/eg-core/tests/glossary.rs::alt_label_search_finds_term` searches by a synonym.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R801.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** A glossary pack imports through the typed-pack importer of R103. A single term writes through the served `GlossaryTermPut`. arbora serves `glossary.*` through `ARBORA-OPS-R855`. | `tests/test_glossary_served.py::test_import_scheme_and_bind_term` imports a scheme and binds one term to a column.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R801.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** A `broader` cycle must refuse with `GLOSSARY_CYCLE`. Two approved terms with one preferred label in one scheme must refuse with `GLOSSARY_LABEL_TAKEN`. A move from `draft` to `approved` without review must refuse with `GLOSSARY_UNREVIEWED`. | `tests/test_glossary_served.py::test_glossary_refusals` asserts each code.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R801.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each status move records the actor and the R802 change request id. | `tests/test_glossary_served.py::test_status_history_reads_back` reads the history back.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R801.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/glossary_search.rs` searches 100,000 terms by label. The p99 stays under 5 ms. | `cargo bench --bench glossary_search` fails on a 10 percent regression.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R801.7
Proposed descriptions for terms and assets
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Proposed descriptions for terms and assets.** The engine must hold model-proposed descriptions for terms, tables and columns as `proposed` records. A proposal cites its inputs: samples digest, lineage, usage and similar assets. A proposal becomes the description only through an R802 change request. | `tests/test_glossary_served.py::test_proposed_description_needs_review` writes one proposal and approves it.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R802
Stewardship roles, change requests and certification (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Stewardship roles, change requests and certification (rollup).** The engine must hold stewardship roles per domain and asset. A change to a governed asset goes through a change request. A steward may certify an asset as trusted. Children `.1` to `.8` deliver it. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R802.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `StewardshipAssignment{scope, role, principal}` with `role` in `owner`, `steward`, `custodian`. Add `ChangeRequest{target, proposed_digest, state, reviewers}` and `Certification{asset, level, by, expires_at}` in `crates/eg-types/src/stewardship.rs`. | `crates/eg-types/tests/stewardship.rs::records_round_trip` round-trips the three records.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R802.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** A scope is a domain, a concept scheme or an asset. The most specific assignment wins. A change request moves `open` to `approved` or `rejected`, then `applied`. A certification expires after 365 days by default. | `crates/eg-core/tests/stewardship.rs::most_specific_assignment_wins` resolves a nested scope.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R802.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** R801 status moves and R805 contract changes open a change request. arbora admits the approval through `ARBORA-OPS-R855`. The decision reads the assignment to pick reviewers. | `tests/test_stewardship_served.py::test_change_request_flow` opens, approves and applies one request.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R802.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** An approval by a principal without the steward or owner role must refuse with `STEWARD_ROLE_MISSING`. An apply of a request whose target changed must refuse with `CHANGE_REQUEST_STALE`. | `tests/test_stewardship_served.py::test_stewardship_refusals` asserts both codes.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R802.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each request records the target digest before and after, each reviewer verdict and the applied batch receipt. | `tests/test_stewardship_served.py::test_request_evidence_reads_back` compares every field.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R802.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/stewardship_resolve.rs` resolves the reviewers of one asset over 100,000 assignments. The p99 stays under 1 ms. | `cargo bench --bench stewardship_resolve` fails on a 10 percent regression.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R802.7
Trust flags on assets
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Trust flags on assets.** A principal may set one trust flag per asset: `endorsement`, `warning` or `deprecation`, each with a reason. Catalog search of EG-UNIFIED-DATA-PLANE-R764 raises an endorsed asset and lowers a deprecated one. A warning or a deprecation notifies each principal whose stored query of EG-FEDERATED-QUERY-R708 reads the asset. | `tests/test_stewardship_served.py::test_deprecation_lowers_rank_and_notifies` deprecates one table and reads rank and notices.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R802.8
Critical data elements
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Critical data elements.** A steward may mark a term or a column as a critical data element. A critical element must have an owner, a steward and at least one active quality rule of EG-UNIFIED-DATA-PLANE-R762. A report lists each critical element that misses one of the three. | `tests/test_stewardship_served.py::test_critical_element_gaps_reported` marks two elements and reads the gap report.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R803
Sensitive data detection proposes classification claims (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Sensitive data detection proposes classification claims (rollup).** The engine must scan columns and documents for personal and sensitive data. Each detection becomes a classification claim of R652 in the proposed state. A steward promotes or rejects it. Children `.1` to `.6` deliver it. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R803.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `SensitiveDetector{id, category, method, threshold}` and `Detection{asset, detector, sample_hits, ratio}` in `crates/eg-types/src/sensitive_detect.rs`. `method` is a closed set: `pattern`, `checksum`, `dictionary`, `model`. | `crates/eg-types/tests/sensitive_detect.rs::records_round_trip` round-trips both records.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R803.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** A scan samples at most 10,000 values per column. A column whose hit ratio passes the threshold yields a proposed claim. The scan stores hit counts, never the matched values. | `crates/eg-core/tests/sensitive_detect.rs::scan_proposes_claim_without_values` scans a fixture with card and email columns.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R803.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** The R761 profiling job of EG-UNIFIED-DATA-PLANE calls the scan for each column. The document chunk path of EG-UNIFIED-DATA-PLANE-R651 calls it for each chunk. | `tests/test_sensitive_detect_served.py::test_profile_job_proposes_claims` profiles a fixture table and reads the claims.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R803.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** A detector with a threshold outside 0 to 1 must refuse with `DETECTOR_THRESHOLD_INVALID`. A claim promotion without a steward must refuse through R802. | `tests/test_sensitive_detect_served.py::test_detector_refusals` asserts the code.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R803.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each claim records the detector id, the sample size, the hit ratio and the scan time. | `tests/test_sensitive_detect_served.py::test_claim_evidence_reads_back` compares every field.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R803.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/sensitive_detect.rs` scans 10,000 values against 20 pattern detectors. The p99 stays under 15 ms. | `cargo bench --bench sensitive_detect` fails on a 10 percent regression.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R804
Ontology revision diff and change impact (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Ontology revision diff and change impact (rollup).** The engine must compare two ontology revisions of R103. Before activation, it reports the change impact on held data, shapes, mappings and stored queries. Children `.1` to `.6` deliver it. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R804.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `OntologyDiff{from_rev, to_rev, added, removed, changed, deprecated}` and `ChangeImpact{instances_invalid, shapes_broken, mappings_broken, queries_broken}` in `crates/eg-types/src/ontology_diff.rs`. | `crates/eg-types/tests/ontology_diff.rs::diff_round_trips` round-trips both records.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R804.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** The diff compares the canonical axiom sets of both revisions. The impact pass validates held instances against the new shapes on a shadow branch of EG-BRANCH-MERGE-R001. It counts broken R2RML mappings and stored queries of EG-FEDERATED-QUERY-R708. | `crates/eg-core/tests/ontology_diff.rs::removed_class_reports_impact` removes one class and counts the impact.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R804.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Add the served method `OntologyDiff`. `ImportOntology` of R103 attaches the impact to its revision record. A breaking impact opens an R802 change request. | `tests/test_ontology_diff_served.py::test_import_reports_impact` imports a breaking revision and reads the impact.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R804.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** A diff between revisions of two ontology IRIs must refuse with `ONTOLOGY_DIFF_IRI_MISMATCH`. | `tests/test_ontology_diff_served.py::test_diff_refusals` asserts the code.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R804.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** The impact names the first 100 broken instances, shapes, mappings and queries by id. | `tests/test_ontology_diff_served.py::test_impact_names_items` reads the item lists back.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R804.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/ontology_diff.rs` diffs two 5,000-axiom revisions. The p99 stays under 50 ms. | `cargo bench --bench ontology_diff` fails on a 10 percent regression.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R805
Data products and data contracts (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Data products and data contracts (rollup).** The engine must hold data products: owned, versioned sets of datasets, terms and access ports with a data contract. A contract states schema, quality and freshness promises. A consumer requests access through a governed request. Children `.1` to `.7` deliver it. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R805.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `DataProduct{id, owner, version, datasets, terms, ports}`, `DataContract{product, schema_digest, quality_rules, freshness_s}` and `AccessRequest{product, principal, purpose, state}` in `crates/eg-types/src/data_product.rs`. | `crates/eg-types/tests/data_product.rs::records_round_trip` round-trips the three records.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R805.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** A contract check compares the live schema digest, the R762 quality scores and the freshness with the promise. A breach records a contract violation. An approved request writes a grant of EG-IDENTITY-R023. | `crates/eg-core/tests/data_product.rs::breach_records_violation` breaks the freshness promise.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R805.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** The R762 quality job of EG-UNIFIED-DATA-PLANE calls the contract check after each score. arbora serves `product.*` and `access_request.*` through `ARBORA-OPS-R855`. | `tests/test_data_product_served.py::test_request_grants_access` requests, approves and reads a product dataset.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R805.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** An access request without a purpose must refuse with `ACCESS_PURPOSE_MISSING`. A product version change that breaks its contract schema must refuse with `CONTRACT_SCHEMA_BREAK` unless it raises the major version. | `tests/test_data_product_served.py::test_product_refusals` asserts both codes.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R805.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each violation records the promise, the observed value and the time. Each grant records the request id. | `tests/test_data_product_served.py::test_violation_evidence_reads_back` compares every field.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R805.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/data_contract_check.rs` checks 1,000 contracts. The p99 per contract stays under 1 ms. | `cargo bench --bench data_contract_check` fails on a 10 percent regression.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R805.7
Data product proposals
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Data product proposals.** The engine must propose a data product from a cluster of assets that the same principals query together. The proposal names datasets, terms and an owner candidate. It becomes a product only through an R802 change request. | `tests/test_data_product_served.py::test_usage_cluster_yields_product_proposal` loads usage and reads the proposal.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R106
Onboarding a connector populates the metadata catalog with its assets, owners, terms and lineage (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Onboarding a connector populates the metadata catalog with its assets, owners, terms and lineage (rollup).** EG is the metadata catalog for every connected source. Each tool, prompt, skill, data resource and field of a connector is an asset. arbora onboarding (`ARBORA-FLEET-R041.15`) is the one producer of the catalog nodes. EG holds the vocabulary, validates the nodes with SHACL and serves the queries. It extends `EG-TYPED-PACKS-R102`, which projects tools, prompts and skills. Each asset gets an owner and steward from `EG-TYPED-PACKS-R802`, glossary terms from `EG-TYPED-PACKS-R801`, and lineage edges from `EG-UNIFIED-DATA-PLANE-R702`. Usage and freshness signals come from `EG-UNIFIED-DATA-PLANE-R764` and `EG-UNIFIED-DATA-PLANE-R762`. The relevance function of `EG-TYPED-PACKS-R108.16` finds every asset from UQL and SPARQL, and every catalog question is a graph query over these nodes. This row adds no second catalog, glossary or lineage store. Children `.1` to `.7` deliver it. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R106.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Extend `crates/eg-core/ontology/connector_pack-v1.ttl` with `cp:Resource`, `cp:Field`, `cp:servesClass`, `cp:exposesResource` and `cp:hasField`. Reuse `cp:realizedBy` and `cp:providesCapability`. Add shapes in `connector_pack-v1.shapes.ttl`: a `cp:Resource` names one connector, one `cp:resourceKind` and one ontology class; a `cp:Field` names one ontology property. Add `cp:declaredOwner` for the pack owner. | `crates/eg-core/tests/connector_pack_surfaces.rs::resource_field_and_owner_shapes_validate`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R106.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** arbora onboarding writes one asset node per tool, prompt, skill, resource and field into the tenant graph. It sends them in one triple batch per onboarding pass, after the attested pack import. The batch replaces the connector's earlier catalog nodes. Each node has a class that is a subclass of `cat:Asset`. It links to its connector with `cp:ofConnector`. It links to the classes or properties it serves with `cp:servesClass`, and to its capability IRIs with the core `:providesCapability`. It links to its pack contract version with `cp:packVersion`. It assigns the pack's `cp:declaredOwner` as owner through a `StewardshipAssignment` node of `EG-TYPED-PACKS-R802.1`. That node links to the asset with `cat:assignedTo`, and it names the principal with `cat:principal` and the role with `cat:role`. A pack with no declared owner makes the importing principal the owner, and the asset carries `cat:flag "owner_missing"`. A SKOS glossary term that names the class binds to the asset through `:definesAsset` (`EG-TYPED-PACKS-R801.2`). So does the native capability term that the asset provides. Lineage from connector to operation to resource to field is a set of `LineageEdge` nodes of `EG-UNIFIED-DATA-PLANE-R702.1` with `cat:from`, `cat:to` and `cat:hop`. Each edge is also a direct `cat:lineageTo` edge, so a property path walks it. A class query over a parent class returns the connector assets. | `crates/eg-core/tests/connector_pack_surfaces.rs::every_asset_has_owner_term_lineage_and_class_link`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R106.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** EG has no asset projection of its own. The catalog nodes arrive through the served triple write of the arbora onboarding batch. The engine validates that batch against the catalog shapes before it commits. Reads are served UQL, served SPARQL (`src/server/handlers/rdf/sparql.rs:30`) and the NL query planner, which compiles a question to a graph query over these nodes. No EG projection path writes catalog nodes. No served catalog, lineage, glossary, stewardship or prompt-candidate read method exists. arbora's intent tools (`ask`, `find`) reach the catalog only through these queries. | `tests/typed_packs/test_connector_catalog_served.py::test_onboarding_batch_is_validated_and_found_by_catalog_search`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R106.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** Import refuses a `cp:servesClass` with `UNRESOLVED_REFERENCE` when the class is absent. The class must exist in the pack ontology or the parent graph. It refuses a resource with no connector with `RESOURCE_UNOWNED`. A pack with no `cp:declaredOwner` imports with the asset flagged `owner_missing`, and the critical-element report of `EG-TYPED-PACKS-R802.8` lists it. | `crates/eg-core/tests/connector_pack_surfaces.rs::unresolved_class_unowned_resource_and_missing_owner_are_reported`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R106.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each asset carries the pack digest, entry revision and graph revision. Usage counts, freshness age and quality score attach to the asset as the engine records them. `GraphSchemaClasses` of `EG-TYPED-PACKS-R077` reports the asset count per class. | `tests/typed_packs/test_connector_catalog_served.py::test_asset_carries_digest_usage_freshness_and_class_counts`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R106.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served triple write that carries an onboarding batch. The batch catalogs a pack that holds two tools, one skill, one prompt and two resources with fields. Served catalog search finds each asset with owner, glossary term and lineage. A SPARQL query on the parent class returns the assets of the connector subclasses. | `tests/typed_packs/test_connector_catalog_served.py::test_catalog_search_finds_assets_with_owner_term_and_lineage`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R106.7
Competency queries
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Competency queries.** Fixed queries answer the catalog questions from the graph alone, over the `EG-TYPED-PACKS-R106.6` fixture. Each runs through served SPARQL and through its UQL equivalent and returns the expected rows. "Owner of X" reads the `StewardshipAssignment` node with `cat:assignedTo` X. "Lineage of X" walks `cat:lineageTo+` into and out of X and reads `cat:hop` from each `LineageEdge`. "Glossary term for X" reads the terms with `:definesAsset` X and their `skos:prefLabel`. "Assets of a connector under a parent class" reads `?asset a/rdfs:subClassOf* cat:Asset ; cp:ofConnector ?connector`. The query strings are the test vectors in the test specification. | `tests/typed_packs/test_catalog_competency_queries.py::test_owner_lineage_term_and_class_queries_answer_from_the_graph`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R107
Each connector pack is a versioned contract and a re-import detects breaking changes (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Each connector pack is a versioned contract and a re-import detects breaking changes (rollup).** The ontology is the contract layer. A pack binds its resources and fields to ontology concepts by mappings. It also carries shapes that validate the data. Extends `EG-TYPED-PACKS-R105`. A pack release is a new contract version. Re-import reuses `OntologyDiff` of `EG-TYPED-PACKS-R804` and the schema-break rule of `EG-TYPED-PACKS-R805.4`. A breaking change opens a change request of `EG-TYPED-PACKS-R802`. A non-breaking change applies and supersedes the older version. A `standalone` ontology needs a governed grant. Children `.1` to `.6` deliver it. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R107.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `PackContractVersion{connector, version, contract_digest, ontology_digest, shapes_digest, supersedes}` and `StandaloneGrant{connector, ontology_iri, reason, owner, expires_at}` in `crates/eg-types/src/connector_pack.rs`. A breaking change is a removed or retyped class, property or field, a narrowed shape, or a removed mapping. | `crates/eg-types/tests/pack_contract.rs::version_and_grant_round_trip`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R107.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Import diffs the new contract against the current one with `OntologyDiff` and the mapping set. A non-breaking release applies and writes a `:supersedes` edge. A breaking release stays pending behind a change request and the older version keeps serving. Virtual-graph queries resolve through the active version only. Removed surfaces leave current queries and stay readable by revision. An expired standalone grant flags the ontology as an orphan. | `crates/eg-core/tests/pack_contract.rs::non_breaking_applies_breaking_waits_and_queries_use_active_version`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R107.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** The diff runs inside `run_import` (`src/server/handlers/admin/connector_pack/import.rs:63`) before `project_head` (`src/server/handlers/admin/connector_pack/reproject.rs:72`). The grant check runs in the ontology import path of `EG-TYPED-PACKS-R105`. The served read method `OrphanReport` lists standalone ontologies and orphan classes per tenant. | `tests/typed_packs/test_pack_contract_served.py::test_diff_runs_in_import_and_orphan_report_is_served`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R107.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** A `standalone` request with no grant refuses with `STANDALONE_NOT_GRANTED`. A grant with no reason or expiry refuses with `GRANT_INCOMPLETE`. A release that breaks the contract stays pending until a change request is approved. It returns `CONTRACT_BREAK_PENDING` with the first 100 broken items. A withdrawn class still named by a stored fact refuses with `CLASS_IN_USE`. | `crates/eg-core/tests/pack_contract.rs::ungranted_incomplete_breaking_and_in_use_refuse`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R107.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each import receipt carries the old and new contract digest. It also carries the breaking item count, the change request id and the grant id. `OrphanReport` names the owner and expiry of each exception. | `tests/typed_packs/test_pack_contract_served.py::test_receipt_carries_digests_break_count_request_and_grant`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R107.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method. The test imports release 1, then a non-breaking release 2, then a release 3 that retypes one field. Release 2 serves at once. Release 3 waits and queries still use release 2. The test approves the request and release 3 serves. | `tests/typed_packs/test_pack_contract_served.py::test_breaking_release_waits_for_approval_then_serves`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108
The metadata catalog also governs agents, the business, workflows and knowledge graphs (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The metadata catalog also governs agents, the business, workflows and knowledge graphs (rollup).** Extends `EG-TYPED-PACKS-R106`. EG stores and governs metadata for four more asset families. They are Agent Library entries, company and business entities, workflows with their runs, and the knowledge graphs themselves. Each family reuses the owner, steward, glossary, lineage and usage rows that R106 reuses. Each asset links to a parent-ontology class. One catalog search and one query reach all families beside connector assets. Children `.1` to `.6` deliver the families. Children `.7` to `.16` deliver the capabilities for every family. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `crates/eg-core/ontology/catalog-v1.ttl` with four families, all as subclasses of one parent `cat:Asset`. Agent Library: `cat:AgentTemplateAsset`, `cat:A2AAgentAsset`, `cat:AgentVersion`, linked to capability, tool, skill, prompt and model profile. Business: `cat:OrgUnit`, `cat:Team`, `cat:Person`, `cat:Role`, `cat:BusinessDomain`, `cat:Product`, `cat:Service`. Workflow: `cat:WorkflowDefinition`, `cat:WorkflowRun`, `cat:WorkflowStep`. Graph: `cat:KnowledgeGraph` with ontology, contract, source, freshness and steward links. Add shapes: each asset names one owner. | `crates/eg-core/tests/catalog_assets.rs::four_families_validate_and_share_one_parent_asset_class`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** Projection catalogs entries that EG already holds, and it copies nothing. Agent Library entries come from `EG-ORCH-VOCAB-R003` and `EG-ORCH-VOCAB-R800`, with versions from `EG-ORCH-VOCAB-R801`. Org units, teams, people and roles come from the organization records of `EG-ORCH-VOCAB-R750`. Workflow definitions and runs come from `EG-CQ-ORCH-R700` and `EG-DECISION-ENGINE-R166`. Each graph registers with its ontology revisions, pack contracts of `EG-TYPED-PACKS-R107`, sources and freshness. Owners and stewards use `EG-TYPED-PACKS-R802`. Terms use `EG-TYPED-PACKS-R801`. Lineage uses `EG-UNIFIED-DATA-PLANE-R702`. Agent assembly (`EG-DECISION-ENGINE-R036`) and the questions of `EG-CQ-ORCH-R003` and `EG-CQ-ORCH-R006` read the same nodes. | `crates/eg-core/tests/catalog_assets.rs::existing_records_project_with_owner_term_and_lineage_without_copies`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** Projection attaches beside the connector projection in `project` (`src/server/connector_pack_projection.rs:228`). It also attaches in the catalog projector behind `EG-UNIFIED-DATA-PLANE-R764` search. Agent Library publish, workflow registration and graph creation each emit the catalog node through that projector. No family keeps its own index. | `tests/typed_packs/test_catalog_assets_served.py::test_publish_register_and_create_reach_the_one_projector`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** A catalog node whose class is not a subclass of `cat:Asset` refuses with `ASSET_CLASS_ORPHAN`. A node with no owner imports flagged `owner_missing` and appears in the critical-element report of `EG-TYPED-PACKS-R802.8`. A person node stores only fields the privacy markings of `EG-TYPED-PACKS-R652` allow, and a marked field refuses with `FIELD_MARKED`. | `crates/eg-core/tests/catalog_assets.rs::orphan_class_missing_owner_and_marked_field_are_handled`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each node carries its source record id, graph revision, owner, steward, last-change time and usage count. Version history of an agent or a graph reads from the supersession chain. | `tests/typed_packs/test_catalog_assets_served.py::test_node_carries_owner_steward_revision_usage_and_history`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is served catalog search and served UQL. The fixture publishes an agent template and registers a workflow with one run. It creates a team with a product. It creates a graph. One query by parent class returns all four families and a connector asset. One question lists the agents, tools and owners that serve a workflow step. | `tests/typed_packs/test_catalog_assets_served.py::test_one_query_returns_agents_business_workflows_graphs_and_connector_assets`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.7
Technical metadata from contracts
