- EG-BRANCH-MERGE7
- EG-CQ-CONN430
- EG-CQ-XSRC62
- EG-DATAPLAT-VOCAB49
- EG-DECISION-ENGINE938
- EG-SDLC42
- EG-DURABLE-KERNEL414
- EG-IDENTITY52
- EG-ENGINE-PARITY80
- EG-FEDERATED-QUERY443
- EG-FINANCE-PRIMITIVES181
- EG-INGEST-WORKER136
- EG-MEDIA-VOCAB123
- EG-OBJECT-STORAGE-BACKEND5
- 10 more specs. Panel D shows all specs.
- Requirementsall slices in all specs4276
- Requirements not donenot VERIFIED3646
- Specs not donewhole specs only24
Each spec shows its requirement count. Panel J lists every record.
Requirements (4276)
Specs (24)
Each bar shows one state against all records of the same kind.
Percentages count current rows. Done means VERIFIED.
| State | Definition |
|---|---|
| SPECIFIED | The requirement is written. No code for it is on the default branch. |
| LANDED | A commit that carries its ID in a Spec trailer is on the default branch. |
| VERIFIED | It is LANDED and a test bound to its ID exists. |
A spec state is the lowest state of its rows. Done means VERIFIED.
Invalid state: 0
| Spec / title | Req. | Landed | Done | Spec state | Code references |
|---|---|---|---|---|---|
| EG-BRANCH-MERGEEG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict Resolution | 7 | 0/7 | 0 | SPECIFIED | plan.md documentation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified status.json implementation: file exists; coverage not verified tasks.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-CQ-CONNEG-CQ-CONN — Connector competency questions | 430 | 0/430 | 0 | SPECIFIED | crates/eg-core/src/graph/schema_sources.rs implementation: file exists; coverage not verified spec.md documentation: file exists; coverage not verified src/server/handlers/decide/stat_decide.rs:50 implementation: file exists; coverage not verified src/server/handlers/rdf/sparql.rs:30 implementation: file exists; coverage not verified tasks.md documentation: file exists; coverage not verified design.md documentation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-CQ-XSRCEG-CQ-XSRC — Cross-source competency: supply chain to services | 62 | 0/62 | 0 | SPECIFIED | `ARBORA-OPS-R018` documentation: external declaration; not verified spec.md documentation: file exists; coverage not verified |
| EG-DATAPLAT-VOCABEG-DATAPLAT-VOCAB — Data-platform vocabulary | 49 | 0/49 | 0 | SPECIFIED | crates/eg-plan/src/virtual_graph_mapping.rs implementation: file exists; coverage not verified spec.md documentation: file exists; coverage not verified plan.md documentation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified |
| EG-DECISION-ENGINEEG-DECISION-ENGINE — Decision engine | 938 | 179/938 | 179 | SPECIFIED | AU-CONTEXT-R004 documentation: external declaration; not verified Capacity.tokens, context_knapsack.py:98 implementation: external declaration; not verified fit_to_budget:422 implementation: external declaration; not verified knapsack_model:161 implementation: external declaration; not verified solve/mod.rs:1 implementation: external declaration; not verified stat_decide.rs:134 implementation: external declaration; not verified ../durable-graph-kernel/plan.md documentation: file exists; coverage not verified contract/schemas/method.request.json implementation: file exists; coverage not verified crates/eg-capabilities/src/scopes/tests.rs implementation: file exists; coverage not verified crates/eg-compute/src/assemble/conclude.rs implementation: file exists; coverage not verified crates/eg-compute/src/assemble/conclude.rs:93 implementation: file exists; coverage not verified crates/eg-compute/src/assemble/conclude.rs:99 implementation: file exists; coverage not verified crates/eg-compute/src/assemble/eliminate.rs:138 implementation: file exists; coverage not verified crates/eg-compute/src/assemble/eliminate.rs:97 implementation: file exists; coverage not verified crates/eg-compute/src/assemble/model.rs:96 implementation: file exists; coverage not verified crates/eg-compute/src/assemble/topology.rs:54 implementation: file exists; coverage not verified crates/eg-compute/src/solve/verify/mod.rs:23 implementation: file exists; coverage not verified crates/eg-core/ontology/orchestration-v1.ttl:250 implementation: file exists; coverage not verified crates/eg-core/src/rbac_persist.rs implementation: file exists; coverage not verified crates/eg-durable/src/project.rs:68 implementation: file exists; coverage not verified crates/eg-epistemic/src/query.rs:661 implementation: file exists; coverage not verified crates/eg-epistemic/src/ranking.rs implementation: file exists; coverage not verified crates/eg-epistemic/src/ranking.rs:116 implementation: file exists; coverage not verified crates/eg-epistemic/src/tms.rs implementation: file exists; coverage not verified crates/eg-modality/src/provenance.rs:22 implementation: file exists; coverage not verified crates/eg-numeric/benches/decision_resident_scorer.rs implementation: file exists; coverage not verified crates/eg-numeric/src/py/method_body.rs implementation: file exists; coverage not verified crates/eg-numeric/src/risk/reputation.rs implementation: file exists; coverage not verified crates/eg-plan/src/exec/reliability.rs implementation: file exists; coverage not verified crates/eg-storage/src/owner/registry.rs implementation: file exists; coverage not verified crates/eg-tsdb/src/derive/mod.rs:152 implementation: file exists; coverage not verified crates/eg-types/src/decision/derivation.rs:310 implementation: file exists; coverage not verified crates/eg-types/src/decision/guardrail.rs implementation: file exists; coverage not verified crates/eg-types/src/decision/guardrail.rs:62 implementation: file exists; coverage not verified crates/eg-types/src/decision/ingestion_ladder.rs:46 implementation: file exists; coverage not verified crates/eg-types/src/decision/record/premise.rs:17 implementation: file exists; coverage not verified crates/eg-types/src/decision/statistical.rs:58 implementation: file exists; coverage not verified crates/eg-types/src/decision/statistical/harness_config.rs:81 implementation: file exists; coverage not verified crates/eg-types/src/decision/statistical/tool_subset.rs:58 implementation: file exists; coverage not verified crates/eg-types/src/decision/task_plan.rs implementation: file exists; coverage not verified crates/eg-types/src/decision/topology.rs:110 implementation: file exists; coverage not verified crates/eg-types/src/decision/topology.rs:75 implementation: file exists; coverage not verified crates/eg-types/src/identity/model.rs implementation: file exists; coverage not verified crates/eg-types/src/outcome_bundle.rs:56 implementation: file exists; coverage not verified epistemic_graph/connector_pack.py implementation: file exists; coverage not verified epistemic_graph/decision_client.py implementation: file exists; coverage not verified scripts/build_method_codec_wasm.py implementation: file exists; coverage not verified src/redb_store/work_item/commit.rs:211 implementation: file exists; coverage not verified src/redb_store/work_item_capability.rs implementation: file exists; coverage not verified src/server/dispatch/graph_pipeline/web_ingest.rs implementation: file exists; coverage not verified src/server/dispatch/identity_store.rs implementation: file exists; coverage not verified src/server/dispatch/policy_evolution/gate.rs implementation: file exists; coverage not verified src/server/dispatch/router/decision_plane.rs:95 implementation: file exists; coverage not verified src/server/handlers/admin/connector_pack/reproject.rs:72 implementation: file exists; coverage not verified src/server/handlers/decide/candidates.rs:415 implementation: file exists; coverage not verified src/server/handlers/decide/commit.rs implementation: file exists; coverage not verified src/server/handlers/decide/stat_decide.rs:137 implementation: file exists; coverage not verified src/server/handlers/decide/stat_decide.rs:48 implementation: file exists; coverage not verified src/server/handlers/decide/stat_tool_subset.rs:33 implementation: file exists; coverage not verified src/server/handlers/decide/stat_walk_forward.rs implementation: file exists; coverage not verified src/server/handlers/decide/statistical.rs:11 implementation: file exists; coverage not verified src/server/handlers/graph_ops/gateway_graph_routes.rs implementation: file exists; coverage not verified src/server/handlers/jobs/submit.rs implementation: file exists; coverage not verified src/server/handlers/jobs/submit.rs:419 implementation: file exists; coverage not verified src/server/handlers/txn/consensus.rs implementation: file exists; coverage not verified src/server/mutation_batch/commit/program.rs implementation: file exists; coverage not verified src/server/mutation_batch/commit/program.rs:64 implementation: file exists; coverage not verified src/server/mutation_batch/terminal_outcome.rs:22 implementation: file exists; coverage not verified src/server/persistence/agent_library.rs implementation: file exists; coverage not verified src/server/persistence/decision_record.rs implementation: file exists; coverage not verified tests/test_decision_static_contracts.py test: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified |
| EG-SDLCEG-SDLC — Graph-driven development lifecycle | 42 | 0/42 | 0 | SPECIFIED | ../../crates/eg-compute/src/parser/tree_sitter.rs implementation: file exists; coverage not verified ../../src/server/dispatch/router/source_ingest.rs implementation: file exists; coverage not verified crates/eg-compute/src/parser/tree_sitter.rs:249 implementation: file exists; coverage not verified crates/eg-core/ontology/sdd-v1.ttl implementation: file exists; coverage not verified spec.md documentation: file exists; coverage not verified src/server/dispatch/router/source_ingest.rs:24 implementation: file exists; coverage not verified plan.md documentation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-DURABLE-KERNELEG-DURABLE-KERNEL — Durable graph kernel | 414 | 120/414 | 111 | SPECIFIED | .github/workflows/ci.yml implementation: file exists; coverage not verified ReadThrough and ReadThroughFactory implementation: file exists; coverage not verified budget.rs:264 implementation: file exists; coverage not verified core_node_mutation.rs:60 implementation: file exists; coverage not verified core_readthrough.rs:11 implementation: file exists; coverage not verified crates/eg-capabilities/src/domains/graph.rs implementation: file exists; coverage not verified crates/eg-core/src/rbac_persist/durable_write.rs:105 implementation: file exists; coverage not verified crates/eg-jobs/src/store.rs implementation: file exists; coverage not verified crates/eg-jobs/src/store.rs:2537 implementation: file exists; coverage not verified crates/eg-plan/src/mirror_target.rs implementation: file exists; coverage not verified crates/eg-tsdb/src/store.rs implementation: file exists; coverage not verified crates/eg-types/src/mirror_sink.rs implementation: file exists; coverage not verified crates/eg-types/src/pre_merge_test_module.rs implementation: file exists; coverage not verified crates/eg-types/src/work_item_command_log.rs implementation: file exists; coverage not verified engine reference documentation: file exists; coverage not verified epistemic_graph/kvcache/connector.py implementation: file exists; coverage not verified gateway_graph.rs:111 implementation: file exists; coverage not verified graph.rs implementation: file exists; coverage not verified main.rs:1547 implementation: file exists; coverage not verified nodes.rs:85 implementation: file exists; coverage not verified persist.rs:78 implementation: file exists; coverage not verified read_through.rs implementation: file exists; coverage not verified redb_backend.rs implementation: file exists; coverage not verified registry.rs:553 implementation: file exists; coverage not verified scripts/validate-raft-cluster.sh implementation: file exists; coverage not verified src/main.rs implementation: file exists; coverage not verified src/raft/flake_budget.rs implementation: file exists; coverage not verified src/raft/harness/trace_capture.rs implementation: file exists; coverage not verified src/raft/tests.rs implementation: file exists; coverage not verified src/server/blob/store/holders.rs implementation: file exists; coverage not verified src/server/dispatch/change_envelope/multi_graph.rs:19 implementation: file exists; coverage not verified src/server/dispatch/router/data_plane.rs:770 implementation: file exists; coverage not verified src/server/handlers/graph_ops/memory.rs implementation: file exists; coverage not verified src/server/mutation_batch.rs implementation: file exists; coverage not verified src/server_startup.rs:155 implementation: file exists; coverage not verified store_read.rs:336 implementation: file exists; coverage not verified store_read.rs:356 implementation: file exists; coverage not verified trait_graph.rs:94 implementation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified |
| EG-IDENTITYEG-IDENTITY — Engine identity, mode and scope authority | 52 | 8/52 | 8 | SPECIFIED | crates/eg-core/src/isolation.rs:157 implementation: file exists; coverage not verified crates/eg-types/src/identity.rs:1 implementation: file exists; coverage not verified crates/eg-types/src/identity/model.rs:41 implementation: file exists; coverage not verified crates/eg-types/src/rbac_elevation/ledger.rs:268 implementation: file exists; coverage not verified src/main.rs implementation: file exists; coverage not verified src/server/access.rs:702 implementation: file exists; coverage not verified src/server/auth.rs:901 implementation: file exists; coverage not verified src/server/dispatch/router/identity_access.rs:47 implementation: file exists; coverage not verified src/server/graph_schema/compose.rs implementation: file exists; coverage not verified src/server/handlers/graph_ops/gateway.rs:72 implementation: file exists; coverage not verified src/server/handlers/graph_ops/gateway_graph.rs:151 implementation: file exists; coverage not verified src/server/handlers/graph_ops/nodes.rs:85 implementation: file exists; coverage not verified src/server/handlers/rdf/validation.rs:21 implementation: file exists; coverage not verified src/server/mutation_batch/compile.rs:126 implementation: file exists; coverage not verified tasks.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified tests/test_native_no_auth_served.py test: file exists; coverage not verified architecture.md documentation: file exists; coverage not verified crates/eg-capabilities/src/domains/security.rs implementation: file exists; coverage not verified crates/eg-core/src/isolation/identity_admin.rs implementation: file exists; coverage not verified crates/eg-core/src/rbac_persist.rs implementation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified src/audit.rs implementation: file exists; coverage not verified src/server/auth.rs implementation: file exists; coverage not verified src/server/dispatch/router/identity_access.rs implementation: file exists; coverage not verified src/server/oidc.rs implementation: file exists; coverage not verified |
| EG-ENGINE-PARITYEG-ENGINE-PARITY — Relational engine parity inside one library | 80 | 0/80 | 0 | SPECIFIED | ../../src/server/pgwire/auth.rs implementation: file exists; coverage not verified ../../src/server/pgwire/mod.rs implementation: file exists; coverage not verified ../../src/server/sql_wire_auth.rs implementation: file exists; coverage not verified spec.md documentation: file exists; coverage not verified .config/spec-aliases.toml implementation: file exists; coverage not verified plan.md documentation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified status.json implementation: file exists; coverage not verified tasks.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-FEDERATED-QUERYEG-FEDERATED-QUERY — Federated query, search, and reasoning | 443 | 73/443 | 44 | SPECIFIED | Column rendering implementation: external declaration; not verified Control-lease contract implementation: external declaration; not verified Dispatch attachment implementation: external declaration; not verified Existing result fetch implementation: external declaration; not verified Foreign-query handler implementation: external declaration; not verified SDK-SOURCE-INGEST-R004.1–.6 documentation: external declaration; not verified SQL validation implementation: external declaration; not verified Compact tests test: file exists; coverage not verified EG-TYPED-PACKS-R043 and R048 documentation: file exists; coverage not verified Method::ShexValidate implementation: file exists; coverage not verified Schema::from_shexj implementation: file exists; coverage not verified ShexReport::from_results implementation: file exists; coverage not verified ShexValidationReport implementation: file exists; coverage not verified architecture documentation: file exists; coverage not verified capability row implementation: file exists; coverage not verified compact.rs implementation: file exists; coverage not verified core tests test: file exists; coverage not verified crates/eg-compute/src/assemble/conclude.rs:69 implementation: file exists; coverage not verified crates/eg-compute/src/finance/market/confidence.rs:113 implementation: file exists; coverage not verified crates/eg-compute/src/mining/causal_impact.rs implementation: file exists; coverage not verified crates/eg-compute/src/mining/cluster.rs implementation: file exists; coverage not verified crates/eg-core/src/isolation.rs:157 implementation: file exists; coverage not verified crates/eg-core/src/projection_catalog.rs:75 implementation: file exists; coverage not verified crates/eg-graphql/src/crossmodal.rs:429 implementation: file exists; coverage not verified crates/eg-lake/src/catalog.rs:27 implementation: file exists; coverage not verified crates/eg-lake/src/iceberg_avro.rs:371 implementation: file exists; coverage not verified crates/eg-lake/src/lib.rs:299 implementation: file exists; coverage not verified crates/eg-modality/src/rowset.rs implementation: file exists; coverage not verified crates/eg-plan/src/algebra.rs:21 implementation: file exists; coverage not verified crates/eg-plan/src/exec.rs implementation: file exists; coverage not verified crates/eg-plan/src/exec.rs:1436 implementation: file exists; coverage not verified crates/eg-plan/src/exec.rs:278 implementation: file exists; coverage not verified crates/eg-plan/src/exec.rs:536 implementation: file exists; coverage not verified crates/eg-plan/src/exec.rs:84 implementation: file exists; coverage not verified crates/eg-plan/src/exec.rs:848 implementation: file exists; coverage not verified crates/eg-plan/src/exec/vector_rank.rs:65 implementation: file exists; coverage not verified crates/eg-plan/src/exec/vector_rank.rs:97 implementation: file exists; coverage not verified crates/eg-plan/src/federation.rs implementation: file exists; coverage not verified crates/eg-plan/src/federation.rs:933 implementation: file exists; coverage not verified crates/eg-plan/src/federation_ssrf.rs implementation: file exists; coverage not verified crates/eg-plan/src/knowledge.rs implementation: file exists; coverage not verified crates/eg-plan/src/leanrag.rs:125 implementation: file exists; coverage not verified crates/eg-plan/src/leanrag.rs:66 implementation: file exists; coverage not verified crates/eg-plan/src/rowset.rs implementation: file exists; coverage not verified crates/eg-plan/src/runtime.rs:61 implementation: file exists; coverage not verified crates/eg-plan/src/uql/serve/annotate.rs implementation: file exists; coverage not verified crates/eg-query/src/sql/ann.rs implementation: file exists; coverage not verified crates/eg-query/src/sql/ann.rs:116 implementation: file exists; coverage not verified crates/eg-query/src/tables/embedding_binding.rs:398 implementation: file exists; coverage not verified crates/eg-types/src/embedding.rs:47 implementation: file exists; coverage not verified crates/eg-types/src/lake_catalog.rs implementation: file exists; coverage not verified crates/eg-types/src/wire_query_core.rs implementation: file exists; coverage not verified crates/eg-types/src/wire_query_core.rs:27 implementation: file exists; coverage not verified eg_shex::validate implementation: file exists; coverage not verified epistemic_graph/generated/query.py implementation: file exists; coverage not verified feature declaration implementation: file exists; coverage not verified handle_shex_validate implementation: file exists; coverage not verified src/redb_store/work_item/control_lease.rs:58 implementation: file exists; coverage not verified src/server/handlers/graph_ops/semantic.rs:88 implementation: file exists; coverage not verified src/server/handlers/graphlearn.rs implementation: file exists; coverage not verified src/server/handlers/jobs/executor_claim.rs:82 implementation: file exists; coverage not verified src/server/handlers/query/dispatch.rs:133 implementation: file exists; coverage not verified src/server/handlers/query/dispatch.rs:66 implementation: file exists; coverage not verified src/server/handlers/query/nl.rs:48 implementation: file exists; coverage not verified src/server/handlers/query/planning.rs:11 implementation: file exists; coverage not verified src/server/handlers/query/planning.rs:411 implementation: file exists; coverage not verified src/server/handlers/query/planning.rs:424 implementation: file exists; coverage not verified src/server/handlers/query/planning.rs:611 implementation: file exists; coverage not verified src/server/handlers/query/planning.rs:854 implementation: file exists; coverage not verified src/server/handlers/query/sql_read.rs:100 implementation: file exists; coverage not verified src/server/handlers/query/sql_read.rs:305 implementation: file exists; coverage not verified src/server/handlers/query/sql_read.rs:379 implementation: file exists; coverage not verified src/server/handlers/query/uql_statement.rs:17 implementation: file exists; coverage not verified src/server/handlers/semantic_index/dispatch.rs:14 implementation: file exists; coverage not verified src/server/handlers/semantic_index/worker.rs:175 implementation: file exists; coverage not verified src/server/lake/catalog_ops.rs:104 implementation: file exists; coverage not verified src/server/lake/mod.rs:602 implementation: file exists; coverage not verified src/server/lake/rest/catalog.rs:318 implementation: file exists; coverage not verified src/server/lake/rest/mod.rs implementation: file exists; coverage not verified src/server/semantic_index.rs:145 implementation: file exists; coverage not verified tasks documentation: file exists; coverage not verified try_handle implementation: file exists; coverage not verified validate.rs implementation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-FINANCE-PRIMITIVESEG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidence | 181 | 25/181 | 25 | SPECIFIED | crates/eg-compute/src/finance/lot_accounting.rs implementation: file exists; coverage not verified crates/eg-compute/src/finance/market/backtest_run.rs implementation: file exists; coverage not verified crates/eg-compute/src/finance/quant/validation.rs implementation: file exists; coverage not verified crates/eg-compute/src/finance/regime.rs implementation: file exists; coverage not verified crates/eg-compute/src/finance/statespace.rs:167 implementation: file exists; coverage not verified crates/eg-compute/src/finance/statespace.rs:56 implementation: file exists; coverage not verified crates/eg-compute/src/finance/statespace.rs:94 implementation: file exists; coverage not verified crates/eg-core/ontology/finance-v1.ttl implementation: file exists; coverage not verified crates/eg-numeric/src/evaluation/skill.rs:16 implementation: file exists; coverage not verified crates/eg-numeric/src/series/kalman.rs:52 implementation: file exists; coverage not verified crates/eg-plan/src/exec/derive.rs:21 implementation: file exists; coverage not verified crates/eg-plan/src/exec/dispatch.rs:461 implementation: file exists; coverage not verified crates/eg-tsdb/src/derive/mod.rs:1 implementation: file exists; coverage not verified crates/eg-types/src/finance_event_envelope.rs implementation: file exists; coverage not verified crates/eg-types/src/wire_finance.rs implementation: file exists; coverage not verified src/server/handlers/finance/route_families.rs:211 implementation: file exists; coverage not verified src/server/handlers/finance/route_families.rs:576 implementation: file exists; coverage not verified src/server/handlers/query/sql_read.rs:305 implementation: file exists; coverage not verified src/server/handlers/timeseries.rs:367 implementation: file exists; coverage not verified src/server/handlers/timeseries/derived.rs:222 implementation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified |