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Technical metadata from contracts.** EG stores metadata and business context only. Raw data stays in its source and is read at query time. The catalog harvests schemas, tables or collections, fields, data types and keys. It also harvests relationships, view definitions and indexes. It reads the pack contract (`SDK-CONNECTOR-CONTROL-R074`) and the source contracts (`EG-UNIFIED-DATA-PLANE-R003`). It stores no row and no software package. An unmapped field imports flagged `field_unmapped`. | `tests/typed_packs/test_catalog_capabilities_served.py::test_contract_harvest_stores_schema_keys_views_indexes_and_no_rows`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.8
Operational metadata from provenance
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Operational metadata from provenance.** The catalog records query history, access logs, execution frequency, last-updated time and user activity per asset. It reads them from query provenance, `RunTrace` and `ToolCall` records. It extends the usage counts of `EG-UNIFIED-DATA-PLANE-R764` and the source query logs of `EG-UNIFIED-DATA-PLANE-R764.7`. A top-queries view ranks by use. The log keeps the question digest, never the result rows. | `tests/typed_packs/test_catalog_capabilities_served.py::test_tool_call_and_query_provenance_feed_usage_frequency_and_top_queries`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.9
Sensitivity propagation and policy link
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Sensitivity propagation and policy link.** A sensitivity class of `EG-TYPED-PACKS-R803` flows along lineage edges. Each derived asset gets a proposed claim. A steward promotes or rejects it through `EG-TYPED-PACKS-R802`. Each asset names the access policy that governs it. The link reads the masking rules of `EG-FEDERATED-QUERY-R706` and the arbora admission policy. The catalog stores the link, not the policy body. | `tests/typed_packs/test_catalog_capabilities_served.py::test_sensitivity_propagates_downstream_as_proposal_and_asset_names_its_policy`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.10
End-to-end lineage across the platform
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**End-to-end lineage across the platform.** Lineage runs from source through connector operation, transformation and workflow. It ends at a dashboard, agent or model. It is column or field level where the source reports it (`EG-UNIFIED-DATA-PLANE-R763`). It extends the edges of `EG-UNIFIED-DATA-PLANE-R702`. A lineage query returns upstream and downstream assets for any asset, with the hop type on each edge. It is a SPARQL property path or a UQL variable-length match over `cat:lineageTo`, and it reads the hop type from the `LineageEdge` node. | `tests/typed_packs/test_catalog_capabilities_served.py::test_lineage_walks_source_operation_workflow_dashboard_agent_and_model`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.11
Metric and KPI definitions
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Metric and KPI definitions.** A `cat:Metric` holds a name, a domain, a formula and a unit. The formula names ontology properties and glossary terms of `EG-TYPED-PACKS-R801`. The engine evaluates the formula at query time over the virtual sources. A formula that names an unknown term refuses with `METRIC_TERM_UNRESOLVED`. | `tests/typed_packs/test_catalog_capabilities_served.py::test_metric_formula_binds_terms_and_unknown_term_refuses`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.12
Annotations: comments, tags, ratings and threads
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Annotations: comments, tags, ratings and threads.** Any asset takes descriptions, comments, tags, ratings and discussion threads. Each carries its author, time and revision. Endorsement, deprecation warnings and certification reuse `EG-TYPED-PACKS-R802.7` and `R802`. A proposed description follows `EG-TYPED-PACKS-R801.7`. A thread on a deleted asset stays readable by revision. | `tests/typed_packs/test_catalog_capabilities_served.py::test_annotations_attach_to_any_asset_and_trust_flags_reuse_the_steward_path`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.13
Curated articles and guides
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Curated articles and guides.** A `cat:Article` is a versioned document with an author and a status. It attaches to assets and to business domains. An article moves through the review lifecycle of `EG-TYPED-PACKS-R801.1`. Search finds it by text and by the asset it describes. | `tests/typed_packs/test_catalog_capabilities_served.py::test_article_attaches_to_asset_and_domain_and_is_found_by_text_and_by_asset`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.14
Dashboards, reports, saved queries and templates
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Dashboards, reports, saved queries and templates.** A dashboard or report is a catalog asset. It lists the assets it reads, its owner and its usage. The dashboards of the agent-webui register through a published descriptor. Saved queries use the stored queries of `EG-FEDERATED-QUERY-R708`. A reusable query template adds named parameters. The catalog stores the descriptor and the query text, not the data shown. | `tests/typed_packs/test_catalog_capabilities_served.py::test_dashboard_report_saved_query_and_template_register_with_reads_and_usage`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.15
AI and ML model assets
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**AI and ML model assets.** A `cat:ModelAsset` holds a registry reference, input and output schemas, training datasets and evaluation results. It links to its dataset lineage and to the model profile of `EG-ORCH-VOCAB-R005`. The engine stores references and metadata, never weights. | `tests/typed_packs/test_catalog_capabilities_served.py::test_model_asset_links_registry_ref_schemas_and_training_lineage_without_weights`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R108.16
One ranked index across all asset families, callable from queries
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**One ranked index across all asset families, callable from queries.** Ranked catalog search is a relevance function inside the query engine. It is not a served method. SPARQL calls it as `cat:relevance(?asset, "text")` in a `FILTER`, `BIND` or `ORDER BY`. UQL calls it as `search("text")` in a `MATCH` filter or order. It covers connector assets, Agent Library entries and business entities. It also covers workflows, graphs, metrics, articles, dashboards, queries and models. It extends the full-text index of `EG-UNIFIED-DATA-PLANE-R764`, and it adds no second index. The score sums name, glossary-label, concept and description matches. Rank boosts assets by usage and by endorsement, and it lowers deprecated assets. A query reads the rank components of each hit through `cat:rankComponents`. The NL query planner uses the function to resolve a business term to assets. arbora's `catalog.search` (`ARBORA-OPS-R855`) compiles to a query that calls it. | `tests/typed_packs/test_catalog_capabilities_served.py::test_one_search_ranks_all_families_with_usage_and_endorsement_boost`
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R109
The dashboard is a first-class catalog asset (rollup)
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**The dashboard is a first-class catalog asset (rollup).** Extends `EG-TYPED-PACKS-R108.14`. A person saves a dashboard document. It is a catalog asset. It has content, an owner and sharing grants. It has catalog links, search and soft delete. arbora saves it through `ARBORA-OPS-R861`. The agent-webui authors it in `WEBUI-DASH-R010` and `WEBUI-DASH-R012`. Children `.1` to `.6` deliver it. | See each child.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R109.1
Model
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Model.** Add `cat:DashboardAsset` as a subclass of `cat:Asset`. It holds a versioned body of panels, queries, layout and parameters. It holds a revision that only increases. It names one owner principal and a list of grants. Each grant gives `view` or `edit` to a principal or a group. Links name the data sources and queries of each panel. They name the glossary terms and ontology concepts it shows. They also hold usage counts (views and last viewed). The body is stored, and the data shown is not. | `crates/eg-core/tests/dashboard_asset.rs::dashboard_asset_shape_validates_body_revision_owner_grants_and_links`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R109.2
Behavior
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Behavior.** A save carries the revision it read. The engine accepts the save only when that revision is the current one. It then stores the new body and raises the revision by one. Each save rebuilds the lineage links from the panels (`EG-UNIFIED-DATA-PLANE-R702`) and the term links (`EG-TYPED-PACKS-R801`). A view raises the usage count and sets the last-viewed time. A delete marks the asset as removed. The engine keeps it for a retention period. A restore inside that period brings it back. After the period the engine drops the body. The revision history stays. | `crates/eg-core/tests/dashboard_asset.rs::save_bumps_revision_rebuilds_links_and_delete_keeps_then_purges`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R109.3
Wiring
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Wiring.** The save, read, share and delete operations run through the one catalog projector beside `EG-TYPED-PACKS-R108.14`. arbora serves them as `ARBORA-OPS-R861`, and the agent-webui calls them as `WEBUI-DASH-R010` and `WEBUI-DASH-R012`. Every read and every write checks EG authority with the owner and grant rows of `EG-TYPED-PACKS-R802`. The asset enters catalog search (`EG-TYPED-PACKS-R108.16`) on save. It leaves the index on delete. | `tests/typed_packs/test_dashboard_asset_served.py::test_save_read_share_and_delete_reach_the_one_projector_with_authority_checks`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R109.4
Refusal
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Refusal.** A save with a stale revision refuses with `DASHBOARD_REVISION_CONFLICT`. The refusal names the current revision. It never overwrites. A read without a grant refuses with `DASHBOARD_NOT_GRANTED`. A write without an `edit` grant refuses the same way. Only the owner may change grants or delete. A body that names a panel with no query refuses with `DASHBOARD_BODY_INVALID`. A read of a purged asset refuses with `DASHBOARD_PURGED`. | `crates/eg-core/tests/dashboard_asset.rs::stale_revision_missing_grant_invalid_body_and_purged_asset_refuse`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R109.5
Evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Evidence.** Each save records its author, time, prior revision and new revision. Each grant change records who gave it and when. Each delete records the retention end. The revision history reads from the supersession chain. Usage reads from view records. | `tests/typed_packs/test_dashboard_asset_served.py::test_revision_grant_and_delete_history_and_usage_are_served`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R109.6
Hot-path proof
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Hot-path proof.** The entry point is the served save operation and served catalog search. The fixture saves a dashboard with two panels. It saves again with a stale revision and sees the conflict. It shares the dashboard to a group and reads as a member and as a stranger. It reads the lineage of a panel back to its data source. It finds the dashboard by search. It deletes it and sees it leave search but stay restorable. | `tests/typed_packs/test_dashboard_asset_served.py::test_dashboard_save_conflict_share_lineage_search_and_soft_delete`.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R085.5
Rollup through R085.5.1–R085.5.4
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Rollup through R085.5.1–R085.5.4.** **Registered human approval keys.** Store broker-attested public Ed25519 keys for signed_approval, bound to the live native human session subject and deployment tenant. Exact revision CAS controls registration, rotation and revocation; lookup binds principal, tenant, key and purpose and conveys no caller authority. | Native lifecycle, persistence, expiry, authority and CAS refusal tests. Broker proof verification and served enrollment remain pending; fixture registration does not qualify them.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R085.6
Rollup through R085.6.1–R085.6.3
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Rollup through R085.6.1–R085.6.3.** **Credential resolution can observe without refreshing.** Existing SessionTouch accepts optional refresh. Omitted or true retains existing Resolve behavior. False verifies the same credential and current session/principal state without changing last-seen or expiry. Resolve metadata reports no mutation for false. Revoke remains a mutation regardless of refresh. | Native tests cover legacy defaults, unchanged authority revision on observation, expiry and revocation refusals, and unconditional revocation. Generated bindings and native qualification remain pending.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R085.7.1
Pure reference inspection
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Pure reference inspection.** Existing identity store validates owner, tenant, completed live session and active principal. Inspection leaves state unchanged and refuses ambiguous references. | Run the reference inspection unit refusal tests.
requirementEG-TYPED-PACKSVERIFIED2b8dd458b459
b6d6bdedcd35
crates/eg-types/src/identity/tests/session_evidence.rs:168
crates/eg-types/src/identity/tests/session_evidence.rs:204
crates/eg-types/src/identity/tests/session_evidence.rs:334
EG-TYPED-PACKS-R085.7.2
Durable reference snapshots
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Durable reference snapshots.** Inspection returns session facts and the global authority revision from one durable snapshot. Reopen and revocation preserve exact reference binding. | Run the core durable session evidence fixture; unit tests alone do not qualify this child.
requirementEG-TYPED-PACKSSPECIFIEDcrates/eg-core/src/isolation/identity_store_tests/session_evidence.rs:6
EG-TYPED-PACKS-R085.7.3
Reference contract and served qualification
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Reference contract and served qualification.** Generated request/result bindings expose reference inspection through the normal verified identity boundary. No reference becomes a credential. | Validate generated schemas and execute served owner/tenant/refusal acceptance; remain pending without that evidence.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R085.4.1
Pure renewal ceiling transitions
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Pure renewal ceiling transitions.** Renewal requires matching current scopes within the original creation-time ceiling. Missing legacy evidence refuses. Idle expiry stays within original absolute expiry. | Run ceiling, legacy, expansion-refusal and narrowing unit fixtures.
requirementEG-TYPED-PACKSVERIFIED2b8dd458b459
b6d6bdedcd35
crates/eg-types/src/identity/tests/session_evidence.rs:220
crates/eg-types/src/identity/tests/session_evidence.rs:335
crates/eg-types/src/identity/tests/session_evidence.rs:364
crates/eg-types/src/identity/tests/session_evidence.rs:385
crates/eg-types/src/identity/tests/session_evidence.rs:420
EG-TYPED-PACKS-R085.4.2
Durable renewal CAS
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Durable renewal CAS.** Expected global authority revision and the renewal write share the existing durable CAS. A competing revocation cannot be overwritten; renewal survives reopen. | Run the core renewal fixture including RevokeBeforeSave; remain pending until native execution.
requirementEG-TYPED-PACKSSPECIFIEDcrates/eg-core/src/isolation/identity_store_tests/session_evidence.rs:161
EG-TYPED-PACKS-R085.4.3
Renewal contract and served qualification
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Renewal contract and served qualification.** Generated bindings and the served identity boundary preserve exact revision, owner, tenant and scope conditions. Renewal issues no credentials or approvals. | Execute generated-contract and served renewal acceptance. Unrelated authority changes must require fresh inspection.
requirementEG-TYPED-PACKSSPECIFIEDsrc/server/dispatch/identity_store/resolution_context/tests.rs:681
EG-TYPED-PACKS-R085.5.1
Pure registered approval-key transitions
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Pure registered approval-key transitions.** Existing identity store implements bound key lifecycle, expiry, broker checks, rotation/revocation CAS and canonical registration bytes. | Run the eg-types approval-key tests; serialization fixtures do not qualify durable writes.
requirementEG-TYPED-PACKSVERIFIED2b8dd458b459
b6d6bdedcd35
crates/eg-types/src/identity/tests/approval_keys.rs:112
crates/eg-types/src/identity/tests/approval_keys.rs:150
crates/eg-types/src/identity/tests/approval_keys.rs:188
crates/eg-types/src/identity/tests/approval_keys.rs:219
crates/eg-types/src/identity/tests/approval_keys.rs:74
EG-TYPED-PACKS-R085.5.2
Durable approval-key evidence
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Durable approval-key evidence.** Registered key facts, rotation and revocation persist through the native authority write path and durable reopen. | Run the core approval-key fixture and retain pending status without native results.
requirementEG-TYPED-PACKSSPECIFIEDcrates/eg-core/src/isolation/identity_store_tests/approval_keys.rs:63
EG-TYPED-PACKS-R085.5.3
Approval-key request stamping
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Approval-key request stamping.** The existing request boundary derives the approval-key binding and replaces untrusted caller stamp material. | Run the native server approval-key stamp test. This does not qualify broker proof verification or enrollment.
requirementEG-TYPED-PACKSSPECIFIEDsrc/server/dispatch/identity_store/tests/approval_keys.rs:4
EG-TYPED-PACKS-R085.5.4
Approval-key served qualification
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Approval-key served qualification.** Generated schemas, broker proof verification and served enrollment meet the parent contract. No fixture authorizes live enrollment. | Execute generated-contract and served qualification; keep pending until owner evidence exists.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-TYPED-PACKS-R085.6.1
Pure credential observation
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Pure credential observation.** Refresh false preserves credential checks and returns resolution without a session touch. Omitted refresh retains legacy behavior and revoke always mutates. | Run observation, default refresh, revocation and authority unit tests.
requirementEG-TYPED-PACKSVERIFIED2b8dd458b459
b6d6bdedcd35
crates/eg-types/src/identity/tests/session_evidence.rs:279
crates/eg-types/src/identity/tests/session_evidence.rs:310
EG-TYPED-PACKS-R085.6.2
Durable observation revision
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Durable observation revision.** Credential observation leaves the complete durable authority image and global revision unchanged. | Run the core observation fixture against the native durable store.
requirementEG-TYPED-PACKSSPECIFIEDcrates/eg-core/src/isolation/identity_store_tests/session_evidence.rs:7
EG-TYPED-PACKS-R085.6.3
Observation contract and served qualification
Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source
**Observation contract and served qualification.** Generated bindings preserve optional refresh and the served verifier issues the existing resolution without a touch when false. | Execute generated-route and served non-touch credential acceptance, including current-authority refusals.
requirementEG-TYPED-PACKSSPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE
EG-UNIFIED-DATA-PLANE — Unified data plane
specNoneSPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R001
Record attached-source and native-hosting architecture decisions
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Record attached-source and native-hosting architecture decisions.** EG documents, as approved architecture decision records, that attached third-party sources are the default integration path, that EG remains the single converged query engine, that native hosting is earned per application through a defined gate, the router's consistency contract, and the scope boundary of the pgrx companion. | Review of the merged architecture decision records confirms each decision is recorded and accepted.
requirementEG-UNIFIED-DATA-PLANELANDED1f6d512ae013
3dd56fe53283
5a4a0b3d4936
7e14801e08c3
9a85c8a49fd4
EG-UNIFIED-DATA-PLANE-R002
Unify attached-source registration into one owner-scoped registry (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Unify attached-source registration into one owner-scoped registry (rollup).** EG provides a single owner-scoped attached-source registry. It replaces the separate eg-plan ForeignSourceSpec::Sql, OBDA external_sources, and kernel mirror-target registrations. A dialect-adapter contract backs it and covers the driver, SQL rendering, catalog reader, change capture, and type map. Credentials are resolved only by secret reference, and registration verifies the outbound target before persistence. This row is a rollup, split by code root into `EG-UNIFIED-DATA-PLANE-R002.1`, `.2` and `.3`. It is LANDED only when all three children are LANDED. | Integration tests show SQL, OBDA, change capture, and mirror paths all resolve through the same registered source. Registration of an unverified or cross-owner endpoint fails closed.
requirementEG-UNIFIED-DATA-PLANELANDED23ba8c7eab2a
3dd56fe53283
64f76c5b3209
9a7674d1bae5
b28c6e06c13a
src/server/foreign_catalog.rs:402
src/server/foreign_catalog.rs:426
EG-UNIFIED-DATA-PLANE-R002.1
Verify the outbound target before persisting a `ForeignSourceSpec::Sql` registration (producer path)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Verify the outbound target before persisting a `ForeignSourceSpec::Sql` registration (producer path).** `ForeignSourceCatalog::register` runs the existing SSRF-sensitive destination gate (`eg_plan::federation_ssrf::check_sql_dsn`) against a `Sql` spec's DSN before the entry is inserted, so a registration naming a disallowed address never reaches the catalog. Depends on none (producer; `check_sql_dsn` and the owner-scoped catalog already exist). | A unit test registers a `Sql` spec whose DSN names a disallowed destination and confirms the catalog holds no entry for it afterward; a spec naming an allowed destination still registers.
requirementEG-UNIFIED-DATA-PLANEVERIFIED23ba8c7eab2a
3dd56fe53283
b28c6e06c13a
d603182af742
src/server/foreign_catalog.rs:403
src/server/foreign_catalog.rs:427
EG-UNIFIED-DATA-PLANE-R002.2
Verify the outbound target before persisting an OBDA `external_sources` registration (consumer path)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Verify the outbound target before persisting an OBDA `external_sources` registration (consumer path).** The OBDA table-source handler (`src/server/handlers/rdf/obda.rs::register_table_sources`) runs the same destination gate against each `ObdaExternalSource`'s DSN before registering it into the `ObdaSourceRegistry`, so OBDA registration fails closed exactly like the SQL federation path. Depends on `EG-UNIFIED-DATA-PLANE-R002.1` (reuses its verification call). | A unit test feeds `register_table_sources` an entry whose DSN names a disallowed destination and confirms the registry holds no source for it afterward; a disallowed entry does not block registering the other, allowed entries in the same call.
requirementEG-UNIFIED-DATA-PLANELANDED23ba8c7eab2a
b28c6e06c13a
EG-UNIFIED-DATA-PLANE-R002.3
Verify the outbound target before persisting a kernel mirror-target registration (sink path)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Verify the outbound target before persisting a kernel mirror-target registration (sink path).** Once `EG-DURABLE-KERNEL-R024` lands a per-target mirror-sink registration (today `CdcHub` holds one process-global `ExternalCdcSink`, not a registry), that registration path runs the same destination gate before a mirror target is persisted. Depends on `EG-UNIFIED-DATA-PLANE-R002.1` and the same-repo `EG-DURABLE-KERNEL-R024` (status: BUILDING — the mirror-target registration concept does not exist yet, so this child has no code root to verify against today). | A unit test registers a mirror target whose destination is disallowed and confirms the sink registry holds no entry for it afterward.
requirementEG-UNIFIED-DATA-PLANELANDED9a7674d1bae5
EG-UNIFIED-DATA-PLANE-R003
Extract typed, hashed catalog graphs per dialect
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Extract typed, hashed catalog graphs per dialect.** Each dialect adapter's catalog reader extracts tables, columns, keys, foreign keys, indexes, views, enums, and JSON columns into a versioned, typed, hashed schema graph, and every catalog artifact has a named OBDA or schema_context consumer. Net-new (no catalog-graph type existed on main): split per the net-new rule. `.1` is the typed catalog-graph model and its hash. Rollup: LANDED only once every child is. | A golden test confirms repeated catalog reads against the same source produce a stable hash and ordering.
requirementEG-UNIFIED-DATA-PLANEVERIFIED37003f28164f
3dd56fe53283
8ef8d8e817b7
dc9533466828
crates/eg-types/src/attached_catalog.rs:117
crates/eg-types/src/attached_catalog.rs:145
crates/eg-types/src/attached_catalog.rs:159
crates/eg-types/src/attached_catalog.rs:173
EG-UNIFIED-DATA-PLANE-R003.1
`AttachedCatalogGraph` is a versioned, typed catalog with a reorder-stable content hash, refusing an ambiguous duplicate table name
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`AttachedCatalogGraph` is a versioned, typed catalog with a reorder-stable content hash, refusing an ambiguous duplicate table name.** `crates/eg-types/src/attached_catalog.rs` hashes a catalog's tables and columns after sorting them, so two reads of the same unchanged catalog in a different discovery order hash identically, and refuses a catalog naming the same schema-qualified table twice. | Verified by unit tests: the hash is stable under table/column reordering, changes when the catalog changes, and a duplicated schema-qualified table name is refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
dc9533466828
crates/eg-types/src/attached_catalog.rs:117
crates/eg-types/src/attached_catalog.rs:145
crates/eg-types/src/attached_catalog.rs:159
crates/eg-types/src/attached_catalog.rs:173
EG-UNIFIED-DATA-PLANE-R004
Infer schema structure deterministically from attached catalogs
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Infer schema structure deterministically from attached catalogs.** EG profiles attached-source columns and infers JSON shapes under a bounded, policy-gated sampling budget, discovers inclusion and functional dependencies with supporting evidence, and groups related tables using Leiden community detection with a fixed seed. Net-new (no sampling-budget type existed on main): split per the net-new rule. `.1` is the typed sampling-budget model. Rollup: LANDED only once every child is. | A deterministic test fixture produces identical dependency and grouping results across repeated runs.
requirementEG-UNIFIED-DATA-PLANEVERIFIED197081533292
3dd56fe53283
8ef8d8e817b7
crates/eg-types/src/schema_inference.rs:101
crates/eg-types/src/schema_inference.rs:65
crates/eg-types/src/schema_inference.rs:75
crates/eg-types/src/schema_inference.rs:88
EG-UNIFIED-DATA-PLANE-R004.1
`ColumnSamplingBudget` is a bounded, policy-gated row/byte budget, refusing a zero or unbounded declaration
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`ColumnSamplingBudget` is a bounded, policy-gated row/byte budget, refusing a zero or unbounded declaration.** `crates/eg-types/src/schema_inference.rs` refuses a sampling budget declaring zero rows, zero bytes, or more rows than a fixed ceiling, so JSON-shape profiling can never run with an effectively unlimited budget. | Verified by unit tests: a budget within bounds validates, and a zero-row, zero-byte, or over-ceiling budget is each refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
8ef8d8e817b7
crates/eg-types/src/schema_inference.rs:101
crates/eg-types/src/schema_inference.rs:65
crates/eg-types/src/schema_inference.rs:75
crates/eg-types/src/schema_inference.rs:88
EG-UNIFIED-DATA-PLANE-R005
Compile approved relational mappings to named R2RML virtual graphs
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Compile approved relational mappings to named R2RML virtual graphs.** EG proposes ontology mappings deterministically first, allows a model to suggest additional mappings as proposals only, and compiles approved mappings to R2RML stored as versioned, server-side named virtual graphs queryable by name from SPARQL, UQL, and REASON. Net-new (no mapping-approval type existed on main): split per the net-new rule. `.1` is the typed approval-state model. Rollup: LANDED only once every child is. | A test confirms an unapproved or model-only mapping cannot be queried, while an approved mapping answers a known query by name.
requirementEG-UNIFIED-DATA-PLANEVERIFIED197081533292
3dd56fe53283
545b68818f0b
79ba71d072a5
crates/eg-plan/src/virtual_graph_mapping.rs:80
crates/eg-plan/src/virtual_graph_mapping.rs:87
crates/eg-plan/src/virtual_graph_mapping.rs:96
EG-UNIFIED-DATA-PLANE-R005.1
`VirtualGraphMapping` carries a typed approval state, refusing a query against a proposed or model-suggested mapping
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`VirtualGraphMapping` carries a typed approval state, refusing a query against a proposed or model-suggested mapping.** `crates/eg-plan/src/virtual_graph_mapping.rs` returns a mapping's queryable name only when its state is `Approved`. A `Proposed` or `ModelSuggested` mapping's query is refused with a typed error naming its actual state. | Verified by unit tests: an approved mapping's name is queryable, and a proposed or model-suggested mapping is each refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED197081533292
3dd56fe53283
crates/eg-plan/src/virtual_graph_mapping.rs:80
crates/eg-plan/src/virtual_graph_mapping.rs:87
crates/eg-plan/src/virtual_graph_mapping.rs:96
EG-UNIFIED-DATA-PLANE-R006
Push down virtual-graph queries to source SQL
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Push down virtual-graph queries to source SQL.** EG renders joins across triples maps on the same source, aggregates, and ORDER BY/LIMIT into native source SQL using typed values rather than text casts, and shows any in-memory fallback explicitly in the query plan. Net-new (no pushdown-decision type existed on main): split per the net-new rule. `.1` is the typed decision/fallback model. Rollup: LANDED only once every child is. | A differential test compares pushed-down query results against the native source and confirms EXPLAIN reports the fallback reason when pushdown is not possible.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
545b68818f0b
crates/eg-plan/src/pushdown_plan.rs:70
crates/eg-plan/src/pushdown_plan.rs:80
crates/eg-plan/src/pushdown_plan.rs:90
EG-UNIFIED-DATA-PLANE-R006.1
`PushdownDecision` names an explicit fallback reason, refusing a decision that claims both success and a fallback
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`PushdownDecision` names an explicit fallback reason, refusing a decision that claims both success and a fallback.** `crates/eg-plan/src/pushdown_plan.rs` refuses a decision where `pushed_down` is true alongside a set `fallback_reason`, so EXPLAIN can never report a fallback reason for a fragment that actually pushed down. | Verified by unit tests: a pushed-down decision with no reason validates, a fallback decision validates, and a decision claiming both is refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
545b68818f0b
crates/eg-plan/src/pushdown_plan.rs:70
crates/eg-plan/src/pushdown_plan.rs:80
crates/eg-plan/src/pushdown_plan.rs:90
EG-UNIFIED-DATA-PLANE-R007
Federate attached tables as DataFusion table providers
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Federate attached tables as DataFusion table providers.** EG exposes attached tables as DataFusion TableProviders with dialect-aware sub-plan pushdown for projection, filter, limit, join, and aggregate operations, reusing the datafusion-table-providers and datafusion-federation crates where their license permits. Net-new (no pushdown-capability type existed on main): split per the net-new rule. `.1` is the typed capability model. Rollup: LANDED only once every child is. | An integration test compares a federated query plan and result against direct execution on the source for each supported pushdown operation.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
bff86f252aa4
e8695518196e
crates/eg-plan/src/federation_capabilities.rs:106
crates/eg-plan/src/federation_capabilities.rs:71
crates/eg-plan/src/federation_capabilities.rs:85
crates/eg-plan/src/federation_capabilities.rs:92
EG-UNIFIED-DATA-PLANE-R008
Normalize change capture into a durable, replayable framework
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Normalize change capture into a durable, replayable framework.** Each adapter emits ChangeEnvelope records into CdcHub, which persists a durable position per subscription, replays idempotently after restart, reports lag metrics with guardrails such as a WAL retention cap, and handles keyless tables explicitly. Catalog-drift detection re-runs schema intelligence and flags mappings that the drift breaks. No typed ChangeEnvelope model existed on main; split producer-first: `.1` is the typed model. Known blocker for the full row: depends on `EG-UNIFIED-DATA-PLANE-R002`, itself `BUILDING`. Rollup: LANDED only once every child is. | A fault-injection test stops and restarts capture mid-stream and confirms the replayed result matches a snapshot of the source, with drift detection flagging an affected mapping.
requirementEG-UNIFIED-DATA-PLANEVERIFIED343ebb9c7c6a
3dd56fe53283
64f76c5b3209
crates/eg-durable/src/change_envelope.rs:113
crates/eg-durable/src/change_envelope.rs:126
crates/eg-durable/src/change_envelope.rs:141
crates/eg-durable/src/change_envelope.rs:157
crates/eg-durable/src/change_envelope.rs:176
EG-UNIFIED-DATA-PLANE-R008.1
`ChangeEnvelope`/`ChangeOp` are a typed change-capture record and a validated refusal rule, refusing a change with no durable position or a keyed table's update/delete with no key
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`ChangeEnvelope`/`ChangeOp` are a typed change-capture record and a validated refusal rule, refusing a change with no durable position or a keyed table's update/delete with no key.** `crates/eg-durable/src/change_envelope.rs` defines the `Insert`/`Update`/`Delete` op enum and the envelope's `source_position`/`table`/`op`/`key`/`table_is_keyless` fields, and `ChangeEnvelope::validate` refuses an empty `source_position` and refuses an `Update`/`Delete` with no `key` unless `table_is_keyless` is set. CdcHub, durable position storage, replay, lag metrics, the WAL retention cap, and catalog-drift detection are out of scope for this child. | Verified by unit tests: a keyed table's insert with no key validates, a keyed table's update with a key validates, an empty `source_position` is refused, a keyed table's update with no key is refused, and an explicitly keyless table's update with no key validates.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
64f76c5b3209
crates/eg-durable/src/change_envelope.rs:113
crates/eg-durable/src/change_envelope.rs:126
crates/eg-durable/src/change_envelope.rs:141
crates/eg-durable/src/change_envelope.rs:157
crates/eg-durable/src/change_envelope.rs:176
EG-UNIFIED-DATA-PLANE-R007.1
`DialectPushdownCapabilities` declares a dialect's supported pushdown operations, refusing an unknown operation name
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`DialectPushdownCapabilities` declares a dialect's supported pushdown operations, refusing an unknown operation name.** `crates/eg-plan/src/federation_capabilities.rs` parses the five named operations (projection, filter, limit, join, aggregate) and refuses the whole capability declaration if any named operation is not one of them. | Verified by unit tests: all five names parse, an unknown name is refused, declaring all valid names succeeds, and one bad name among good ones refuses the whole declaration.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
e8695518196e
crates/eg-plan/src/federation_capabilities.rs:106
crates/eg-plan/src/federation_capabilities.rs:71
crates/eg-plan/src/federation_capabilities.rs:85
crates/eg-plan/src/federation_capabilities.rs:92
EG-UNIFIED-DATA-PLANE-R009
Drive consumers from change capture idempotently
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Drive consumers from change capture idempotently.** Change events update the graph through approved mappings, refresh vector and full-text indexes, and emit CEP and outbox events, all idempotent on the source position so a replayed event produces no duplicate effect. Net-new (no idempotent-consumer type existed on main): split per the net-new rule. `.1` is the typed checkpoint/idempotent-apply model. Rollup: LANDED only once every child is. | A replay test re-delivers the same change position and confirms each consumer's state is unchanged.
requirementEG-UNIFIED-DATA-PLANEVERIFIED79ba71d072a5
crates/eg-durable/src/idempotent_consumer.rs:60
crates/eg-durable/src/idempotent_consumer.rs:66
crates/eg-durable/src/idempotent_consumer.rs:74
crates/eg-durable/src/idempotent_consumer.rs:82
EG-UNIFIED-DATA-PLANE-R010
Maintain an accelerated local copy of attached data
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Maintain an accelerated local copy of attached data.** EG maintains an optional cached virtual graph or columnar replica in eg-lake for attached tables, refreshed by change capture under a per-table acceleration policy. Depends on EG-UNIFIED-DATA-PLANE-R008 (change capture), which is being split concurrently. Split per the net-new rule (no typed acceleration-policy model existed on main): `.1` is the typed model. Rollup: LANDED only once every child is. | A restart/failover test shows the accelerated copy reconverges to the source within its declared lag objective.
requirementEG-UNIFIED-DATA-PLANEVERIFIED343ebb9c7c6a
crates/eg-lake/src/acceleration_policy.rs:110
crates/eg-lake/src/acceleration_policy.rs:72
crates/eg-lake/src/acceleration_policy.rs:83
crates/eg-lake/src/acceleration_policy.rs:94
EG-UNIFIED-DATA-PLANE-R010.1
`AccelerationPolicy` is a typed per-table policy, refusing a declaration its own verification could never check
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`AccelerationPolicy` is a typed per-table policy, refusing a declaration its own verification could never check.** `crates/eg-lake/src/acceleration_policy.rs` validates a declared policy names a real table and, when `enabled`, declares a non-zero lag objective — an enabled policy with no declared lag objective cannot be measured against a "reconverges within its declared lag objective" test. A disabled policy may carry `lag_objective_ms == 0`. | Verified by unit tests: an enabled policy with a positive lag objective validates, a disabled policy with `lag_objective_ms == 0` validates, an empty table name is refused regardless of `enabled`, and an enabled policy with `lag_objective_ms == 0` is refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED343ebb9c7c6a
crates/eg-lake/src/acceleration_policy.rs:110
crates/eg-lake/src/acceleration_policy.rs:72
crates/eg-lake/src/acceleration_policy.rs:83
crates/eg-lake/src/acceleration_policy.rs:94
EG-UNIFIED-DATA-PLANE-R009.1
`ConsumerCheckpoint` applies an incoming position idempotently, refusing an unnamed consumer
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`ConsumerCheckpoint` applies an incoming position idempotently, refusing an unnamed consumer.** `crates/eg-durable/src/idempotent_consumer.rs` refuses a checkpoint with no `consumer_id`, and `apply_if_newer` is a no-op on a replayed or stale position rather than reapplying it. | Verified by unit tests: a named checkpoint validates, an empty `consumer_id` is refused, a strictly newer position applies, and replaying the same position a second time is an idempotent no-op.
requirementEG-UNIFIED-DATA-PLANEVERIFIED79ba71d072a5
crates/eg-durable/src/idempotent_consumer.rs:60
crates/eg-durable/src/idempotent_consumer.rs:66
crates/eg-durable/src/idempotent_consumer.rs:74
crates/eg-durable/src/idempotent_consumer.rs:82
EG-UNIFIED-DATA-PLANE-R011
Route queries by freshness across native, live, and accelerated paths
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Route queries by freshness across native, live, and accelerated paths.** The query router selects between the native store, a live source read, and the accelerated copy based on declared freshness policy, and a client requesting read-your-writes waits for its last committed source position up to a bounded timeout rather than returning a stale result. EXPLAIN reports the selected route. Net-new (no freshness-route type existed on main): split per the net-new rule. `.1` is the typed route/bounded-wait model. Rollup: LANDED only once every child is. | A timeout test confirms a read-your-writes request either waits successfully or fails explicitly, never returning stale data silently, and EXPLAIN output is checked against the actual route taken.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDbff86f252aa4
crates/eg-plan/src/freshness_router.rs:72
crates/eg-plan/src/freshness_router.rs:79
crates/eg-plan/src/freshness_router.rs:85
crates/eg-plan/src/freshness_router.rs:91
EG-UNIFIED-DATA-PLANE-R011.1
`ReadYourWritesWait` is a bounded timeout, refusing a zero (unbounded) declaration; `FreshnessRoute` names exactly the three tiers
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`ReadYourWritesWait` is a bounded timeout, refusing a zero (unbounded) declaration; `FreshnessRoute` names exactly the three tiers.** `crates/eg-plan/src/freshness_router.rs` refuses constructing a wait with `timeout_ms == 0`, and resolves a wait to one of exactly two typed outcomes (satisfied or typed-timeout), never an implicit stale-data path. | Verified by unit tests: a positive timeout constructs, a zero timeout is refused, the two wait outcomes are distinct, and all three routes are known.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDbff86f252aa4
crates/eg-plan/src/freshness_router.rs:72
crates/eg-plan/src/freshness_router.rs:79
crates/eg-plan/src/freshness_router.rs:85
crates/eg-plan/src/freshness_router.rs:91
EG-UNIFIED-DATA-PLANE-R012
Govern write-back to attached sources
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Govern write-back to attached sources.** EG writes back to an attached source only through an approved, idempotent path with an audit reservation, and prefers the application's own API over a direct write when the application declares business logic of its own. Rollup: split into `.1` (below) per SPEC-SIZING §5; further children land the live adapter dispatch and the EG-DURABLE-KERNEL-R031 audit reservation wiring. | A negative test confirms a write missing approval, an audit reservation, or idempotency is rejected before it reaches the source.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDb3aca9fb42ce
d0a69c4685f5
crates/eg-types/src/attached_source_governance.rs:109
crates/eg-types/src/attached_source_governance.rs:120
crates/eg-types/src/attached_source_governance.rs:131
crates/eg-types/src/attached_source_governance.rs:142
crates/eg-types/src/attached_source_governance.rs:92
EG-UNIFIED-DATA-PLANE-R012.1
Typed model for attached-source write-back governance, proved by refusal tests
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Typed model for attached-source write-back governance, proved by refusal tests.** `eg-types::attached_source_governance` defines `AttachedSourceWriteRequest` (approval reference, audit reservation digest, idempotency key, application-API-vs-direct-write path) and a fail-closed `validate` that refuses a write missing approval, missing an audit reservation, missing an idempotency key, or taking the direct-write path against a source that declares its own business logic. | Unit tests prove refusal for each of the four missing/disallowed conditions and acceptance for a fully-governed request.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDd0a69c4685f5
crates/eg-types/src/attached_source_governance.rs:109
crates/eg-types/src/attached_source_governance.rs:120
crates/eg-types/src/attached_source_governance.rs:131
crates/eg-types/src/attached_source_governance.rs:142
crates/eg-types/src/attached_source_governance.rs:92
EG-UNIFIED-DATA-PLANE-R013
Implement the Postgres attached-source adapter
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Implement the Postgres attached-source adapter.** The Postgres adapter connects via sqlx/tokio-postgres, reads the pg_catalog, captures changes through pgoutput logical replication, and maps jsonb, array, enum, and pgvector types without loss. | A per-engine conformance entry compares EG's query and capture results against native Postgres for each covered type.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
6bc4b5668ed0
crates/eg-types/src/postgres_adapter.rs:205
EG-UNIFIED-DATA-PLANE-R014
Implement the MySQL and MariaDB attached-source adapters
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Implement the MySQL and MariaDB attached-source adapters.** The MySQL and MariaDB adapters connect via sqlx mysql, read information_schema, capture changes through row-based binlog with GTID, and map each engine's types, with separate conformance entries for MySQL and MariaDB. | A per-engine conformance entry compares EG's query and capture results against native MySQL and against native MariaDB.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDbf6452b7f8d4
EG-UNIFIED-DATA-PLANE-R014.1
Typed MySQL/MariaDB dialect-entry model (producer-first split of R014)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Typed MySQL/MariaDB dialect-entry model (producer-first split of R014).** A pure, typed model (`SqlEngineKind`, `SqlEngineCaptureSupport`, `SqlEngineDialectEntry`) keeps MySQL and MariaDB as two separate, explicitly declared dialect entries rather than one collapsed dialect, refusing to construct an entry with a default version floor or type-map revision. The driver, SQL rendering, catalog reader and binlog capture parts are later slices (`R014.2`+). | A test asserts a MySQL entry and a MariaDB entry built from equivalent inputs remain distinct (never merged), plus negative tests that an empty version floor and a zero type-map revision are both refused rather than defaulted.
requirementEG-UNIFIED-DATA-PLANEVERIFIED0e6a4eb8555d
3dd56fe53283
crates/eg-types/src/attached_source_dialect.rs:127
crates/eg-types/src/attached_source_dialect.rs:146
crates/eg-types/src/attached_source_dialect.rs:96
EG-UNIFIED-DATA-PLANE-R014.2
Remaining scope of EG-UNIFIED-DATA-PLANE-R014 (slice .2): Implement the MySQL and MariaDB attached-source adapters
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Remaining scope of EG-UNIFIED-DATA-PLANE-R014 (slice .2): Implement the MySQL and MariaDB attached-source adapters.** Child slice of `EG-UNIFIED-DATA-PLANE-R014` (see tasks.md). This row is LANDED only once every child is. | A per-engine conformance entry compares EG's query and capture results against native MySQL and against native MariaDB
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R014.2.1
MySQL/MariaDB adapter skeleton: typed connection-config → driver-config mapping plus the connect/refusal path
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**MySQL/MariaDB adapter skeleton: typed connection-config → driver-config mapping plus the connect/refusal path.** `crates/eg-types/src/mysql_mariadb_connection.rs` defines `MysqlMariadbConnectionConfig`/`MysqlMariadbDriverConfig` and `to_driver_config`, refusing an empty host, empty database, empty username, or zero port before any network attempt — behind the existing `federation-sql` sqlx-mysql feature structure already present in `crates/eg-plan`. The binlog/GTID capture loop and real sqlx connection are `EG-UNIFIED-DATA-PLANE-R014.2.2+`. | Verified by unit tests needing no live database: a MySQL and a MariaDB config both map to a driver config; empty host, empty database, empty username, and zero port are each refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6b382bb1a3ec
crates/eg-types/src/mysql_mariadb_connection.rs:107
crates/eg-types/src/mysql_mariadb_connection.rs:119
crates/eg-types/src/mysql_mariadb_connection.rs:130
crates/eg-types/src/mysql_mariadb_connection.rs:141
crates/eg-types/src/mysql_mariadb_connection.rs:152
EG-UNIFIED-DATA-PLANE-R014.2.2
Live MySQL/MariaDB binlog/GTID capture and per-engine conformance
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live MySQL/MariaDB binlog/GTID capture and per-engine conformance.** Child slice of `EG-UNIFIED-DATA-PLANE-R014.2` wiring the real sqlx connection, row-based binlog with GTID, and the information_schema catalog read behind `MysqlMariadbDriverConfig` from `.2.1`. | A per-engine conformance entry compares EG's query and capture results against native MySQL and against native MariaDB.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R015
Implement the SQLite file attached-source adapter (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Implement the SQLite file attached-source adapter (rollup).** The SQLite adapter extends eg-sqlite-format to cover WITHOUT ROWID tables, attaches a live application's database file read-only in a lock-safe manner, and captures changes by WAL-frame tailing where safe or by rowid/updated_at watermark polling otherwise. No typed SQLite catalog model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A conformance test attaches a live SQLite fixture under concurrent writes and confirms no lock contention and correct change capture.
requirementEG-UNIFIED-DATA-PLANESPECIFIED423b02e97c9d
EG-UNIFIED-DATA-PLANE-R015.1
`SqliteSourceCatalog` is a typed catalog model with a WITHOUT-ROWID capture-safety refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`SqliteSourceCatalog` is a typed catalog model with a WITHOUT-ROWID capture-safety refusal.** `crates/eg-types/src/sqlite_attached_catalog.rs` defines `SqliteSourceCatalog`/`SqliteTableCatalog`/`SqliteColumn` with a closed `SqliteCaptureMode` vocabulary (`WalRowidTailing`, `WatermarkPolling`), and `validate_table` refuses a `WITHOUT ROWID` table that declares no primary-key column or that claims rowid/WAL tailing (it has no implicit rowid to tail). | Verified by unit tests: a rowid table with WAL tailing round-trips through `insert_table`; a WITHOUT ROWID table with a declared primary key and watermark polling is valid; a WITHOUT ROWID table with no primary key is refused; a WITHOUT ROWID table claiming WAL tailing is refused; an invalid table is refused rather than silently inserted; the capture-mode variants stay distinct; and the catalog serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED37003f28164f
6c11520aebfc
crates/eg-types/src/sqlite_attached_catalog.rs:130
crates/eg-types/src/sqlite_attached_catalog.rs:147
crates/eg-types/src/sqlite_attached_catalog.rs:159
crates/eg-types/src/sqlite_attached_catalog.rs:171
crates/eg-types/src/sqlite_attached_catalog.rs:186
EG-UNIFIED-DATA-PLANE-R015.2
Lock-safe live read-only attach and real WAL-frame tailing/watermark polling
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Lock-safe live read-only attach and real WAL-frame tailing/watermark polling.** Child slice of `EG-UNIFIED-DATA-PLANE-R015` (see tasks.md). This row is LANDED only once every child is. | A conformance test attaches a live SQLite fixture under concurrent writes and confirms no lock contention and correct change capture
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R015.2.1
SQLite live-attach adapter skeleton: typed attach-config → driver-open-config mapping plus the refusal path
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**SQLite live-attach adapter skeleton: typed attach-config → driver-open-config mapping plus the refusal path.** `crates/eg-types/src/sqlite_live_attach.rs` defines `SqliteAttachConfig`/`SqliteDriverOpenConfig` and `to_driver_open_config`, refusing an empty file path and refusing the `ReadOnlyImmutable` open mode paired with either declared `SqliteCaptureMode`. The real WAL-frame tailing/watermark polling against a live, concurrently-written file is `EG-UNIFIED-DATA-PLANE-R015.2.2+`. | Verified by unit tests needing no live database file: a lock-safe attach maps for both `WalRowidTailing` and `WatermarkPolling`. An empty file path is refused. The immutable open mode is refused for either capture mode.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6b382bb1a3ec
crates/eg-types/src/sqlite_live_attach.rs:102
crates/eg-types/src/sqlite_live_attach.rs:113
crates/eg-types/src/sqlite_live_attach.rs:124
crates/eg-types/src/sqlite_live_attach.rs:84
crates/eg-types/src/sqlite_live_attach.rs:95
EG-UNIFIED-DATA-PLANE-R015.2.2
Real WAL-frame tailing / watermark polling under concurrent writers
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Real WAL-frame tailing / watermark polling under concurrent writers.** Child slice of `EG-UNIFIED-DATA-PLANE-R015.2` wiring the real lock-safe open and capture loop behind `SqliteDriverOpenConfig` from `.2.1`. | A conformance test attaches a live SQLite fixture under concurrent writes and confirms no lock contention and correct change capture.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R016
Implement the Microsoft SQL Server attached-source adapter (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Implement the Microsoft SQL Server attached-source adapter (rollup).** The SQL Server adapter connects via the tiberius driver, reads the sys.* catalog, renders T-SQL including TOP and OFFSET/FETCH pagination, and captures changes through CDC or Change Tracking polled by LSN. No typed SQL Server catalog model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A conformance entry compares EG's query and capture results against native SQL Server.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R016.1
`MssqlSourceCatalog` is a typed catalog model with a bracket-quoting identifier refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`MssqlSourceCatalog` is a typed catalog model with a bracket-quoting identifier refusal.** `crates/eg-types/src/mssql_attached_catalog.rs` defines `MssqlSourceCatalog`/`MssqlTableCatalog`/`MssqlColumn` with a closed `MssqlCaptureMode` vocabulary (`Cdc`, `ChangeTracking`, `Unsupported`), and `validate_identifier`/`validate_table` refuse a schema or table identifier that is empty or contains `]` or a NUL byte — either would break the renderer's `[schema].[table]` bracket-quoting. | Verified by unit tests: a valid table round-trips through `insert_table`; an empty identifier is refused; a `]`-containing identifier is refused; a NUL-byte identifier is refused; an unsafe identifier is refused rather than silently inserted; `Unsupported` stays a distinct capture-mode variant; and the catalog serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED37003f28164f
6c11520aebfc
crates/eg-types/src/mssql_attached_catalog.rs:119
crates/eg-types/src/mssql_attached_catalog.rs:132
crates/eg-types/src/mssql_attached_catalog.rs:141
crates/eg-types/src/mssql_attached_catalog.rs:147
crates/eg-types/src/mssql_attached_catalog.rs:153
EG-UNIFIED-DATA-PLANE-R016.2
tiberius driver connection, T-SQL TOP/OFFSET-FETCH rendering, and LSN-polled CDC/Change Tracking capture
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**tiberius driver connection, T-SQL TOP/OFFSET-FETCH rendering, and LSN-polled CDC/Change Tracking capture.** Child slice of `EG-UNIFIED-DATA-PLANE-R016` (see tasks.md). This row is LANDED only once every child is. | A conformance entry compares EG's query and capture results against native SQL Server
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R016.2.1
MSSQL adapter skeleton: typed connection-config → tiberius-shaped driver-config mapping plus the connect/refusal path
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**MSSQL adapter skeleton: typed connection-config → tiberius-shaped driver-config mapping plus the connect/refusal path.** `crates/eg-types/src/mssql_driver_connection.rs` defines `MssqlConnectionConfig`/`MssqlDriverConfig` and `to_driver_config`, refusing an empty host, empty database, empty username, zero port, or `trust_server_certificate` paired with `Strict` encryption, before any network attempt. T-SQL TOP/OFFSET-FETCH rendering and the real tiberius connection + LSN-polled capture are `EG-UNIFIED-DATA-PLANE-R016.2.2+`. | Verified by unit tests needing no live server: a CDC and a Change Tracking config both map to a driver config. Empty host, empty database, zero port, and trusting an unverified certificate under strict encryption are each refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6b382bb1a3ec
crates/eg-types/src/mssql_driver_connection.rs:113
crates/eg-types/src/mssql_driver_connection.rs:124
crates/eg-types/src/mssql_driver_connection.rs:135
crates/eg-types/src/mssql_driver_connection.rs:146
crates/eg-types/src/mssql_driver_connection.rs:157
EG-UNIFIED-DATA-PLANE-R016.2.2
Real tiberius connection, T-SQL TOP/OFFSET-FETCH rendering, and LSN-polled CDC/Change Tracking capture loop
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Real tiberius connection, T-SQL TOP/OFFSET-FETCH rendering, and LSN-polled CDC/Change Tracking capture loop.** Child slice of `EG-UNIFIED-DATA-PLANE-R016.2` wiring the tiberius driver behind `MssqlDriverConfig` from `.2.1`. | A conformance entry compares EG's query and capture results against native SQL Server.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R017
Implement the ClickHouse attached-source adapter (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Implement the ClickHouse attached-source adapter (rollup).** The ClickHouse adapter connects via its HTTP or native client, reads the system.* catalog, and supports federation and acceleration while explicitly declaring that it has no change-capture capability. No typed ClickHouse catalog model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A conformance entry confirms federated query results match native ClickHouse and that capture requests return an explicit unsupported result.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R017.1
`ClickHouseSourceCatalog` is a typed catalog model whose capture capability is always explicit
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`ClickHouseSourceCatalog` is a typed catalog model whose capture capability is always explicit.** `crates/eg-types/src/clickhouse_attached_catalog.rs` defines `ClickHouseSourceCatalog`/`ClickHouseTableCatalog`/`ClickHouseColumn`, and `ClickHouseTableCatalog::capture_capability` always returns the single `ClickHouseCaptureCapability::Unsupported` value rather than a silently-missing `Option<_>`; `validate_table` refuses an empty database/table name or a table with no discovered columns. | Verified by unit tests: a valid table round-trips through `insert_table`; `capture_capability` is always explicitly `Unsupported`; an empty database/table name is refused; a table with no columns is refused; an invalid table is refused rather than silently inserted; and the catalog serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED37003f28164f
6c11520aebfc
crates/eg-types/src/clickhouse_attached_catalog.rs:142
crates/eg-types/src/clickhouse_attached_catalog.rs:150
crates/eg-types/src/clickhouse_attached_catalog.rs:159
crates/eg-types/src/clickhouse_attached_catalog.rs:167
crates/eg-types/src/clickhouse_attached_catalog.rs:178
EG-UNIFIED-DATA-PLANE-R017.2
HTTP/native client connection and federated query pushdown (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**HTTP/native client connection and federated query pushdown (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R017` (see tasks.md), split producer-first: `.2.1` is the typed driver config plus connect/refusal path. `.2.2` is live federated query pushdown. This row is LANDED only once every child is. | A conformance entry confirms federated query results match native ClickHouse and that capture requests return an explicit unsupported result
requirementEG-UNIFIED-DATA-PLANESPECIFIED04791f8c77de
EG-UNIFIED-DATA-PLANE-R017.2.1
`ClickHouseDriverConfig` builds from validated host/port/database, and `connect` refuses an unsafe or invalid destination before issuing any request
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`ClickHouseDriverConfig` builds from validated host/port/database, and `connect` refuses an unsafe or invalid destination before issuing any request.** `crates/eg-plan/src/clickhouse_connection.rs` converts host/port/database into a `ClickHouseDriverConfig`, refusing an empty host, a zero port, or an empty database; `connect` resolves the configured host and refuses (does not dial) a non-loopback or otherwise unresolvable destination, mirroring the existing `connect_remote_engine` gate in `crates/eg-plan/src/federation.rs`. No live ClickHouse server is required. | Verified by unit tests needing no live database: a valid config round-trips; an empty host, zero port, and empty database are each refused; an unresolvable destination is refused by `connect`; and a loopback destination passes the refusal gate.