| EG-INGEST-WORKEREG-INGEST-WORKER — Durable ingest worker | 136 | 0/136 | 0 | SPECIFIED | crates/eg-document/src/contract.rs:141 implementation: file exists; coverage not verified crates/eg-document/src/document.rs:225 implementation: file exists; coverage not verified crates/eg-document/src/runtime.rs:79 implementation: file exists; coverage not verified crates/eg-types/src/source_ingestion.rs:265 implementation: file exists; coverage not verified spec.md documentation: file exists; coverage not verified src/redb_store/store_state.rs implementation: file exists; coverage not verified src/server/dispatch/graph_pipeline/native_routes.rs:408 implementation: file exists; coverage not verified src/server/dispatch/graph_pipeline/native_routes.rs:428 implementation: file exists; coverage not verified src/server/handlers/modality/ingest.rs:151 implementation: file exists; coverage not verified src/server/handlers/source_ingestion.rs implementation: file exists; coverage not verified src/server/handlers/source_ingestion.rs:155 implementation: file exists; coverage not verified src/server/handlers/source_ingestion.rs:1683 implementation: file exists; coverage not verified src/server/handlers/source_ingestion.rs:1791 implementation: file exists; coverage not verified src/server/handlers/source_ingestion.rs:2187 implementation: file exists; coverage not verified src/server/handlers/source_ingestion.rs:385 implementation: file exists; coverage not verified |
| EG-MEDIA-VOCABEG-MEDIA-VOCAB — Media and personal-content vocabulary | 123 | 0/123 | 0 | SPECIFIED | spec.md documentation: file exists; coverage not verified |
| EG-OBJECT-STORAGE-BACKENDEG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost Gate | 5 | 0/5 | 0 | SPECIFIED | plan.md documentation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified status.json implementation: file exists; coverage not verified tasks.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-CQ-ORCHEG-CQ-ORCH — Orchestration competency questions | 91 | 0/91 | 0 | SPECIFIED | crates/eg-compute/src/parser/resolve.rs:63 implementation: file exists; coverage not verified design.md documentation: file exists; coverage not verified src/server/handlers/mining/impact.rs:264 implementation: file exists; coverage not verified |
| EG-ORCH-VOCABEG-ORCH-VOCAB — Orchestration vocabulary | 152 | 27/152 | 27 | SPECIFIED | crates/eg-core/ontology/orchestration-v1.shapes.ttl implementation: file exists; coverage not verified crates/eg-core/ontology/sdd-v1.ttl implementation: file exists; coverage not verified crates/eg-query/src/cypher/exec.rs:4574 implementation: file exists; coverage not verified crates/eg-rdf/tests/orchestration_vocabulary.rs test: file exists; coverage not verified crates/eg-types/src/agent_ontology.rs implementation: file exists; coverage not verified crates/eg-types/src/agent_template.rs implementation: file exists; coverage not verified crates/eg-types/src/authority/replay.rs:191 implementation: file exists; coverage not verified crates/eg-types/src/change_envelope.rs:248 implementation: file exists; coverage not verified crates/eg-types/src/graph_schema.rs:79 implementation: file exists; coverage not verified crates/eg-types/src/ingestion_wire.rs:36 implementation: file exists; coverage not verified crates/eg-types/src/outcome_bundle.rs:130 implementation: file exists; coverage not verified crates/eg-types/src/outcome_bundle.rs:668 implementation: file exists; coverage not verified crates/eg-types/src/protocol/method/method_00.rs:6 implementation: file exists; coverage not verified crates/eg-types/src/protocol/method/method_03.rs:317 implementation: file exists; coverage not verified design.md documentation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified src/server/connector_pack_projection.rs implementation: file exists; coverage not verified src/server/dispatch/change_envelope.rs:36 implementation: file exists; coverage not verified src/server/dispatch/router/source_ingest.rs:24 implementation: file exists; coverage not verified src/server/handlers/decide/assemble.rs implementation: file exists; coverage not verified src/server/handlers/graph_ops/gateway_graph.rs implementation: file exists; coverage not verified src/server/handlers/graph_ops/gateway_graph.rs:62 implementation: file exists; coverage not verified src/server/mutation/coalescer.rs implementation: file exists; coverage not verified src/server/persistence/provenance_anchor.rs:55 implementation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-PLACEMENTEG-PLACEMENT — Placement, worker policy and analytics bound | 71 | 10/71 | 10 | SPECIFIED | crates/eg-compute/src/mining/association.rs:402 implementation: file exists; coverage not verified crates/eg-jobs/src/store.rs:736 implementation: file exists; coverage not verified crates/eg-quantum-jobs/src/job.rs:275 implementation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified spec.md documentation: file exists; coverage not verified specs/decision-engine/requirements.md:163 documentation: file exists; coverage not verified src/server/dispatch/router/decision_plane.rs:64 implementation: file exists; coverage not verified src/server/handlers/decide/assemble.rs:57 implementation: file exists; coverage not verified src/server/handlers/jobs/submit.rs:289 implementation: file exists; coverage not verified |
| EG-CONTRACTEG-CONTRACT — Public engine contract and reproducible clients | 87 | 61/87 | 53 | SPECIFIED | .github/workflows/release.yml implementation: file exists; coverage not verified Cargo.toml implementation: file exists; coverage not verified EG-DECISION-ENGINE documentation: file exists; coverage not verified EG-DURABLE-KERNEL documentation: file exists; coverage not verified EG-FEDERATED-QUERY documentation: file exists; coverage not verified EG-FINANCE-PRIMITIVES documentation: file exists; coverage not verified EG-IDENTITY documentation: file exists; coverage not verified EG-UNIFIED-DATA-PLANE-R001 documentation: file exists; coverage not verified The component registry implementation: file exists; coverage not verified The engine diagram documentation: file exists; coverage not verified The scanner configuration implementation: file exists; coverage not verified build_backend.py implementation: file exists; coverage not verified clients/go/go.mod implementation: file exists; coverage not verified clients/js/package-lock.json implementation: file exists; coverage not verified crates/eg-core/src/read_through.rs implementation: file exists; coverage not verified engine.md documentation: file exists; coverage not verified folded-wheel/action.yml implementation: file exists; coverage not verified modality_serving.md documentation: file exists; coverage not verified native-program-optimization.md documentation: file exists; coverage not verified pyproject.toml implementation: file exists; coverage not verified scripts/build_method_codec_wasm.py implementation: file exists; coverage not verified scripts/check_wheel_completeness.py implementation: file exists; coverage not verified scripts/check_wheel_privacy.py implementation: file exists; coverage not verified scripts/ci_parity.sh implementation: file exists; coverage not verified src/server/handlers/query/planning.rs:424 implementation: file exists; coverage not verified src/server/mutation.rs:136 implementation: file exists; coverage not verified clients/go/codec.go implementation: file exists; coverage not verified clients/js/codec.mjs implementation: file exists; coverage not verified contract/errors.json implementation: file exists; coverage not verified contract/fixtures/method_body_vectors.json implementation: file exists; coverage not verified contract/methods.json implementation: file exists; coverage not verified crates/eg-capabilities/src/bin/gen_contract.rs implementation: file exists; coverage not verified epistemic_graph/generated/models.py implementation: file exists; coverage not verified plan.md documentation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified scripts/generated_artifacts.py implementation: file exists; coverage not verified tasks.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-REPO-INGESTEG-REPO-INGEST — Repository index and native ingestion | 101 | 23/101 | 6 | SPECIFIED | .config/pre-commit.yaml implementation: file exists; coverage not verified architecture.md documentation: file exists; coverage not verified crates/eg-compute/src/parser/branch_index.rs implementation: file exists; coverage not verified crates/eg-compute/src/parser/branch_index_tests.rs implementation: file exists; coverage not verified crates/eg-types/src/ingestion_wire.rs implementation: file exists; coverage not verified crates/eg-types/src/source_ingestion.rs implementation: file exists; coverage not verified crates/eg-types/src/source_ingestion/tests.rs implementation: file exists; coverage not verified docs/architecture/source_ingestion.md documentation: file exists; coverage not verified epistemic_graph/generated/index_repository.py implementation: file exists; coverage not verified spec.md documentation: file exists; coverage not verified src/server/dispatch/graph_pipeline/repository_index.rs implementation: file exists; coverage not verified src/server/handlers/repository_index.rs implementation: file exists; coverage not verified src/server/handlers/repository_index_tests.rs implementation: file exists; coverage not verified src/server/handlers/source_ingestion.rs implementation: file exists; coverage not verified src/server/repository_enrichment_worker.rs implementation: file exists; coverage not verified tests/repository_index_durable.rs test: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-SRC-AUTHEG-SRC-AUTH — Source authority: the ontology says which connected source answers a concept | 73 | 0/73 | 0 | SPECIFIED | crates/eg-core/src/graph/schema_sources.rs implementation: file exists; coverage not verified crates/eg-core/src/isolation.rs:1058 implementation: file exists; coverage not verified crates/eg-plan/src/federation.rs implementation: file exists; coverage not verified crates/eg-rdf/src/source_selection.rs implementation: file exists; coverage not verified crates/eg-rdf/src/source_selection.rs:172 implementation: file exists; coverage not verified crates/eg-rdf/src/source_selection.rs:26 implementation: file exists; coverage not verified crates/eg-types/src/governed_change.rs implementation: file exists; coverage not verified crates/eg-types/src/protocol/method/method_00.rs:6 implementation: file exists; coverage not verified crates/eg-types/src/wire_query_modalities.rs implementation: file exists; coverage not verified specs/cross-source-competency/plan.md documentation: file exists; coverage not verified specs/orchestration-competency/requirements.md documentation: file exists; coverage not verified src/server/graph_schema/approved.rs implementation: file exists; coverage not verified src/server/graph_schema/virtual_graph_tests.rs:35 implementation: file exists; coverage not verified src/server/handlers/graph_ops/gateway_graph.rs:62 implementation: file exists; coverage not verified crates/eg-core/ontology/virtual_graph-v1.ttl implementation: file exists; coverage not verified |
| EG-SCMEG-SCM — Source changesets as the source of truth | 21 | 0/21 | 0 | SPECIFIED | src/server/blob/store.rs implementation: file exists; coverage not verified src/server/blob/stream.rs implementation: file exists; coverage not verified plan.md documentation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified status.json implementation: file exists; coverage not verified tasks.md documentation: file exists; coverage not verified test-spec.md documentation: file exists; coverage not verified |
| EG-SUPPLY-VOCABEG-SUPPLY-VOCAB — Supply-chain and service-impact vocabulary | 69 | 1/69 | 1 | SPECIFIED | crates/eg-types/src/entity_link_proposal.rs implementation: file exists; coverage not verified spec.md documentation: file exists; coverage not verified specs/cross-source-competency/plan.md documentation: file exists; coverage not verified src/server/handlers/mining/impact.rs:264 implementation: file exists; coverage not verified plan.md documentation: file exists; coverage not verified |
| EG-TYPED-PACKSEG-TYPED-PACKS — Typed packs and catalog authority | 359 | 112/359 | 82 | SPECIFIED | benches/schema_drift_classify.rs implementation: file exists; coverage not verified crates/eg-core/ontology/swarm_topology-v1.ttl:80 implementation: file exists; coverage not verified crates/eg-core/src/ontology_codegen.rs:45 implementation: file exists; coverage not verified crates/eg-types/src/agent_component.rs:130 implementation: file exists; coverage not verified crates/eg-types/src/agent_component/facts.rs:169 implementation: file exists; coverage not verified crates/eg-types/src/agent_component/facts.rs:198 implementation: file exists; coverage not verified crates/eg-types/src/agent_component/facts.rs:395 implementation: file exists; coverage not verified crates/eg-types/src/connector_pack/annotations.rs:46 implementation: file exists; coverage not verified crates/eg-types/src/decision/statistical/tool_subset.rs:58 implementation: file exists; coverage not verified crates/eg-types/src/domain_pack.rs implementation: file exists; coverage not verified crates/eg-types/src/fleet_catalog/row.rs:103 implementation: file exists; coverage not verified crates/eg-types/src/graph_schema/drift.rs implementation: file exists; coverage not verified crates/eg-types/src/lib.rs implementation: file exists; coverage not verified evidence/gr1080-r048-5-20261011/client-parity.json implementation: file exists; coverage not verified evidence/gr1080-r048-5-20261011/results.json implementation: file exists; coverage not verified src/server/blob/engine_bodies.rs implementation: file exists; coverage not verified src/server/blob/engine_bodies.rs:202 implementation: file exists; coverage not verified src/server/connector_pack_projection.rs implementation: file exists; coverage not verified src/server/connector_pack_projection.rs:220 implementation: file exists; coverage not verified src/server/dispatch/consensus/fleet_catalog/project.rs:271 implementation: file exists; coverage not verified src/server/graph_schema.rs:191 implementation: file exists; coverage not verified src/server/graph_schema/attach_pack.rs implementation: file exists; coverage not verified src/server/handlers/admin/agent.rs:142 implementation: file exists; coverage not verified src/server/handlers/admin/component_content.rs implementation: file exists; coverage not verified src/server/handlers/admin/component_content.rs:55 implementation: file exists; coverage not verified src/server/handlers/admin/connector_pack/import/annotations.rs implementation: file exists; coverage not verified src/server/handlers/admin/connector_pack/import/annotations.rs:34 implementation: file exists; coverage not verified src/server/handlers/admin/connector_pack/import/facts.rs:21 implementation: file exists; coverage not verified src/server/handlers/admin/connector_pack/reproject.rs:227 implementation: file exists; coverage not verified src/server/handlers/decide/stat_decide.rs:137 implementation: file exists; coverage not verified src/server/handlers/decide/stat_tool_subset.rs:99 implementation: file exists; coverage not verified src/server/handlers/graph_ops/gateway_graph_routes.rs:656 implementation: file exists; coverage not verified src/server/handlers/rdf/dispatch.rs implementation: file exists; coverage not verified src/server/handlers/rdf/sparql.rs:30 implementation: file exists; coverage not verified src/server/persistence/agent_component/write.rs:39 implementation: file exists; coverage not verified src/server/persistence/connector_pack.rs implementation: file exists; coverage not verified src/server/persistence/connector_pack/declaration.rs implementation: file exists; coverage not verified tests/packs/test_schema_drift_served.py test: file exists; coverage not verified architecture.md documentation: file exists; coverage not verified contract/fixtures/connector_pack_digest_vectors.json implementation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified tasks.md documentation: file exists; coverage not verified |
| EG-UNIFIED-DATA-PLANEEG-UNIFIED-DATA-PLANE — Unified data plane | 290 | 89/290 | 84 | SPECIFIED | Requirements documentation: file exists; coverage not verified crates/eg-ann/src/recall.rs:28 implementation: file exists; coverage not verified crates/eg-ann/src/version.rs:129 implementation: file exists; coverage not verified crates/eg-ann/src/version.rs:32 implementation: file exists; coverage not verified crates/eg-lake/src/catalog.rs implementation: file exists; coverage not verified crates/eg-modality/src/lib.rs implementation: file exists; coverage not verified crates/eg-plan/src/federation_opt/run.rs:26 implementation: file exists; coverage not verified crates/eg-query/src/tables/embedding_binding.rs:526 implementation: file exists; coverage not verified crates/eg-rdf/src/obda.rs implementation: file exists; coverage not verified cross-repository contracts documentation: file exists; coverage not verified src/server/cdc.rs implementation: file exists; coverage not verified src/server/dispatch/graph_pipeline/web_ingest.rs implementation: file exists; coverage not verified src/server/foreign_catalog.rs implementation: file exists; coverage not verified src/server/handlers/rdf/obda.rs implementation: file exists; coverage not verified requirements.md documentation: file exists; coverage not verified status.json implementation: file exists; coverage not verified tasks documentation: file exists; coverage not verified test specification documentation: file exists; coverage not verified |
Landed counts LANDED and VERIFIED requirements. Done counts VERIFIED requirements only.
The spec state comes from the spec status file only.
Packages group specs by repository and declared component. Unassigned means no component was declared. Code links do not prove coverage. Mermaid source.
Knuckles-Team/medulla / Connector packs (1)
EG-TYPED-PACKS: source plan diagrams (Mermaid)
flowchart LR
SDK[SDK builds canonical pack] --> UP[Blob upload]
SDK --> IM[ConnectorPack.Import]
UP --> IM
IM --> V[Bounded validation G1–G21]
V --> B[Engine body store]
B --> TX[Agent Library owner transaction]
TX --> H[Head, members, holders, receipt]
TX --> O[Import outbox]
O --> P[Projection worker]
P --> GS[GraphSchema.Attach pack source]
GS --> VIS[Visible record + outbox ack]
VIS --> READ[Typed catalog and component reads]
Knuckles-Team/medulla / Development lifecycle (1)
EG-SDLC: source plan diagrams (Mermaid)
flowchart LR
REQ[Requirement] -- verifiedBy --> TEST[TestCase]
SYM[CodeSymbol] -- implements --> REQ
CS[Changeset] -- changes --> SYM
CS -- citesRequirement --> REQ
TEST -- exercises --> SYM
GV[GateVerdict] -- judges --> CS
CS -- producedBy --> RT[RunTrace]
DEF[Defect] -- affects --> SYM
DEF -- introducedBy --> CS
DEF -- fixedBy --> CS
REL[Release] -- contains --> CS
DEP[Deployment] -- deploys --> REL
INC[Incident] -- observedIn --> DEP
INC -- raises --> DEF
Knuckles-Team/medulla / Storage (1)
EG-ENGINE-PARITY: source plan diagrams (Mermaid)
flowchart TB
subgraph Clients
N[Native and generated clients]
W[Outside SQL and BI tools]
end
W -- PostgreSQL wire protocol --> PW[Wire front end R006-R009]
N --> RB[Request boundary]
PW --> RB
RB --> AD[Admission, principal, row security]
AD --> PL[SQL / UQL planner over the columnar engine]
PL --> TX[Transaction: snapshot reads, read and write sets R002]
TX --> GC[Group committer per store file R001]
GC --> P1[(Store file: tenant A)]
GC --> P2[(Store file: tenant B)]
GC --> LOG[Committed log]
LOG --> CDC[Change stream R015]
LOG --> ARC[Log archive and snapshots R016]
LOG --> REP[Read replicas R017]
LOG --> COL[Columnar copies of hot classes R018]
PL --> COL
PL --> EXT[Attached outside databases, read and federate only R019]
Knuckles-Team/medulla / Unassigned (21)
EG-BRANCH-MERGE: no plan diagram declared.
EG-CONTRACT: no plan diagram declared.
EG-CQ-CONN: no plan diagram declared.
EG-CQ-ORCH: no plan diagram declared.
EG-CQ-XSRC: no plan diagram declared.
EG-DATAPLAT-VOCAB: no plan diagram declared.
EG-DECISION-ENGINE: no plan diagram declared.
EG-DURABLE-KERNEL: source plan diagrams (Mermaid)
flowchart LR
W[Native / RESP / SQL / client wire] --> A[Verified identity and policy]
A --> C[Request classifier and MutationBatch compiler]
C --> O[Owner manifest and transaction admission]
O --> L[redb commit and Raft log]
L --> P[Graph / table / KV / TSDB projections]
L --> E[Outbox / CDC / audit receipts]
E --> M[Mirror and subscriber cursors]
EG-FEDERATED-QUERY: no plan diagram declared.
EG-FINANCE-PRIMITIVES: no plan diagram declared.
EG-IDENTITY: no plan diagram declared.
EG-INGEST-WORKER: no plan diagram declared.
EG-MEDIA-VOCAB: no plan diagram declared.
EG-OBJECT-STORAGE-BACKEND: no plan diagram declared.
EG-ORCH-VOCAB: no plan diagram declared.
EG-PLACEMENT: no plan diagram declared.
EG-REPO-INGEST: source plan diagrams (Mermaid)
flowchart LR
P[Provider snapshot adapter] --> S[Generated IndexRepository client]
S --> A[Authenticated EG request boundary]
A --> I[Branch index parser and resolver]
I --> C[CAS source admission]
C --> E[Canonical ChangeEnvelope compiler]
E --> D[Durable graph and outbox commit]
D --> Q[Graph and semantic queries]
D --> W[Budgeted enrichment worker]
W --> D
EG-SCM: no plan diagram declared.
EG-SRC-AUTH: no plan diagram declared.
EG-SUPPLY-VOCAB: no plan diagram declared.
EG-UNIFIED-DATA-PLANE: no plan diagram declared.
Depends on means a declared prerequisite. Extends and references do not imply prerequisite order. Shared code never creates dependencies. External targets are source declarations, not verified delivery.