requirementEG-UNIFIED-DATA-PLANEVERIFIED04791f8c77de
crates/eg-plan/src/clickhouse_connection.rs:114
crates/eg-plan/src/clickhouse_connection.rs:124
crates/eg-plan/src/clickhouse_connection.rs:133
crates/eg-plan/src/clickhouse_connection.rs:142
crates/eg-plan/src/clickhouse_connection.rs:151
EG-UNIFIED-DATA-PLANE-R017.2.2
Live HTTP/native client federated query pushdown
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live HTTP/native client federated query pushdown.** `connect`'s validated handle issues real ClickHouse HTTP/native-client queries and pushes federated query fragments down to `system.*`-backed execution. Depends on `EG-UNIFIED-DATA-PLANE-R017.2.1`. | A conformance entry confirms federated query results match native ClickHouse and that capture requests return an explicit unsupported result.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R018
Implement the Oracle and Db2 attached-source adapters (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Implement the Oracle and Db2 attached-source adapters (rollup).** The Oracle and Db2 adapters query and read the catalog through their driver or ODBC, and capture changes through the Debezium bridge. No typed Oracle/Db2 catalog model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A conformance entry compares EG's query results against native Oracle and native Db2, and confirms captured changes match a Debezium-sourced change stream.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDc14a9a63a0b3
EG-UNIFIED-DATA-PLANE-R018.1
`RelationalSourceCatalog` is a typed Oracle/Db2 catalog model with identifier and Debezium-capture refusals
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`RelationalSourceCatalog` is a typed Oracle/Db2 catalog model with identifier and Debezium-capture refusals.** `crates/eg-types/src/relational_attached_catalog.rs` defines `RelationalSourceCatalog`/`RelationalTableCatalog`/`RelationalColumn` over a closed `RelationalEngine` (`Oracle`, `Db2`); `validate_table` refuses a schema/table identifier that is empty or contains `"` or a NUL byte (either breaks double-quoted identifier rendering), and refuses a table marked `captured_via_debezium` with no declared primary-key column. | Verified by unit tests: a valid table round-trips through `insert_table`; a `"`-containing identifier is refused; a NUL-byte identifier is refused; a Debezium-captured table with no primary key is refused; a non-captured table with no primary key is valid; an invalid table is refused rather than silently inserted; and the catalog serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
eb058c53407e
crates/eg-types/src/relational_attached_catalog.rs:137
crates/eg-types/src/relational_attached_catalog.rs:147
crates/eg-types/src/relational_attached_catalog.rs:155
crates/eg-types/src/relational_attached_catalog.rs:163
crates/eg-types/src/relational_attached_catalog.rs:173
EG-UNIFIED-DATA-PLANE-R018.2
Driver/ODBC connection, catalog read, and Debezium bridge wiring (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Driver/ODBC connection, catalog read, and Debezium bridge wiring (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R018` (see tasks.md), split producer-first: `.2.1` is the typed driver config plus connect/refusal path; `.2.2` is live catalog read and Debezium bridge wiring. This row is LANDED only once every child is. | A conformance entry compares EG's query results against native Oracle and native Db2, and confirms captured changes match a Debezium-sourced change stream
requirementEG-UNIFIED-DATA-PLANESPECIFIED04791f8c77de
EG-UNIFIED-DATA-PLANE-R018.2.1
`RelationalDriverConfig` builds from a validated engine/host/port/service name, and `connect` refuses an unsafe or invalid destination before issuing any request
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`RelationalDriverConfig` builds from a validated engine/host/port/service name, and `connect` refuses an unsafe or invalid destination before issuing any request.** `crates/eg-plan/src/relational_connection.rs` converts a `RelationalEngine` (`Oracle`, `Db2`) plus host/port/service name into a `RelationalDriverConfig`, refusing an empty host, a zero port, or an empty service name; `connect` resolves the configured host and refuses (does not dial) a non-loopback or otherwise unresolvable destination, mirroring the existing `connect_remote_engine` gate in `crates/eg-plan/src/federation.rs`. No live Oracle/Db2 server or Debezium bridge is required. | Verified by unit tests needing no live database: a valid config round-trips for each engine; an empty host, zero port, and empty service name are each refused; an unresolvable destination is refused by `connect`; and a loopback destination passes the refusal gate.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R018.2.2
Live driver/ODBC catalog read and Debezium bridge wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live driver/ODBC catalog read and Debezium bridge wiring.** `connect`'s validated handle reads the Oracle/Db2 catalog through its driver or ODBC and wires change capture through the Debezium bridge. Depends on `EG-UNIFIED-DATA-PLANE-R018.2.1`. | A conformance entry compares EG's query results against native Oracle and native Db2, and confirms captured changes match a Debezium-sourced change stream.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R019
Implement the MongoDB and DocumentDB attached-source adapter
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Implement the MongoDB and DocumentDB attached-source adapter.** The MongoDB/DocumentDB adapter connects through its native driver, represents the inferred document JSON shape as its catalog, and captures changes through native change streams. Split per the net-new rule (no document-catalog type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB.
requirementEG-UNIFIED-DATA-PLANESPECIFIED211962e9c846
EG-UNIFIED-DATA-PLANE-R019.1
`DocumentSourceCatalog` is a typed inferred-shape model with a refusal for a malformed field path
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`DocumentSourceCatalog` is a typed inferred-shape model with a refusal for a malformed field path.** `crates/eg-types/src/document_source_catalog.rs` defines `DocumentSourceCatalog`/`DocumentCollectionShape`/`DocumentField` with a closed `DocumentFieldType` vocabulary (including `Mixed` for sampling that observes more than one type at a path), and `validate_field_path` refuses an empty, leading/trailing-dot, empty-segment, or `$`-operator-prefixed path rather than admitting it into the shape. | Verified by unit tests: a valid dotted path round-trips through `insert_field`, each malformed path shape is refused, a malformed path is refused rather than silently inserted, `Mixed` stays a distinct variant, and the catalog serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED211962e9c846
6c11520aebfc
crates/eg-types/src/document_source_catalog.rs:108
crates/eg-types/src/document_source_catalog.rs:119
crates/eg-types/src/document_source_catalog.rs:128
crates/eg-types/src/document_source_catalog.rs:135
crates/eg-types/src/document_source_catalog.rs:141
EG-UNIFIED-DATA-PLANE-R019.2
Native MongoDB/DocumentDB driver connection and change-stream capture into ChangeEnvelope (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Native MongoDB/DocumentDB driver connection and change-stream capture into ChangeEnvelope (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R019` (see tasks.md), split producer-first: `.2.1` is the typed driver config plus connect/refusal path. `.2.2` is the live native-driver connection and change-stream capture. This row is LANDED only once every child is. | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB
requirementEG-UNIFIED-DATA-PLANESPECIFIED04791f8c77de
94edcf341758
c3b87d31ac11
EG-UNIFIED-DATA-PLANE-R019.2.1
`DocumentDriverConfig` builds from a validated host/port/database, and `connect` refuses an unsafe or invalid destination before issuing any request
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`DocumentDriverConfig` builds from a validated host/port/database, and `connect` refuses an unsafe or invalid destination before issuing any request.** `crates/eg-plan/src/document_connection.rs` converts host/port/database into a `DocumentDriverConfig`, refusing an empty host, a zero port, or an empty database; `connect` resolves the configured host and refuses (does not dial) a non-loopback or otherwise unresolvable destination, mirroring the existing `connect_remote_engine` gate in `crates/eg-plan/src/federation.rs`. No live MongoDB/DocumentDB server is required; the native driver and change-stream capture are a later slice. | Verified by unit tests needing no live database: a valid config round-trips; an empty host, zero port, and empty database are each refused; an unresolvable destination is refused by `connect`; and a loopback destination passes the refusal gate.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R019.2.2
Live native driver connection and change-stream capture into `ChangeEnvelope`
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live native driver connection and change-stream capture into `ChangeEnvelope`.** `connect`'s validated handle opens a real MongoDB/DocumentDB native-driver session and captures native change-stream events into `ChangeEnvelope`. Depends on `EG-UNIFIED-DATA-PLANE-R019.2.1`. | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R019.3
Conformance entry comparing EG query results and captured change stream against native MongoDB/DocumentDB (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Conformance entry comparing EG query results and captured change stream against native MongoDB/DocumentDB (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R019` (see tasks.md), split producer-first: `.3.1` is the typed per-adapter conformance-entry constructor. `.3.2` is actually running the comparison against native MongoDB/DocumentDB. This row is LANDED only once every child is. | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R019.3.1
`build_document_conformance_entry` builds a MongoDB/DocumentDB conformance entry with a fixed adapter label, refusing a malformed outcome/deviation shape
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`build_document_conformance_entry` builds a MongoDB/DocumentDB conformance entry with a fixed adapter label, refusing a malformed outcome/deviation shape.** `crates/eg-types/src/document_conformance.rs` defines the closed `DocumentConformanceEngine` vocabulary (`MongoDb6`/`MongoDb7`/`DocumentDb`) and builds a `DialectConformanceEntry` (EG-UNIFIED-DATA-PLANE-R022.1) whose `adapter` is always the fixed `mongodb_documentdb` label, never a caller-supplied string, delegating to that type's own refusal for a deviated entry with no reviewed deviation or a green entry carrying one. No live MongoDB/DocumentDB connection is required; actually running the comparison is a later child. | Verified by unit tests needing no live database: a green entry builds with the fixed adapter label; each engine variant maps to its own version label; a deviated entry with no reviewed deviation is refused; a deviated entry with a reviewed deviation builds; and a green entry carrying a deviation is refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDd6e3cf6232d8
crates/eg-types/src/document_conformance.rs:101
crates/eg-types/src/document_conformance.rs:118
crates/eg-types/src/document_conformance.rs:65
crates/eg-types/src/document_conformance.rs:78
crates/eg-types/src/document_conformance.rs:90
EG-UNIFIED-DATA-PLANE-R019.3.2
Live comparison of EG's query results and captured change stream against native MongoDB/DocumentDB
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live comparison of EG's query results and captured change stream against native MongoDB/DocumentDB.** Runs the comparison and records its real outcome through `build_document_conformance_entry`. Depends on `EG-UNIFIED-DATA-PLANE-R019.3.1` and `EG-UNIFIED-DATA-PLANE-R019.2`. | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R020
Federate Snowflake, BigQuery, DuckDB, and Iceberg sources
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Federate Snowflake, BigQuery, DuckDB, and Iceberg sources.** EG federates queries to Snowflake, BigQuery, DuckDB, and Iceberg as read-only sources, extending the existing iceberg_federation.rs for Iceberg, and uses Arrow Flight SQL where the source offers it. Split per the net-new rule (no warehouse-source-kind type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A conformance entry compares federated query results against each native warehouse or lake engine.
requirementEG-UNIFIED-DATA-PLANESPECIFIED74870676b1cc
EG-UNIFIED-DATA-PLANE-R020.1
`WarehouseSourceKind`/`WarehouseSourceConfig` are a closed source-kind vocabulary with a per-kind required-field refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`WarehouseSourceKind`/`WarehouseSourceConfig` are a closed source-kind vocabulary with a per-kind required-field refusal.** `crates/eg-types/src/warehouse_federation.rs` defines `WarehouseSourceKind` (`Snowflake`/`BigQuery`/`DuckDb`/`Iceberg`), each kind's declared Arrow-Flight-SQL offering and required connection-config fields, and `WarehouseSourceConfig::validate`, which refuses a config with no declared kind or a missing/empty required field rather than deferring the gap to connect time. | Verified by unit tests: a complete Snowflake config validates, an incomplete BigQuery config names its missing field, an empty field value counts as missing, an undeclared kind is refused rather than guessed, Flight SQL is offered only by the declared kinds, and the config serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
74870676b1cc
crates/eg-types/src/warehouse_federation.rs:118
crates/eg-types/src/warehouse_federation.rs:128
crates/eg-types/src/warehouse_federation.rs:136
crates/eg-types/src/warehouse_federation.rs:143
crates/eg-types/src/warehouse_federation.rs:150
EG-UNIFIED-DATA-PLANE-R020.2
Query pushdown per kind (Arrow Flight SQL where offered), extending eg-query::sql::iceberg_federation for Iceberg (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Query pushdown per kind (Arrow Flight SQL where offered), extending eg-query::sql::iceberg_federation for Iceberg (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R020` (see tasks.md), split producer-first: `.2.1` is the typed pushdown-transport dispatch plus its refusal path. `.2.2` is actually issuing the pushed-down query per kind. This row is LANDED only once every child is. | A conformance entry compares federated query results against each native warehouse or lake engine
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R020.2.1
`plan_pushdown` decides the Arrow-Flight-SQL-vs-native transport for a validated `WarehouseSourceConfig`, refusing an invalid config or an unmet Flight SQL preference
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`plan_pushdown` decides the Arrow-Flight-SQL-vs-native transport for a validated `WarehouseSourceConfig`, refusing an invalid config or an unmet Flight SQL preference.** `crates/eg-plan/src/warehouse_pushdown.rs` defines `WarehousePushdownRequest`/`WarehousePushdownTransport` and `plan_pushdown`, which first delegates to `WarehouseSourceConfig::validate` (EG-UNIFIED-DATA-PLANE-R020.1) and then refuses — rather than silently downgrading — a `prefer_flight_sql` request against a kind that does not offer it. Issues no request and opens no connection. | Verified by unit tests needing no live warehouse: Snowflake prefers Flight SQL when requested; DuckDB with no preference uses native; a DuckDB/Iceberg Flight SQL preference is refused rather than downgraded; and an invalid or kind-less config is refused before any transport decision.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDd6e3cf6232d8
crates/eg-plan/src/warehouse_pushdown.rs:111
crates/eg-plan/src/warehouse_pushdown.rs:127
crates/eg-plan/src/warehouse_pushdown.rs:145
crates/eg-plan/src/warehouse_pushdown.rs:160
crates/eg-plan/src/warehouse_pushdown.rs:173
EG-UNIFIED-DATA-PLANE-R020.2.2
Live Arrow Flight SQL / native query pushdown per kind, extending `eg-query::sql::iceberg_federation` for Iceberg
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live Arrow Flight SQL / native query pushdown per kind, extending `eg-query::sql::iceberg_federation` for Iceberg.** `plan_pushdown`'s validated transport decision is used to issue the real pushed-down query against each native warehouse or lake engine. Depends on `EG-UNIFIED-DATA-PLANE-R020.2.1`. | A conformance entry compares federated query results against each native warehouse or lake engine.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R020.3
Conformance entry comparing federated query results against each native warehouse/lake engine (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Conformance entry comparing federated query results against each native warehouse/lake engine (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R020` (see tasks.md), split producer-first: `.3.1` is the typed per-kind conformance-entry constructor. `.3.2` is actually running the comparison against each native engine. This row is LANDED only once every child is. | A conformance entry compares federated query results against each native warehouse or lake engine
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R020.3.1
`build_warehouse_conformance_entry` builds a warehouse/lake conformance entry whose adapter label is derived from the closed `WarehouseSourceKind`, refusing a blank engine version or a malformed outcome/deviation shape
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`build_warehouse_conformance_entry` builds a warehouse/lake conformance entry whose adapter label is derived from the closed `WarehouseSourceKind`, refusing a blank engine version or a malformed outcome/deviation shape.** `crates/eg-types/src/warehouse_conformance.rs` derives the `adapter` label (`warehouse_snowflake`/`warehouse_bigquery`/`warehouse_duckdb`/`warehouse_iceberg`) from `WarehouseSourceKind` (EG-UNIFIED-DATA-PLANE-R020.1) rather than a caller-supplied string, refuses an empty `engine_version`, and delegates to `DialectConformanceEntry::validate` (EG-UNIFIED-DATA-PLANE-R022.1) for the outcome/deviation shape. No live warehouse/lake connection is required; actually running the comparison is a later child. | Verified by unit tests needing no live engine: a green entry builds with the kind-derived label; each kind maps to a distinct label; an empty engine version is refused; a deviated entry with no reviewed deviation is refused; and a deviated entry with a reviewed deviation builds.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDd6e3cf6232d8
crates/eg-types/src/warehouse_conformance.rs:102
crates/eg-types/src/warehouse_conformance.rs:119
crates/eg-types/src/warehouse_conformance.rs:134
crates/eg-types/src/warehouse_conformance.rs:151
crates/eg-types/src/warehouse_conformance.rs:88
EG-UNIFIED-DATA-PLANE-R020.3.2
Live comparison of federated query results against each native warehouse/lake engine
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live comparison of federated query results against each native warehouse/lake engine.** Runs the comparison and records its real outcome through `build_warehouse_conformance_entry`. Depends on `EG-UNIFIED-DATA-PLANE-R020.3.1` and `EG-UNIFIED-DATA-PLANE-R020.2`. | A conformance entry compares federated query results against each native warehouse or lake engine.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R021
Bridge Debezium Kafka events into ChangeEnvelope
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Bridge Debezium Kafka events into ChangeEnvelope.** EG consumes Debezium change events from Kafka and converts them into ChangeEnvelope records for any Debezium-supported source, reimplementing Debezium's envelope semantics natively in EG. Split per the net-new rule (no Debezium event type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A replay test feeds a captured Debezium event stream through the bridge and confirms the resulting ChangeEnvelope sequence matches the source's actual changes.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
9cb571fb74aa
de71b5ddd2b2
crates/eg-types/src/debezium_bridge.rs:273
crates/eg-types/src/debezium_bridge.rs:282
crates/eg-types/src/debezium_bridge.rs:291
crates/eg-types/src/debezium_bridge.rs:303
crates/eg-types/src/debezium_bridge.rs:315
EG-UNIFIED-DATA-PLANE-R021.1
`DebeziumChangeEvent` is a typed envelope shape with an op-code and before/after refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`DebeziumChangeEvent` is a typed envelope shape with an op-code and before/after refusal.** `crates/eg-types/src/debezium_bridge.rs` defines the closed `DebeziumOp` vocabulary (`c`/`u`/`d`/`r`, refusing an unrecognized code), `DebeziumSource`, `DebeziumChangeEvent`, and `validate`, which refuses a create/update/read event with no `after` row or a delete event with no `before` row; `to_change_cursor` maps the source position onto an opaque `ChangeCursor`. | Verified by unit tests: every known op code parses, an unknown code is refused, a create without `after` and a delete without `before` are refused, a well-formed update validates, the cursor stays opaque and carries the source position, and the event serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
9cb571fb74aa
crates/eg-types/src/debezium_bridge.rs:273
crates/eg-types/src/debezium_bridge.rs:282
crates/eg-types/src/debezium_bridge.rs:291
crates/eg-types/src/debezium_bridge.rs:303
crates/eg-types/src/debezium_bridge.rs:315
EG-UNIFIED-DATA-PLANE-R021.2
Kafka consumer plus real conversion into ChangeEnvelope records
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Kafka consumer plus real conversion into ChangeEnvelope records.** Child slice of `EG-UNIFIED-DATA-PLANE-R021` (see tasks.md). | A replay test feeds a captured Debezium event stream through the bridge and confirms the resulting ChangeEnvelope sequence matches the source's actual changes
requirementEG-UNIFIED-DATA-PLANEVERIFIEDde71b5ddd2b2
crates/eg-types/src/debezium_bridge.rs:361
crates/eg-types/src/debezium_bridge.rs:402
EG-UNIFIED-DATA-PLANE-R021.3
Replay test feeding a captured Debezium event stream through the bridge
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Replay test feeding a captured Debezium event stream through the bridge.** Child slice of `EG-UNIFIED-DATA-PLANE-R021` (see tasks.md). | A replay test feeds a captured Debezium event stream through the bridge and confirms the resulting ChangeEnvelope sequence matches the source's actual changes
requirementEG-UNIFIED-DATA-PLANEVERIFIEDde71b5ddd2b2
crates/eg-types/src/debezium_bridge.rs:417
EG-UNIFIED-DATA-PLANE-R022
Build a per-dialect conformance harness
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Build a per-dialect conformance harness.** A conformance harness runs each adapter against a containerized matrix of supported engine versions, verifying that pushed-down query results equal the native source's result and that a change-capture replay equals a snapshot of the source. Split per the net-new rule (no conformance-entry type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | The harness reports a green conformance entry per engine/version pair and a reviewed deviation for any known difference.
requirementEG-UNIFIED-DATA-PLANESPECIFIED23769c3ec0f9
EG-UNIFIED-DATA-PLANE-R022.1
`DialectConformanceEntry`/`ConformanceReport` are a typed per-engine-version result with a refusal for an auto-suppressed deviation
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`DialectConformanceEntry`/`ConformanceReport` are a typed per-engine-version result with a refusal for an auto-suppressed deviation.** `crates/eg-types/src/dialect_conformance.rs` defines `ConformanceOutcome` (green/deviated), `ConformanceDeviation` (description, reviewer, reproducing fixture), and `validate`, which refuses a deviated entry with no deviation record, a green entry carrying one, or a deviation with a blank reviewer — a deviation can never be auto-suppressed. | Verified by unit tests: a green entry without deviation validates, a deviated entry with a reviewed deviation validates, a deviated entry without one is refused, a green entry with one is refused, a blank-reviewer deviation is refused, and a report refuses if any entry is malformed while still reporting its green count.
requirementEG-UNIFIED-DATA-PLANEVERIFIED23769c3ec0f9
6c11520aebfc
crates/eg-types/src/dialect_conformance.rs:121
crates/eg-types/src/dialect_conformance.rs:133
crates/eg-types/src/dialect_conformance.rs:145
crates/eg-types/src/dialect_conformance.rs:160
crates/eg-types/src/dialect_conformance.rs:175
EG-UNIFIED-DATA-PLANE-R022.2
Containerized matrix runner per adapter/engine version
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Containerized matrix runner per adapter/engine version.** Child slice of `EG-UNIFIED-DATA-PLANE-R022` (see tasks.md). | The harness reports a green conformance entry per engine/version pair and a reviewed deviation for any known difference
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R022.3
Change-capture replay comparison against a source snapshot (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Change-capture replay comparison against a source snapshot (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R022` (see tasks.md), split producer-first: `.3.1` is the pure comparison and conformance-entry construction. `.3.2` is running it against a real replay stream and source snapshot. This row is LANDED only once every child is. | The harness reports a green conformance entry per engine/version pair and a reviewed deviation for any known difference
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R022.3.1
`compare_replay_to_snapshot` builds a `DialectConformanceEntry` from a replayed row-state map and a source-snapshot row-state map, refusing a blank engine version
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`compare_replay_to_snapshot` builds a `DialectConformanceEntry` from a replayed row-state map and a source-snapshot row-state map, refusing a blank engine version.** `crates/eg-types/src/replay_conformance.rs` compares the two already-captured maps and delegates to `DialectConformanceEntry::validate` (EG-UNIFIED-DATA-PLANE-R022.1) for the outcome/deviation shape: a difference is `Deviated` with no deviation record, so it still needs human review before it validates — never auto-suppressed. No live replay stream or source connection is read; running the comparison against a real replay is a later child. | Verified by unit tests needing no live replay stream: matching maps build a `Green` entry; differing maps build a `Deviated` entry that is refused until reviewed; a blank engine version is refused; and a fixture source-snapshot comparison builds `Green`.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDa4d1e790a69e
crates/eg-types/src/replay_conformance.rs:114
crates/eg-types/src/replay_conformance.rs:124
crates/eg-types/src/replay_conformance.rs:82
crates/eg-types/src/replay_conformance.rs:96
EG-UNIFIED-DATA-PLANE-R022.3.2
Live change-capture replay comparison against a real source snapshot
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live change-capture replay comparison against a real source snapshot.** Feeds a real replay stream's resulting row state and a real source snapshot through `compare_replay_to_snapshot`. Depends on `EG-UNIFIED-DATA-PLANE-R022.3.1` and `EG-UNIFIED-DATA-PLANE-R022.2`. | The harness reports a green conformance entry per engine/version pair and a reviewed deviation for any known difference.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R022.4
Source-category coverage matrix
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Source-category coverage matrix.** The conformance harness must hold one matrix row per `SourceCategory` of `EG-UNIFIED-DATA-PLANE-R038.3.1`. Each row names the standard protocol or format, the pushdown capabilities, the mapping form and the hot-path proof test. The pushdown capabilities are filter, projection, join, aggregate, limit and time range. The matrix is the table in `plan.md`. A category without a passing hot-path proof must report `unproven`. | A unit test fails when a category lacks a row. It reports `unproven` for a category without a passing proof.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R022.4.1
Residency column
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Residency column.** The matrix in `plan.md` must state the default residency of each category. Closed residency values are `virtual` and `ingested`. The web metasearch row must state `virtual` with a 900 s time-to-live. A fetched web page has no virtual category. It enters as a Document through `EG-UNIFIED-DATA-PLANE-R651.7`. Proving test: `crates/eg-types/src/dialect_conformance.rs::tests::matrix_states_residency`. | The test fails when a category row has no residency value.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R023
Operate a shared CloudNativePG and MariaDB platform
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Operate a shared CloudNativePG and MariaDB platform.** EG runs attached applications on a shared platform using CloudNativePG, grouping clusters by major version and required extensions, with a dedicated database and role per application, separate EG read and replication roles, wal_level set to logical, point-in-time recovery to object storage, scheduled restore drills, and local storage volumes. A separate shared MariaDB group serves MariaDB-based applications. Split per the net-new rule (no cluster-group type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state.
requirementEG-UNIFIED-DATA-PLANESPECIFIED03439e243c80
EG-UNIFIED-DATA-PLANE-R023.1
`SharedPlatformClusterGroup` is a typed cluster-group and role-set model with engine-specific refusals
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`SharedPlatformClusterGroup` is a typed cluster-group and role-set model with engine-specific refusals.** `crates/eg-types/src/shared_db_platform.rs` defines `SharedPlatformEngine` (CloudNativePG/MariaDB), `ApplicationRoleSet` (dedicated application/EG-read/EG-replication roles), and `validate`, which refuses a CloudNativePG group not declaring `wal_level=logical`, a MariaDB group declaring one, an application aliasing two of its three roles, and an empty group. | Verified by unit tests: a well-formed Postgres group validates, a non-logical or absent `wal_level` is refused, a MariaDB group with a `wal_level` is refused and without one validates, an aliased role is refused, and an empty group is refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED03439e243c80
6c11520aebfc
crates/eg-types/src/shared_db_platform.rs:138
crates/eg-types/src/shared_db_platform.rs:144
crates/eg-types/src/shared_db_platform.rs:155
crates/eg-types/src/shared_db_platform.rs:166
crates/eg-types/src/shared_db_platform.rs:182
EG-UNIFIED-DATA-PLANE-R023.2
CloudNativePG/MariaDB operator wiring and PITR schedule to object storage (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**CloudNativePG/MariaDB operator wiring and PITR schedule to object storage (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R023` (see tasks.md), split producer-first: `.2.1` is the typed PITR schedule contract and refusal path. `.2.2` is wiring the real operator CRDs and installing the schedule. This row is LANDED only once every child is. | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R023.2.1
`PitrSchedule`/`validate` are a typed PITR schedule contract with an engine/archiving-mode refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`PitrSchedule`/`validate` are a typed PITR schedule contract with an engine/archiving-mode refusal.** `crates/eg-types/src/pitr_schedule.rs` defines `ContinuousArchivingMode` (logical-WAL/binlog) and `PitrSchedule`, whose `validate` refuses an archiving mode that does not match the cluster group's `SharedPlatformEngine` (EG-UNIFIED-DATA-PLANE-R023.1), a zero retention window, or a blank cron or destination URI. No CloudNativePG/MariaDB operator is wired yet; installing the real schedule is a later child. | Verified by unit tests needing no live operator: a well-formed Postgres schedule validates; a Postgres schedule with binlog archiving is refused; a MariaDB schedule with logical-WAL archiving is refused; a MariaDB schedule with binlog validates; zero retention is refused; and a blank cron or destination is refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDa4d1e790a69e
crates/eg-types/src/pitr_schedule.rs:110
crates/eg-types/src/pitr_schedule.rs:116
crates/eg-types/src/pitr_schedule.rs:127
crates/eg-types/src/pitr_schedule.rs:139
crates/eg-types/src/pitr_schedule.rs:148
EG-UNIFIED-DATA-PLANE-R023.2.2
Live CloudNativePG/MariaDB operator wiring and PITR schedule installation to object storage
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live CloudNativePG/MariaDB operator wiring and PITR schedule installation to object storage.** Installs a validated `PitrSchedule` against the real operator CRDs. Depends on `EG-UNIFIED-DATA-PLANE-R023.2.1`. | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R023.3
Restore-drill automation and post-restore data-match verification (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Restore-drill automation and post-restore data-match verification (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R023` (see tasks.md), split producer-first: `.3.1` is the typed drill-result contract and refusal path. `.3.2` is automating the real drill. This row is LANDED only once every child is. | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R023.3.1
`RestoreDrillResult`/`validate` are a typed drill-result contract that refuses a `data_matched` flag disagreeing with the actual digest comparison
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`RestoreDrillResult`/`validate` are a typed drill-result contract that refuses a `data_matched` flag disagreeing with the actual digest comparison.** `crates/eg-types/src/restore_drill.rs` defines `RestoreDrillResult` and `from_digests`, the only constructor that derives `data_matched` from comparing the pre/post-restore digests; `validate` refuses a matched flag with differing digests, a mismatched flag with equal digests, or a blank digest. No restore is run yet; automating the real drill is a later child. | Verified by unit tests needing no live cluster: matching and differing digests built via `from_digests` both validate; a hand-set matched flag with differing digests is refused; a hand-set mismatched flag with equal digests is refused; and a blank digest is refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDa4d1e790a69e
crates/eg-types/src/restore_drill.rs:108
crates/eg-types/src/restore_drill.rs:121
crates/eg-types/src/restore_drill.rs:134
crates/eg-types/src/restore_drill.rs:150
crates/eg-types/src/restore_drill.rs:166
EG-UNIFIED-DATA-PLANE-R023.3.2
Live restore-drill automation and post-restore data-match verification
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Live restore-drill automation and post-restore data-match verification.** Runs the real restore drill and records its digests through `RestoreDrillResult::from_digests`. Depends on `EG-UNIFIED-DATA-PLANE-R023.3.1` and `EG-UNIFIED-DATA-PLANE-R023.2`. | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R024
Admit applications to the shared platform with rollback
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Admit applications to the shared platform with rollback.** EG admits each application to the shared database platform one at a time, with a tested rollback path, and retires that application's prior ingest connector only after it is fully attached with parity. Split per the net-new rule (no admission-stage type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | An admission test for each candidate application confirms rollback restores the prior state and that the retired connector no longer writes.
requirementEG-UNIFIED-DATA-PLANEVERIFIED15a7370ecac3
1b3cc2f03fa2
6c11520aebfc
crates/eg-types/src/platform_admission.rs:232
crates/eg-types/src/platform_admission.rs:242
crates/eg-types/src/platform_admission.rs:254
crates/eg-types/src/platform_admission.rs:262
crates/eg-types/src/platform_admission.rs:272
EG-UNIFIED-DATA-PLANE-R024.1
`ApplicationAdmission` is a typed stage machine refusing early connector retirement
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`ApplicationAdmission` is a typed stage machine refusing early connector retirement.** `crates/eg-types/src/platform_admission.rs` defines `AdmissionStage` (`Pending`/`Admitted`/`ParityConfirmed`/`ConnectorRetired`/`RolledBack`) and `advance`, the one entry point that moves a record, which refuses retiring the connector before `ParityConfirmed` and refuses a rollback once the connector is retired. | Verified by unit tests: the full admission path advances in order, retiring the connector before parity or from `Pending` is refused without changing the recorded stage, rollback is allowed before connector retirement, rollback after retirement is refused, and the record serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED1b3cc2f03fa2
6c11520aebfc
crates/eg-types/src/platform_admission.rs:232
crates/eg-types/src/platform_admission.rs:242
crates/eg-types/src/platform_admission.rs:254
crates/eg-types/src/platform_admission.rs:262
crates/eg-types/src/platform_admission.rs:272
EG-UNIFIED-DATA-PLANE-R024.2
Admission runner and tested rollback path per candidate application
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Admission runner and tested rollback path per candidate application.** Split per the net-new rule (no runner existed on main): `.1` is the runner slice needing no live service; the live per-application runs against the real candidates are a later child. | An admission test for each candidate application confirms rollback restores the prior state and that the retired connector no longer writes
requirementEG-UNIFIED-DATA-PLANEVERIFIED15a7370ecac3
crates/eg-types/src/platform_admission.rs:292
crates/eg-types/src/platform_admission.rs:304
crates/eg-types/src/platform_admission.rs:317
EG-UNIFIED-DATA-PLANE-R024.2.1
`AdmissionRunner` drives `ApplicationAdmission` against a pluggable `PriorIngestConnector`, with a tested rollback path
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`AdmissionRunner` drives `ApplicationAdmission` against a pluggable `PriorIngestConnector`, with a tested rollback path.** `crates/eg-types/src/platform_admission.rs` adds `PriorIngestConnector`, `AdmissionRunner`, and `AdmissionRunError`; the runner retires the connector only after `ParityConfirmed` and refuses to record retirement if the connector still reports writing. Needs no live candidate application: driven against a fake in-process connector. | Verified by unit tests: retiring the connector after parity stops its writes, rollback restores `Pending`-reachable state while the connector keeps writing, and rollback is refused once the connector is retired.
requirementEG-UNIFIED-DATA-PLANEVERIFIED15a7370ecac3
crates/eg-types/src/platform_admission.rs:292
crates/eg-types/src/platform_admission.rs:304
crates/eg-types/src/platform_admission.rs:317
EG-UNIFIED-DATA-PLANE-R024.3
Per-application admission test confirming rollback and that the retired connector no longer writes
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Per-application admission test confirming rollback and that the retired connector no longer writes.** Split per the net-new rule (no such test existed on main): `.1` covers every candidate application against a fake connector, needing no live service; the live per-application runs against the real candidates are a later child. | An admission test for each candidate application confirms rollback restores the prior state and that the retired connector no longer writes
requirementEG-UNIFIED-DATA-PLANEVERIFIED15a7370ecac3
crates/eg-types/src/platform_admission.rs:352
EG-UNIFIED-DATA-PLANE-R024.3.1
One fake-connector admission test per candidate application, confirming rollback and that the retired connector no longer writes
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**One fake-connector admission test per candidate application, confirming rollback and that the retired connector no longer writes.** `crates/eg-types/src/platform_admission.rs` runs the rollback-restores-state and retirement-stops-writes assertions for each of `gramps`, `immich`, and `firefly` against `AdmissionRunner`. Needs no live candidate application. | Verified by a unit test iterating all three candidate applications: each confirms rollback leaves the prior connector writing and that a retired connector stops writing.
requirementEG-UNIFIED-DATA-PLANEVERIFIED15a7370ecac3
crates/eg-types/src/platform_admission.rs:352
EG-UNIFIED-DATA-PLANE-R025
Evaluate a pgrx companion extension through a spike
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evaluate a pgrx companion extension through a spike.** A pgrx-based companion extension spike evaluates running a slice of EG inside Postgres, covering SPARQL over tables, vector search, one time-series kernel, and a wait-for-position helper, concluding in an approved go/no-go architecture decision record. Split per the net-new rule (no spike-decision type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | The spike's results and the recorded decision are reviewed against its defined scope before further pgrx work is authorized.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDe265a52820f5
EG-UNIFIED-DATA-PLANE-R025.1
`PgrxSpikeDecision` is a typed decision record refusing an outcome without full-scope evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`PgrxSpikeDecision` is a typed decision record refusing an outcome without full-scope evidence.** `crates/eg-types/src/pgrx_spike.rs` defines the closed `PgrxSpikeArea` vocabulary (SPARQL over tables, vector search, time-series kernel, wait-for-position helper) and `validate`, which refuses a decision missing evidence for any declared area or recording no outcome. | Verified by unit tests: a complete decision validates with its outcome, a missing area is refused and named, a decision without an outcome is refused, an empty decision names every missing area, and the record serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
e265a52820f5
crates/eg-types/src/pgrx_spike.rs:171
crates/eg-types/src/pgrx_spike.rs:181
crates/eg-types/src/pgrx_spike.rs:197
crates/eg-types/src/pgrx_spike.rs:207
crates/eg-types/src/pgrx_spike.rs:217
EG-UNIFIED-DATA-PLANE-R025.2
Run the spike across its declared scope areas
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run the spike across its declared scope areas.** Split per the net-new rule (no spike runner existed on main): `.1` is the runner slice needing no live pgrx/Postgres instance; the live run inside pgrx/Postgres is a later child. | The spike's results and the recorded decision are reviewed against its defined scope before further pgrx work is authorized
requirementEG-UNIFIED-DATA-PLANEVERIFIED15a7370ecac3
crates/eg-types/src/pgrx_spike.rs:229
crates/eg-types/src/pgrx_spike.rs:242
crates/eg-types/src/pgrx_spike.rs:257
EG-UNIFIED-DATA-PLANE-R025.2.1
`run_spike` assembles a `PgrxSpikeDecision` from one evidence source per declared area, deferring to the typed model's full-scope refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`run_spike` assembles a `PgrxSpikeDecision` from one evidence source per declared area, deferring to the typed model's full-scope refusal.** `crates/eg-types/src/pgrx_spike.rs` adds `PgrxSpikeAreaEvaluator` and `run_spike`, which collects one `PgrxSpikeEvidence` per evaluator and validates the assembled decision. Needs no live pgrx extension or Postgres instance: driven against fake evaluators. | Verified by unit tests: a full set of evaluators plus an outcome produces a valid decision, an evaluator set missing an area is refused and named, and a complete evaluator set with no outcome is refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED15a7370ecac3
crates/eg-types/src/pgrx_spike.rs:229
crates/eg-types/src/pgrx_spike.rs:242
crates/eg-types/src/pgrx_spike.rs:257
EG-UNIFIED-DATA-PLANE-R025.3
Review the spike's results and recorded decision; produce the approved ADR
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Review the spike's results and recorded decision; produce the approved ADR.** Child slice of `EG-UNIFIED-DATA-PLANE-R025` (see tasks.md). This row is LANDED only once every child is. | The spike's results and the recorded decision are reviewed against its defined scope before further pgrx work is authorized
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R025.3.1
Review skeleton: typed review request → approved ADR mapping plus the refusal path
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Review skeleton: typed review request → approved ADR mapping plus the refusal path.** `crates/eg-types/src/pgrx_spike_review.rs` defines `PgrxSpikeReviewRequest`/`ApprovedPgrxAdr` and `approve`, refusing an invalid underlying decision, an empty reviewer, or an empty ADR title before any ADR is approved. Filing the ADR document and the live spike results it reviews are `EG-UNIFIED-DATA-PLANE-R025.3.2+`. | Verified by unit tests needing no live service: a well-formed review approves the ADR. An invalid decision, an empty reviewer, and an empty ADR title are each refused. The approved ADR serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED04347dc35255
crates/eg-types/src/pgrx_spike_review.rs:106
crates/eg-types/src/pgrx_spike_review.rs:119
crates/eg-types/src/pgrx_spike_review.rs:130
crates/eg-types/src/pgrx_spike_review.rs:141
crates/eg-types/src/pgrx_spike_review.rs:97
EG-UNIFIED-DATA-PLANE-R025.3.2
File the approved pgrx ADR from the live spike results
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**File the approved pgrx ADR from the live spike results.** Remaining scope of `EG-UNIFIED-DATA-PLANE-R025.3` after the `.1` review skeleton: review the real spike results recorded by `R025.2`, approve through `approve`, and file the ADR document before further pgrx work is authorized. | The filed ADR names the reviewed `PgrxSpikeDecision`, its reviewer and scope, and is produced through `approve` from the live spike results.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R026
Run the Gramps native-hosting pilot phases P0 through P5
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run the Gramps native-hosting pilot phases P0 through P5.** The Gramps pilot records a baseline content digest, establishes a real-Postgres control with a captured driver statement corpus, runs that corpus unmodified against EG, fixes only proven gaps with a failing test first, verifies restore paths, and demonstrates schema understanding through an approved mapping and query. Split per the net-new rule (no phase-gate type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Each phase's exit artifact, as defined in the specification, is produced and reviewed before the next phase begins.
requirementEG-UNIFIED-DATA-PLANESPECIFIED30af64b172d4
EG-UNIFIED-DATA-PLANE-R026.1
`GrampsPilotProgress` is a typed P0-P5 phase gate refusing a wrong, unreviewed, or out-of-order exit
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`GrampsPilotProgress` is a typed P0-P5 phase gate refusing a wrong, unreviewed, or out-of-order exit.** `crates/eg-types/src/gramps_pilot_phase.rs` defines the closed `GrampsPilotPhase` order and each phase's required exit-artifact kind, `PhaseExitArtifact::validate` (refuses a mismatched artifact kind or a blank reviewer), and `GrampsPilotProgress::admits`/`next_phase`, which refuse admitting a phase before every earlier phase has a valid exit. | Verified by unit tests: a well-formed exit validates, a wrong artifact kind and an unreviewed exit are refused, a fresh pilot admits only P0, skipping ahead without a prior exit is refused, an invalid exit does not advance progress, and the full ordered exit sequence completes the pilot.
requirementEG-UNIFIED-DATA-PLANEVERIFIED30af64b172d4
6c11520aebfc
9a7674d1bae5
eb058c53407e
crates/eg-types/src/gramps_pilot_phase.rs:151
crates/eg-types/src/gramps_pilot_phase.rs:157
crates/eg-types/src/gramps_pilot_phase.rs:168
crates/eg-types/src/gramps_pilot_phase.rs:176
crates/eg-types/src/gramps_pilot_phase.rs:185
EG-UNIFIED-DATA-PLANE-R026.2
Run P0-P2 (baseline digest, Postgres control, unmodified corpus replay)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run P0-P2 (baseline digest, Postgres control, unmodified corpus replay).** Child slice of `EG-UNIFIED-DATA-PLANE-R026` (see tasks.md). This row is LANDED only once every child is. | Each phase's exit artifact, as defined in the specification, is produced and reviewed before the next phase begins
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R026.2.1
P0 adapter skeleton: typed baseline-digest → P0 phase-exit mapping plus the refusal path
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**P0 adapter skeleton: typed baseline-digest → P0 phase-exit mapping plus the refusal path.** `crates/eg-types/src/gramps_baseline_digest.rs` defines `GrampsBaselineDigest` and `to_phase_exit`, refusing a zero record count, an empty digest, or an unreviewed exit before P0 is marked closed. The real baseline capture, the Postgres control, and the unmodified corpus replay (P1-P2) are `EG-UNIFIED-DATA-PLANE-R026.2.2+`. | Verified by unit tests needing no live service: a well-formed digest maps to the P0 exit. A zero record count, an empty digest, and an unreviewed exit are each refused. The digest serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED04347dc35255
crates/eg-types/src/gramps_baseline_digest.rs:100
crates/eg-types/src/gramps_baseline_digest.rs:111
crates/eg-types/src/gramps_baseline_digest.rs:121
crates/eg-types/src/gramps_baseline_digest.rs:78
crates/eg-types/src/gramps_baseline_digest.rs:89
EG-UNIFIED-DATA-PLANE-R026.2.2
Run P0-P2 live: real baseline capture, Postgres control, unmodified corpus replay
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run P0-P2 live: real baseline capture, Postgres control, unmodified corpus replay.** Remaining scope of `EG-UNIFIED-DATA-PLANE-R026.2` after the `.1` P0 skeleton: capture the real Gramps baseline digest, stand up the Postgres control, and replay the unmodified corpus, recording each phase exit through `to_phase_exit`. | Each of P0-P2 produces its reviewed phase-exit artifact from the live run before the next phase begins.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R026.3
Run P3-P5 (proven-gap fixes, restore verification, schema-understanding demonstration)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run P3-P5 (proven-gap fixes, restore verification, schema-understanding demonstration).** Child slice of `EG-UNIFIED-DATA-PLANE-R026` (see tasks.md). This row is LANDED only once every child is. | Each phase's exit artifact, as defined in the specification, is produced and reviewed before the next phase begins
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R026.3.1
P3 adapter skeleton: typed proven-gap-fix → P3 phase-exit mapping plus the refusal path
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**P3 adapter skeleton: typed proven-gap-fix → P3 phase-exit mapping plus the refusal path.** `crates/eg-types/src/gramps_gap_fix.rs` defines `GrampsProvenGapFix` and `to_phase_exit`, refusing an empty description, an empty failing or passing test name, an identical before/after test name, or an unreviewed exit before P3 is marked closed. Real restore verification (P4) and the schema-understanding demonstration (P5) are `EG-UNIFIED-DATA-PLANE-R026.3.2+`. | Verified by unit tests needing no live service: a well-formed fix maps to the P3 exit; an empty description, an empty failing-test name, an identical before/after test name, and an unreviewed exit are each refused; the fix serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED04347dc35255
crates/eg-types/src/gramps_gap_fix.rs:105
crates/eg-types/src/gramps_gap_fix.rs:116
crates/eg-types/src/gramps_gap_fix.rs:127
crates/eg-types/src/gramps_gap_fix.rs:138
crates/eg-types/src/gramps_gap_fix.rs:148
EG-UNIFIED-DATA-PLANE-R026.3.2
Run P4-P5 live: restore verification and the schema-understanding demonstration
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run P4-P5 live: restore verification and the schema-understanding demonstration.** Remaining scope of `EG-UNIFIED-DATA-PLANE-R026.3` after the `.1` P3 skeleton: verify a real restore and demonstrate schema understanding over the Gramps corpus, recording each phase exit. | P4 and P5 each produce their reviewed phase-exit artifact from the live run.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R027
Fix Postgres compatibility gaps proven by captured traffic
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Fix Postgres compatibility gaps proven by captured traffic.** EG implements each Postgres compatibility feature in its inventory only once captured application traffic proves it is needed, with a test that fails before the fix and passes after. Split per the net-new rule (no feature-fix-proof type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Each fixed feature has a committed test shown failing against the prior behavior and passing against the fix.