Knuckles-Team/medulla / Connector packs
| Spec | Relationship | Target | Evidence |
|---|---|---|---|
| EG-TYPED-PACKS | references | ARBORA-FLEET-R036 | Knuckles-Team/graph-os: external declaration; not verified; source: specs/typed-packs-and-catalog/plan.md |
| EG-TYPED-PACKS | references | SDK-CONNECTOR-CONTROL-R068 | Knuckles-Team/agent-connector-sdk: external declaration; not verified; source: specs/typed-packs-and-catalog/plan.md |
| EG-TYPED-PACKS | references | EG-TYPED-PACKS-R101 | Knuckles-Team/medulla: local spec declaration; source: specs/typed-packs-and-catalog/plan.md |
| EG-TYPED-PACKS | references | EG-TYPED-PACKS-R103 | Knuckles-Team/medulla: local spec declaration; source: specs/typed-packs-and-catalog/plan.md |
Knuckles-Team/medulla / Development lifecycle
| Spec | Relationship | Target | Evidence |
|---|---|---|---|
| EG-SDLC | references | EG-ORCH-VOCAB | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/development-lifecycle/spec.md |
| EG-SDLC | references | EG-REPO-INGEST | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/development-lifecycle/spec.md |
| EG-SDLC | references | EG-SCM | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/development-lifecycle/spec.md |
| EG-SDLC | references | EG-UNIFIED-DATA-PLANE | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/development-lifecycle/spec.md |
| EG-SDLC | depends on | EG-ORCH-VOCAB-R012 | Knuckles-Team/medulla: local spec declaration; source: specs/development-lifecycle/spec.md |
| EG-SDLC | depends on | EG-SCM-R002 | Knuckles-Team/medulla: local spec declaration; source: specs/development-lifecycle/spec.md |
| EG-SDLC | depends on | EG-SCM-R008 | Knuckles-Team/medulla: local spec declaration; source: specs/development-lifecycle/spec.md |
Knuckles-Team/medulla / Storage
| Spec | Relationship | Target | Evidence |
|---|---|---|---|
| EG-ENGINE-PARITY | references | EG-DURABLE-KERNEL | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/engine-parity/spec.md |
| EG-ENGINE-PARITY | references | EG-FEDERATED-QUERY | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/engine-parity/spec.md |
| EG-ENGINE-PARITY | references | EG-SCM | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/engine-parity/spec.md |
| EG-ENGINE-PARITY | references | EG-UNIFIED-DATA-PLANE | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/engine-parity/spec.md |
Knuckles-Team/medulla / Unassigned
| Spec | Relationship | Target | Evidence |
|---|---|---|---|
| EG-BRANCH-MERGE | No relationships declared; dependencies unknown | ||
| EG-CONTRACT | references | EG-DURABLE-KERNEL | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/public-engine-contract-and-release/plan.md |
| EG-CONTRACT | references | EG-FEDERATED-QUERY | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/public-engine-contract-and-release/plan.md |
| EG-CONTRACT | references | EG-IDENTITY | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/public-engine-contract-and-release/plan.md |
| EG-CONTRACT | references | FQR-03/04/06 | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/public-engine-contract-and-release/plan.md |
| EG-CQ-CONN | references | federated query contract | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/connector-competency/plan.md |
| EG-CQ-CONN | references | unified data plane | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/connector-competency/plan.md |
| EG-CQ-ORCH | No relationships declared; dependencies unknown | ||
| EG-CQ-XSRC | No relationships declared; dependencies unknown | ||
| EG-DATAPLAT-VOCAB | No relationships declared; dependencies unknown | ||
| EG-DECISION-ENGINE | No relationships declared; dependencies unknown | ||
| EG-DURABLE-KERNEL | references | `unified-data-plane` | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md |
| EG-DURABLE-KERNEL | references | federated query and reasoning | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md |
| EG-DURABLE-KERNEL | references | public engine contract and release spec | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md |
| EG-DURABLE-KERNEL | references | typed packs and catalog | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md |
| EG-DURABLE-KERNEL | references | unified data plane | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/durable-graph-kernel/spec.md |
| EG-FEDERATED-QUERY | references | unified-data-plane | Knuckles-Team/medulla: file exists; coverage not verified; source: specs/federated-query-and-reasoning/spec.md |
| EG-FINANCE-PRIMITIVES | No relationships declared; dependencies unknown | ||
| EG-IDENTITY | No relationships declared; dependencies unknown | ||
| EG-INGEST-WORKER | No relationships declared; dependencies unknown | ||
| EG-MEDIA-VOCAB | No relationships declared; dependencies unknown | ||
| EG-OBJECT-STORAGE-BACKEND | No relationships declared; dependencies unknown | ||
| EG-ORCH-VOCAB | No relationships declared; dependencies unknown | ||
| EG-PLACEMENT | No relationships declared; dependencies unknown | ||
| EG-REPO-INGEST | No relationships declared; dependencies unknown | ||
| EG-SCM | No relationships declared; dependencies unknown | ||
| EG-SRC-AUTH | No relationships declared; dependencies unknown | ||
| EG-SUPPLY-VOCAB | No relationships declared; dependencies unknown | ||
| EG-UNIFIED-DATA-PLANE | No relationships declared; dependencies unknown | ||
Issues
1 open at capture.
- #656 ConnectorPackIndex caps a pack at 1024 entries; per-operation connectors exceed it updated 2026-10-18T09:49:51Z
Pull Requests
7 open at capture.
- #778 spec: supply/authority vocab, connector competency bulk, source-authority rows (L1+L2+L3) updated 2026-10-25T19:26:16Z
- #777 release: 2.27.8 train (#767 + #768, main-merged) updated 2026-10-25T16:24:16Z
- #767 fix(nl): ground planner output on the graph schema before it runs (G7) updated 2026-10-24T15:46:57Z
- #766 feat(ontology): metadata catalog core module (EG-TYPED-PACKS-R106.1, R814.1) updated 2026-10-24T15:22:24Z
- #758 perf(storage): faster shard open, clean-shutdown marker (R006.1-3) updated 2026-10-24T12:58:21Z
- #746 feat(ontology): IT4IT delivery, data platform, media and retrieval modules updated 2026-10-24T12:08:47Z
- #741 Integrate pending media, usage, host-start and checkpoint contracts for 2.27.6 updated 2026-10-24T01:54:16Z
The build reads GitHub one time. This page makes no live API requests.
Each status file gives one spec row. Each requirement gives one more row. A record without a valid state shows INVALID. Expand a Definition to read the canonical requirement and verification text.
All documented records (4300 rows)
| ID / source | Kind | Parent | State | Commit / test evidence |
|---|---|---|---|---|
| EG-BRANCH-MERGE EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict Resolution | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-BRANCH-MERGE-R001 Typed branch model and create Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source**Typed branch model and create.** Model: a branch is a registry entry. It binds tenant, graph, name, base engine version, and creator. A branch is a view over the commit chain. It is not a data copy. Behavior: CreateBranch registers the name at its base version. It returns the branch identity. Branch reads use the off-lock graph snapshot. Tenant RLS applies as usual. Wiring: add a branch module to `crates/eg-types`. Serve it through the request boundary. Persist registrations in the owner-store lineage registry (EG-DURABLE-KERNEL-R003). Refusal: the registry refuses empty or duplicate names. It refuses reserved-namespace names. It refuses foreign-tenant creation. It refuses an unresolvable base version. Every refusal is a typed error before state change. Evidence: the identity round-trips. Every refusal leaves no registry entry. | `tests/test_branch_create.py::test_branch_create_and_refusals` creates a branch. It reads the branch back. Each refusal returns a typed error with no registry entry. | requirement | EG-BRANCH-MERGE | SPECIFIED | No recorded commit/test evidence |
| EG-BRANCH-MERGE-R002 Branch-scoped mutations Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source**Branch-scoped mutations.** Model: a mutation names its target branch. A commit appends to that branch's append-only chain. The commit carries a parent pointer to the branch's prior head. It commits commit-before-ack. Behavior: branch writes show on that branch only. They stay invisible to main and sibling branches until merge. Branch writes are idempotent under a tenant-scoped branch idempotency key. Wiring: extend the mutation path in `src/server/handlers` with branch targeting. Reuse the existing commit and raft paths. Reuse the tenant-scoped idempotency pattern of EG-DURABLE-KERNEL-R019. Refusal: the engine refuses a mutation that names an unknown branch. It refuses a deleted branch. It refuses a foreign-tenant branch. The refusal happens before any graph mutation. A replayed branch write returns the original receipt. Evidence: a branch write is invisible on main until merge. The replay returns an identical receipt. | `tests/test_branch_scoped_mutation.py::test_branch_write_invisible_until_merge` writes on a branch. It asserts main is unchanged. It asserts the replay receipt is identical. | requirement | EG-BRANCH-MERGE | SPECIFIED | No recorded commit/test evidence |
| EG-BRANCH-MERGE-R003 Merge base and fast-forward Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source**Merge base and fast-forward.** Model: merge outcomes form the closed set `up_to_date` / `fast_forward` / `merged` / `conflict`. The engine computes them over the two branch commit chains. Behavior: when the target has no writes since the merge base, the merge fast-forwards. When the source head is a descendant of the target head, the merge fast-forwards. The fast-forward moves the target to the source head without an entity scan. When the source is already contained, the outcome is up-to-date. Nothing publishes. Wiring: add merge-base computation to the branch module. Reuse the commit-chain walk of the owner store. Refusal: the engine refuses a merge whose branches share no ancestor. The refusal is typed. It never invents an implicit base. Evidence: up-to-date publishes nothing. Fast-forward advances the target with a single-parent receipt. The receipt names the source head as merged parent. | `tests/test_branch_merge_base.py::test_merge_outcomes_up_to_date_and_fast_forward` drives four fixture topologies. It asserts the closed outcome set. | requirement | EG-BRANCH-MERGE | SPECIFIED | No recorded commit/test evidence |
| EG-BRANCH-MERGE-R004 Entity-level three-way merge Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source**Entity-level three-way merge.** Model: the merge resolves per entity. Node identity is `(tenant, type, key)`. Edge identity is the existing `(source, target, relation_type)` triple (EG-REPO-INGEST-R009.1). Behavior: both-sides-unchanged entities stay on the target without row copy. One-sided entities are adopted. Adoption passes schema, constraint, and ABox validation. The validation uses the existing typed authorities. Both-sides entities become typed conflicts. They are never silent overwrites. Wiring: add the entity-level merge pass to the branch module. Reuse the constraint and ABox check authorities of schema repair (EG-DECISION-ENGINE-R102.1). Refusal: an adopted entity that fails validation refuses the whole merge. The merge refuses atomically with a named reason. No partial merge publishes. Evidence: disjoint, one-sided, and both-sides fixtures each produce the declared outcome. The atomic-refusal case publishes nothing. | `tests/test_branch_three_way_merge.py::test_entity_level_outcomes` drives the three fixtures. It asserts the published target state matches the expected entities exactly. | requirement | EG-BRANCH-MERGE | SPECIFIED | No recorded commit/test evidence |
| EG-BRANCH-MERGE-R005 Epistemic conflict resolution Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source**Epistemic conflict resolution.** Model: a conflicted entity produces a typed conflict record. The record carries both candidate values. Each candidate keeps its bitemporal windows (`valid_from`/`valid_until`, `tx_from`/`tx_until`). Each keeps its provenance (source reliability, confidence, evidence refs). Behavior: an owner-pinned epistemic policy selects the winner. Or it leaves the conflict open. The open conflict is a typed queryable state. Resolution is never a silent last-write-wins. A resolved row keeps the contradiction link. It keeps both evidence refs in its epistemic neighbourhood. Wiring: extend the conflict path of R004. Reuse the epistemic neighbourhood fields served by `WITH KNOWLEDGE`. Reuse the source-reliability authority. Refusal: the engine refuses resolution with a missing epistemic policy. It refuses stale evidence refs. It refuses nonfinite confidence. A conflict with no policy leaves the entity unmerged. The engine never guesses. Evidence: the two-candidate fixture resolves per the pinned policy. The no-policy conflict stays open with both candidates queryable. In contrast to an entity-level last-write-wins merge with constraint checks, this row is evidence-weighted and validity-aware. | `tests/test_branch_epistemic_conflict.py::test_evidence_weighted_resolution_and_open_conflict` resolves under a pinned policy. It re-runs without a policy. It reads back the open conflict with both candidates. | requirement | EG-BRANCH-MERGE | SPECIFIED | No recorded commit/test evidence |
| EG-BRANCH-MERGE-R006 Branch diff and time-travel reads Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source**Branch diff and time-travel reads.** Model: a branch or commit diff is a typed change feed. It names a baseline (entity, operation, image ref). It uses the engine's change-envelope vocabulary. A branch reads at any engine version on its chain. Behavior: an as-of-version read serves the off-lock snapshot. The snapshot pins to that version. It stays RLS-filtered. The diff between two versions lists added, updated, and deleted entities. Wiring: add as-of snapshot reads to the branch module. Reuse the existing snapshot and off-lock read paths. Reuse the tenant-scoping filter (EG-DURABLE-KERNEL-R029). Refusal: the engine refuses a version not on the branch's chain. It refuses a cross-tenant diff. Both refusals are typed. Evidence: a read at version N equals the write set at N. The diff between N and M equals the commits in between. The foreign-tenant and unknown-version cases refuse. | `tests/test_branch_time_travel.py::test_as_of_reads_and_diff` walks a branch chain of three versions. It reads each as-of. It asserts the diff matches the intervening commits. | requirement | EG-BRANCH-MERGE | SPECIFIED | No recorded commit/test evidence |
| EG-BRANCH-MERGE-R007 Atomic merge publication Definition — EG-BRANCH-MERGE / EG-BRANCH-MERGE — Agent Branching, Three-Way Merge, and Epistemic Conflict ResolutionCanonical requirement and verification source**Atomic merge publication.** Model: a merge publishes the target change atomically. The publication spans every affected type and modality. It uses the existing cross-modal transaction and raft path. The receipt is a typed two-parent commit. The receipt carries commit id, manifest digest, parents, actor, and creation timestamp. Behavior: replay against the same `(source_head, target_head, merge_base)` returns the original receipt. A merge that cannot complete publishes nothing. It never claims a rollback. Wiring: extend the commit publication path. Reuse raft command sealing (EG-DURABLE-KERNEL-R009). Reuse the cross-modal transaction. Refusal: the engine refuses a target that advanced past its recorded head. The refusal names the state as stale. It never silently rebases. It refuses an unknown actor. Evidence: the two-parent receipt reads back byte-identically. The replay returns the same receipt. The stale-target case publishes nothing. | `tests/test_branch_merge_publish.py::test_atomic_two_parent_publication_and_replay` publishes a two-parent merge. It reads it back. It replays it. It asserts the stale-target refusal leaves the target unchanged. | requirement | EG-BRANCH-MERGE | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN EG-CQ-CONN — Connector competency questions | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R001 ansible-tower competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ansible-tower competency rollup.** The ontology answers one single-source and one cross-source question over the `ansible-tower` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R001.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R001.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R001.1 ansible-tower single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ansible-tower single-source question.** "Which job templates failed in their last run, and against which inventory hosts?" Answered from the ansible-tower connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over ansible-tower data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R001.2 ansible-tower cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ansible-tower cross-source question.** "Which hosts that failed their last Tower run also have an open ServiceNow change or incident?" Requires linking ansible-tower to servicenow and systems-manager through the ontology concept: managed host (configuration item). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R001.3 ansible-tower acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ansible-tower acceptance test.** Both questions (EG-CQ-CONN-R001.1 and EG-CQ-CONN-R001.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R001.1 and EG-CQ-CONN-R001.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R002 archimate competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**archimate competency rollup.** The ontology answers one single-source and one cross-source question over the `archimate` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R002.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R002.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R002.1 archimate single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**archimate single-source question.** "Which application components serve a given business process, and through which relationships?" Answered from the archimate connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A fixture query over archimate data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R002.2 archimate cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**archimate cross-source question.** "Which ArchiMate application components have no matching LeanIX fact sheet or ServiceNow CI?" Requires linking archimate to leanix and servicenow through the ontology concept: application / configuration item. Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R002.3 archimate acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**archimate acceptance test.** Both questions (EG-CQ-CONN-R002.1 and EG-CQ-CONN-R002.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R002.1 and EG-CQ-CONN-R002.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R003 archivebox competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**archivebox competency rollup.** The ontology answers one single-source and one cross-source question over the `archivebox` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R003.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R003.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R003.1 archivebox single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**archivebox single-source question.** "Which archived snapshots of a given domain failed one or more extractors, and when?" Answered from the archivebox connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/documentation-v1.ttl`. | A fixture query over archivebox data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R003.2 archivebox cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**archivebox cross-source question.** "Which archived pages were first seen as FreshRSS articles but never captured by ArchiveBox?" Requires linking archivebox to freshrss and searxng through the ontology concept: URL / web resource. Vocabulary: `crates/eg-core/ontology/documentation-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R003.3 archivebox acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**archivebox acceptance test.** Both questions (EG-CQ-CONN-R003.1 and EG-CQ-CONN-R003.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R003.1 and EG-CQ-CONN-R003.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R004 aris competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**aris competency rollup.** The ontology answers one single-source and one cross-source question over the `aris` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R004.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R004.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R004.1 aris single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**aris single-source question.** "Which EPC functions in a process model have no outgoing control-flow connection?" Answered from the aris connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A fixture query over aris data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R004.2 aris cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**aris cross-source question.** "Which ARIS-modelled processes have a deployed Camunda definition, and which do not?" Requires linking aris to camunda and archimate through the ontology concept: business process. Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R004.3 aris acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**aris acceptance test.** Both questions (EG-CQ-CONN-R004.1 and EG-CQ-CONN-R004.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R004.1 and EG-CQ-CONN-R004.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R005 arr competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**arr competency rollup.** The ontology answers one single-source and one cross-source question over the `arr` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R005.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R005.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R005.1 arr single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**arr single-source question.** "Which monitored movies and episodes are wanted but have no file, and which indexer last searched them?" Answered from the arr connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over arr data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R005.2 arr cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**arr cross-source question.** "Which wanted Radarr titles are currently downloading in qBittorrent and not yet visible in Jellyfin?" Requires linking arr to qbittorrent and jellyfin through the ontology concept: media item (title). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R005.3 arr acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**arr acceptance test.** Both questions (EG-CQ-CONN-R005.1 and EG-CQ-CONN-R005.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R005.1 and EG-CQ-CONN-R005.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R006 atlassian competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**atlassian competency rollup.** The ontology answers one single-source and one cross-source question over the `atlassian` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R006.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R006.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R006.1 atlassian single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**atlassian single-source question.** "Which Jira issues in a project are blocked and unassigned, and by which linked issue?" Answered from the atlassian connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over atlassian data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R006.2 atlassian cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**atlassian cross-source question.** "Which open Jira issues reference a GitHub pull request that is already merged?" Requires linking atlassian to github and plane through the ontology concept: work item / pull request. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R006.3 atlassian acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**atlassian acceptance test.** Both questions (EG-CQ-CONN-R006.1 and EG-CQ-CONN-R006.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R006.1 and EG-CQ-CONN-R006.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R007 audiobookshelf competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**audiobookshelf competency rollup.** The ontology answers one single-source and one cross-source question over the `audiobookshelf` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R007.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R007.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R007.1 audiobookshelf single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**audiobookshelf single-source question.** "Which audiobook series have a book with listening progress stopped partway, and for which user?" Answered from the audiobookshelf connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over audiobookshelf data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R007.2 audiobookshelf cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**audiobookshelf cross-source question.** "Which audiobooks exist both in Audiobookshelf and as a downloaded file from media-downloader, and which are only one side?" Requires linking audiobookshelf to jellyfin and media-downloader through the ontology concept: media item (title). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R007.3 audiobookshelf acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**audiobookshelf acceptance test.** Both questions (EG-CQ-CONN-R007.1 and EG-CQ-CONN-R007.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R007.1 and EG-CQ-CONN-R007.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R008 audio-transcriber competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**audio-transcriber competency rollup.** The ontology answers one single-source and one cross-source question over the `audio-transcriber` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R008.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R008.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R008.1 audio-transcriber single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**audio-transcriber single-source question.** "Which recordings were transcribed with a low-confidence segment, and what text was affected?" Answered from the audio-transcriber connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over audio-transcriber data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R008.2 audio-transcriber cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**audio-transcriber cross-source question.** "Which transcribed recordings mention a topic that also appears in PulseLink social or video transcripts?" Requires linking audio-transcriber to pulselink and paperless-ngx through the ontology concept: document / transcript. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R008.3 audio-transcriber acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**audio-transcriber acceptance test.** Both questions (EG-CQ-CONN-R008.1 and EG-CQ-CONN-R008.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R008.1 and EG-CQ-CONN-R008.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R009 caddy competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**caddy competency rollup.** The ontology answers one single-source and one cross-source question over the `caddy` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R009.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R009.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R009.1 caddy single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**caddy single-source question.** "Which routes proxy to a given upstream, and which hostnames are served by each site block?" Answered from the caddy connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over caddy data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R009.2 caddy cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**caddy cross-source question.** "Which Caddy hostnames have no DNS record in Technitium or no Uptime Kuma monitor?" Requires linking caddy to technitium-dns and uptime through the ontology concept: hostname. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R009.3 caddy acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**caddy acceptance test.** Both questions (EG-CQ-CONN-R009.1 and EG-CQ-CONN-R009.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R009.1 and EG-CQ-CONN-R009.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R010 camunda competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**camunda competency rollup.** The ontology answers one single-source and one cross-source question over the `camunda` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R010.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R010.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R010.1 camunda single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**camunda single-source question.** "Which process instances have an open incident, and at which activity did they stop?" Answered from the camunda connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A fixture query over camunda data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R010.2 camunda cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**camunda cross-source question.** "Which running Camunda process definitions have an open ServiceNow incident raised against their service?" Requires linking camunda to aris and servicenow through the ontology concept: business process. Vocabulary: `crates/eg-core/ontology/process_intelligence-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R010.3 camunda acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**camunda acceptance test.** Both questions (EG-CQ-CONN-R010.1 and EG-CQ-CONN-R010.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R010.1 and EG-CQ-CONN-R010.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R011 ciso-assistant competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ciso-assistant competency rollup.** The ontology answers one single-source and one cross-source question over the `ciso-assistant` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R011.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R011.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R011.1 ciso-assistant single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ciso-assistant single-source question.** "Which controls in an applied framework are non-compliant and which risk scenarios do they mitigate?" Answered from the ciso-assistant connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A fixture query over ciso-assistant data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R011.2 ciso-assistant cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ciso-assistant cross-source question.** "Which CISO Assistant risks map to a ServiceNow CMDB service with an open incident?" Requires linking ciso-assistant to onetrust and servicenow through the ontology concept: control / risk. Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R011.3 ciso-assistant acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ciso-assistant acceptance test.** Both questions (EG-CQ-CONN-R011.1 and EG-CQ-CONN-R011.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R011.1 and EG-CQ-CONN-R011.2. Mapping acceptance depends on these producer rows: `RiskScenario`: `EG-CQ-CONN-R073.2` (`government-v1.ttl`); `mitigatesRisk`: `EG-CQ-CONN-R073.3` (`government-v1.ttl`); `inFramework`: `EG-CQ-CONN-R073.4` (`government-v1.ttl`); `riskAffectsService`: `EG-CQ-CONN-R073.5` (`government-v1.ttl`). The acceptance test must preserve `government-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::ciso_assistant` must parse the exact `ciso-assistant` Coverage row and `EG-CQ-CONN-R011.1` / `EG-CQ-CONN-R011.2` Vocabulary cells. It must assert `government-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R012 clarity competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**clarity competency rollup.** The ontology answers one single-source and one cross-source question over the `clarity` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R012.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R012.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R012.1 clarity single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**clarity single-source question.