requirementEG-UNIFIED-DATA-PLANEVERIFIED5873d340b4de
6c11520aebfc
e8b99c7db914
crates/eg-types/src/pg_compat_feature.rs:193
crates/eg-types/src/pg_compat_feature.rs:204
crates/eg-types/src/pg_compat_feature.rs:215
crates/eg-types/src/pg_compat_feature.rs:228
crates/eg-types/src/pg_compat_feature.rs:240
EG-UNIFIED-DATA-PLANE-R027.1
`FeatureFixRecord` is a typed inventory entry refusing a fix without complete captured-traffic/test proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`FeatureFixRecord` is a typed inventory entry refusing a fix without complete captured-traffic/test proof.** `crates/eg-types/src/pg_compat_feature.rs` defines the closed `PgCompatFeature` inventory and `validate`, which accepts an unfixed (no-proof) record, accepts a fixed record only with a non-empty captured-traffic reference and a non-empty failing/passing test-reference pair, and refuses any proof with an empty field. | Verified by unit tests: an unfixed feature with no proof validates, a fixed feature with complete proof validates and reports fixed, a proof with an empty traffic or failing-test reference is refused and reports unfixed, and the record serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED5873d340b4de
6c11520aebfc
crates/eg-types/src/pg_compat_feature.rs:193
crates/eg-types/src/pg_compat_feature.rs:204
crates/eg-types/src/pg_compat_feature.rs:215
crates/eg-types/src/pg_compat_feature.rs:228
crates/eg-types/src/pg_compat_feature.rs:240
EG-UNIFIED-DATA-PLANE-R027.2
Capture application traffic per feature and record the proof reference
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Capture application traffic per feature and record the proof reference.** Split per the net-new rule (no capture runner existed on main): `.1` is the runner slice needing no live candidate application. The live per-feature captures against real traffic are a later child. | Each fixed feature has a committed test shown failing against the prior behavior and passing against the fix
requirementEG-UNIFIED-DATA-PLANEVERIFIEDe8b99c7db914
crates/eg-types/src/pg_compat_feature.rs:262
crates/eg-types/src/pg_compat_feature.rs:272
crates/eg-types/src/pg_compat_feature.rs:280
EG-UNIFIED-DATA-PLANE-R027.2.1
`capture_feature_fix` assembles a `FeatureFixRecord` from a pluggable `TrafficCaptureSource`, refusing an unproven or incomplete capture
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`capture_feature_fix` assembles a `FeatureFixRecord` from a pluggable `TrafficCaptureSource`, refusing an unproven or incomplete capture.** `crates/eg-types/src/pg_compat_feature.rs` adds `TrafficCaptureSource` and `capture_feature_fix`, which refuses to produce a fixed record when the source has not yet captured traffic proving the feature needed, and bubbles `FeatureFixRecord::validate`'s refusal for an incomplete proof. Needs no live candidate application: driven against a fake capture source. | Verified by unit tests: a complete captured proof produces a valid fixed record, a source with no traffic yet is refused as not proven, and an incomplete captured proof is refused and reports the underlying validation error.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDe8b99c7db914
crates/eg-types/src/pg_compat_feature.rs:262
crates/eg-types/src/pg_compat_feature.rs:272
crates/eg-types/src/pg_compat_feature.rs:280
EG-UNIFIED-DATA-PLANE-R027.3
Implement each proven feature with its failing-then-passing test
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Implement each proven feature with its failing-then-passing test.** Split per the net-new rule (no fix-application runner existed on main): `.1` is the runner slice needing no live Postgres-compatible target. Applying each real feature's fix is a later child. | Each fixed feature has a committed test shown failing against the prior behavior and passing against the fix
requirementEG-UNIFIED-DATA-PLANEVERIFIEDe8b99c7db914
crates/eg-types/src/pg_compat_feature.rs:295
crates/eg-types/src/pg_compat_feature.rs:311
EG-UNIFIED-DATA-PLANE-R027.3.1
`apply_proven_fix` applies a feature's fix only once its record is proven fixed, refusing -- without invoking the fix -- an unproven record
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`apply_proven_fix` applies a feature's fix only once its record is proven fixed, refusing -- without invoking the fix -- an unproven record.** `crates/eg-types/src/pg_compat_feature.rs` adds `apply_proven_fix`, which checks `FeatureFixRecord::is_fixed()` before invoking the caller-supplied fix closure. Needs no live Postgres-compatible target: driven against a fake fix closure. | Verified by unit tests: a proven record invokes the fix exactly once for its feature, and an unproven record is refused without invoking the fix.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDe8b99c7db914
crates/eg-types/src/pg_compat_feature.rs:295
crates/eg-types/src/pg_compat_feature.rs:311
EG-UNIFIED-DATA-PLANE-R028
Build the Postgres-equivalence differential harness
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Build the Postgres-equivalence differential harness.** A differential harness compares EG against real Postgres. Its inputs are the Postgres regression suite, generated metamorphic query cases and captured application traffic. The harness records each known difference as a reviewed, named deviation. It never uses a self-updating baseline. Split per the net-new rule (no deviation-baseline type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | The harness report lists every deviation with its owner and a reproducing fixture, and no deviation is auto-suppressed on a subsequent run.
requirementEG-UNIFIED-DATA-PLANESPECIFIED2f94e96c5129
EG-UNIFIED-DATA-PLANE-R028.1
`DeviationBaseline::reconcile` refuses a baseline update that drops a deviation without an explicit resolution
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`DeviationBaseline::reconcile` refuses a baseline update that drops a deviation without an explicit resolution.** `crates/eg-types/src/pg_diff_baseline.rs` defines the closed `DifferentialSource` vocabulary (Postgres regression suite, metamorphic-generated, captured application traffic), `PostgresDeviation` (name, source, owner, reproducing fixture), and `reconcile`, which refuses when a current run's baseline is missing a prior deviation that is not named in an explicit `resolved` list — a deviation never silently vanishes. | Verified by unit tests: an identical baseline reconciles, a new deviation is not a problem, a dropped deviation without resolution is refused and named, a dropped deviation with explicit resolution reconciles, an emptied current baseline against a nonempty prior is refused, and a deviation serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED2f94e96c5129
6c11520aebfc
crates/eg-types/src/pg_diff_baseline.rs:141
crates/eg-types/src/pg_diff_baseline.rs:149
crates/eg-types/src/pg_diff_baseline.rs:157
crates/eg-types/src/pg_diff_baseline.rs:166
crates/eg-types/src/pg_diff_baseline.rs:177
EG-UNIFIED-DATA-PLANE-R028.2
Run the Postgres regression suite and generated metamorphic query corpora against EG
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run the Postgres regression suite and generated metamorphic query corpora against EG.** Split per the net-new rule (no harness runner existed on main): `.1` is the runner slice needing no live Postgres instance; the live regression-suite and metamorphic-generated runs are a later child. | The harness report lists every deviation with its owner and a reproducing fixture, and no deviation is auto-suppressed on a subsequent run
requirementEG-UNIFIED-DATA-PLANEVERIFIEDe8b99c7db914
crates/eg-types/src/pg_diff_baseline.rs:210
crates/eg-types/src/pg_diff_baseline.rs:233
crates/eg-types/src/pg_diff_baseline.rs:245
EG-UNIFIED-DATA-PLANE-R028.2.1
`run_differential_harness` assembles a run's `DeviationBaseline` from one evaluator per declared corpus source and reconciles it against the prior baseline
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`run_differential_harness` assembles a run's `DeviationBaseline` from one evaluator per declared corpus source and reconciles it against the prior baseline.** `crates/eg-types/src/pg_diff_baseline.rs` adds `DifferentialCaseEvaluator` and `run_differential_harness`, which merges each evaluator's deviations by name and bubbles `DeviationBaseline::reconcile`'s refusal for an unaccounted drop. Needs no live Postgres instance: driven against fake evaluators. | Verified by unit tests: deviations from every declared source merge into one baseline, a dropped prior deviation with no resolution is refused and named, and an explicitly resolved drop reconciles.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDe8b99c7db914
crates/eg-types/src/pg_diff_baseline.rs:210
crates/eg-types/src/pg_diff_baseline.rs:233
crates/eg-types/src/pg_diff_baseline.rs:245
EG-UNIFIED-DATA-PLANE-R028.3
Run the captured-application-traffic corpus and publish the harness report
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run the captured-application-traffic corpus and publish the harness report.** Child slice of `EG-UNIFIED-DATA-PLANE-R028` (see tasks.md). | The harness report lists every deviation with its owner and a reproducing fixture, and no deviation is auto-suppressed on a subsequent run
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R029
Expose a schema_context query surface
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Expose a schema_context query surface.** EG exposes a schema_context query that answers what a table is, what joins to it, which ontology class and application it belongs to, and the impact of a change, following the same pattern as the existing code_context surface. Split per the net-new rule (no schema_context answer type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A query test against a known catalog fixture confirms schema_context returns the expected joins, class, application, and impact for a table.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
c1bf552a9c33
d9b702c9e7e2
efcab03c2fa8
crates/eg-types/src/schema_context.rs:146
crates/eg-types/src/schema_context.rs:156
crates/eg-types/src/schema_context.rs:163
crates/eg-types/src/schema_context.rs:170
crates/eg-types/src/schema_context.rs:179
EG-UNIFIED-DATA-PLANE-R029.1
`SchemaContextCatalog::schema_context` is a typed answer lookup refusing an unknown table
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`SchemaContextCatalog::schema_context` is a typed answer lookup refusing an unknown table.** `crates/eg-types/src/schema_context.rs` defines `SchemaContextAnswer` (joins, ontology class, application, change impact) and `schema_context`, which refuses a table absent from the catalog rather than returning a default/empty answer. | Verified by unit tests: a known table returns its full answer, an unknown table is refused rather than defaulted, an empty catalog refuses every table, and the answer serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
d9b702c9e7e2
crates/eg-types/src/schema_context.rs:146
crates/eg-types/src/schema_context.rs:156
crates/eg-types/src/schema_context.rs:163
crates/eg-types/src/schema_context.rs:170
EG-UNIFIED-DATA-PLANE-R029.2
Wire the real schema_context query entry point through Graph OS, following the code_context pattern
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wire the real schema_context query entry point through Graph OS, following the code_context pattern.** Child slice of `EG-UNIFIED-DATA-PLANE-R029` (see tasks.md). | A query test against a known catalog fixture confirms schema_context returns the expected joins, class, application, and impact for a table
requirementEG-UNIFIED-DATA-PLANEVERIFIEDc1bf552a9c33
efcab03c2fa8
crates/eg-types/src/schema_context.rs:179
crates/eg-types/src/schema_context.rs:202
EG-UNIFIED-DATA-PLANE-R030
Resolve entities across attached applications
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Resolve entities across attached applications.** EG proposes cross-application entity links among Gramps, Immich, Twenty, and Firefly using blocking, field similarity, and a Fellegi-Sunter model, and records each link as an owl:sameAs proposal that only becomes active once approved. Split per the net-new rule (no entity-link-proposal type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | An entity-resolution fixture with true matches, false matches, and ambiguous candidates confirms no proposal is asserted as owl:sameAs before approval.
requirementEG-UNIFIED-DATA-PLANESPECIFIED648e9b47f700
EG-UNIFIED-DATA-PLANE-R030.1
`EntityLinkProposal::assert_same_as` refuses an unapproved or non-Match candidate
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`EntityLinkProposal::assert_same_as` refuses an unapproved or non-Match candidate.** `crates/eg-types/src/entity_link_proposal.rs` defines `AttachedApplication` (Gramps/Immich/Twenty/Firefly), `MatchClass` (Match/NonMatch/Ambiguous), and `assert_same_as`, which refuses a `NonMatch`/`Ambiguous` candidate even if marked approved, and refuses an unapproved or blank-approver `Match`. | Verified by unit tests: an approved match asserts, an unapproved match is refused, an approved non-match and an approved ambiguous candidate are both refused, a blank approver is refused, and the proposal serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED648e9b47f700
6c11520aebfc
crates/eg-types/src/entity_link_proposal.rs:109
crates/eg-types/src/entity_link_proposal.rs:116
crates/eg-types/src/entity_link_proposal.rs:123
crates/eg-types/src/entity_link_proposal.rs:130
crates/eg-types/src/entity_link_proposal.rs:137
EG-UNIFIED-DATA-PLANE-R030.2
Blocking and field-similarity candidate generation across Gramps/Immich/Twenty/Firefly
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Blocking and field-similarity candidate generation across Gramps/Immich/Twenty/Firefly.** Child slice of `EG-UNIFIED-DATA-PLANE-R030` (see tasks.md). | An entity-resolution fixture with true matches, false matches, and ambiguous candidates confirms no proposal is asserted as owl:sameAs before approval
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R030.3
Real Fellegi-Sunter scoring and the approval workflow
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Real Fellegi-Sunter scoring and the approval workflow.** Child slice of `EG-UNIFIED-DATA-PLANE-R030` (see tasks.md). | An entity-resolution fixture with true matches, false matches, and ambiguous candidates confirms no proposal is asserted as owl:sameAs before approval
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R031
Enforce consolidation safety across attached applications (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Enforce consolidation safety across attached applications (rollup).** EG isolates each attached application by tenant and principal, exposes its data only through approved mappings, enforces quotas that bound the blast radius of one application's load or failure, and applies an explicit upgrade-coupling policy and admission criteria before adding another application. No typed admission/quota model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A fault-isolation test confirms one application's failure or quota breach does not degrade another attached application's service.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R031.1
`ApplicationAdmission`/`ConsolidationIsolationRegistry` are a typed admission model with identity and quota refusals
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`ApplicationAdmission`/`ConsolidationIsolationRegistry` are a typed admission model with identity and quota refusals.** `crates/eg-types/src/consolidation_isolation.rs` defines `ApplicationAdmission` (tenant/principal/quota/`UpgradeCouplingPolicy`); `validate_admission` refuses an admission with an empty application/tenant/principal or a quota with every bound at zero, and `ConsolidationIsolationRegistry::admit` additionally refuses re-admitting the same tenant/application pair under a different principal. | Verified by unit tests: a valid admission round-trips through `admit`; an empty identity is refused; an all-zero quota is refused; the same principal re-admitting is idempotent; a different principal re-admitting the same tenant/application is refused; and an invalid admission is refused rather than silently admitted.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
eb058c53407e
crates/eg-types/src/consolidation_isolation.rs:160
crates/eg-types/src/consolidation_isolation.rs:170
crates/eg-types/src/consolidation_isolation.rs:178
crates/eg-types/src/consolidation_isolation.rs:193
crates/eg-types/src/consolidation_isolation.rs:206
EG-UNIFIED-DATA-PLANE-R031.2
Real fault-isolation enforcement and quota metering
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Real fault-isolation enforcement and quota metering.** Child slice of `EG-UNIFIED-DATA-PLANE-R031` (see tasks.md). | A fault-isolation test confirms one application's failure or quota breach does not degrade another attached application's service
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R032
Run the Immich connector pilot phases I0 through I6 (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run the Immich connector pilot phases I0 through I6 (rollup).** The Immich pilot generates a version-pinned API client from a checked-in OpenAPI fixture, provides read-first MCP tools with approval-gated writes, registers the connector across every required release catalog, ingests assets and per-user people incrementally with no-op replay on a second run, resolves cross-application entity proposals, and adds health, lag, and upgrade-digest checks. No typed phase-gate model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | Each phase's fixture and test, as defined in the specification, passes, including the no-op replay and one-change incremental ingest tests.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R032.1
`ImmichPilotProgress` is a typed phase gate (I0-I6) with exit-artifact and skip-ahead refusals
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`ImmichPilotProgress` is a typed phase gate (I0-I6) with exit-artifact and skip-ahead refusals.** `crates/eg-types/src/immich_pilot_phase.rs` defines the closed `ImmichPilotPhase` order (I0 client generation through I6 health checks) with each phase's required exit-artifact kind; `PhaseExitArtifact::validate` refuses a mismatched artifact kind or a blank reviewer, and `ImmichPilotProgress::admits`/`next_phase` refuse admitting a phase before every earlier phase has a valid exit. | Verified by unit tests: a well-formed exit validates; a wrong artifact kind is refused; an unreviewed exit is refused; a fresh pilot admits only I0; skipping ahead without a prior exit is refused; an invalid exit does not advance progress; and the full I0-I6 order completes the pilot.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
eb058c53407e
crates/eg-types/src/immich_pilot_phase.rs:158
crates/eg-types/src/immich_pilot_phase.rs:167
crates/eg-types/src/immich_pilot_phase.rs:178
crates/eg-types/src/immich_pilot_phase.rs:186
crates/eg-types/src/immich_pilot_phase.rs:198
EG-UNIFIED-DATA-PLANE-R032.2
Run phase I0 (version-pinned OpenAPI client generation and digest)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Run phase I0 (version-pinned OpenAPI client generation and digest).** Child slice of `EG-UNIFIED-DATA-PLANE-R032` (see tasks.md). | Each phase's fixture and test, as defined in the specification, passes, including the no-op replay and one-change incremental ingest tests
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R033
Cut over Gramps to EG-backed storage in production (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Cut over Gramps to EG-backed storage in production (rollup).** Gramps P6 moves the production family tree to EG-backed storage with a Postgres replica and a nightly independent XML export, keeps a 30-day read-only SQLite fallback available, and proceeds only after an explicit, separately recorded go-ahead following the P0 through P5 evidence. No typed go-ahead model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A rehearsed failover test exercises the fallback path and confirms the nightly export and replica remain consistent throughout the 30-day observation window.
requirementEG-UNIFIED-DATA-PLANESPECIFIED273dc35315ff
EG-UNIFIED-DATA-PLANE-R033.1
`GrampsCutoverGoAhead` is a typed go-ahead model gated on a valid P5 exit and a 30-day fallback window
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`GrampsCutoverGoAhead` is a typed go-ahead model gated on a valid P5 exit and a 30-day fallback window.** `crates/eg-types/src/gramps_cutover_gate.rs` reuses `gramps_pilot_phase::PhaseExitArtifact`; `validate_go_ahead` refuses a go-ahead that cites any phase but `P5SchemaUnderstanding`, cites an invalid (unreviewed) P5 exit, names no approver, or declares a fallback window shorter than the required 30 days. | Verified by unit tests: a well-formed go-ahead validates; citing the wrong phase is refused; citing an unreviewed P5 exit is refused; naming no approver is refused; a fallback window under 30 days is refused; and the model serializes and decodes round-trip.
requirementEG-UNIFIED-DATA-PLANEVERIFIED6c11520aebfc
9a7674d1bae5
crates/eg-types/src/gramps_cutover_gate.rs:101
crates/eg-types/src/gramps_cutover_gate.rs:107
crates/eg-types/src/gramps_cutover_gate.rs:121
crates/eg-types/src/gramps_cutover_gate.rs:132
crates/eg-types/src/gramps_cutover_gate.rs:143
EG-UNIFIED-DATA-PLANE-R033.2
Real production cutover: Postgres replica, nightly independent XML export, and the rehearsed failover test
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Real production cutover: Postgres replica, nightly independent XML export, and the rehearsed failover test.** Child slice of `EG-UNIFIED-DATA-PLANE-R033` (see tasks.md). | A rehearsed failover test exercises the fallback path and confirms the nightly export and replica remain consistent throughout the 30-day observation window
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R034
Keep eg-core's build, Clippy, and generated contract suite green
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Keep eg-core's build, Clippy, and generated contract suite green.** eg-core's root library compiles successfully, and Clippy passes cleanly with all features and targets enabled. The generated contract suite passes all of its cases, and the scanner/contract/catalog test suite passes all of its cases. | Continuous integration enforces a successful root library build, a clean all-features/all-targets Clippy run, and full passes of the generated contract and scanner/contract/catalog test suites.
requirementEG-UNIFIED-DATA-PLANELANDED2e6d7617289a
EG-UNIFIED-DATA-PLANE-R035
Share the compiled ontology cache with attached-schema graphs
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Share the compiled ontology cache with attached-schema graphs.** EG reuses the compiled shapes and ontology cache on every RDF write to a graph with an attached, non-core schema source, rather than recomputing the full parse-and-classification composition in icv_guard::compiled_policy on each write, matching the caching EG-TYPED-PACKS-R051 requires for core-schema graphs. | A benchmark test measures per-write latency on an attached-schema graph and confirms it matches cache-hit performance rather than full-recomputation performance.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
bee3dd02e6ed
src/server/graph_schema/compiled_tests.rs:68
src/server/graph_schema/compiled_tests.rs:79
src/server/graph_schema/compiled_tests.rs:93
EG-UNIFIED-DATA-PLANE-R036
Derive HealthAnomaly and Incident facts with conformance checking
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Derive HealthAnomaly and Incident facts with conformance checking.** EG's complex-event-processing pipeline derives HealthAnomaly and Incident facts from the data plane's change and telemetry events, and checks each derived fact against its declared-versus-observed conformance. | A test feeds a known event sequence through the pipeline and confirms the expected HealthAnomaly and Incident facts and conformance result are produced.
requirementEG-UNIFIED-DATA-PLANEVERIFIED155bd9b55e81
6c11520aebfc
crates/eg-stream/src/telemetry/tests/derive.rs:108
crates/eg-stream/src/telemetry/tests/derive.rs:121
crates/eg-stream/src/telemetry/tests/derive.rs:139
crates/eg-stream/src/telemetry/tests/derive.rs:28
crates/eg-stream/src/telemetry/tests/derive.rs:48
EG-UNIFIED-DATA-PLANE-R760
Served incident authority (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Served incident authority (rollup).** Extends `EG-UNIFIED-DATA-PLANE-R036`. Rust-native in `eg-cep`. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R760.1
Model: served incident authority
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model: served incident authority.** `eg-cep` keeps `Incident{id, tenant, signature_digest, severity, status, opened_at_ms}` and `HealthAnomaly{entity_ref, signal, observed, baseline, at_ms}`. Arbora deleted its own incident tool and anomaly writer and calls the served methods instead. | Planned: model tests in `crates/eg-cep/tests/incident_authority.rs`
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R760.2
Behavior: served incident authority
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior: served incident authority.** Correlation groups anomalies by entity and window in one pass in O(events). An open incident with the same signature is reused. A status moves only from open to acknowledged to resolved. | Planned: behavior tests in `crates/eg-cep/tests/incident_authority.rs`
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R760.3
Wiring: served incident authority
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring: served incident authority.** The served methods are `incident.record_anomaly`, `incident.correlate`, `incident.evidence`, `incident.related_claims` and `incident.set_status`. Arbora reaches each one through its generated `eg.<domain>.<Method>` operation. | Planned: a contract test checks that the manifest lists every method.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R760.4
Refusal: served incident authority
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal: served incident authority.** The engine refuses a call without the tenant scope. It refuses a status move that skips a state and a read of another tenant's incident. | Planned: refusal tests in `crates/eg-cep/tests/incident_authority.rs`
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R760.5
Evidence: served incident authority
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence: served incident authority.** Tests assert one incident per signature, the evidence set of each incident and the state order. | Planned: evidence tests in `crates/eg-cep/tests/incident_authority.rs`
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R760.6
Hot-path proof: served incident authority
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof: served incident authority.** Criterion benchmark `incident_correlate` correlates 100,000 anomalies in one pass under 250 ms and under 64 MiB, with a p99 per anomaly under 5 microseconds. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress by more than 10 percent.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R037
Virtual-graph vocabulary is an EG core schema source
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Virtual-graph vocabulary is an EG core schema source.** EG ships `core:virtual-graph@1` with three classes: `SourceConnection`, `MetadataContract` and `VirtualMapping`. A `SourceConnection` carries a source kind, an endpoint reference and declared capabilities. Source kinds cover API, MCP, A2A, GraphQL, SQL, Iceberg, Teradata-style warehouses and SPARQL endpoints. A `MetadataContract` describes one source at one schema version under a content digest. It lists discovered entities, fields, relationships and operations. A `VirtualMapping` binds one ontology class to one discovered entity, with a key field and predicate-to-field pairs. SHACL shapes refuse an endpoint reference with credentials. They also refuse a mapping that names an undiscovered entity or field. Only an approved mapping serves reads. | Shape fixtures accept a valid connection, contract and approved mapping. They reject credential-bearing references, undiscovered fields and unapproved mappings at read time.
requirementEG-UNIFIED-DATA-PLANEVERIFIED3dd56fe53283
85f4ea82f45f
9b6036853937
src/server/graph_schema/virtual_graph_tests.rs:52
src/server/graph_schema/virtual_graph_tests.rs:74
src/server/graph_schema/virtual_graph_tests.rs:80
EG-UNIFIED-DATA-PLANE-R038
Materialize metadata and hot subsets; virtualize the rest (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Materialize metadata and hot subsets; virtualize the rest (rollup).** Metadata discovery runs for every registered source kind, not only SQL dialect catalogs. Discovery writes a versioned, hashed `MetadataContract` and never copies entity rows. Entity rows stay at the source by default and answer queries through approved virtual mappings. A mapping copies rows only under an acceleration policy. That policy needs the source `copy` capability, a declared hot-subset predicate and a freshness watermark. A missing watermark disables the copied route. EXPLAIN states whether each fragment ran live or from a copy. No typed `MetadataContract`/acceleration-policy model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | Tests prove discovery writes metadata only, a cold mapping reads live, a hot mapping copies only its declared subset, and a stale watermark falls back to live reads.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.1
`MetadataContract`/`AccelerationPolicy` are typed models with a capability refusal and a watermark-missing live fallback
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`MetadataContract`/`AccelerationPolicy` are typed models with a capability refusal and a watermark-missing live fallback.** `crates/eg-types/src/metadata_acceleration.rs` defines `MetadataContract` (source-kind-generic, metadata only, no row data field) and `AccelerationPolicy`; `validate_policy` refuses a policy that declares a hot-subset predicate for a source with no `copy` capability, and `AccelerationPolicy::resolve_mode` returns `FragmentExecutionMode::Live` whenever the copy capability, predicate, or freshness watermark is missing, `Copy` only when all three are present. | Verified by unit tests: a well-formed contract validates; an empty source kind is refused; a fully declared policy resolves to `Copy`; a missing watermark falls back to `Live`; a mapping with no predicate is `Live`; and a predicate declared without copy capability is refused.
requirementEG-UNIFIED-DATA-PLANEVERIFIED9a7674d1bae5
crates/eg-types/src/metadata_acceleration.rs:121
crates/eg-types/src/metadata_acceleration.rs:127
crates/eg-types/src/metadata_acceleration.rs:135
crates/eg-types/src/metadata_acceleration.rs:147
crates/eg-types/src/metadata_acceleration.rs:154
EG-UNIFIED-DATA-PLANE-R038.2
Real per-source-kind discovery writing the contract, the copy pipeline, and EXPLAIN's per-fragment live/copy reporting
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Real per-source-kind discovery writing the contract, the copy pipeline, and EXPLAIN's per-fragment live/copy reporting.** Child slice of `EG-UNIFIED-DATA-PLANE-R038` (see tasks.md). | Tests prove discovery writes metadata only, a cold mapping reads live, a hot mapping copies only its declared subset, and a stale watermark falls back to live reads
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.3
Transactional row stores answer through one consistent snapshot (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Transactional row stores answer through one consistent snapshot (rollup).** The engine registers transactional row stores as one source category. All pushed fragments of one query must read one source snapshot. Children `.1` to `.6` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.3.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add the closed `SourceCategory` enum in `crates/eg-types/src/metadata_acceleration.rs` beside `MetadataContract` (line 21). It lists every category of the coverage matrix in `EG-UNIFIED-DATA-PLANE-R022.4`. Add `SnapshotSemantics{isolation, snapshot_token, replica_lag_bound_ms}`. Closed `isolation` values are `snapshot` and `repeatable_read`. Proving test: `crates/eg-types/src/metadata_acceleration.rs::tests::snapshot_semantics_round_trip`. | A serde round trip keeps every field and rejects an unknown category or isolation.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.3.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** The planner opens one read-only transaction per source per query. Every fragment of that source carries the same snapshot token. A declared read replica serves the read only within its lag bound. The default lag bound is 5000 ms. The default statement timeout is 30 s. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::fragments_share_snapshot`. | Two fragments of one query read one snapshot while a concurrent writer commits.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.3.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** `foreign_scan` at `crates/eg-plan/src/federation_opt/run.rs:26` opens the snapshot through the source session. `SourceCapabilities` at `crates/eg-plan/src/federation_opt/capability.rs:63` carries `snapshot_reads`. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::foreign_scan_opens_snapshot`. | A served query over a transactional source reaches the snapshot path.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.3.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A multi-fragment query on a source without `snapshot_reads` must refuse with `SNAPSHOT_UNAVAILABLE`. A request may accept per-fragment consistency explicitly. A replica over its lag bound must not serve the read. A write path must not be reachable from the read plan. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::snapshot_refusals`. | Each case returns its code and runs no source statement.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.3.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** EXPLAIN and answer provenance must carry the snapshot token, isolation, source and read time. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::provenance_names_snapshot`. | The answer provenance names one snapshot token per source.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.3.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is the served SPARQL method over a transactional source mapped by R2RML. A concurrent writer commits during the query. The answer must match the snapshot and the engine must store no source rows. Proving test: `tests/federation/test_oltp_snapshot_served.py::test_fragments_share_one_snapshot`. | The answer matches the snapshot oracle and the engine row count for that source stays unchanged.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.4
Metastore catalogs and ORC and Avro files answer in place (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Metastore catalogs and ORC and Avro files answer in place (rollup).** The engine reads table metadata from a catalog that speaks the Hive metastore Thrift protocol. It reads ORC and Avro files in place, with no copy. Children `.1` to `.6` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.4.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `MetastoreCatalogSpec{endpoint, database_filter, auth_ref}` and the `Orc` and `Avro` file formats in `crates/eg-lake`. A `MetadataContract` row carries partition keys, file locations and column statistics. Proving test: `crates/eg-lake/src/tests/metastore_model.rs::metastore_spec_round_trips`. | A serde round trip keeps every field and rejects an unknown format.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.4.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** Discovery writes one `MetadataContract` per table. Scans prune partitions by pushed predicates. ORC scans skip stripes by stripe statistics. Avro scans project the reader schema. A catalog listing pages at 1,000 tables. Proving test: `crates/eg-lake/src/tests/metastore_scan.rs::partition_and_stripe_pruning`. | A pushed predicate reads only the matching partitions and stripes.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.4.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Discovery attaches to the per-source-kind discovery of `EG-UNIFIED-DATA-PLANE-R038.2`. Scans attach at `foreign_scan` (`crates/eg-plan/src/federation_opt/run.rs:26`). Proving test: `crates/eg-lake/src/tests/metastore_scan.rs::served_scan_reaches_pruning`. | A served query over a metastore table reaches the pruned scan.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.4.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A reader and writer Avro schema pair that does not resolve must refuse with `SCHEMA_INCOMPATIBLE`. A transactional delta layout without a readable base must refuse with `UNSUPPORTED_TABLE_LAYOUT`. An unreachable catalog must abstain and name the source. Proving test: `crates/eg-lake/src/tests/metastore_scan.rs::metastore_refusals`. | Each case returns its code and reads no data file.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.4.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** The scan receipt must list pruned partitions, files read, stripes read and bytes read. Proving test: `crates/eg-lake/src/tests/metastore_scan.rs::receipt_counts_match`. | The receipt counts match the files the scan opened.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.4.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is the served SPARQL method over a fixture metastore. The fixture holds one partitioned ORC table and one Avro table. The query must read only the matching partitions. Proving test: `tests/federation/test_metastore_orc_avro_served.py::test_partition_pruned_scan`. | The answer matches the full-scan oracle and the receipt shows pruning.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.5
Search-index sources answer with relevance pushdown (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Search-index sources answer with relevance pushdown (rollup).** Full-text and vector index sources answer through approved mappings. The planner pushes the relevance query and top-k to the index. Children `.1` to `.6` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.5.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `SearchIndexCapability{full_text, vector_space, filter_fields, max_k, score_kind}` beside `SourceCapabilities` (`crates/eg-plan/src/federation_opt/capability.rs:63`). A mapping binds a document id to an entity IRI and the score to a named score channel (`EG-FEDERATED-QUERY-R067`). Proving test: `crates/eg-plan/src/federation_opt/tests.rs::search_capability_round_trips`. | A serde round trip keeps every field and rejects an unknown score kind.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.5.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** The planner pushes text match, vector nearest-neighbour search, declared filters and top-k. A remote vector query must use a compatible embedding space (`EG-FEDERATED-QUERY-R039.1`). Local residual filters replenish to k or return a typed shortfall (`EG-FEDERATED-QUERY-R039`). Proving test: `crates/eg-plan/src/federation_opt/tests.rs::relevance_pushdown_replenishes`. | A pushed query returns k results with remote scores in their channel.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.5.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Pushdown attaches at `foreign_scan` (`run.rs:26`). Fusion with local scores reuses `fuse_rrf` at `crates/eg-plan/src/exec.rs:848`. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::served_search_reaches_fusion`. | A served query reaches the remote index and the shared fusion.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.5.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** An incompatible vector space must refuse with `EMBEDDING_SPACE_MISMATCH`. A k above `max_k` must page. The engine must not invent a score for a remote result. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::search_refusals`. | Each case returns its code or pages, and no result carries an invented score.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.5.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Each fragment receipt must name the index source, the query digest, k, the score kind and the returned count. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::search_receipt`. | The receipt matches the remote request.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.5.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `UnifiedQuery` method. The query joins a remote full-text index with a local graph filter. The filter drops some results. Proving test: `tests/federation/test_search_index_pushdown_served.py::test_relevance_pushed_and_k_replenished`. | The answer holds k results, and the engine stores no index documents.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.6
openCypher and Gremlin answer over relational and lake sources without a copy (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**openCypher and Gremlin answer over relational and lake sources without a copy (rollup).** The served openCypher and Gremlin surfaces answer over virtual sources. They use the same approved mappings as SPARQL. Children `.1` to `.6` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.6.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `GraphView{mapping_digest, node_labels, relationship_types}` in `crates/eg-types/src/virtual_graph_view.rs`. A node label maps to an ontology class. A relationship type maps to a join of approved R2RML mappings (`EG-UNIFIED-DATA-PLANE-R005`). Proving test: `crates/eg-types/src/virtual_graph_view.rs::tests::graph_view_round_trips`. | A serde round trip keeps every field and rejects an unmapped label.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.6.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** The planner translates node and relationship patterns into virtual-graph scans. It pushes same-source joins and filters into source SQL through the `EG-UNIFIED-DATA-PLANE-R006` path. The default variable-length path depth limit is 8. Proving test: `crates/eg-query/src/cypher/tests/virtual_view.rs::pattern_pushes_join`. | One pattern renders one pushed SQL statement per same-source join.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.6.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** `handle_cypher_read` at `src/server/handlers/query/cypher.rs:61` resolves the graph view before `parse` (`crates/eg-query/src/cypher/parser.rs:1181`). The Gremlin text surface compiles into the same plan. Proving test: `crates/eg-query/src/cypher/tests/virtual_view.rs::served_read_resolves_view`. | A served openCypher read over a mapped source reaches the view resolution.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.6.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A write against a view must refuse with `VIRTUAL_VIEW_READ_ONLY`. An unmapped label must refuse with `UNMAPPED_LABEL`. A path over the depth limit must refuse with `PATH_DEPTH_EXCEEDED`. Proving test: `crates/eg-query/src/cypher/tests/virtual_view.rs::view_refusals`. | Each case returns its code and runs no source statement.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.6.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** EXPLAIN must show the pushed statement per fragment and the mapping digest. Proving test: `crates/eg-query/src/cypher/tests/virtual_view.rs::explain_names_mapping`. | EXPLAIN names the mapping digest of each fragment.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.6.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is the served Cypher method and the Gremlin method. One question runs in openCypher, Gremlin and SPARQL over one relational source. Proving test: `tests/federation/test_graph_language_virtual_served.py::test_cypher_and_gremlin_match_sparql_over_sql_source`. | The three answers are equal, and the engine row count for that source stays unchanged.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.7
Web metasearch sources answer at query time through a cached connector query (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Web metasearch sources answer at query time through a cached connector query (rollup).** A web metasearch connector is one source category. A SPARQL or UQL pattern over web results becomes one connector query. Results are typed graph resources with a time-to-live cache and provenance. The engine copies no result into the graph store. Tool selection for a web search job runs through `EG-DECISION-ENGINE-R176`. Children `.1` to `.6` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.7.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `WebSearchCapability{categories, engines, time_ranges, languages, max_results}` beside `SourceCapabilities` (`crates/eg-plan/src/federation_opt/capability.rs:63`). Add `WebResult{url, title, snippet, engine, rank, retrieved_at}` mapped to `cv:SearchResult` (`EG-MEDIA-VOCAB-R004.4`). Add `SourceCategory::WebMetasearch`. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_result_round_trips`. | A serde round trip keeps every field and rejects a result without a URL.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.7.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** The planner pushes the query text, the category, the engine set, the time range and the language as connector arguments. It pushes the result limit. The cache key is the canonical argument digest. The default time-to-live is 900 s. A cache hit returns the cached rows with their original retrieval time. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_search_pushdown_and_ttl`. | A repeated pattern within the time-to-live sends one connector query.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.7.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Pushdown attaches at `foreign_scan` (`crates/eg-plan/src/federation_opt/run.rs:26`) through the operation-bound MCP source kind of `EG-FEDERATED-QUERY-R073`. The time-to-live cache reuses `FragmentCacheScope` (`crates/eg-plan/src/federation_opt/cache.rs:27`). Proving test: `crates/eg-plan/src/federation_opt/tests.rs::served_web_search_reaches_cache`. | A served pattern over web results reaches the connector operation and the shared cache.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.7.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** An argument outside the declared capability must refuse with `UNSUPPORTED_SEARCH_ARGUMENT`. An expired entry must not serve a read. An unreachable connector must abstain and name the source. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_search_refusals`. | Each case returns its code, and no expired row serves a read.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.7.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Each result row must carry the connector, the argument digest, the engine, the rank and the retrieval time. The answer must state whether each row came from the cache. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_result_provenance`. | Each row names its engine, rank and retrieval time, and a cached row says so.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.7.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is the served SPARQL method over a fixture web metasearch connector. The test asks one pattern twice within the time-to-live and once after it. Proving test: `tests/federation/test_web_metasearch_served.py::test_pattern_pushes_to_connector_with_ttl_cache`. | The connector receives two queries, the rows are typed, and the graph store holds no result rows.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R038.7.7
Candidate handoff
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Candidate handoff.** A web result row is a fetch candidate, not a stored record. The engine must not ingest a result by default. Each row must carry the query text, the query digest, the engine, the rank and the retrieval time. Add `WebCandidateSet{query_text, query_digest, candidates, retrieved_at}` beside `WebResult` (`crates/eg-plan/src/federation_opt/capability.rs:63`). The candidate set is the input of the fetch selection of `EG-DECISION-ENGINE-R802`. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_candidates_carry_query_provenance`. | A served pattern returns candidates with query provenance, and the graph store holds no result rows.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R039
Authenticated, tenant-scoped Iceberg REST catalog (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Authenticated, tenant-scoped Iceberg REST catalog (rollup).** The lake catalog endpoint must refuse unauthenticated and cross-tenant requests. It must reuse EG's verified request envelope and tenant model, not a second token store. External engines then read EG tables as Iceberg tables. | Tests prove a valid token lists and loads its own tables, and a missing or cross-tenant token is refused.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R039.1
`CatalogPrincipal` typed model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**`CatalogPrincipal` typed model.** `crates/eg-lake/src/catalog.rs` must define `CatalogPrincipal` with tenant, subject and scopes, built only from the verified request envelope. | Unit test builds a principal from a verified envelope and rejects an unsigned one.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R039.2
Catalog authorization refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Catalog authorization refusal.** `authorize_catalog_call` in `crates/eg-lake/src/catalog.rs` must refuse a call whose principal tenant differs from the table tenant, and must refuse an absent principal. | Two unit tests: cross-tenant refusal and absent-principal refusal.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R039.3
Locate and wire the REST listener
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Locate and wire the REST listener.** The first step must locate the lake REST listener and call `authorize_catalog_call` on every route. No route may keep the deny-all stub. | Route test enumerates every catalog route and asserts each calls the check.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R039.4
Partition spec in emitted Iceberg metadata
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Partition spec in emitted Iceberg metadata.** `crates/eg-lake/src/iceberg.rs` must emit a partition spec and per-partition field summaries when a table declares a partition column. Unpartitioned tables stay unchanged. | Metadata test reads back the partition spec and prunes one manifest by a partition predicate.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R039.5
End-to-end external read
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**End-to-end external read.** An external Iceberg client must load a table through the authenticated catalog, and an out-of-tenant client must be refused. | Disposable-fixture test with a pinned external reader loads one table and fails the cross-tenant load.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R040
Per-modality retrieval gate blocks promotion of a shared embedding space (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Per-modality retrieval gate blocks promotion of a shared embedding space (rollup).** Embeddings for the text, image and audio modalities share one vector space. After any model or projector change, the engine must re-validate each modality on its own retrieval check. A modality that regresses must block promotion. Children `.1` to `.6` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R040.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `ModalityCheck{modality, probe_set_digest, metric, floor, baseline}` and `PromotionVerdict` in new `crates/eg-types/src/embedding_promotion.rs`. Closed `modality` values are `text`, `image` and `audio`. `EmbeddingVersion` at `crates/eg-ann/src/version.rs:32` names a model and version but holds no check result. Proving test: `crates/eg-types/src/embedding_promotion.rs::tests::checks_round_trip`. | A serde round trip keeps every field and rejects an unknown modality.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R040.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** Add `evaluate_promotion(candidate, checks)` in `embedding_promotion.rs`. It computes recall at k per modality with `recall_at_k` at `crates/eg-ann/src/recall.rs:28` on that modality probe set. A drop beyond the tolerance blocks promotion. The default tolerance is 0.02 absolute and is a named replaceable default. A modality with no probe set blocks promotion. Proving test: `crates/eg-types/src/embedding_promotion.rs::tests::one_regression_blocks_promotion`. | One regressed modality blocks even when the mean improves.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R040.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** The gate attaches before `EmbeddingVersionStore::tag_batch` at `crates/eg-ann/src/version.rs:129` in the re-embed path. No production caller of `tag_batch` or `tag` exists today. This row creates the call site in the re-embed worker queued by `EG-FEDERATED-QUERY-R077.3`, and it reads the binding at `crates/eg-query/src/tables/embedding_binding.rs:526`. Proving test: `crates/eg-ann/src/version.rs::tests::tag_requires_passing_verdict`. | The re-embed worker calls the gate before it tags a new version.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R040.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A blocked promotion must leave the prior version active. The engine must return `PromotionBlocked` naming each regressed modality, its baseline and its measured value. The engine must not tag any vector with the candidate version. Proving test: `crates/eg-ann/src/version.rs::tests::blocked_promotion_tags_nothing`. | No vector carries the candidate version after a block.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R040.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** The engine must store each `PromotionVerdict` as a node linked to the candidate model and version. It carries the per-modality metric, floor and probe set digest. The node is readable through a graph query. Proving test: `crates/eg-types/src/embedding_promotion.rs::tests::verdict_is_stored_with_modality_entries`. | A graph query returns the verdict with one entry per modality.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R040.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is a served row write on a bound text column. The test replaces the embedding model with a candidate that regresses the image check. The write passes through the re-embed worker and the wired gate. The test observes the blocked promotion and the prior version still active. Proving test: `tests/embedding/test_promotion_gate_served.py::test_regressed_modality_blocks_promotion`. | The served write leaves the prior version active and records the verdict.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R026.4
EG:64 source definition
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**EG:64 source definition.** Expose graph-backed relational projections through an approved, version-pinned schema mapping. Reuse `AttachedCatalogGraph`/R2RML and the existing query surface. A projection-read request binds tenant, actor, graph, mapping id/revision, table, selected columns, typed predicates, and query digest. Its response binds mapping revision, graph revision, column types, and result digest. Projection reads are read-only. Refuse INSERT, UPDATE, DELETE, or DDL through projected tables. Apply the same refusal to read-only principals and principals with separate write grants. A write request names the target graph mutation and passes existing policy/admission through the authoritative `MutationBatch` path. A mutation grant does not make a projection a writer. Preserve R026 P0–P5. Reuse R003/R005 for catalog and mapping. Reuse R029 for schema context. **Explicit hold:** The source record names no external application, relational table/column contract, or driver statement corpus. Keep application-level schema compatibility open until the R026 P0/P5 owner provides and approves the concrete mapping and captured statements. Do not imply a universal relational schema. **Original source objective:** The platform acts as a persistent store backend for external applications expecting a relational schema. Expose graph data read-only through that schema unless writes are explicitly granted. **Source SHA-256:** `c55bc629b1bfefc9d0346b75b8bb95e5a231b891e7e34297df17b960d6c9773c`. **Preserves:** EG-DURABLE-KERNEL-R035, EG-DURABLE-KERNEL-R043, EG-FEDERATED-QUERY-R080, EG-UNIFIED-DATA-PLANE-R026, EG-FEDERATED-QUERY-R080.1, EG-FEDERATED-QUERY-R080.2, EG-FEDERATED-QUERY-R080.3, EG-FEDERATED-QUERY-R080.4, EG-FEDERATED-QUERY-R080.5, and EG-FEDERATED-QUERY-R080.6. Delivery state remains SPECIFIED. This text does not assert implementation or served evidence. | A served external client reads a mapped table through an approved, pinned mapping. Bind the result to schema/graph revisions and row digest. Try INSERT, UPDATE, DELETE, and DDL through read-only and separately mutation-granted principals. Each attempt refuses and leaves graph revision unchanged. Submit an authorized graph `MutationBatch`. Confirm the projection read reflects its committed revision. Also refuse stale/unapproved mappings and unauthorized graph mutations. Keep application-level SQL/schema conformance open until R026 provides the approved target mapping and captured statement corpus. These are acceptance targets only. No test, implementation, receipt, or served result is asserted.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R612
Registered external graph connections, schema profiles and governed tabular reads are one registry (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Registered external graph connections, schema profiles and governed tabular reads are one registry (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R612.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** `crates/eg-federation/src/connections.rs` defines ExternalGraphConnection, SchemaProfile, LabelMapping, TabularRequest, FleetCatalogTable. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R612.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** Named connections to external graph or SQL stores are persisted without secrets. Profiling imprints a source schema into the graph and maps source labels onto ontology classes with scored candidates. Governed tabular reads return a columnar batch under the caller's scope. Fleet catalog tables keep versioned discovery rows with migration refusal for a newer schema. | Unit tests cover each rule with positive and boundary cases.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R612.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Extends EG-UNIFIED-DATA-PLANE-R002 and R029. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R612.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A connection spec carrying an inline secret is refused; only references persist. The stable code is `CONNECTION_SECRET_INLINE`. | Test submits the invalid input and asserts the code and zero partial writes.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R612.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Per profile: labels mapped, unmapped, candidates. | Test reads the trace or metrics after one success and one refusal.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R612.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** profile of 5k labels under 1.5 s p99; tabular read of 100k rows under 400 ms p99. The benchmark is `benches/r612_unified_data_plane.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R750
Conversation history source, run audit rows and step store (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Conversation history source, run audit rows and step store (rollup).** Rust-native in `crates/eg-durable/src/history`. Delivered through its child requirements. | Child requirements prove it.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R750.750
Model: Conversation history source, run audit rows and step store
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model: Conversation history source, run audit rows and step store.** The engine serves these records by query. They are per-run audit records and tool-call rows linked to trace nodes. They are also redacted identities and a scoped conversation-search source over stored steps. Types: `HistorySource`, `StepStore`, `RunAuditRecord`, `ToolCallRecord`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R750.751
Behavior: Conversation history source, run audit rows and step store
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior: Conversation history source, run audit rows and step store.** Audit append is idempotent per run and tool call. Search is tenant- and scope-filtered before ranking. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R750.752