** "Which pages have the highest rage-click or dead-click rate over the last week?" Answered from the clarity connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over clarity data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R012.2 clarity cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**clarity cross-source question.** "Which pages with a spike in rage clicks were changed by a pull request merged in the previous week?" Requires linking clarity to plane and github through the ontology concept: web page / release. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R012.3 clarity acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**clarity acceptance test.** Both questions (EG-CQ-CONN-R012.1 and EG-CQ-CONN-R012.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R012.1 and EG-CQ-CONN-R012.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R013 container-manager competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**container-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `container-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R013.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R013.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R013.1 container-manager single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**container-manager single-source question.** "Which containers or pods are restarting repeatedly, and from which image?" Answered from the container-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over container-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R013.2 container-manager cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**container-manager cross-source question.** "Which running images have a newer tag on Docker Hub than the one deployed?" Requires linking container-manager to dockerhub and portainer through the ontology concept: container image. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R013.3 container-manager acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**container-manager acceptance test.** Both questions (EG-CQ-CONN-R013.1 and EG-CQ-CONN-R013.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R013.1 and EG-CQ-CONN-R013.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R014 data-science competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**data-science competency rollup.** The ontology answers one single-source and one cross-source question over the `data-science` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R014.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R014.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R014.1 data-science single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**data-science single-source question.** "Which trained models have validation metrics below their baseline run, and on which dataset?" Answered from the data-science connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over data-science data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R014.2 data-science cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**data-science cross-source question.** The question is "Which fine-tuned models have no evaluation trace and no stored artifact?" The trace store holds evaluation traces. The object store holds artifacts. The answer links data-science to langfuse and objectstore through the ontology concept model / dataset. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R014.3 data-science acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**data-science acceptance test.** Both questions (EG-CQ-CONN-R014.1 and EG-CQ-CONN-R014.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R014.1 and EG-CQ-CONN-R014.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R015 dockerhub competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**dockerhub competency rollup.** The ontology answers one single-source and one cross-source question over the `dockerhub` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R015.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R015.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R015.1 dockerhub single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**dockerhub single-source question.** "Which repositories in an organization have not been pushed to in a year, and what are their pull counts?" Answered from the dockerhub connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over dockerhub data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R015.2 dockerhub cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**dockerhub cross-source question.** "Which Docker Hub repositories correspond to a GitHub repository with recent commits but no recent image push?" Requires linking dockerhub to container-manager and github through the ontology concept: container image / repository. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R015.3 dockerhub acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**dockerhub acceptance test.** Both questions (EG-CQ-CONN-R015.1 and EG-CQ-CONN-R015.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R015.1 and EG-CQ-CONN-R015.2. Mapping acceptance depends on these producer rows: `lastPushedAt`: `EG-CQ-CONN-R068.13` (`infrastructure-v1.ttl`); `pullCount`: `EG-CQ-CONN-R068.14` (`infrastructure-v1.ttl`); `Repository`: `EG-CQ-CONN-R069.2` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `infrastructure-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::dockerhub` must parse the exact `dockerhub` Coverage row and `EG-CQ-CONN-R015.1` / `EG-CQ-CONN-R015.2` Vocabulary cells. It must assert `infrastructure-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R016 documentdb competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**documentdb competency rollup.** The ontology answers one single-source and one cross-source question over the `documentdb` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R016.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R016.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R016.1 documentdb single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**documentdb single-source question.** "Which collections have the most documents and which fields are missing in more than half of them?" Answered from the documentdb connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over documentdb data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R016.2 documentdb cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**documentdb cross-source question.** "Which documentdb collections duplicate a table in the SQL database, and which side is newer?" Requires linking documentdb to sql and objectstore through the ontology concept: dataset / collection. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R016.3 documentdb acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**documentdb acceptance test.** Both questions (EG-CQ-CONN-R016.1 and EG-CQ-CONN-R016.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R016.1 and EG-CQ-CONN-R016.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R017 egeria competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**egeria competency rollup.** The ontology answers one single-source and one cross-source question over the `egeria` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R017.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R017.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R017.1 egeria single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**egeria single-source question.** "Which glossary terms are linked to a data asset with a confidential classification?" Answered from the egeria connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A fixture query over egeria data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R017.2 egeria cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**egeria cross-source question.** "Which Egeria-cataloged assets correspond to a live SQL table, and which are cataloged but missing?" Requires linking egeria to sql and jena through the ontology concept: data asset. Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R017.3 egeria acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**egeria acceptance test.** Both questions (EG-CQ-CONN-R017.1 and EG-CQ-CONN-R017.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R017.1 and EG-CQ-CONN-R017.2. Mapping acceptance depends on these producer rows: `GlossaryTerm`: `EG-CQ-CONN-R074.2` (`core-foundation-v1.ttl`); `termAssignedTo`: `EG-CQ-CONN-R074.3` (`core-foundation-v1.ttl`). The acceptance test must preserve `core-foundation-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::egeria` must parse the exact `egeria` Coverage row and `EG-CQ-CONN-R017.1` / `EG-CQ-CONN-R017.2` Vocabulary cells. It must assert `core-foundation-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R018 emerald-exchange competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**emerald-exchange competency rollup.** The ontology answers one single-source and one cross-source question over the `emerald-exchange` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R018.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R018.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R018.1 emerald-exchange single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**emerald-exchange single-source question.** "Which open orders on an exchange are partially filled and what is their remaining quantity?" Answered from the emerald-exchange connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A fixture query over emerald-exchange data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R018.2 emerald-exchange cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**emerald-exchange cross-source question.** "Which exchange fills correspond to a deposit or withdrawal recorded in the Firefly III ledger?" Requires linking emerald-exchange to firefly-iii and home-assistant through the ontology concept: account / currency. Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R018.3 emerald-exchange acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**emerald-exchange acceptance test.** Both questions (EG-CQ-CONN-R018.1 and EG-CQ-CONN-R018.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R018.1 and EG-CQ-CONN-R018.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R019 erpnext competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**erpnext competency rollup.** The ontology answers one single-source and one cross-source question over the `erpnext` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R019.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R019.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R019.1 erpnext single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**erpnext single-source question.** "Which open purchase orders are late, and from which supplier?" Answered from the erpnext connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A fixture query over erpnext data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R019.2 erpnext cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**erpnext cross-source question.** "Which ERPNext suppliers with late orders are also marked as active accounts in the Twenty CRM or paid in Firefly III?" Requires linking erpnext to twenty and firefly-iii through the ontology concept: party (supplier / customer). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R019.3 erpnext acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**erpnext acceptance test.** Both questions (EG-CQ-CONN-R019.1 and EG-CQ-CONN-R019.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R019.1 and EG-CQ-CONN-R019.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R020 fan-manager competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**fan-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `fan-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R020.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R020.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R020.1 fan-manager single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**fan-manager single-source question.** "Which fans ran above 80 percent duty while the host temperature stayed above its threshold?" Answered from the fan-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over fan-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R020.2 fan-manager cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**fan-manager cross-source question.** "Which hosts had fan duty at maximum during a window in which Grafana alerted on temperature?" Requires linking fan-manager to systems-manager and lgtm through the ontology concept: host. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R020.3 fan-manager acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**fan-manager acceptance test.** Both questions (EG-CQ-CONN-R020.1 and EG-CQ-CONN-R020.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R020.1 and EG-CQ-CONN-R020.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R021 firefly-iii competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**firefly-iii competency rollup.** The ontology answers one single-source and one cross-source question over the `firefly-iii` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R021.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R021.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R021.1 firefly-iii single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**firefly-iii single-source question.** "Which budgets were exceeded this month, and by which transactions?" Answered from the firefly-iii connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A fixture query over firefly-iii data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R021.2 firefly-iii cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**firefly-iii cross-source question.** "Which Firefly III expenses match an ERPNext purchase invoice by amount and date?" Requires linking firefly-iii to erpnext and emerald-exchange through the ontology concept: account / transaction. Vocabulary: `crates/eg-core/ontology/finance-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R021.3 firefly-iii acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**firefly-iii acceptance test.** Both questions (EG-CQ-CONN-R021.1 and EG-CQ-CONN-R021.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R021.1 and EG-CQ-CONN-R021.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R022 freshrss competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**freshrss competency rollup.** The ontology answers one single-source and one cross-source question over the `freshrss` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R022.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R022.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R022.1 freshrss single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**freshrss single-source question.** "Which unread articles from a given feed were published in the last 48 hours?" Answered from the freshrss connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over freshrss data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R022.2 freshrss cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**freshrss cross-source question.** "Which FreshRSS articles also appear in SearXNG results for the same query, and which are new?" Requires linking freshrss to archivebox and searxng through the ontology concept: URL / article. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R022.3 freshrss acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**freshrss acceptance test.** Both questions (EG-CQ-CONN-R022.1 and EG-CQ-CONN-R022.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R022.1 and EG-CQ-CONN-R022.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R023 github competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**github competency rollup.** The ontology answers one single-source and one cross-source question over the `github` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R023.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R023.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R023.1 github single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**github single-source question.** "Which open pull requests have failing checks and no reviewer assigned?" Answered from the github connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over github data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R023.2 github cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**github cross-source question.** "Which GitHub pull requests close a Jira issue that is still in an open state?" Requires linking github to gitlab and atlassian through the ontology concept: repository / change request. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R023.3 github acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**github acceptance test.** Both questions (EG-CQ-CONN-R023.1 and EG-CQ-CONN-R023.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R023.1 and EG-CQ-CONN-R023.2. Mapping acceptance depends on these producer rows: `requestedReviewer`: `EG-CQ-CONN-R069.12` (`sdlc_lifecycle-v1.ttl`); `closesTicket`: `EG-CQ-CONN-R069.10` (`sdlc_lifecycle-v1.ttl`); `proposalState`: `EG-CQ-CONN-R069.11` (`sdlc_lifecycle-v1.ttl`); `Repository`: `EG-CQ-CONN-R069.2` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `sdlc_lifecycle-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::github` must parse the exact `github` Coverage row and `EG-CQ-CONN-R023.1` / `EG-CQ-CONN-R023.2` Vocabulary cells. It must assert `sdlc_lifecycle-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R024 gitlab competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**gitlab competency rollup.** The ontology answers one single-source and one cross-source question over the `gitlab` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R024.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R024.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R024.1 gitlab single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**gitlab single-source question.** "Which pipelines on the default branch failed in the last day, and at which job?" Answered from the gitlab connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over gitlab data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R024.2 gitlab cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**gitlab cross-source question.** "Which repositories exist in GitLab and GitHub with diverging default-branch heads?" Requires linking gitlab to github and repository-manager through the ontology concept: repository / pipeline. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R024.3 gitlab acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**gitlab acceptance test.** Both questions (EG-CQ-CONN-R024.1 and EG-CQ-CONN-R024.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R024.1 and EG-CQ-CONN-R024.2. Mapping acceptance depends on these producer rows: `PipelineJob`: `EG-CQ-CONN-R069.13` (`sdlc_lifecycle-v1.ttl`); `pipelineJobOf`: `EG-CQ-CONN-R069.14` (`sdlc_lifecycle-v1.ttl`); `Branch`: `EG-CQ-CONN-R069.3` (`sdlc_lifecycle-v1.ttl`); `branchOf`: `EG-CQ-CONN-R069.4` (`sdlc_lifecycle-v1.ttl`); `headCommit`: `EG-CQ-CONN-R069.5` (`sdlc_lifecycle-v1.ttl`); `isDefaultBranch`: `EG-CQ-CONN-R069.6` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `sdlc_lifecycle-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::gitlab` must parse the exact `gitlab` Coverage row and `EG-CQ-CONN-R024.1` / `EG-CQ-CONN-R024.2` Vocabulary cells. It must assert `sdlc_lifecycle-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R025 gramps competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**gramps competency rollup.** The ontology answers one single-source and one cross-source question over the `gramps` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R025.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R025.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R025.1 gramps single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**gramps single-source question.** "Which people in the tree were born in a given place before a given year, and who are their parents?" Answered from the gramps connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A fixture query over gramps data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R025.2 gramps cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**gramps cross-source question.** "Which Gramps people have a photo or document reference that exists as a file in Nextcloud?" Requires linking gramps to nextcloud through the ontology concept: person / media. Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R025.3 gramps acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**gramps acceptance test.** Both questions (EG-CQ-CONN-R025.1 and EG-CQ-CONN-R025.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R025.1 and EG-CQ-CONN-R025.2. Mapping acceptance depends on these producer rows: `birthPlace`: `EG-CQ-CONN-R076.1` (`personal-v1.ttl`); `birthYear`: `EG-CQ-CONN-R076.2` (`personal-v1.ttl`). The acceptance test must preserve `personal-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::gramps` must parse the exact `gramps` Coverage row and `EG-CQ-CONN-R025.1` / `EG-CQ-CONN-R025.2` Vocabulary cells. It must assert `personal-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R026 home-assistant competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**home-assistant competency rollup.** The ontology answers one single-source and one cross-source question over the `home-assistant` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R026.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R026.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R026.1 home-assistant single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**home-assistant single-source question.** "Which sensors reported a value outside their normal range in the last 24 hours?" Answered from the home-assistant connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over home-assistant data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R026.2 home-assistant cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**home-assistant cross-source question.** "Which Home Assistant devices went unavailable at the same time as an Uptime Kuma monitor failure?" Requires linking home-assistant to fan-manager and uptime through the ontology concept: device / host. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R026.3 home-assistant acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**home-assistant acceptance test.** Both questions (EG-CQ-CONN-R026.1 and EG-CQ-CONN-R026.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R026.1 and EG-CQ-CONN-R026.2. Mapping acceptance depends on these producer rows: `entityState`: `EG-CQ-CONN-R068.15` (`infrastructure-v1.ttl`); `unavailableSince`: `EG-CQ-CONN-R068.16` (`infrastructure-v1.ttl`). The acceptance test must preserve `infrastructure-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::home_assistant` must parse the exact `home-assistant` Coverage row and `EG-CQ-CONN-R026.1` / `EG-CQ-CONN-R026.2` Vocabulary cells. It must assert `infrastructure-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R027 jellyfin competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**jellyfin competency rollup.** The ontology answers one single-source and one cross-source question over the `jellyfin` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R027.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R027.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R027.1 jellyfin single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**jellyfin single-source question.** "Which movies in a library have never been played and were added more than a year ago?" Answered from the jellyfin connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over jellyfin data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R027.2 jellyfin cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**jellyfin cross-source question.** "Which Jellyfin items have no matching Radarr or Sonarr entry, and so cannot be re-fetched?" Requires linking jellyfin to arr and qbittorrent through the ontology concept: media item (title). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R027.3 jellyfin acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**jellyfin acceptance test.** Both questions (EG-CQ-CONN-R027.1 and EG-CQ-CONN-R027.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R027.1 and EG-CQ-CONN-R027.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R028 jena competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**jena competency rollup.** The ontology answers one single-source and one cross-source question over the `jena` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R028.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R028.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R028.1 jena single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**jena single-source question.** "Which named graphs contain the most triples and which have no recent update?" Answered from the jena connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/virtual_graph-v1.ttl`. | A fixture query over jena data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R028.2 jena cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**jena cross-source question.** "Which Jena named graphs describe the same entities as an Egeria-cataloged asset?" Requires linking jena to egeria and sql through the ontology concept: graph / dataset. Vocabulary: `crates/eg-core/ontology/virtual_graph-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R028.3 jena acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**jena acceptance test.** Both questions (EG-CQ-CONN-R028.1 and EG-CQ-CONN-R028.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R028.1 and EG-CQ-CONN-R028.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R029 kafka competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**kafka competency rollup.** The ontology answers one single-source and one cross-source question over the `kafka` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R029.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R029.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R029.1 kafka single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**kafka single-source question.** "Which consumer groups lag by more than a threshold on which topic partitions?" Answered from the kafka connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over kafka data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R029.2 kafka cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**kafka cross-source question.** "Which Kafka consumer groups with sustained lag belong to a service that Grafana is alerting on?" Requires linking kafka to langfuse and lgtm through the ontology concept: topic / service. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R029.3 kafka acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**kafka acceptance test.** Both questions (EG-CQ-CONN-R029.1 and EG-CQ-CONN-R029.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R029.1 and EG-CQ-CONN-R029.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R030 keycloak competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**keycloak competency rollup.** The ontology answers one single-source and one cross-source question over the `keycloak` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R030.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R030.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R030.1 keycloak single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**keycloak single-source question.** "Which clients can a given user sign in to, and through which role?" Answered from the keycloak connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A fixture query over keycloak data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R030.2 keycloak cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**keycloak cross-source question.** "Which people have access to a service that has an open security incident?" Requires linking keycloak to okta and servicenow through the ontology concept: person / service. Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R030.3 keycloak acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**keycloak acceptance test.** Both questions (EG-CQ-CONN-R030.1 and EG-CQ-CONN-R030.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R030.1 and EG-CQ-CONN-R030.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R031 langfuse competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**langfuse competency rollup.** The ontology answers one single-source and one cross-source question over the `langfuse` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R031.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R031.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R031.1 langfuse single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**langfuse single-source question.** "Which traces had the highest token cost and which prompt version produced them?" Answered from the langfuse connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/orchestration-v1.ttl`. | A fixture query over langfuse data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R031.2 langfuse cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**langfuse cross-source question.** "Which prompt versions with falling evaluation scores were last changed by a merged GitHub pull request?" Requires linking langfuse to data-science and github through the ontology concept: prompt / model. Vocabulary: `crates/eg-core/ontology/orchestration-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R031.3 langfuse acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**langfuse acceptance test.** Both questions (EG-CQ-CONN-R031.1 and EG-CQ-CONN-R031.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R031.1 and EG-CQ-CONN-R031.2. Mapping acceptance depends on these producer rows: `promptVersion`: `EG-CQ-CONN-R079.2` (`orchestration-v1.ttl`); `tokenCost`: `EG-CQ-CONN-R079.3` (`orchestration-v1.ttl`); `tracePrompt`: `EG-CQ-CONN-R079.4` (`orchestration-v1.ttl`); `evaluationScore`: `EG-CQ-CONN-R079.5` (`orchestration-v1.ttl`). The acceptance test must preserve `orchestration-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::langfuse` must parse the exact `langfuse` Coverage row and `EG-CQ-CONN-R031.1` / `EG-CQ-CONN-R031.2` Vocabulary cells. It must assert `orchestration-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R032 leanix competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**leanix competency rollup.** The ontology answers one single-source and one cross-source question over the `leanix` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R032.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R032.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R032.1 leanix single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**leanix single-source question.** "Which fact sheets of type application have lifecycle phase end-of-life but still have active users?" Answered from the leanix connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/enterprise-v1.ttl`. | A fixture query over leanix data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R032.2 leanix cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**leanix cross-source question.** "Which end-of-life LeanIX applications still have an active ServiceNow CI and open incidents?" Requires linking leanix to archimate and servicenow through the ontology concept: application. Vocabulary: `crates/eg-core/ontology/enterprise-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R032.3 leanix acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**leanix acceptance test.** Both questions (EG-CQ-CONN-R032.1 and EG-CQ-CONN-R032.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R032.1 and EG-CQ-CONN-R032.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R033 legal-peripherals competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**legal-peripherals competency rollup.** The ontology answers one single-source and one cross-source question over the `legal-peripherals` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R033.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R033.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R033.1 legal-peripherals single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**legal-peripherals single-source question.** "Which contracts expire within 90 days and have no renewal action recorded?" Answered from the legal-peripherals connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A fixture query over legal-peripherals data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R033.2 legal-peripherals cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**legal-peripherals cross-source question.** "Which expiring contracts have a scanned copy in Paperless-ngx and a matching OneTrust vendor assessment?" Requires linking legal-peripherals to paperless-ngx and onetrust through the ontology concept: contract / document. Vocabulary: `crates/eg-core/ontology/core-foundation-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R033.3 legal-peripherals acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**legal-peripherals acceptance test.** Both questions (EG-CQ-CONN-R033.1 and EG-CQ-CONN-R033.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R033.1 and EG-CQ-CONN-R033.2. Mapping acceptance depends on these producer rows: `counterparty`: `EG-CQ-CONN-R074.4` (`core-foundation-v1.ttl`); `agreementExpiresAt`: `EG-CQ-CONN-R074.5` (`core-foundation-v1.ttl`); `hasRenewalAction`: `EG-CQ-CONN-R074.6` (`core-foundation-v1.ttl`). The acceptance test must preserve `core-foundation-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::legal_peripherals` must parse the exact `legal-peripherals` Coverage row and `EG-CQ-CONN-R033.1` / `EG-CQ-CONN-R033.2` Vocabulary cells. It must assert `core-foundation-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R034 lgtm competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**lgtm competency rollup.** The ontology answers one single-source and one cross-source question over the `lgtm` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R034.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R034.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R034.1 lgtm single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**lgtm single-source question.** "Which alerts are firing right now, with what severity and for how long?" Answered from the lgtm connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over lgtm data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R034.2 lgtm cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**lgtm cross-source question.** "Which firing Grafana alerts have no open ServiceNow incident, and which incidents have no alert?" Requires linking lgtm to uptime and servicenow through the ontology concept: service / alert. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R034.3 lgtm acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**lgtm acceptance test.** Both questions (EG-CQ-CONN-R034.1 and EG-CQ-CONN-R034.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R034.1 and EG-CQ-CONN-R034.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R035 listmonk competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**listmonk competency rollup.** The ontology answers one single-source and one cross-source question over the `listmonk` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R035.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R035.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R035.1 listmonk single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**listmonk single-source question.** "Which campaigns had an open rate below the list average, and to which lists were they sent?" Answered from the listmonk connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over listmonk data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R035.2 listmonk cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**listmonk cross-source question.** "Which subscribers on a Listmonk list have no matching Twenty contact, and which contacts are unsubscribed?" Requires linking listmonk to twenty and postiz through the ontology concept: contact / audience. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R035.3 listmonk acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**listmonk acceptance test.** Both questions (EG-CQ-CONN-R035.1 and EG-CQ-CONN-R035.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R035.1 and EG-CQ-CONN-R035.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R036 mattermost competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**mattermost competency rollup.** The ontology answers one single-source and one cross-source question over the `mattermost` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R036.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R036.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R036.1 mattermost single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**mattermost single-source question.** "Which channels have had no posts in 90 days but still have more than ten members?" Answered from the mattermost connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over mattermost data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R036.2 mattermost cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**mattermost cross-source question.** "Which Mattermost members have no active identity-provider account, and which people lack a Mattermost account?" Requires linking mattermost to keycloak and okta through the ontology concept: person. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R036.3 mattermost acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**mattermost acceptance test.** Both questions (EG-CQ-CONN-R036.1 and EG-CQ-CONN-R036.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R036.1 and EG-CQ-CONN-R036.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R037 mealie competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**mealie competency rollup.** The ontology answers one single-source and one cross-source question over the `mealie` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R037.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R037.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R037.1 mealie single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**mealie single-source question.** "Which recipes use an ingredient that is also on the current shopping list?" Answered from the mealie connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A fixture query over mealie data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R037.2 mealie cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**mealie cross-source question.** "Which planned Mealie meals exceed the daily calorie target set in wger, and what did the groceries cost in Firefly III?" Requires linking mealie to wger and firefly-iii through the ontology concept: food / ingredient. Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R037.3 mealie acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**mealie acceptance test.** Both questions (EG-CQ-CONN-R037.1 and EG-CQ-CONN-R037.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R037.1 and EG-CQ-CONN-R037.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R038 media-downloader competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**media-downloader competency rollup.** The ontology answers one single-source and one cross-source question over the `media-downloader` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R038.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R038.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R038.1 media-downloader single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**media-downloader single-source question.** "Which download jobs failed in the last week, with what error, for which source URL?" Answered from the media-downloader connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over media-downloader data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R038.2 media-downloader cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**media-downloader cross-source question.** "Which completed downloads were never added to Jellyfin or Audiobookshelf?" Requires linking media-downloader to audiobookshelf and jellyfin through the ontology concept: media item / URL. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R038.3 media-downloader acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**media-downloader acceptance test.** Both questions (EG-CQ-CONN-R038.1 and EG-CQ-CONN-R038.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R038.1 and EG-CQ-CONN-R038.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R039 microsoft competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**microsoft competency rollup.** The ontology answers one single-source and one cross-source question over the `microsoft` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R039.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R039.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R039.1 microsoft single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**microsoft single-source question.** "Which meetings tomorrow overlap, and which attendees are double-booked?" Answered from the microsoft connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/calendar-v1.ttl`. | A fixture query over microsoft data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R039.2 microsoft cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**microsoft cross-source question.** "Which attendees of an upcoming meeting have no identity-provider account or Mattermost presence?" Requires linking microsoft to okta and mattermost through the ontology concept: person. Vocabulary: `crates/eg-core/ontology/calendar-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R039.3 microsoft acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**microsoft acceptance test.** Both questions (EG-CQ-CONN-R039.1 and EG-CQ-CONN-R039.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R039.1 and EG-CQ-CONN-R039.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R040 nextcloud competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**nextcloud competency rollup.** The ontology answers one single-source and one cross-source question over the `nextcloud` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R040.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R040.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R040.1 nextcloud single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**nextcloud single-source question.** "Which shared folders are accessible by external links and when do those shares expire?" Answered from the nextcloud connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A fixture query over nextcloud data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R040.2 nextcloud cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**nextcloud cross-source question.** "Which publicly shared Nextcloud files also exist as Paperless-ngx documents tagged confidential?" Requires linking nextcloud to keycloak and paperless-ngx through the ontology concept: file / person. Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R040.3 nextcloud acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**nextcloud acceptance test.** Both questions (EG-CQ-CONN-R040.1 and EG-CQ-CONN-R040.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R040.1 and EG-CQ-CONN-R040.2. Mapping acceptance depends on these producer rows: `FileShare`: `EG-CQ-CONN-R076.6` (`personal-v1.ttl`); `sharesFile`: `EG-CQ-CONN-R076.7` (`personal-v1.ttl`); `isPublicLink`: `EG-CQ-CONN-R076.8` (`personal-v1.ttl`); `shareExpiresAt`: `EG-CQ-CONN-R076.9` (`personal-v1.ttl`). The acceptance test must preserve `personal-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::nextcloud` must parse the exact `nextcloud` Coverage row and `EG-CQ-CONN-R040.1` / `EG-CQ-CONN-R040.2` Vocabulary cells. It must assert `personal-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R041 objectstore competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**objectstore competency rollup.** The ontology answers one single-source and one cross-source question over the `objectstore` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R041.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R041.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R041.1 objectstore single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**objectstore single-source question.** "Which buckets hold the most data and which objects have not been read in a year?" Answered from the objectstore connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over objectstore data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R041.2 objectstore cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**objectstore cross-source question.** "Which object-store artifacts are not referenced by any model or dataset in the data-science connector?" Requires linking objectstore to data-science and documentdb through the ontology concept: dataset / artifact. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R041.3 objectstore acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**objectstore acceptance test.** Both questions (EG-CQ-CONN-R041.1 and EG-CQ-CONN-R041.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R041.1 and EG-CQ-CONN-R041.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R042 okta competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**okta competency rollup.** The ontology answers one single-source and one cross-source question over the `okta` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R042.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R042.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R042.1 okta single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**okta single-source question.** "Which users hold a given application assignment through which group?" Answered from the okta connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A fixture query over okta data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R042.2 okta cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**okta cross-source question.** "Which Okta users were deactivated but still hold a Keycloak role or an open ServiceNow assignment?" Requires linking okta to keycloak and servicenow through the ontology concept: person / role. Vocabulary: `crates/eg-core/ontology/identity-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R042.3 okta acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**okta acceptance test.** Both questions (EG-CQ-CONN-R042.1 and EG-CQ-CONN-R042.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R042.1 and EG-CQ-CONN-R042.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R043 onetrust competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**onetrust competency rollup.** The ontology answers one single-source and one cross-source question over the `onetrust` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R043.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R043.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R043.1 onetrust single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**onetrust single-source question.** "Which privacy assessments are overdue and which processing activities do they cover?" Answered from the onetrust connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A fixture query over onetrust data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R043.2 onetrust cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**onetrust cross-source question.** "Which vendors with an overdue OneTrust assessment have open ERPNext purchase orders?" Requires linking onetrust to ciso-assistant and erpnext through the ontology concept: processing activity / vendor. Vocabulary: `crates/eg-core/ontology/government-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R043.3 onetrust acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**onetrust acceptance test.** Both questions (EG-CQ-CONN-R043.1 and EG-CQ-CONN-R043.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R043.1 and EG-CQ-CONN-R043.2. Mapping acceptance depends on these producer rows: `PrivacyAssessment`: `EG-CQ-CONN-R073.6` (`government-v1.ttl`); `ProcessingActivity`: `EG-CQ-CONN-R073.7` (`government-v1.ttl`); `assessmentCovers`: `EG-CQ-CONN-R073.8` (`government-v1.ttl`); `assessmentDueDate`: `EG-CQ-CONN-R073.9` (`government-v1.ttl`); `assessedVendor`: `EG-CQ-CONN-R073.10` (`government-v1.ttl`); `assessmentStatus`: `EG-CQ-CONN-R073.11` (`government-v1.ttl`). The acceptance test must preserve `government-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::onetrust` must parse the exact `onetrust` Coverage row and `EG-CQ-CONN-R043.1` / `EG-CQ-CONN-R043.2` Vocabulary cells. It must assert `government-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R044 openbao competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**openbao competency rollup.** The ontology answers one single-source and one cross-source question over the `openbao` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R044.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R044.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R044.1 openbao single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**openbao single-source question.** "Which secret paths have not been rotated in 180 days, and which policies grant read on them?" Answered from the openbao connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over openbao data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R044.2 openbao cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**openbao cross-source question.** "Which services running in container-manager read a secret path that has no recent rotation?" Requires linking openbao to keycloak and container-manager through the ontology concept: secret / service. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R044.3 openbao acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**openbao acceptance test.** Both questions (EG-CQ-CONN-R044.1 and EG-CQ-CONN-R044.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R044.1 and EG-CQ-CONN-R044.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R045 owncast competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**owncast competency rollup.** The ontology answers one single-source and one cross-source question over the `owncast` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R045.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R045.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R045.1 owncast single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**owncast single-source question.** "Which streams had the highest peak viewer count and how long did they run?" Answered from the owncast connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over owncast data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R045.2 owncast cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**owncast cross-source question.** "Which Owncast broadcasts were announced through a Postiz post, and what was the audience versus the post reach?" Requires linking owncast to postiz and mattermost through the ontology concept: broadcast / audience. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R045.3 owncast acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**owncast acceptance test.** Both questions (EG-CQ-CONN-R045.1 and EG-CQ-CONN-R045.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R045.1 and EG-CQ-CONN-R045.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R046 paperless-ngx competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**paperless-ngx competency rollup.** The ontology answers one single-source and one cross-source question over the `paperless-ngx` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R046.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R046.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R046.1 paperless-ngx single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**paperless-ngx single-source question.** "Which documents tagged as invoice have no correspondent or no due date?" Answered from the paperless-ngx connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A fixture query over paperless-ngx data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R046.2 paperless-ngx cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**paperless-ngx cross-source question.** "Which Paperless-ngx invoices have no matching ERPNext purchase invoice or Firefly III expense?" Requires linking paperless-ngx to erpnext and firefly-iii through the ontology concept: document / invoice. Vocabulary: `crates/eg-core/ontology/personal-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R046.3 paperless-ngx acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**paperless-ngx acceptance test.** Both questions (EG-CQ-CONN-R046.1 and EG-CQ-CONN-R046.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R046.1 and EG-CQ-CONN-R046.2. Mapping acceptance depends on these producer rows: `documentType`: `EG-CQ-CONN-R076.3` (`personal-v1.ttl`); `dueDate`: `EG-CQ-CONN-R076.4` (`personal-v1.ttl`); `totalAmount`: `EG-CQ-CONN-R076.5` (`personal-v1.ttl`). The acceptance test must preserve `personal-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::paperless_ngx` must parse the exact `paperless-ngx` Coverage row and `EG-CQ-CONN-R046.1` / `EG-CQ-CONN-R046.2` Vocabulary cells. It must assert `personal-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R047 plane competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**plane competency rollup.** The ontology answers one single-source and one cross-source question over the `plane` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R047.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R047.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R047.1 plane single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**plane single-source question.** "Which work items in the active cycle are overdue and which module do they belong to?" Answered from the plane connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over plane data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R047.2 plane cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**plane cross-source question.** "Which Plane work items link to a GitHub pull request that has merged but are not marked done?" Requires linking plane to github and atlassian through the ontology concept: work item. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R047.3 plane acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**plane acceptance test.** Both questions (EG-CQ-CONN-R047.1 and EG-CQ-CONN-R047.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R047.1 and EG-CQ-CONN-R047.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R048 portainer competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**portainer competency rollup.** The ontology answers one single-source and one cross-source question over the `portainer` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R048.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R048.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R048.1 portainer single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**portainer single-source question.** "Which stacks have services with fewer running replicas than desired, and on which endpoint?" Answered from the portainer connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over portainer data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R048.2 portainer cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**portainer cross-source question.** "Which Portainer stacks deploy from a Git repository whose latest GitLab pipeline failed?" Requires linking portainer to container-manager and gitlab through the ontology concept: stack / repository. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R048.3 portainer acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**portainer acceptance test.** Both questions (EG-CQ-CONN-R048.1 and EG-CQ-CONN-R048.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R048.1 and EG-CQ-CONN-R048.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R049 postiz competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**postiz competency rollup.** The ontology answers one single-source and one cross-source question over the `postiz` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R049.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R049.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R049.1 postiz single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**postiz single-source question.** "Which scheduled posts failed to publish and on which channel?" Answered from the postiz connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over postiz data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R049.2 postiz cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**postiz cross-source question.** "Which Postiz posts promote a campaign that Listmonk also sent, and which got the better engagement?" Requires linking postiz to owncast and listmonk through the ontology concept: campaign / channel. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R049.3 postiz acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**postiz acceptance test.** Both questions (EG-CQ-CONN-R049.1 and EG-CQ-CONN-R049.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R049.1 and EG-CQ-CONN-R049.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R050 pulselink competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**pulselink competency rollup.** The ontology answers one single-source and one cross-source question over the `pulselink` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R050.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R050.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R050.1 pulselink single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**pulselink single-source question.** "Which videos on a topic had transcripts mentioning a given term this week?" Answered from the pulselink connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over pulselink data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R050.2 pulselink cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**pulselink cross-source question.** "Which topics appear in PulseLink video transcripts and SearXNG news but not in any archived page?" Requires linking pulselink to searxng and audio-transcriber through the ontology concept: topic / transcript. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R050.3 pulselink acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**pulselink acceptance test.** Both questions (EG-CQ-CONN-R050.1 and EG-CQ-CONN-R050.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R050.1 and EG-CQ-CONN-R050.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R051 qbittorrent competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**qbittorrent competency rollup.** The ontology answers one single-source and one cross-source question over the `qbittorrent` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R051.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R051.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R051.1 qbittorrent single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**qbittorrent single-source question.** "Which torrents are stalled, with what ratio and how long since last activity?" Answered from the qbittorrent connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over qbittorrent data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R051.2 qbittorrent cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**qbittorrent cross-source question.** "Which stalled torrents belong to a wanted Radarr or Sonarr title, and so block it from import?" Requires linking qbittorrent to arr and jellyfin through the ontology concept: media item (torrent). Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R051.3 qbittorrent acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**qbittorrent acceptance test.** Both questions (EG-CQ-CONN-R051.1 and EG-CQ-CONN-R051.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R051.1 and EG-CQ-CONN-R051.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R052 repository-manager competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**repository-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `repository-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R052.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R052.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R052.1 repository-manager single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**repository-manager single-source question.** "Which worktrees are stale or dangling relative to their base branch?" Answered from the repository-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A fixture query over repository-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R052.2 repository-manager cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**repository-manager cross-source question.** "Which local worktrees track a branch whose pull request has already been merged on GitHub or GitLab?" Requires linking repository-manager to github and gitlab through the ontology concept: repository / branch. Vocabulary: `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R052.3 repository-manager acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**repository-manager acceptance test.** Both questions (EG-CQ-CONN-R052.1 and EG-CQ-CONN-R052.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R052.1 and EG-CQ-CONN-R052.2. Mapping acceptance depends on these producer rows: `Worktree`: `EG-CQ-CONN-R069.20` (`sdlc_lifecycle-v1.ttl`); `worktreeState`: `EG-CQ-CONN-R069.21` (`sdlc_lifecycle-v1.ttl`); `tracksBranch`: `EG-CQ-CONN-R069.22` (`sdlc_lifecycle-v1.ttl`); `proposalBranch`: `EG-CQ-CONN-R069.23` (`sdlc_lifecycle-v1.ttl`); `Repository`: `EG-CQ-CONN-R069.2` (`sdlc_lifecycle-v1.ttl`); `Branch`: `EG-CQ-CONN-R069.3` (`sdlc_lifecycle-v1.ttl`); `proposalState`: `EG-CQ-CONN-R069.11` (`sdlc_lifecycle-v1.ttl`). The acceptance test must preserve `sdlc_lifecycle-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::repository_manager` must parse the exact `repository-manager` Coverage row and `EG-CQ-CONN-R052.1` / `EG-CQ-CONN-R052.2` Vocabulary cells. It must assert `sdlc_lifecycle-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R053 rom-manager competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**rom-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `rom-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R053.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R053.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R053.1 rom-manager single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**rom-manager single-source question.** "Which ROMs in a platform collection fail a checksum match against the reference set?" Answered from the rom-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over rom-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R053.2 rom-manager cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**rom-manager cross-source question.** "Which ROMs were obtained by a media-downloader job and which are still unconverted?" Requires linking rom-manager to media-downloader and jellyfin through the ontology concept: game / file. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R053.3 rom-manager acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**rom-manager acceptance test.** Both questions (EG-CQ-CONN-R053.1 and EG-CQ-CONN-R053.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R053.1 and EG-CQ-CONN-R053.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R054 salesforce competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**salesforce competency rollup.** The ontology answers one single-source and one cross-source question over the `salesforce` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R054.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R054.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R054.1 salesforce single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**salesforce single-source question.** "Which open opportunities close this quarter, with what amount and owner?" Answered from the salesforce connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A fixture query over salesforce data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R054.2 salesforce cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**salesforce cross-source question.** "Which Salesforce accounts have an open ServiceNow incident and an opportunity closing this quarter?" Requires linking salesforce to twenty and servicenow through the ontology concept: account / customer. Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R054.3 salesforce acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**salesforce acceptance test.** Both questions (EG-CQ-CONN-R054.1 and EG-CQ-CONN-R054.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R054.1 and EG-CQ-CONN-R054.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R055 scholarx competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**scholarx competency rollup.** The ontology answers one single-source and one cross-source question over the `scholarx` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R055.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R055.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R055.1 scholarx single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**scholarx single-source question.