Refusal: Conversation history source, run audit rows and step store
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal: Conversation history source, run audit rows and step store.** A record with an unredacted identity field and a search outside the caller scope are refused. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R750.753
Hot-path proof: Conversation history source, run audit rows and step store
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof: Conversation history source, run audit rows and step store.** Criterion benchmark `history_search` over 1M steps. The p50 is under 12 ms and the p99 is under 35 ms. Memory stays under 128 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R650
Phase-ordered ingestion pipeline (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Phase-ordered ingestion pipeline (rollup).** EG runs ingestion as a registry of ordered phases. The phases run in this order. First come scan, parse, registry, embedding and communities. Next come centrality, community reports and SHACL quarantine. Then come sync, memory, validation, observability, knowledge base and external graphs. The phases have explicit dependencies and a shared context. Enrichment does not block. The Rust home is `crates/eg-jobs/src/pipeline.rs`. Satisfied only when children `EG-UNIFIED-DATA-PLANE-R650.1`-`EG-UNIFIED-DATA-PLANE-R650.6` are satisfied. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R650.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `PipelinePhase{id,deps,blocking}`, `PipelineContext`, `PhaseRegistry`, `PhaseReceipt`, `QuarantineProjection` in `crates/eg-jobs/src/pipeline.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R650.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** Topologically order phases in O(P+D). Run blocking phases to the commit. Enqueue enrichment phases as budgeted durable jobs. Quarantine invalid candidates before sync and report them without blocking valid ones. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R650.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Phase list is data in the registry; the Leiden driver of `EG-REPO-INGEST-R011` backs communities and centrality. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R650.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A cyclic phase graph, a missing dependency and a sync that bypasses quarantine are refused at registration. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R650.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Record phase order, receipts, durations and quarantine counts. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R650.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** Benchmark `pipeline_phase_dispatch` (14 phases, 100k nodes): p50 200 us, p99 1 ms, peak memory 8 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-jobs pipeline_phase_dispatch` against the stored baseline.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R651
Document ingest, update and delete across every store (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Document ingest, update and delete across every store (rollup).** One document operation keeps the document record, its vectors and its graph relationships consistent. Ingest writes all three. Update regenerates embeddings and relationships. Delete cascades and leaves no orphan behind. The Rust home is `crates/eg-durable/src/document_ops.rs`. Satisfied only when children `EG-UNIFIED-DATA-PLANE-R651.1`-`EG-UNIFIED-DATA-PLANE-R651.6` are satisfied. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R651.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `DocumentOp{Ingest,Update,Delete}`, `CascadePlan`, `OrphanReport` in `crates/eg-durable/src/document_ops.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R651.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** Plan the cascade from the document's back-references. Apply it in one transaction. Verify that no orphan remains by a post-condition scan limited to the plan's keys. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R651.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Served `DocumentIngest`, `DocumentUpdate`, `DocumentDelete` through SourceIngest. | A wiring test shows the served method reaches this code and no second implementation remains outside EG.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R651.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A delete with live external references or a partial cascade is refused as a whole. | One refusal test per case asserts the stable code and that no state changed.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R651.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Record cascade plan, affected keys and the orphan report. | A served-path test reads the evidence back through a separately authorized query and compares every field.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R651.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** Benchmark `document_cascade_delete` (document with 500 chunks): p50 2 ms, p99 12 ms, peak memory 16 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-durable document_cascade_delete` against the stored baseline.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R651.7
Fetched web pages enrich through the one document path (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Fetched web pages enrich through the one document path (rollup).** A fetched web page becomes one Document through `SourceIngest`. The served `EnrichDocument` method chunks the Document, embeds the chunks and links every chunk and vector to the Document. Entity, relation and claim extraction is child `.7.7`. The path reuses `EG-REPO-INGEST-R652` (chunking), the vector path of `AddEmbedding` and `EG-INGEST-WORKER-R701` (extraction). No second chunker, embedder or extractor exists. Children `.7.1` to `.7.7` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDtests/web_document_enrich_served.rs:218
EG-UNIFIED-DATA-PLANE-R651.7.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** `crates/eg-types/src/source_ingestion/web_document.rs` holds `EnrichDocumentRequest{document_id, text_property, fetch_backend, max_chunk_bytes, overlap_bytes}`, `EnrichDocumentReceipt` and the closed `FetchBackend` values `webarchiver` and `archivebox`. The Document carries its web provenance as properties: `url`, `canonical_url`, `retrieved_at`, `content_digest`, `title` and `fetch_backend`. Proving test: `web_document.rs::tests::web_provenance_round_trips`. | A serde round trip keeps every field and rejects a missing Document ID or an unknown backend.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDb3d7b62e5f61
crates/eg-types/src/source_ingestion/web_document.rs:94
EG-UNIFIED-DATA-PLANE-R651.7.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** `EnrichDocument` chunks the Document text with `eg_document::processing::chunk_text`. Chunks follow headings and paragraphs, have a size limit and an overlap, and carry byte and character offsets. The chunks are embedded through the `/v1/embeddings` wire endpoint named by `EPISTEMIC_GRAPH_EMBEDDING_URL`, `EPISTEMIC_GRAPH_EMBEDDING_MODEL` and `EPISTEMIC_GRAPH_EMBEDDING_DIMS`. Without an endpoint, the deterministic hash embedder is used and `embedder = hash` is recorded. Each chunk node links to the Document by a `chunkOf` edge and holds its vector. An enriched content digest is a no-op. A new digest supersedes the chunks of the earlier digest. The stored chunks do not depend on the backend. Proving test: `src/server/handlers/web_ingest_tests.rs::links_chunks_vectors_and_facts`. | Unit tests observe linked chunks and vectors. An equal digest is a no-op, and a new digest supersedes.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDb3d7b62e5f61
crates/eg-document/src/processing.rs:269
crates/eg-document/src/processing.rs:282
crates/eg-document/src/processing.rs:301
src/server/handlers/web_ingest/embedder.rs:212
src/server/handlers/web_ingest_tests.rs:44
EG-UNIFIED-DATA-PLANE-R651.7.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** The served `EnrichDocument` method reaches `src/server/dispatch/graph_pipeline/web_ingest.rs` after graph ACL and placement. It reads only an RLS-visible Document. It commits through the `ApplyChangeEnvelope` authority, the same commit path as `IndexRepository`. `SemanticSearch` then finds the chunk vectors. The production caller is the arbora operation `ARBORA-OPS-R067`. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | A served `EnrichDocument` call commits chunks, edges and vectors, and a served `SemanticSearch` returns a chunk.
requirementEG-UNIFIED-DATA-PLANEVERIFIED780ae2e14170
9c20a3137fe3
b3d7b62e5f61
cbe98c46062a
tests/web_document_enrich_served.rs:219
EG-UNIFIED-DATA-PLANE-R651.7.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A missing or invisible Document must refuse with `DOCUMENT_NOT_FOUND`. A Document without text must refuse with `DOCUMENT_TEXT_MISSING`. An unknown stored backend must refuse with `WEB_BACKEND_INVALID`. A chunk window outside 64 to 65 536 bytes must refuse with `CHUNK_CONFIG_INVALID`. An embedding endpoint failure must refuse with `EMBEDDING_UNAVAILABLE`. A refusal must write no chunk or vector. Proving test: `tests/web_document_enrich_served.rs::test_web_document_refusals`. | Each case returns its code, and the graph version does not change.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDb3d7b62e5f61
cbda3e13e4c8
d715658809da
crates/eg-document/src/processing.rs:314
src/server/handlers/web_ingest_tests.rs:113
tests/web_document_enrich_served.rs:421
EG-UNIFIED-DATA-PLANE-R651.7.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** The receipt and one `DocumentEnrichment` record node name the Document, the content digest, the fetch backend, the embedder, the model, the dimensions and the chunker version. They list the chunk, vector and superseded counts. Every chunk node holds the backend, the embedder, its offsets and the citation fields of the Document. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | The receipt counts match a separate read of the chunk nodes and edges.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDb3d7b62e5f61
tests/web_document_enrich_served.rs:220
EG-UNIFIED-DATA-PLANE-R651.7.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is the served `EnrichDocument` method followed by served `SemanticSearch`. The test enriches the same page through each backend. Both runs store equal chunk text and offsets. Chunking a 1 MiB Markdown document must stay under 3 ms p50 and 15 ms p99. The benchmark is `crates/eg-document/benches/document_chunk_tree.rs`. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | The served test passes, and the benchmark meets both budgets.
requirementEG-UNIFIED-DATA-PLANEVERIFIEDb3d7b62e5f61
tests/web_document_enrich_served.rs:221
EG-UNIFIED-DATA-PLANE-R651.7.7
Extraction
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Extraction.** Entity, relation and claim extraction of `EG-INGEST-WORKER-R701` runs over the enriched chunks. Each fact links to its chunk and its Document. Proving test: `tests/web_document_enrich_served.rs::test_enriched_chunks_extract_facts`. | Each extracted fact links to a chunk of the Document.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R700
Governed Actions: typed parameters, submission criteria, effects and write-back (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Governed Actions: typed parameters, submission criteria, effects and write-back (rollup).** A named Action declares typed parameters, submission criteria and an ordered effect list. The engine validates a submission, applies effects as one mutation, records status, and supports vendor write-back through the same path. Notification delivery is a consumer of the action outbox, not part of the engine. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R700.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** `ActionSpec { name, params: Vec<ActionParameter>, criteria: Vec<SubmissionCriterion>, effects: Vec<ActionEffectSpec> }`, `EffectKind`, `ActionStatus` in `crates/eg-types`; the registry is a `BTreeMap` per graph. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R700.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** Template resolution of parameters is a single pass over effect text. Criteria evaluate with `CriterionOp` comparisons in declared order and stop at the first failure. All effects commit in one `MutationBatch`. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R700.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Extends write-back governance (R012) and Decide-routed write-back proposals (DE R043). Action completion emits outbox events consumed by graph-os for notification. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R700.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A submission failing any criterion is refused with the criterion name. An unknown parameter or a type mismatch is refused. A write-back to an unattached source is refused. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R700.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Each action run stores parameters, the criterion verdicts and the effect receipts. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R700.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/data_plane/test_actions_served.py::test_failed_criterion_applies_no_effect` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/action_apply.rs` must show p50 under 2 ms and p99 under 12 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R701
Standards conformance: cohorts, drift scores and consolidation recommendations (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Standards conformance: cohorts, drift scores and consolidation recommendations (rollup).** The engine groups assets into capability cohorts and scores each against its declared enterprise standard. It reports drift per domain and organization. It recommends consolidation for cohorts with overlapping capability. Implemented in eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R701.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** `Standard`, `CapabilityCohort`, `DriftScore { asset, standard, score }`, `ConsolidationRecommendation` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R701.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** One grouping pass forms cohorts from shared capability classes. Drift is a weighted fraction of satisfied rules. Recommendations are scored by overlap and cost. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R701.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Extends consolidation safety (R031): a recommendation across attached applications is only a proposal. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R701.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A recommendation touching assets of different tenants is refused. An asset with no applicable standard reports `not_applicable`, never score zero. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R701.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Each score lists the satisfied and failed rules. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R701.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/data_plane/test_standards_drift_served.py::test_missing_standard_is_not_zero` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/standards_drift.rs` must show p50 under 4 ms and p99 under 30 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R702
ETL runs record lineage and consume OpenLineage run events (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**ETL runs record lineage and consume OpenLineage run events (rollup).** A declarative ETL run writes typed records and lineage between source and target datasets. Its field transforms include coalesce, cast, rename, flatten and stable id. The engine maps external lineage run events, de-duplicates them and drains them into the same lineage graph. It quarantines malformed events. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R702.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** `EtlRun`, `LineageEdge { dataset_in, dataset_out, run }`, `QuarantinedLineageEvent` in `crates/eg-types`; dataset ids are content-addressed. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R702.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** Event mapping is a pure function. Drain is idempotent on the event id. It processes in batches of the configured size with bounded memory. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R702.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** UQL serves lineage queries over the lineage graph (as derived series lineage R004). Consumption of the event topic follows the change-capture framework (R008, R009). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R702.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A malformed dataset reference is quarantined with a typed reason and never dropped. A replayed event adds no edge. | Negative tests assert each refusal code and that durable state is unchanged.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R702.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Quarantined events keep their original payload digest. | A read of the stored record reproduces the recorded decision from its recorded inputs.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R702.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The entry point is the served wire method. The test `tests/data_plane/test_lineage_drain_served.py::test_replay_adds_no_edges_and_bad_events_quarantine` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/lineage_drain.rs` must show p50 under 3 ms and p99 under 18 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R710
Message-stream adapters normalize into ChangeEnvelope: model and behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Message-stream adapters normalize into ChangeEnvelope: model and behavior.** Extends `EG-UNIFIED-DATA-PLANE-R008`. Adapters consume Kafka-style and subject-based message streams. Each adapter maps a message to a ChangeEnvelope with an opaque cursor. It commits offsets only after the durable write. It exposes consumer enablement as configuration. The framework treats every stream alike. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R711
Message-stream adapters normalize into ChangeEnvelope: refusal, evidence and hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Message-stream adapters normalize into ChangeEnvelope: refusal, evidence and hot-path proof.** Extends `EG-UNIFIED-DATA-PLANE-R008`. A message that cannot map is dead-lettered with its payload digest, never dropped. Test `tests/data_plane/test_stream_adapters_served.py::test_offset_commits_after_durable_write`; benchmark `benches/stream_adapter.rs` sustains 50,000 messages per second per consumer with p99 map latency under 0.2 ms, memory under 64 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R030.700
Identity evidence kinds and merge decisions for candidate links: model and behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Identity evidence kinds and merge decisions for candidate links: model and behavior.** Each candidate link carries typed identity evidence (exact key, normalized name, version variant, entropy-qualified token, embedding). It also carries a merge decision, and that decision is a proposal. Names that look like opaque high-entropy tokens never merge on name alone. Version variants link and do not merge. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R030.701
Identity evidence kinds and merge decisions for candidate links: refusal, evidence and hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Identity evidence kinds and merge decisions for candidate links: refusal, evidence and hot-path proof.** A merge decision without an approver is refused. Test `tests/data_plane/test_identity_evidence_served.py::test_high_entropy_names_do_not_merge`; benchmark `benches/identity_candidates.rs` p50 under 20 ms and p99 under 100 ms per 10,000 records with blocking, memory under 128 MiB. | The served test passes and the benchmark receipt meets the budget.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R761
Dataset and column profiling (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Dataset and column profiling (rollup).** The engine must profile attached and native datasets. A profile holds per-column statistics and attaches to the R003 catalog graph. Children `.1` to `.6` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R761.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `ColumnProfile{dataset, column, rows, nulls, distinct_estimate, min, max, top_k, histogram, profiled_at}` in `crates/eg-types/src/profile.rs`. | `crates/eg-types/tests/profile.rs::profile_round_trips` round-trips a profile.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R761.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** Profiling pushes aggregate queries to the source through R006 where the dialect supports them. It samples otherwise. Distinct counts use a sketch with 1 percent relative error. | `crates/eg-core/tests/profile.rs::distinct_estimate_within_error` profiles 1M rows and checks the error.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R761.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Add the job kind `DatasetProfile` to the `AnalyticsJob` path in `src/server/handlers/jobs/submit.rs`. The job calls the R803 sensitive data scan of EG-TYPED-PACKS per column. | `tests/test_profile_served.py::test_profile_job_attaches_to_catalog` profiles a fixture table and reads the catalog node.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R761.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A profile of a dataset outside the caller scope must refuse with `PROFILE_FORBIDDEN`. A source without aggregate support and without sampling must refuse with `PROFILE_UNSUPPORTED`. | `tests/test_profile_served.py::test_profile_refusals` asserts both codes.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R761.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Each profile records the method, pushdown or sample, and the sample size. | `tests/test_profile_served.py::test_profile_method_recorded` reads the method back.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R761.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/column_profile.rs` profiles 10 columns over 10M native rows. It stays under 3 s and 256 MiB. | `cargo bench --bench column_profile` fails on a 10 percent regression.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R762
Data quality rules, scores and quality incidents (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Data quality rules, scores and quality incidents (rollup).** The engine must evaluate declared quality rules over datasets and graphs. It must record scores per dimension and open a quality incident on a breach. Children `.1` to `.8` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R762.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `QualityRule{id, target, dimension, expression, threshold, severity}` and `QualityScore{rule, value, passed, at}` in `crates/eg-types/src/quality.rs`. `dimension` is a closed set: `completeness`, `uniqueness`, `validity`, `consistency`, `freshness`, `accuracy`. | `crates/eg-types/tests/quality.rs::rule_round_trips` round-trips a rule and a score.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R762.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** A SQL rule compiles to one pushed aggregate query. A graph rule compiles to a SHACL shape of `crates/eg-shacl`. A freshness rule reads the change-capture lag of R008. Three consecutive failures of one rule open one incident through R760. | `crates/eg-core/tests/quality.rs::three_failures_open_one_incident` fails one rule three times.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R762.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** Add the job kind `QualityEvaluate` to the `AnalyticsJob` path in `src/server/handlers/jobs/submit.rs`. The R805 contract check of EG-TYPED-PACKS reads the scores. arbora serves `quality.*` through `ARBORA-OPS-R856`. | `tests/test_quality_served.py::test_rule_scores_and_incident` evaluates a failing rule and reads the incident.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R762.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** A rule whose expression does not compile must refuse with `QUALITY_RULE_INVALID`. A threshold outside 0 to 1 must refuse with `QUALITY_THRESHOLD_INVALID`. | `tests/test_quality_served.py::test_quality_refusals` asserts both codes.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R762.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Each score records the compiled query digest and the row counts that produced it. | `tests/test_quality_served.py::test_score_evidence_reads_back` compares every field.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R762.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/quality_evaluate.rs` evaluates 100 rules over a 10M-row native dataset. It stays under 5 s. | `cargo bench --bench quality_evaluate` fails on a 10 percent regression.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R762.7
Rule proposals from profiles
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Rule proposals from profiles.** The engine must propose quality rules from each R761 profile. A null ratio, a key-like distinct count or a value pattern yields one candidate rule. Each candidate enters the R802 change request flow of EG-TYPED-PACKS as `proposed`. It never evaluates as active before approval. | `crates/eg-core/tests/quality.rs::profile_yields_proposed_rules` profiles a fixture and lists the proposals.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R762.8
Quality results from outside checkers
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Quality results from outside checkers.** The engine must accept quality results from outside checkers through `SourceIngest` as `QualityScore` records. Each record names its checker. Outside and native scores share one dimension set and one incident rule. | `tests/test_quality_served.py::test_outside_scores_open_incident` ingests three failing outside scores and reads the incident.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R763
Column-level lineage from SQL text (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Column-level lineage from SQL text (rollup).** The engine must derive column-level lineage from view definitions, ETL transforms and query logs. It extends the dataset lineage of R702 down to columns. Children `.1` to `.6` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R763.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `ColumnLineageEdge{source_column, target_column, transform, query_digest}` in `crates/eg-types/src/lineage.rs`. `transform` is a closed set: `identity`, `expression`, `aggregate`, `filter_only`. | `crates/eg-types/tests/lineage.rs::column_edge_round_trips` round-trips an edge.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R763.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** The engine parses SQL with the shared planner parser. It resolves each output column to its input columns through the R003 catalog. Star expansion uses the catalog. An unresolved column stays a typed gap. | `crates/eg-core/tests/column_lineage.rs::view_columns_resolve` parses a join view with an aggregate.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R763.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** The R003 catalog reader calls the parser for each view definition. The R702 drain calls it for each ETL run with SQL text. An impact query walks the column edges. | `tests/test_column_lineage_served.py::test_view_lineage_and_impact` attaches a source with a view and asks the impact of one column.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R763.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** SQL that fails to parse must quarantine with `LINEAGE_SQL_UNPARSEABLE`. It never drops silently. | `tests/test_column_lineage_served.py::test_unparseable_sql_quarantines` reads the quarantine record.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R763.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Each edge records the source query digest and the parser version. | `tests/test_column_lineage_served.py::test_edge_evidence_reads_back` compares every field.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R763.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/column_lineage.rs` parses 10,000 view definitions. The p99 per view stays under 2 ms. | `cargo bench --bench column_lineage` fails on a 10 percent regression.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R764
Asset usage statistics and catalog search (rollup)
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Asset usage statistics and catalog search (rollup).** The engine must count asset use per principal and period. Catalog search over datasets, columns, terms, products and stored queries ranks by text, vector and usage. Children `.1` to `.8` deliver it. | See each child.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R764.1
Model
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Model.** Add `AssetUsage{asset, principal, period, reads, queries}` in `crates/eg-types/src/asset_usage.rs` and `CatalogSearchHit{asset, kind, score, usage_rank}`. | `crates/eg-types/tests/asset_usage.rs::usage_round_trips` round-trips both records.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R764.2
Behavior
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Behavior.** The engine increments usage from the query audit, never from client claims. Search fuses text and vector scores of EG-FEDERATED-QUERY-R008 with a usage prior capped at 20 percent of the score. | `crates/eg-core/tests/catalog_search.rs::usage_prior_is_capped` checks the cap.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R764.3
Wiring
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Wiring.** The audit append of EG-DURABLE-KERNEL-R031 feeds usage buckets in `eg-tsdb`. Add the served method `CatalogSearch`. arbora serves `catalog.search` through `ARBORA-OPS-R855`. | `tests/test_catalog_search_served.py::test_search_ranks_used_asset_higher` queries two equal assets with different usage.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R764.4
Refusal
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Refusal.** Search never returns an asset outside the caller access. A query over 1,000 characters must refuse with `CATALOG_QUERY_TOO_LONG`. | `tests/test_catalog_search_served.py::test_search_refusals` checks both cases.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R764.5
Evidence
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Evidence.** Each hit lists its text, vector and usage components. | `tests/test_catalog_search_served.py::test_hit_components_listed` reads the components back.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R764.6
Hot-path proof
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Hot-path proof.** The benchmark `benches/catalog_search.rs` searches 1M assets. The p99 stays under 30 ms. | `cargo bench --bench catalog_search` fails on a 10 percent regression.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R764.7
Usage from attached-source query logs
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Usage from attached-source query logs.** The engine must read the query history of each attached source that exposes one, through its R013 to R020 adapter. It parses each statement with the R763 parser. It counts reads per table and column and per principal. It records the joins and filters in common use. | `tests/test_catalog_search_served.py::test_source_query_log_feeds_usage` loads a fixture query log and reads usage and join counts.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
EG-UNIFIED-DATA-PLANE-R764.8
Frequent users and usage suggestions
Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source
**Frequent users and usage suggestions.** The engine must name the most frequent principals per asset as suggested contacts. It must offer the most common joins and filters of an asset as query suggestions. Both read only usage that the caller may see. | `tests/test_catalog_search_served.py::test_frequent_users_and_join_suggestions` reads both answers for one table.
requirementEG-UNIFIED-DATA-PLANESPECIFIEDNo recorded commit/test evidence
TitleSpec delivery: medulla
RepositoryKnuckles-Team/medulla
Commitc1c92bc65ff6
Captured (UTC)2026-10-25T23:20:53
Snapshotsnapshot.json (v1)
Sourcespecs/*/status.json
Sheet1 of 1