** "Which papers cite a given paper and were published in the last two years?" Answered from the scholarx connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over scholarx data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R055.2 scholarx cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**scholarx cross-source question.** "Which papers on a topic are in ScholarX but were never surfaced by a SearXNG query for that topic?" Requires linking scholarx to searxng and langfuse through the ontology concept: paper / topic. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R055.3 scholarx acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**scholarx acceptance test.** Both questions (EG-CQ-CONN-R055.1 and EG-CQ-CONN-R055.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R055.1 and EG-CQ-CONN-R055.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R056 searxng competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**searxng competency rollup.** The ontology answers one single-source and one cross-source question over the `searxng` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R056.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R056.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R056.1 searxng single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**searxng single-source question.** "Which engines returned no results for a given query, and which returned the most?" Answered from the searxng connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over searxng data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R056.2 searxng cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**searxng cross-source question.** "Which URLs from a SearXNG query are not yet archived in ArchiveBox?" Requires linking searxng to freshrss and archivebox through the ontology concept: URL / query. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R056.3 searxng acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**searxng acceptance test.** Both questions (EG-CQ-CONN-R056.1 and EG-CQ-CONN-R056.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R056.1 and EG-CQ-CONN-R056.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R057 servicenow competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**servicenow competency rollup.** The ontology answers one single-source and one cross-source question over the `servicenow` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R057.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R057.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R057.1 servicenow single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**servicenow single-source question.** "Which incidents are open on a given configuration item and who is assigned?" Answered from the servicenow connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A fixture query over servicenow data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R057.2 servicenow cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**servicenow cross-source question.** "Which open incidents on a CI also show a Grafana alert and a failing Uptime Kuma monitor?" Requires linking servicenow to okta and lgtm through the ontology concept: configuration item / service. Vocabulary: `crates/eg-core/ontology/archimate-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R057.3 servicenow acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**servicenow acceptance test.** Both questions (EG-CQ-CONN-R057.1 and EG-CQ-CONN-R057.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R057.1 and EG-CQ-CONN-R057.2. Mapping acceptance depends on these producer rows: `ConfigurationItem`: `EG-CQ-CONN-R070.5` (`archimate-v1.ttl`); `affectsConfigurationItem`: `EG-CQ-CONN-R070.6` (`archimate-v1.ttl`); `incidentState`: `EG-CQ-CONN-R070.7` (`archimate-v1.ttl`); `incidentAssignee`: `EG-CQ-CONN-R070.8` (`archimate-v1.ttl`). The acceptance test must preserve `archimate-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::servicenow` must parse the exact `servicenow` Coverage row and `EG-CQ-CONN-R057.1` / `EG-CQ-CONN-R057.2` Vocabulary cells. It must assert `archimate-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R058 sql competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**sql competency rollup.** The ontology answers one single-source and one cross-source question over the `sql` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R058.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R058.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R058.1 sql single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**sql single-source question.** "Which tables have no primary key, and which columns reference tables that do not exist?" Answered from the sql connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over sql data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R058.2 sql cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**sql cross-source question.** "Which SQL tables are not cataloged in Egeria, and which cataloged tables no longer exist?" Requires linking sql to egeria and documentdb through the ontology concept: table / data asset. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R058.3 sql acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**sql acceptance test.** Both questions (EG-CQ-CONN-R058.1 and EG-CQ-CONN-R058.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R058.1 and EG-CQ-CONN-R058.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R059 stirlingpdf competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**stirlingpdf competency rollup.** The ontology answers one single-source and one cross-source question over the `stirlingpdf` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R059.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R059.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R059.1 stirlingpdf single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**stirlingpdf single-source question.** "Which operations failed on which PDFs and with what error?" Answered from the stirlingpdf connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/action-v1.ttl`. | A fixture query over stirlingpdf data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R059.2 stirlingpdf cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**stirlingpdf cross-source question.** "Which PDFs processed by Stirling-PDF were stored in Paperless-ngx or Nextcloud, and which were not?" Requires linking stirlingpdf to paperless-ngx and nextcloud through the ontology concept: document. Vocabulary: `crates/eg-core/ontology/action-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R059.3 stirlingpdf acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**stirlingpdf acceptance test.** Both questions (EG-CQ-CONN-R059.1 and EG-CQ-CONN-R059.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R059.1 and EG-CQ-CONN-R059.2. Mapping acceptance depends on these producer rows: `failureReason`: `EG-CQ-CONN-R082.1` (`action-v1.ttl`). The acceptance test must preserve `action-v1.ttl` in `plan.md` Coverage and both question Vocabulary cells. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. `connector_audit_reassignment::stirlingpdf` must parse the exact `stirlingpdf` Coverage row and `EG-CQ-CONN-R059.1` / `EG-CQ-CONN-R059.2` Vocabulary cells. It must assert `action-v1.ttl` in all three cells and resolve every listed producer IRI through its registered CoreSpec module. It must reject a missing producer term, a wrong-module IRI, and an unrelated-row-only edit. Decomposition lint must pass. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R060 systems-manager competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**systems-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `systems-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R060.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R060.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R060.1 systems-manager single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**systems-manager single-source question.** "Which hosts have pending OS updates and what is their uptime?" Answered from the systems-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over systems-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R060.2 systems-manager cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**systems-manager cross-source question.** "Which hosts with pending updates have no Ansible Tower patch job scheduled and no ServiceNow change?" Requires linking systems-manager to ansible-tower and servicenow through the ontology concept: host (configuration item). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R060.3 systems-manager acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**systems-manager acceptance test.** Both questions (EG-CQ-CONN-R060.1 and EG-CQ-CONN-R060.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R060.1 and EG-CQ-CONN-R060.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R061 technitium-dns competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**technitium-dns competency rollup.** The ontology answers one single-source and one cross-source question over the `technitium-dns` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R061.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R061.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R061.1 technitium-dns single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**technitium-dns single-source question.** "Which zones contain records pointing to an address that no host answers on?" Answered from the technitium-dns connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over technitium-dns data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R061.2 technitium-dns cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**technitium-dns cross-source question.** "Which DNS A records have no Caddy route and no Uptime Kuma monitor?" Requires linking technitium-dns to caddy and uptime through the ontology concept: hostname. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R061.3 technitium-dns acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**technitium-dns acceptance test.** Both questions (EG-CQ-CONN-R061.1 and EG-CQ-CONN-R061.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R061.1 and EG-CQ-CONN-R061.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R062 tunnel-manager competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**tunnel-manager competency rollup.** The ontology answers one single-source and one cross-source question over the `tunnel-manager` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R062.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R062.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R062.1 tunnel-manager single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**tunnel-manager single-source question.** "Which SSH hosts in the inventory failed their last connection, and with what error?" Answered from the tunnel-manager connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over tunnel-manager data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R062.2 tunnel-manager cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**tunnel-manager cross-source question.** "Which hosts that tunnel-manager cannot reach are still listed as managed in Ansible Tower?" Requires linking tunnel-manager to ansible-tower and systems-manager through the ontology concept: host. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R062.3 tunnel-manager acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**tunnel-manager acceptance test.** Both questions (EG-CQ-CONN-R062.1 and EG-CQ-CONN-R062.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R062.1 and EG-CQ-CONN-R062.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R063 twenty competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**twenty competency rollup.** The ontology answers one single-source and one cross-source question over the `twenty` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R063.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R063.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R063.1 twenty single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**twenty single-source question.** "Which people at a company have no logged activity in the last 60 days while a deal is open?" Answered from the twenty connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A fixture query over twenty data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R063.2 twenty cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**twenty cross-source question.** "Which Twenty contacts also exist as Salesforce contacts with different email addresses?" Requires linking twenty to salesforce and listmonk through the ontology concept: person / company. Vocabulary: `crates/eg-core/ontology/commercial-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R063.3 twenty acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**twenty acceptance test.** Both questions (EG-CQ-CONN-R063.1 and EG-CQ-CONN-R063.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R063.1 and EG-CQ-CONN-R063.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R064 uptime competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**uptime competency rollup.** The ontology answers one single-source and one cross-source question over the `uptime` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R064.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R064.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R064.1 uptime single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**uptime single-source question.** "Which monitored services were down in the last 24 hours and for how long?" Answered from the uptime connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A fixture query over uptime data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R064.2 uptime cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**uptime cross-source question.** "Which services Uptime Kuma saw down had a Grafana alert or a Caddy route error at the same time?" Requires linking uptime to lgtm and caddy through the ontology concept: service / hostname. Vocabulary: `crates/eg-core/ontology/infrastructure-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R064.3 uptime acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**uptime acceptance test.** Both questions (EG-CQ-CONN-R064.1 and EG-CQ-CONN-R064.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R064.1 and EG-CQ-CONN-R064.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R065 vector competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**vector competency rollup.** The ontology answers one single-source and one cross-source question over the `vector` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R065.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R065.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R065.1 vector single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**vector single-source question.** "Which collections have the most vectors and which have an embedding dimension that mismatches the model?" Answered from the vector connector alone, carrying provenance (source, record id, as-of). Vocabulary: MISSING. | A fixture query over vector data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R065.2 vector cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**vector cross-source question.** "Which Paperless-ngx documents have no embedding stored in the vector database?" Requires linking vector to data-science and paperless-ngx through the ontology concept: embedding / document. Vocabulary: MISSING. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R065.3 vector acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**vector acceptance test.** Both questions (EG-CQ-CONN-R065.1 and EG-CQ-CONN-R065.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R065.1 and EG-CQ-CONN-R065.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R066 wger competency rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**wger competency rollup.** The ontology answers one single-source and one cross-source question over the `wger` connector\'s access contract (virtual-first); delivered as children `EG-CQ-CONN-R066.1`, `.2`, `.3`. Becomes LANDED when every child is LANDED. | Children EG-CQ-CONN-R066.1 to .3 are LANDED. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R066.1 wger single-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**wger single-source question.** "Which workout routines were not completed in the last two weeks and which exercises were skipped?" Answered from the wger connector alone, carrying provenance (source, record id, as-of). Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A fixture query over wger data returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R066.2 wger cross-source question Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**wger cross-source question.** "Which weeks of low workout completion coincide with a Mealie meal plan above the calorie target?" Requires linking wger to mealie and home-assistant through the ontology concept: person / nutrition plan. Vocabulary: `crates/eg-core/ontology/nutrition-v1.ttl`. | A federated fixture over both connectors returns a non-empty provenance-carrying answer, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R066.3 wger acceptance test Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**wger acceptance test.** Both questions (EG-CQ-CONN-R066.1 and EG-CQ-CONN-R066.2) run end to end through the connector's declared access contract, fetching from the source at query time with no copy of the source required in the engine, and return a non-empty, provenance-carrying answer, or a typed abstention naming the unconnected source. Depends on EG-CQ-CONN-R066.1 and EG-CQ-CONN-R066.2. | One acceptance test asserts non-empty answer with provenance fields, or the typed abstention, for each question. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R067 Contract kinds rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Contract kinds rollup.** For each access-contract kind the ontology can declare a source of that kind and the engine answers a question by fetching through the contract at query time, with no copy of the source in the engine; delivered as children `EG-CQ-CONN-R067.1` to `EG-CQ-CONN-R067.6`. Mechanism: `specs/federated-query-and-reasoning` and `specs/unified-data-plane`; no new functionality outside them. | All children verified. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R067.1 MCP contract answers at query time Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**MCP contract answers at query time.** One acceptance test declares a connector that exposes MCP tools and resources in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R067.2 A2A contract answers at query time Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**A2A contract answers at query time.** One acceptance test declares an external agent reached over the A2A protocol in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R067.3 API (REST) contract answers at query time Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**API (REST) contract answers at query time.** One acceptance test declares a connector that calls an HTTP API described by an operation contract in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R067.4 GraphQL contract answers at query time Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**GraphQL contract answers at query time.** One acceptance test declares a connector whose source speaks GraphQL in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R067.5 virtual graph over a relational or document store contract answers at query time Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**virtual graph over a relational or document store contract answers at query time.** One acceptance test declares a SQL or document source mapped by a virtual-graph mapping in the ontology, asks one question, and asserts the answer was fetched through the contract (provenance names the contract and the fetch time) and that no source rows were stored in the engine. | One acceptance test asserts a non-empty answer, contract provenance and an unchanged engine row count for that source, or a typed abstention naming the unconnected source. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R067.6 Materialisation is declared, never implicit Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Materialisation is declared, never implicit.** A source may be copied into the engine only when its ontology declaration states a materialisation policy with a reason; a source with no such statement is always fetched at query time. | One test asserts a source without a materialisation statement stores no rows after a query, and one with the statement does. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068 infrastructure-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**infrastructure-v1.ttl additions rollup.** 26 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R068.1` to `EG-CQ-CONN-R068.26`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.1 shapes companion for infrastructure-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for infrastructure-v1.** Create `crates/eg-core/ontology/infrastructure-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `infrastructure` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_infrastructure_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.2 AutomationJob Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**AutomationJob.** Add owl:Class `:AutomationJob` (subClassOf :Workload-adjacent bfo process; one Tower job run) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: AutomationJob: jobStatus minCount 1, in `infrastructure-v1.shapes.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::AutomationJob_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.3 AutomationJobTemplate Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**AutomationJobTemplate.** Add owl:Class `:AutomationJobTemplate` (template a job instantiates) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::AutomationJobTemplate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.4 jobStatus Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**jobStatus.** Add owl:DatatypeProperty `:jobStatus` (AutomationJob -> xsd:string (successful|failed|running|canceled)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: sh:in on jobStatus, in `infrastructure-v1.shapes.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::jobStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.5 ranAgainstHost Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ranAgainstHost.** Add owl:ObjectProperty `:ranAgainstHost` (AutomationJob -> :Host) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: ansible-tower. | `ontology_audit_infrastructure_v1::ranAgainstHost_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.6 routeHostname Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**routeHostname.** Add owl:DatatypeProperty `:routeHostname` (ProxyRoute -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: routeHostname minCount 1 on ProxyRoute, in `infrastructure-v1.shapes.ttl`. Needed by: caddy. | `ontology_audit_infrastructure_v1::routeHostname_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.7 upstreamAddress Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**upstreamAddress.** Add owl:DatatypeProperty `:upstreamAddress` (ProxyRoute -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: caddy. | `ontology_audit_infrastructure_v1::upstreamAddress_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.8 Alert Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Alert.** Add owl:Class `:Alert` (a firing or resolved alert rule instance on a :Service) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: Alert: alertSeverity, alertState minCount 1, in `infrastructure-v1.shapes.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::Alert_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.9 alertSeverity Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**alertSeverity.** Add owl:DatatypeProperty `:alertSeverity` (Alert -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::alertSeverity_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.10 alertState Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**alertState.** Add owl:DatatypeProperty `:alertState` (Alert -> xsd:string (firing|resolved|pending)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::alertState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.11 firingSince Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**firingSince.** Add owl:DatatypeProperty `:firingSince` (Alert -> xsd:dateTime) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::firingSince_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.12 alertsOn Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**alertsOn.** Add owl:ObjectProperty `:alertsOn` (Alert -> :Service) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: lgtm. | `ontology_audit_infrastructure_v1::alertsOn_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.13 lastPushedAt Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**lastPushedAt.** Add owl:DatatypeProperty `:lastPushedAt` (ContainerImage -> xsd:dateTime) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: dockerhub. | `ontology_audit_infrastructure_v1::lastPushedAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.14 pullCount Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**pullCount.** Add owl:DatatypeProperty `:pullCount` (ContainerImage -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: pullCount minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: dockerhub. | `ontology_audit_infrastructure_v1::pullCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.15 entityState Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**entityState.** Add owl:DatatypeProperty `:entityState` (ha :Entity -> xsd:string (value or unavailable)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: home-assistant. | `ontology_audit_infrastructure_v1::entityState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.16 unavailableSince Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**unavailableSince.** Add owl:DatatypeProperty `:unavailableSince` (ha :Entity -> xsd:dateTime) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: home-assistant. | `ontology_audit_infrastructure_v1::unavailableSince_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.17 desiredReplicas Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**desiredReplicas.** Add owl:DatatypeProperty `:desiredReplicas` (ContainerStack -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::desiredReplicas_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.18 runningReplicas Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**runningReplicas.** Add owl:DatatypeProperty `:runningReplicas` (ContainerStack -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::runningReplicas_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.19 stackSourceRepository Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**stackSourceRepository.** Add owl:ObjectProperty `:stackSourceRepository` (ContainerStack -> :Repository) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::stackSourceRepository_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.20 ManagementEnvironment Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ManagementEnvironment.** Add owl:Class `:ManagementEnvironment` (a Portainer environment (named so it does not collide with the probed :Endpoint)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: portainer. | `ontology_audit_infrastructure_v1::ManagementEnvironment_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.21 pendingUpdateCount Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**pendingUpdateCount.** Add owl:DatatypeProperty `:pendingUpdateCount` (OperatingSystem -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. SHACL: minInclusive 0, in `infrastructure-v1.shapes.ttl`. Needed by: systems-manager. | `ontology_audit_infrastructure_v1::pendingUpdateCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.22 uptimeSeconds Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**uptimeSeconds.** Add owl:DatatypeProperty `:uptimeSeconds` (OperatingSystem -> xsd:integer) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: systems-manager. | `ontology_audit_infrastructure_v1::uptimeSeconds_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.23 recordType Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**recordType.** Add owl:DatatypeProperty `:recordType` (DnsRecord -> xsd:string (the existing :dnsType is typed on :DNSService, not the record)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: technitium-dns. | `ontology_audit_infrastructure_v1::recordType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.24 recordValue Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**recordValue.** Add owl:DatatypeProperty `:recordValue` (DnsRecord -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: technitium-dns. | `ontology_audit_infrastructure_v1::recordValue_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.25 lastConnectionStatus Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**lastConnectionStatus.** Add owl:DatatypeProperty `:lastConnectionStatus` (Host -> xsd:string (ok|failed)) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: tunnel-manager. | `ontology_audit_infrastructure_v1::lastConnectionStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R068.26 lastConnectionError Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**lastConnectionError.** Add owl:DatatypeProperty `:lastConnectionError` (Host -> xsd:string) to `crates/eg-core/ontology/infrastructure-v1.ttl`. Needed by: tunnel-manager. | `ontology_audit_infrastructure_v1::lastConnectionError_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069 sdlc_lifecycle-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**sdlc_lifecycle-v1.ttl additions rollup.** 23 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R069.1` to `EG-CQ-CONN-R069.23`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.1 shapes companion for sdlc_lifecycle-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for sdlc_lifecycle-v1.** Create `crates/eg-core/ontology/sdlc_lifecycle-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `sdlc_lifecycle` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_sdlc_lifecycle_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.2 Repository Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Repository.** Add owl:Class `:Repository` (source repository (class used by infra:ContainerImage/aliasOf but never declared)) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: dockerhub, github, repository-manager. | `ontology_audit_sdlc_lifecycle_v1::Repository_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.3 Branch Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Branch.** Add owl:Class `:Branch` (a ref in a Repository) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab, repository-manager. | `ontology_audit_sdlc_lifecycle_v1::Branch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.4 branchOf Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**branchOf.** Add owl:ObjectProperty `:branchOf` (Branch -> Repository) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::branchOf_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.5 headCommit Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**headCommit.** Add owl:ObjectProperty `:headCommit` (Branch -> software:Commit) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::headCommit_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.6 isDefaultBranch Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**isDefaultBranch.** Add owl:DatatypeProperty `:isDefaultBranch` (Branch -> xsd:boolean) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::isDefaultBranch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.7 blockedBy Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**blockedBy.** Add owl:ObjectProperty `:blockedBy` (Ticket -> Ticket) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian. | `ontology_audit_sdlc_lifecycle_v1::blockedBy_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.8 assignedTo Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**assignedTo.** Add owl:ObjectProperty `:assignedTo` (Ticket -> :Person) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian. | `ontology_audit_sdlc_lifecycle_v1::assignedTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.9 ticketStatus Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ticketStatus.** Add owl:DatatypeProperty `:ticketStatus` (Ticket -> xsd:string) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian, plane. | `ontology_audit_sdlc_lifecycle_v1::ticketStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.10 closesTicket Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**closesTicket.** Add owl:ObjectProperty `:closesTicket` (CodeChangeProposal -> Ticket) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: atlassian, github. | `ontology_audit_sdlc_lifecycle_v1::closesTicket_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.11 proposalState Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**proposalState.** Add owl:DatatypeProperty `:proposalState` (CodeChangeProposal -> xsd:string (open|merged|closed)) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. SHACL: sh:in, in `sdlc_lifecycle-v1.shapes.ttl`. Needed by: atlassian, github, repository-manager. | `ontology_audit_sdlc_lifecycle_v1::proposalState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.12 requestedReviewer Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**requestedReviewer.** Add owl:ObjectProperty `:requestedReviewer` (CodeChangeProposal -> :Person) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: github. | `ontology_audit_sdlc_lifecycle_v1::requestedReviewer_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.13 PipelineJob Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**PipelineJob.** Add owl:Class `:PipelineJob` (one job inside a PipelineRun) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::PipelineJob_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.14 pipelineJobOf Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**pipelineJobOf.** Add owl:ObjectProperty `:pipelineJobOf` (PipelineJob -> PipelineRun) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: gitlab. | `ontology_audit_sdlc_lifecycle_v1::pipelineJobOf_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.15 IterationCycle Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**IterationCycle.** Add owl:Class `:IterationCycle` (Plane cycle / sprint) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::IterationCycle_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.16 inCycle Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**inCycle.** Add owl:ObjectProperty `:inCycle` (Ticket -> IterationCycle) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::inCycle_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.17 WorkModule Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**WorkModule.** Add owl:Class `:WorkModule` (Plane module grouping tickets) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::WorkModule_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.18 inModule Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**inModule.** Add owl:ObjectProperty `:inModule` (Ticket -> WorkModule) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::inModule_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.19 ticketDueDate Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ticketDueDate.** Add owl:DatatypeProperty `:ticketDueDate` (Ticket -> xsd:date) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: plane. | `ontology_audit_sdlc_lifecycle_v1::ticketDueDate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.20 Worktree Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Worktree.** Add owl:Class `:Worktree` (a linked git worktree of a Repository) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::Worktree_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.21 worktreeState Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**worktreeState.** Add owl:DatatypeProperty `:worktreeState` (Worktree -> xsd:string (active|stale|dangling|merged)) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. SHACL: sh:in, in `sdlc_lifecycle-v1.shapes.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::worktreeState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.22 tracksBranch Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**tracksBranch.** Add owl:ObjectProperty `:tracksBranch` (Worktree -> Branch) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::tracksBranch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R069.23 proposalBranch Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**proposalBranch.** Add owl:ObjectProperty `:proposalBranch` (CodeChangeProposal -> Branch) to `crates/eg-core/ontology/sdlc_lifecycle-v1.ttl`. Needed by: repository-manager. | `ontology_audit_sdlc_lifecycle_v1::proposalBranch_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R070 archimate-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**archimate-v1.ttl additions rollup.** 8 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R070.1` to `EG-CQ-CONN-R070.8`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R070.1 shapes companion for archimate-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for archimate-v1.** Create `crates/eg-core/ontology/archimate-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `archimate` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_archimate_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R070.2 ApplicationComponent Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ApplicationComponent.** Add owl:Class `:ApplicationComponent` (subClassOf :ApplicationLayer; anchor for LeanIX/Backstage components) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: archimate. | `ontology_audit_archimate_v1::ApplicationComponent_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R070.3 ArchimateRelationship Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ArchimateRelationship.** Add owl:Class `:ArchimateRelationship` (reified relationship) to `crates/eg-core/ontology/archimate-v1.ttl`. SHACL: ArchimateRelationship: relationshipType, relSource, relTarget minCount 1, in `archimate-v1.shapes.ttl`. Needed by: archimate. | `ontology_audit_archimate_v1::ArchimateRelationship_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R070.4 relationshipType Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**relationshipType.** Add owl:DatatypeProperty `:relationshipType` (ArchimateRelationship -> xsd:string (Serving|Realization|Assignment|...)) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: archimate. | `ontology_audit_archimate_v1::relationshipType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R070.5 ConfigurationItem Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ConfigurationItem.** Add owl:Class `:ConfigurationItem` (subClassOf :ApplicationLayer; crosswalk anchor for a ServiceNow CI) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::ConfigurationItem_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R070.6 affectsConfigurationItem Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**affectsConfigurationItem.** Add owl:ObjectProperty `:affectsConfigurationItem` (Incident|Change -> ConfigurationItem) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::affectsConfigurationItem_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R070.7 incidentState Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**incidentState.** Add owl:DatatypeProperty `:incidentState` (Incident -> xsd:string (new|in_progress|resolved|closed)) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::incidentState_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R070.8 incidentAssignee Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**incidentAssignee.** Add owl:ObjectProperty `:incidentAssignee` (Incident -> :Person) to `crates/eg-core/ontology/archimate-v1.ttl`. Needed by: servicenow. | `ontology_audit_archimate_v1::incidentAssignee_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R071 documentation-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**documentation-v1.ttl additions rollup.** 6 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R071.1`, `EG-CQ-CONN-R071.2`, `EG-CQ-CONN-R071.3`, `EG-CQ-CONN-R071.4`, `EG-CQ-CONN-R071.5`, `EG-CQ-CONN-R071.6`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R071.1 shapes companion for documentation-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for documentation-v1.** Create `crates/eg-core/ontology/documentation-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `documentation` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_documentation_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R071.2 WebSnapshot Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**WebSnapshot.** Add owl:Class `:WebSnapshot` (subClassOf :Document; a captured URL snapshot) to `crates/eg-core/ontology/documentation-v1.ttl`. SHACL: WebSnapshot: sourceRef minCount 1 (the URL), in `documentation-v1.shapes.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::WebSnapshot_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R071.3 ArchiveResult Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ArchiveResult.** Add owl:Class `:ArchiveResult` (one extractor outcome for a snapshot) to `crates/eg-core/ontology/documentation-v1.ttl`. SHACL: ArchiveResult: extractorName, resultStatus minCount 1, in `documentation-v1.shapes.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::ArchiveResult_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R071.4 hasArchiveResult Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**hasArchiveResult.** Add owl:ObjectProperty `:hasArchiveResult` (WebSnapshot -> ArchiveResult) to `crates/eg-core/ontology/documentation-v1.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::hasArchiveResult_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R071.5 extractorName Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**extractorName.** Add owl:DatatypeProperty `:extractorName` (ArchiveResult -> xsd:string) to `crates/eg-core/ontology/documentation-v1.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::extractorName_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R071.6 resultStatus Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**resultStatus.** Add owl:DatatypeProperty `:resultStatus` (ArchiveResult -> xsd:string (succeeded|failed|skipped)) to `crates/eg-core/ontology/documentation-v1.ttl`. Needed by: archivebox. | `ontology_audit_documentation_v1::resultStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R072 process_intelligence-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**process_intelligence-v1.ttl additions rollup.** 7 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R072.1`, `EG-CQ-CONN-R072.2`, `EG-CQ-CONN-R072.3`, `EG-CQ-CONN-R072.4`, `EG-CQ-CONN-R072.5`, `EG-CQ-CONN-R072.6`, `EG-CQ-CONN-R072.7`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R072.1 EpcFunction Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**EpcFunction.** Add owl:Class `:EpcFunction` (subClassOf :ProcessEventType; ARIS EPC function) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: aris. | `ontology_audit_process_intelligence_v1::EpcFunction_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R072.2 EpcRuleOperator Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**EpcRuleOperator.** Add owl:Class `:EpcRuleOperator` (ARIS split/join (AND|OR|XOR) between EPC nodes) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: aris. | `ontology_audit_process_intelligence_v1::EpcRuleOperator_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R072.3 flowsTo Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**flowsTo.** Add owl:ObjectProperty `:flowsTo` (model-level control-flow edge: EPC node -> EPC node (distinct from instance-level :directlyFollows)) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: aris. | `ontology_audit_process_intelligence_v1::flowsTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R072.4 ProcessInstance Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ProcessInstance.** Add owl:Class `:ProcessInstance` (one running or finished execution of a ProcessModelVersion) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::ProcessInstance_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R072.5 instanceOfProcessModel Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**instanceOfProcessModel.** Add owl:ObjectProperty `:instanceOfProcessModel` (ProcessInstance -> :ProcessModelVersion) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::instanceOfProcessModel_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R072.6 stoppedAtActivity Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**stoppedAtActivity.** Add owl:ObjectProperty `:stoppedAtActivity` (ProcessInstance -> :ProcessEventType) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::stoppedAtActivity_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R072.7 raisedIncident Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**raisedIncident.** Add owl:ObjectProperty `:raisedIncident` (ProcessInstance -> :ApplicationEvent (archimate crosswalk)) to `crates/eg-core/ontology/process_intelligence-v1.ttl`. Needed by: camunda. | `ontology_audit_process_intelligence_v1::raisedIncident_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073 government-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**government-v1.ttl additions rollup.** 11 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R073.1` to `EG-CQ-CONN-R073.11`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.1 shapes companion for government-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for government-v1.** Create `crates/eg-core/ontology/government-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `government` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_government_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.2 RiskScenario Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**RiskScenario.** Add owl:Class `:RiskScenario` (a risk scenario in a risk assessment) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::RiskScenario_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.3 mitigatesRisk Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**mitigatesRisk.** Add owl:ObjectProperty `:mitigatesRisk` (SecurityControl -> RiskScenario) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::mitigatesRisk_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.4 inFramework Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**inFramework.** Add owl:ObjectProperty `:inFramework` (SecurityControl -> core:Framework) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::inFramework_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.5 riskAffectsService Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**riskAffectsService.** Add owl:ObjectProperty `:riskAffectsService` (RiskScenario -> infra:Service) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: ciso-assistant. | `ontology_audit_government_v1::riskAffectsService_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.6 PrivacyAssessment Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**PrivacyAssessment.** Add owl:Class `:PrivacyAssessment` (DPIA/PIA instance) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::PrivacyAssessment_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.7 ProcessingActivity Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ProcessingActivity.** Add owl:Class `:ProcessingActivity` (a records-of-processing entry) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::ProcessingActivity_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.8 assessmentCovers Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**assessmentCovers.** Add owl:ObjectProperty `:assessmentCovers` (PrivacyAssessment -> ProcessingActivity) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessmentCovers_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.9 assessmentDueDate Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**assessmentDueDate.** Add owl:DatatypeProperty `:assessmentDueDate` (PrivacyAssessment -> xsd:date) to `crates/eg-core/ontology/government-v1.ttl`. SHACL: assessmentDueDate minCount 1, in `government-v1.shapes.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessmentDueDate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.10 assessedVendor Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**assessedVendor.** Add owl:ObjectProperty `:assessedVendor` (PrivacyAssessment -> trm:Vendor) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessedVendor_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R073.11 assessmentStatus Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**assessmentStatus.** Add owl:DatatypeProperty `:assessmentStatus` (PrivacyAssessment -> xsd:string (draft|in_review|approved); overdue is derived from as-of and assessmentDueDate) to `crates/eg-core/ontology/government-v1.ttl`. Needed by: onetrust. | `ontology_audit_government_v1::assessmentStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R074 core-foundation-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**core-foundation-v1.ttl additions rollup.** 6 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R074.1`, `EG-CQ-CONN-R074.2`, `EG-CQ-CONN-R074.3`, `EG-CQ-CONN-R074.4`, `EG-CQ-CONN-R074.5`, `EG-CQ-CONN-R074.6`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R074.1 shapes companion for core-foundation-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for core-foundation-v1.** Create `crates/eg-core/ontology/core-foundation-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `core-foundation` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_core_foundation_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R074.2 GlossaryTerm Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**GlossaryTerm.** Add owl:Class `:GlossaryTerm` (subClassOf :Concept; a governed business term) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: egeria. | `ontology_audit_core_foundation_v1::GlossaryTerm_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R074.3 termAssignedTo Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**termAssignedTo.** Add owl:ObjectProperty `:termAssignedTo` (GlossaryTerm -> :Dataset) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: egeria. | `ontology_audit_core_foundation_v1::termAssignedTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R074.4 counterparty Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**counterparty.** Add owl:ObjectProperty `:counterparty` (Agreement -> :LegalEntity) to `crates/eg-core/ontology/core-foundation-v1.ttl`. SHACL: counterparty minCount 1, in `core-foundation-v1.shapes.ttl`. Needed by: legal-peripherals. | `ontology_audit_core_foundation_v1::counterparty_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R074.5 agreementExpiresAt Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**agreementExpiresAt.** Add owl:DatatypeProperty `:agreementExpiresAt` (Agreement -> xsd:date) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: legal-peripherals. | `ontology_audit_core_foundation_v1::agreementExpiresAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R074.6 hasRenewalAction Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**hasRenewalAction.** Add owl:ObjectProperty `:hasRenewalAction` (Agreement -> :Action) to `crates/eg-core/ontology/core-foundation-v1.ttl`. Needed by: legal-peripherals. | `ontology_audit_core_foundation_v1::hasRenewalAction_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R075 finance-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**finance-v1.ttl additions rollup.** 7 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R075.1`, `EG-CQ-CONN-R075.2`, `EG-CQ-CONN-R075.3`, `EG-CQ-CONN-R075.4`, `EG-CQ-CONN-R075.5`, `EG-CQ-CONN-R075.6`, `EG-CQ-CONN-R075.7`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R075.1 shapes companion for finance-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for finance-v1.** Create `crates/eg-core/ontology/finance-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `finance` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_finance_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R075.2 orderQty Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**orderQty.** Add owl:DatatypeProperty `:orderQty` (VersionedOrder -> xsd:float) to `crates/eg-core/ontology/finance-v1.ttl`. SHACL: filledQty sh:lessThanOrEquals orderQty, in `finance-v1.shapes.ttl`. Needed by: emerald-exchange. | `ontology_audit_finance_v1::orderQty_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R075.3 Budget Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Budget.** Add owl:Class `:Budget` (a spending budget) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::Budget_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R075.4 budgetLimit Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**budgetLimit.** Add owl:DatatypeProperty `:budgetLimit` (Budget -> xsd:decimal) to `crates/eg-core/ontology/finance-v1.ttl`. SHACL: minCount 1, in `finance-v1.shapes.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::budgetLimit_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R075.5 LedgerTransaction Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**LedgerTransaction.** Add owl:Class `:LedgerTransaction` (a personal-ledger transaction (not position-bound, unlike :Activity)) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::LedgerTransaction_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R075.6 chargedToBudget Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**chargedToBudget.** Add owl:ObjectProperty `:chargedToBudget` (LedgerTransaction -> Budget) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::chargedToBudget_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R075.7 transactionAmount Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**transactionAmount.** Add owl:DatatypeProperty `:transactionAmount` (LedgerTransaction -> xsd:decimal) to `crates/eg-core/ontology/finance-v1.ttl`. Needed by: firefly-iii. | `ontology_audit_finance_v1::transactionAmount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076 personal-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**personal-v1.ttl additions rollup.** 9 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R076.1` to `EG-CQ-CONN-R076.9`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076.1 birthPlace Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**birthPlace.** Add owl:ObjectProperty `:birthPlace` (core:Person -> core:Place) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: gramps. | `ontology_audit_personal_v1::birthPlace_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076.2 birthYear Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**birthYear.** Add owl:DatatypeProperty `:birthYear` (core:Person -> xsd:gYear) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: gramps. | `ontology_audit_personal_v1::birthYear_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076.3 documentType Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**documentType.** Add owl:DatatypeProperty `:documentType` (core:Document -> xsd:string) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: paperless-ngx. | `ontology_audit_personal_v1::documentType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076.4 dueDate Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**dueDate.** Add owl:DatatypeProperty `:dueDate` (core:Document -> xsd:date) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: paperless-ngx. | `ontology_audit_personal_v1::dueDate_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076.5 totalAmount Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**totalAmount.** Add owl:DatatypeProperty `:totalAmount` (core:Document -> xsd:decimal) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: paperless-ngx. | `ontology_audit_personal_v1::totalAmount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076.6 FileShare Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**FileShare.** Add owl:Class `:FileShare` (a Nextcloud share of a file or folder) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::FileShare_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076.7 sharesFile Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**sharesFile.** Add owl:ObjectProperty `:sharesFile` (FileShare -> core:Document) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::sharesFile_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076.8 isPublicLink Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**isPublicLink.** Add owl:DatatypeProperty `:isPublicLink` (FileShare -> xsd:boolean) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::isPublicLink_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R076.9 shareExpiresAt Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shareExpiresAt.** Add owl:DatatypeProperty `:shareExpiresAt` (FileShare -> xsd:date) to `crates/eg-core/ontology/personal-v1.ttl`. Needed by: nextcloud. | `ontology_audit_personal_v1::shareExpiresAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R077 virtual_graph-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**virtual_graph-v1.ttl additions rollup.** 3 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R077.1`, `EG-CQ-CONN-R077.2`, `EG-CQ-CONN-R077.3`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R077.1 NamedGraph Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**NamedGraph.** Add owl:Class `:NamedGraph` (subClassOf core:Dataset; a graph in a triple store) to `crates/eg-core/ontology/virtual_graph-v1.ttl`. Needed by: jena. | `ontology_audit_virtual_graph_v1::NamedGraph_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R077.2 tripleCount Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**tripleCount.** Add owl:DatatypeProperty `:tripleCount` (NamedGraph -> xsd:integer) to `crates/eg-core/ontology/virtual_graph-v1.ttl`. Needed by: jena. | `ontology_audit_virtual_graph_v1::tripleCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R077.3 lastModifiedAt Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**lastModifiedAt.** Add owl:DatatypeProperty `:lastModifiedAt` (NamedGraph -> xsd:dateTime) to `crates/eg-core/ontology/virtual_graph-v1.ttl`. Needed by: jena. | `ontology_audit_virtual_graph_v1::lastModifiedAt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R078 identity-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**identity-v1.ttl additions rollup.** 5 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R078.1`, `EG-CQ-CONN-R078.2`, `EG-CQ-CONN-R078.3`, `EG-CQ-CONN-R078.4`, `EG-CQ-CONN-R078.5`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R078.1 shapes companion for identity-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for identity-v1.** Create `crates/eg-core/ontology/identity-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `identity` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_identity_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R078.2 Application Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Application.** Add owl:Class `:Application` (declare the class already used as range of :assignedApp) to `crates/eg-core/ontology/identity-v1.ttl`. Needed by: keycloak, okta. | `ontology_audit_identity_v1::Application_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R078.3 OidcClient Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**OidcClient.** Add owl:Class `:OidcClient` (subClassOf :Application) to `crates/eg-core/ontology/identity-v1.ttl`. Needed by: keycloak. | `ontology_audit_identity_v1::OidcClient_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R078.4 roleGrantsAccessTo Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**roleGrantsAccessTo.** Add owl:ObjectProperty `:roleGrantsAccessTo` (IdentityRole -> Application) to `crates/eg-core/ontology/identity-v1.ttl`. Needed by: keycloak. | `ontology_audit_identity_v1::roleGrantsAccessTo_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R078.5 accountStatus Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**accountStatus.** Add owl:DatatypeProperty `:accountStatus` (IdentityUser -> xsd:string) to `crates/eg-core/ontology/identity-v1.ttl`. SHACL: sh:in (ACTIVE|SUSPENDED|DEACTIVATED), in `identity-v1.shapes.ttl`. Needed by: okta. | `ontology_audit_identity_v1::accountStatus_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R079 orchestration-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**orchestration-v1.ttl additions rollup.** 5 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R079.1`, `EG-CQ-CONN-R079.2`, `EG-CQ-CONN-R079.3`, `EG-CQ-CONN-R079.4`, `EG-CQ-CONN-R079.5`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R079.1 shapes companion for orchestration-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for orchestration-v1.** Create `crates/eg-core/ontology/orchestration-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `orchestration` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_orchestration_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R079.2 promptVersion Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**promptVersion.** Add owl:DatatypeProperty `:promptVersion` (Prompt -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::promptVersion_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R079.3 tokenCost Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**tokenCost.** Add owl:DatatypeProperty `:tokenCost` (RunTrace -> xsd:decimal) to `crates/eg-core/ontology/orchestration-v1.ttl`. SHACL: minInclusive 0, in `orchestration-v1.shapes.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::tokenCost_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R079.4 tracePrompt Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**tracePrompt.** Add owl:ObjectProperty `:tracePrompt` (RunTrace -> Prompt) to `crates/eg-core/ontology/orchestration-v1.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::tracePrompt_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R079.5 evaluationScore Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**evaluationScore.** Add owl:DatatypeProperty `:evaluationScore` (RunTrace|Prompt -> xsd:decimal) to `crates/eg-core/ontology/orchestration-v1.ttl`. Needed by: langfuse. | `ontology_audit_orchestration_v1::evaluationScore_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R080 enterprise-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**enterprise-v1.ttl additions rollup.** 4 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R080.1`, `EG-CQ-CONN-R080.2`, `EG-CQ-CONN-R080.3`, `EG-CQ-CONN-R080.4`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R080.1 shapes companion for enterprise-v1 Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**shapes companion for enterprise-v1.** Create `crates/eg-core/ontology/enterprise-v1.shapes.ttl` (precedent: `finance-v1.shapes.ttl`) and set `shapes: Some(include_str!(...))` on the `enterprise` CoreSpec in `schema_sources.rs`. Empty shapes graph is valid; each term child below adds its own NodeShape. Reuse an existing companion without replacing its shapes; delivery still requires the named registry-load test. | `ontology_audit_enterprise_v1::shapes_module_loads`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R080.2 factSheetType Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**factSheetType.** Add owl:DatatypeProperty `:factSheetType` (EAFactSheet -> xsd:string) to `crates/eg-core/ontology/enterprise-v1.ttl`. Needed by: leanix. | `ontology_audit_enterprise_v1::factSheetType_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R080.3 lifecyclePhase Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**lifecyclePhase.** Add owl:DatatypeProperty `:lifecyclePhase` (EAFactSheet -> xsd:string (plan|active|phaseOut|endOfLife)) to `crates/eg-core/ontology/enterprise-v1.ttl`. SHACL: sh:in, in `enterprise-v1.shapes.ttl`. Needed by: leanix. | `ontology_audit_enterprise_v1::lifecyclePhase_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain) and that a violating fixture fails the shape. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R080.4 activeUserCount Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**activeUserCount.** Add owl:DatatypeProperty `:activeUserCount` (EAFactSheet -> xsd:integer) to `crates/eg-core/ontology/enterprise-v1.ttl`. Needed by: leanix. | `ontology_audit_enterprise_v1::activeUserCount_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R081 nutrition-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**nutrition-v1.ttl additions rollup.** 8 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R081.1` to `EG-CQ-CONN-R081.8`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R081.1 Recipe Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Recipe.** Add owl:Class `:Recipe` (a recipe) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::Recipe_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R081.2 usesIngredient Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**usesIngredient.** Add owl:ObjectProperty `:usesIngredient` (Recipe -> :Food) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::usesIngredient_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R081.3 ShoppingListItem Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**ShoppingListItem.** Add owl:Class `:ShoppingListItem` (item on a shopping list, refers to a Food) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::ShoppingListItem_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R081.4 MealPlanEntry Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**MealPlanEntry.** Add owl:Class `:MealPlanEntry` (a planned meal on a date for a Recipe) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: mealie. | `ontology_audit_nutrition_v1::MealPlanEntry_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R081.5 WorkoutRoutine Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**WorkoutRoutine.** Add owl:Class `:WorkoutRoutine` (a planned set of exercises) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::WorkoutRoutine_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R081.6 Exercise Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Exercise.** Add owl:Class `:Exercise` (an exercise) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::Exercise_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R081.7 includesExercise Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**includesExercise.** Add owl:ObjectProperty `:includesExercise` (WorkoutRoutine -> Exercise) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::includesExercise_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R081.8 WorkoutSession Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**WorkoutSession.** Add owl:Class `:WorkoutSession` (a performed instance of a routine with completedAt) to `crates/eg-core/ontology/nutrition-v1.ttl`. Needed by: wger. | `ontology_audit_nutrition_v1::WorkoutSession_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R082 action-v1.ttl additions rollup Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**action-v1.ttl additions rollup.** 1 child rows, one per missing term (plus setup rows); becomes LANDED when every child is LANDED. Children: `EG-CQ-CONN-R082.1`. | Children landed. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R082.1 failureReason Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**failureReason.** Add owl:DatatypeProperty `:failureReason` (ActionInvocation -> xsd:string) to `crates/eg-core/ontology/action-v1.ttl`. Needed by: stirlingpdf. | `ontology_audit_action_v1::failureReason_declared` loads the module and asserts the term (ASK over rdf:type / rdfs:domain). | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R083 erpnext, salesforce and twenty vocabulary (rollup, single row) Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**erpnext, salesforce and twenty vocabulary (rollup, single row).** Commercial term and representation requirements are owned by `EG-SUPPLY-VOCAB` in `crates/eg-core/ontology/commercial-v1.ttl`. Rows `EG-SUPPLY-VOCAB-R003.7` through `EG-SUPPLY-VOCAB-R003.12` reuse Organization and Person rather than adding Party or Contact classes. They declare PurchaseOrder, PurchaseInvoice, Opportunity, contactOf and lastActivityAt. No `commerce-v1.ttl` is created. Needed by: erpnext, salesforce, twenty. Also depends on EG-SUPPLY-VOCAB-R003.13 through EG-SUPPLY-VOCAB-R003.17. Vocabulary reassignment text is not implementation evidence. | `commercial_connector_prerequisites` parses all three Coverage rows and both Vocabulary cells per connector. Resolve every required producer IRI through registered modules. Reject a missing producer, an unrelated-row-only edit, or duplicate incompatible declarations. Live unavailable fields cause typed abstention. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R084 Connector-pack competency questions (rollup) Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Connector-pack competency questions (rollup).** The ontology answers selection and governance questions by SPARQL over imported connector packs. Each pack carries a domain ontology, an ingest contract and its surface. Children `.1` to `.6` state the questions, their answer shapes and the proof. | Rollup closes when every child `.1` to `.6` passes its proving test. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R084.1 Which finance algorithms apply to analysis type X for instrument or position type Y, and which connector tool performs each? Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Which finance algorithms apply to analysis type X for instrument or position type Y, and which connector tool performs each?** Answer shape: rows of algorithm class, analysis type, instrument or position class, tool component id, connector and pack digest. Depends on `:FinanceAlgorithm`, `:AnalysisType`, `:appliesToAnalysis` and `:appliesToInstrumentType` (`.5`). It also depends on `cp:Tool` and `cp:executes` (`EG-TYPED-PACKS-R102.1`). | `crates/eg-core/tests/connector_pack_competency.rs::finance_algorithm_selection_answers`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R084.2 What are my trades and positions, and which risk analyses apply to them? Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**What are my trades and positions, and which risk analyses apply to them?** Answer shape: rows of position or order IRI, instrument, quantity, as-of time, analysis type and algorithm class. Depends on `:Position`, `:PortfolioPosition`, `:VersionedOrder`, `:FinancialInstrument` and `:RiskSnapshot` in `finance-v1.ttl`. It also depends on `.5` and `cp:governedBy` (`EG-TYPED-PACKS-R101.1`). | `crates/eg-core/tests/connector_pack_competency.rs::positions_and_applicable_risk_analyses_answer`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R084.3 Which connector features, tools, prompts and skills can satisfy capability C, and under which ingest contract? Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Which connector features, tools, prompts and skills can satisfy capability C, and under which ingest contract?** Answer shape: rows of connector, feature, component kind, component id and contract IRI. Depends on `cp:Connector`, `cp:Feature`, `cp:realizedBy`, `cp:providesCapability` and `cp:hasContract` (`EG-TYPED-PACKS-R102.1`). | `crates/eg-core/tests/connector_pack_competency.rs::capability_to_surface_and_contract_answers`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R084.4 Which connector ingest contracts govern record R, with their mappings, access policy and provenance requirements? Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Which connector ingest contracts govern record R, with their mappings, access policy and provenance requirements?** Answer shape: rows of contract IRI, connector, contract revision, mapping IRI, default ACL, privacy class per field and required provenance fields. Depends on `cp:governedBy`, `cp:FieldMapping`, `cp:AccessPolicy`, `cp:privacyClass` and `cp:ProvenanceRequirement` (`EG-TYPED-PACKS-R101.1`). | `crates/eg-core/tests/connector_pack_competency.rs::record_governance_answers`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R084.5 Finance method vocabulary Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Finance method vocabulary.** Add `:FinanceAlgorithm`, `:AnalysisType`, `:appliesToAnalysis`, `:appliesToInstrumentType` and `:requiresInput` to `crates/eg-core/ontology/finance-v1.ttl`. Add a shape to `finance-v1.shapes.ttl`: each algorithm names at least one analysis type and one instrument or position class. | `crates/eg-core/tests/connector_pack_competency.rs::finance_method_terms_and_shape`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R084.6 Hot-path proof Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method. The test imports a finance connector pack and a document connector pack, then ingests fixture records through `SourceIngest`. It runs `.1` to `.4` through the served SPARQL method and `.1` through `Decide` (`EG-DECISION-ENGINE-R172.12`). Each answer must be non-empty and carry source, record id and as-of. Without the finance pack, `.1` must abstain and name the missing pack. | `tests/typed_packs/test_connector_pack_competency_served.py::test_pack_questions_end_to_end`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R085 Competency check: a question spans a connector's live data and the ontology (rollup) Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Competency check: a question spans a connector's live data and the ontology (rollup).** Arbora onboards one connector alone (`ARBORA-FLEET-R041`). One question then needs its live data and a parent-ontology concept. The answer comes through the virtual graph and carries provenance. It extends `EG-CQ-CONN-R067` and `EG-CQ-XSRC-R005`. It proves `EG-TYPED-PACKS-R105`, `EG-TYPED-PACKS-R106`, `EG-TYPED-PACKS-R107` and `EG-FEDERATED-QUERY-R722` together. The answer resolves through the active pack contract. The catalog lists the connector assets with owner and lineage. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R085.1 Model Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Model.** Add the fixture `crates/eg-core/tests/fixtures/connector_auto_onboard/` with one connector pack. The pack holds an ontology that extends a parent class. It also holds one system prompt, one skill and one tool. One data resource has a mock operation. Record the expected answer as rows of parent class, connector class, instance and source. | `crates/eg-core/tests/connector_auto_onboard.rs::fixture_parses_and_is_linked_to_the_parent`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R085.2 Behavior Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Behavior.** The question names only parent-ontology terms. It asks which instances of parent class C exist, with their live status. The engine answers from the connector subclass through the virtual source. The answer includes native rows of the same class. It names the connector, contract and fetch time per row. With the connector absent, the question returns only native rows and names the missing connector. | `crates/eg-core/tests/connector_auto_onboard.rs::parent_term_question_returns_native_and_live_connector_rows`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R085.3 Wiring Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Wiring.** The check enters through the served `ConnectorPack.Import` method and the served `Uql` and `NlQuery` methods. It uses the same `project` path (`src/server/connector_pack_projection.rs:228`) and `foreign_scan` (`crates/eg-plan/src/federation_opt/run.rs:26`) as production. | `tests/typed_packs/test_connector_auto_onboard_served.py::test_check_uses_production_import_and_scan`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R085.4 Refusal Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Refusal.** With the ontology orphaned, the import refuses with `ONTOLOGY_ORPHAN` and the question abstains. With the mapping held, the answer abstains on the live part and names `SOURCE_HELD`. A wrong answer is a failure, not an abstention. | `crates/eg-core/tests/connector_auto_onboard.rs::orphan_and_held_variants_abstain_by_name`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R085.5 Evidence Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Evidence.** The answer cites the pack digest, the graph revision and the fetch time. The same test lists the system prompt, skill and tool of the connector. They appear in the load set for a job on that class (`EG-CQ-ORCH-R011.1`). | `tests/typed_packs/test_connector_auto_onboard_served.py::test_answer_cites_digest_revision_fetch_time_and_load_set`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-CONN-R085.6 Hot-path proof Definition — EG-CQ-CONN / EG-CQ-CONN — Connector competency questionsCanonical requirement and verification source**Hot-path proof.** The entry point is a real fixture connector process over MCP. Arbora onboards it with no manual step. A served NL question through arbora returns the combined answer. The test then drops the connector and sees the live part leave the answer. | `tests/typed_packs/test_connector_auto_onboard_served.py::test_onboarded_connector_answers_a_cross_ontology_live_question`. | requirement | EG-CQ-CONN | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC EG-CQ-XSRC — Cross-source competency: supply chain to services | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R001 Concept-to-source authority is declared in the ontology (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Concept-to-source authority is declared in the ontology (rollup).** The ontology itself states which attached source is authoritative for which ontology class, so source choice is data, not query text. Children add the vocabulary, its SHACL shapes and a precedence rule. Rollup: LANDED only once every child is. | Every child is LANDED and the decisive swap test (R007.4) passes. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R001.1 Add `vg:SourceAuthority`, `vg:authoritativeSource`, `vg:authorityFor` and `vg:authorityRank` to the virtual-graph vocabulary Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Add `vg:SourceAuthority`, `vg:authoritativeSource`, `vg:authorityFor` and `vg:authorityRank` to the virtual-graph vocabulary.** `crates/eg-core/ontology/virtual_graph-v1.ttl` gains class `vg:SourceAuthority` and properties `vg:authoritativeSource` (to `vg:SourceConnection`), `vg:authorityFor` (to an ontology class) and `vg:authorityRank` (integer, lower wins). Net-new: no authority term exists in any shipped .ttl (grep for authoritative/systemOfRecord found only unrelated DNS and ADR text). | The ontology parses and the new terms are present with domain and range. A unit test loads the file and lists them. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R001.2 SHACL shape: a `vg:SourceAuthority` names exactly one connected source, one class and one rank Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**SHACL shape: a `vg:SourceAuthority` names exactly one connected source, one class and one rank.** `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl` adds `vg:SourceAuthorityShape`. It refuses an authority with no source, no class or no rank, an authority whose source is not a `vg:SourceConnection`, and two authorities of equal rank for one class. Depends on `EG-CQ-XSRC-R001.1`. | Shape fixtures accept a valid authority and refuse each of the four faults, including the equal-rank tie. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R001.3 Authority applies through subclass entailment Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Authority applies through subclass entailment.** An authority declared on a superclass (for example `:ApplicationEvent`) serves its subclasses (for example `:Incident`) unless a subclass declares its own. Reuses the subclass entailment of `EG-FEDERATED-QUERY-R072`; adds only the precedence rule. Depends on `EG-CQ-XSRC-R001.1`. | A fixture shows the superclass authority inherited and a subclass authority overriding it. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R001.4 Authority records the approval of its mapping Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Authority records the approval of its mapping.** An authority is effective only while the `vg:VirtualMapping` it points at is approved (`vg:approved true`, `EG-UNIFIED-DATA-PLANE-R037`). An unapproved or retracted mapping makes the authority inactive, and the class is reported uncovered rather than served by a fallback source. | A fixture with an unapproved mapping returns the class as uncovered with the reason named. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R002 Supply-chain concepts and the sources that are authoritative for them (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Supply-chain concepts and the sources that are authoritative for them (rollup).** Add the supply-chain concepts missing from the ontology and declare their authoritative sources. `:Vendor` and `:TechnologyProduct` (`trm-v1.ttl`) exist and are reused. Sources named here are a judgement from the connector list: erpnext-mcp (suppliers, purchase orders, items), salesforce-mcp and twenty-mcp (customer and partner accounts), ciso-assistant-mcp and onetrust-mcp (third-party risk and vendor assessments), leanix-mcp (provider fact sheets); software supply chain: dockerhub-mcp (image publisher and tags), github-mcp and gitlab-mcp (source repositories, dependencies, advisories), repository-manager-mcp (workspace repositories). Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R002.1 Add `:Supplier` as a subclass of `:Vendor`, and `:SupplyChainItem` with `:suppliedBy` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Add `:Supplier` as a subclass of `:Vendor`, and `:SupplyChainItem` with `:suppliedBy`.** A new `crates/eg-core/ontology/supply_chain-v1.ttl` declares `:Supplier rdfs:subClassOf :Vendor` (reusing `trm-v1.ttl`), `:SupplyChainItem` and `:suppliedBy` (item to supplier). MISSING today: no supplier, procurement or supply-chain-item term exists outside `energy_geopolitics-v1.ttl` `:SupplyRoute`. | The file parses, `:Supplier` entails `:Vendor` in the reasoner, and a unit test lists the terms. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R002.2 Add `:SoftwareComponent`, `:ComponentVersion` and `:publishedBy` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Add `:SoftwareComponent`, `:ComponentVersion` and `:publishedBy`.** `supply_chain-v1.ttl` adds the software supply-chain terms: a component, a version of it, and the publisher (a `:Supplier`). A `:ContainerImage` (`infrastructure-v1.ttl`) is declared a `:SoftwareComponent`. Depends on `EG-CQ-XSRC-R002.1`. | The file parses and `:ContainerImage` entails `:SoftwareComponent`. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R002.3 Add `:Vulnerability` and `:affectsComponent` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Add `:Vulnerability` and `:affectsComponent`.** `supply_chain-v1.ttl` adds `:Vulnerability` (identifier, severity, fixed-in version) and `:affectsComponent` (to a `:ComponentVersion`). MISSING today: the only vulnerability term is the count `:vulnerabilityCount` in `trm-v1.ttl`. Depends on `EG-CQ-XSRC-R002.2`. | The file parses and a unit test lists the terms; `:vulnerabilityCount` is left unchanged. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R002.4 SHACL shape for supplier and component Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**SHACL shape for supplier and component.** `crates/eg-core/ontology/supply_chain-v1.shapes.ttl` requires a `:Supplier` to carry a name and a `:ComponentVersion` to name its component and a version string. Depends on `EG-CQ-XSRC-R002.2`. | Shape fixtures accept valid items and refuse a nameless supplier and a versionless component. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R002.5 Source-authority mapping: suppliers and purchase items Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Source-authority mapping: suppliers and purchase items.** Declare `vg:SourceAuthority` rows: `:Supplier` and `:SupplyChainItem` to erpnext-mcp (rank 1) with leanix-mcp `Provider` fact sheets (rank 2); third-party risk to ciso-assistant-mcp. Judgement: ERPNext is the transactional procurement system; LeanIX is the architecture catalogue. A seed `.ttl` fixture under `crates/eg-core/tests/fixtures/` holds the rows. Depends on `EG-CQ-XSRC-R001.1`, `EG-CQ-XSRC-R002.1`. | The seed loads, passes `vg:SourceAuthorityShape`, and `select_sources` returns erpnext for `:Supplier`. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R002.6 Source-authority mapping: software components and vulnerabilities Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Source-authority mapping: software components and vulnerabilities.** Declare `vg:SourceAuthority` rows: `:ContainerImage` to dockerhub-mcp (publisher, tags) with gitlab-mcp and github-mcp for source repositories. `:Vulnerability` to gitlab-mcp (vulnerability findings) with github-mcp advisories at rank 2. Judgement: the registry is authoritative for what an image is, the code host for what is wrong with it. Depends on `EG-CQ-XSRC-R002.3`. | The seed loads and `select_sources` returns the registry for an image and the code host for a vulnerability. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R002.7 Virtual mapping fixture: erpnext supplier table to `:Supplier` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Virtual mapping fixture: erpnext supplier table to `:Supplier`.** One approved `vg:VirtualMapping` (`vg:mapsOntologyClass :Supplier`, key field, predicate-field pairs for name and status) over a recorded erpnext-mcp operation contract, using the operation-bound kinds of `EG-FEDERATED-QUERY-R073`. Cross-repo prerequisite: the erpnext connector operation contract (owning repo: agent-packages connector). | The mapping passes the `EG-UNIFIED-DATA-PLANE-R037` shapes and reads equal rows from a recorded response. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R003 Service concepts and the sources that are authoritative for them (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Service concepts and the sources that are authoritative for them (rollup).** Declare which sources are authoritative for services, their hosts and their health. Found: `:Service` (a monitored network service, `infrastructure-v1.ttl`), `:Host`, `:Node`, `:Rack`, `:ContainerImage`, `:Incident`, `:BusinessCapability` (`archimate-v1.ttl`). Sources named are a judgement: uptime-mcp and lgtm-mcp for live service health, container-manager-mcp and portainer-mcp for deployed workloads and images, servicenow-mcp (CMDB) and leanix-mcp for the service catalogue and business capabilities, archimate-mcp for the architecture model, caddy-mcp and technitium-dns-mcp for ingress and name records, systems-manager-mcp for host facts. Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R003.1 Source-authority mapping: `:Service` health Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Source-authority mapping: `:Service` health.** Declare `:Service` to uptime-mcp (rank 1) and lgtm-mcp (rank 2) for health, and to servicenow-mcp CMDB (rank 1) for the catalogue identity. Where two sources hold different facets, the authority row carries a `vg:authorityFor` property list rather than the whole class. Depends on `EG-CQ-XSRC-R001.1`. | The seed passes the shape and `select_sources` names uptime for health and CMDB for identity. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R003.2 Source-authority mapping: deployed workloads and images Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Source-authority mapping: deployed workloads and images.** Declare `:ContainerImage` deployment facts and `:Host` placement to container-manager-mcp (rank 1) and portainer-mcp (rank 2); `:Host` hardware facts to systems-manager-mcp. Depends on `EG-CQ-XSRC-R001.1`. | The seed passes the shape and `select_sources` names container-manager for deployed images. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R003.3 Source-authority mapping: business capabilities Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Source-authority mapping: business capabilities.** Declare `:BusinessCapability` to leanix-mcp (rank 1) and archimate-mcp (rank 2). Judgement: LeanIX is the maintained catalogue, ArchiMate the modelled view. Depends on `EG-CQ-XSRC-R001.1`. | The seed passes the shape and `select_sources` names leanix, with archimate as the second. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R003.4 Virtual mapping fixture: uptime monitor to `:Service` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Virtual mapping fixture: uptime monitor to `:Service`.** One approved `vg:VirtualMapping` from a recorded uptime-mcp operation contract to `:Service`, with name, status and last-check fields. Cross-repo prerequisite: the uptime connector operation contract (owning repo: agent-packages connector). | The mapping passes the `EG-UNIFIED-DATA-PLANE-R037` shapes and reads equal rows from a recorded response. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R003.5 Virtual mapping fixture: container-manager workload to `:Service` and `:ContainerImage` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Virtual mapping fixture: container-manager workload to `:Service` and `:ContainerImage`.** One approved `vg:VirtualMapping` from a recorded container-manager-mcp contract to `:Service` with its image reference. Cross-repo prerequisite: the container-manager operation contract (owning repo: agent-packages connector). | The mapping passes the shapes and reads equal rows from a recorded response. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R004 Linking relation between a supply-chain entity and a service, with entity resolution across sources (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Linking relation between a supply-chain entity and a service, with entity resolution across sources (rollup).** The relation that joins the two sides, and the resolution that makes one real-world thing in two sources one node. Found: `:dependsOn` (service to service, `infrastructure-v1.ttl`), `:runsOn`, `:hostedBy`, `:buildsImageFor`, `:affectsEntity`, `:alignedWith`, `owl:sameAs` proposals (`EG-UNIFIED-DATA-PLANE-R030`). Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R004.1 Add `:usesComponent` (service to component version) and `:suppliesService` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Add `:usesComponent` (service to component version) and `:suppliesService`.** `supply_chain-v1.ttl` adds `:usesComponent` (domain `:Service`, range `:ComponentVersion`) and `:suppliesService` as its property chain with `:publishedBy` (supplier to service). The service-to-image step reuses the existing `:buildsImageFor`/`:runsOn` terms; it is not redefined. MISSING: no supplier-to-service relation exists. Depends on `EG-CQ-XSRC-R002.2`. | The file parses and a reasoner fixture entails `:suppliesService` from a service, its image and the image publisher. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R004.2 SHACL shape: `:usesComponent` domain and range Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**SHACL shape: `:usesComponent` domain and range.** `supply_chain-v1.shapes.ttl` refuses `:usesComponent` from a non-service or to a non-component. Depends on `EG-CQ-XSRC-R004.1`. | Shape fixtures accept a valid link and refuse both faults. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R004.3 Resolve a vendor in erpnext, leanix and dockerhub to one `:Supplier` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Resolve a vendor in erpnext, leanix and dockerhub to one `:Supplier`.** Adapt the entity-resolution model of `EG-UNIFIED-DATA-PLANE-R030` (it covers Gramps, Immich, Twenty and Firefly today) to supplier records: blocking on normalized name and domain, a proposed `owl:sameAs` that is active only once approved. Adds `Erpnext`, `Leanix` and `Dockerhub` to `AttachedApplication` in `crates/eg-types/src/entity_link_proposal.rs`. Depends on `EG-UNIFIED-DATA-PLANE-R030.1`. | A fixture with a true match, a false match and an ambiguous pair proves no link is asserted before approval, mirroring R030. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R004.4 Resolve a service in uptime, container-manager and the CMDB to one `:Service` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Resolve a service in uptime, container-manager and the CMDB to one `:Service`.** The same resolution applied to service records: blocking on name, host and port, an inactive proposal until approved. Reuses the `R030` model; adds only the application kinds and the blocking keys. Depends on `EG-CQ-XSRC-R004.3`. | A fixture proves the three records resolve to one node after approval and stay three before it. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R004.5 Query-time link: a join may only cross an approved `owl:sameAs` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Query-time link: a join may only cross an approved `owl:sameAs`.** The federated query joins records from different sources only through an approved link. A candidate link that is unapproved contributes nothing and is reported as an unresolved candidate in the answer. Mechanism: `EG-FEDERATED-QUERY-R072` path plus the approval state of R030. | A fixture shows the join empty before approval, non-empty after, and the candidate listed while unapproved. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R005 The federated query is planned from the ontology's source declarations (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**The federated query is planned from the ontology's source declarations (rollup).** Source selection reads `vg:SourceAuthority`. The question names only ontology classes; the planner picks the sources. Mechanism: `EG-FEDERATED-QUERY-R072` (source selection with premises), `EG-FEDERATED-QUERY-R046` and `R069` (pushdown), `EG-FEDERATED-QUERY-R073` (operation-bound sources), `EG-UNIFIED-DATA-PLANE-R005`/`R006` (R2RML virtual graphs). Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R005.1 `select_sources` orders candidate mappings by `vg:authorityRank` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**`select_sources` orders candidate mappings by `vg:authorityRank`.** Extend `eg-rdf::source_selection` so a covered class names the authoritative source by rank and lists the lower-ranked ones as alternates, each with a `Premise` citing the authority row. Depends on `EG-FEDERATED-QUERY-R072.1`, `EG-CQ-XSRC-R001.1`. | A two-source fixture shows the rank-1 source chosen, the alternate listed, and the authority row in the premises. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R005.2 Query fixture: the supply-chain impact query over classes only Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Query fixture: the supply-chain impact query over classes only.** A SPARQL fixture in `crates/eg-rdf/tests/fixtures/` asks for `:Service`, the `:SoftwareComponent` and `:Supplier` behind it, and `:Vulnerability` on it. It names no source, endpoint or connector. A test fails if the text contains a connector name. Depends on `EG-CQ-XSRC-R004.1`. | The fixture parses, and the no-connector-name check passes. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R005.3 The plan is derived, not authored: planned sources equal the declared authorities Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**The plan is derived, not authored: planned sources equal the declared authorities.** Plan the fixture of R005.2 and assert the set of sources in the plan equals the set derived from the authority rows. Depends on `EG-CQ-XSRC-R005.1`, `EG-CQ-XSRC-R005.2`. | The test compares the planned set to the authority-derived set for the seed. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R005.4 An unconnected authoritative source yields a typed abstention, not a silent fallback Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**An unconnected authoritative source yields a typed abstention, not a silent fallback.** When the rank-1 source for a class is not connected, the plan names it as `Unconnected { source, class }`. A lower-ranked alternate is used only if the authority row permits fallback (`vg:allowFallback`), and the report then says so. Depends on `EG-CQ-XSRC-R005.1`. | A fixture with erpnext unconnected returns the typed abstention naming erpnext and `:Supplier`. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R005.5 `EXPLAIN` shows the authority premise for each planned source Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**`EXPLAIN` shows the authority premise for each planned source.** Served `EXPLAIN` lists, per fragment, the authority row, rank, mapping generation and whether it was pushed. Mechanism: the redacted trace of `EG-FEDERATED-QUERY-R044`; no URL or credential in the output. Depends on `EG-CQ-XSRC-R005.3`. | A test reads the `EXPLAIN` output and finds the authority premises and no endpoint URL. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R006 The unified report shape (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**The unified report shape (rollup).** One typed report: impact per service, the supply-chain items behind each, the sources used and why, freshness per source, and typed abstention. Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R006.1 Add the typed `SupplyChainImpactReport` model Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Add the typed `SupplyChainImpactReport` model.** `crates/eg-types/src/supply_chain_report.rs` defines the report: a list of `ServiceImpact` (service IRI, items with supplier, component version, vulnerability and impact kind), `sources_used` (source, class served, authority premise), and `abstentions`. It refuses a `ServiceImpact` item with no source. Depends on `EG-CQ-XSRC-R005.1`. | Unit tests construct a valid report, refuse an item with no source, and round-trip the wire encoding. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R006.2 Report carries freshness per source Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Report carries freshness per source.** Each `sources_used` entry carries the watermark and age of its data (live read, or accelerated copy with its watermark, per `EG-UNIFIED-DATA-PLANE-R038.1`). A source with no watermark is reported `live`. Depends on `EG-CQ-XSRC-R006.1`. | Unit tests cover a copy with a watermark, a live read, and the refusal of a copy with no watermark. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R006.3 Report abstention variants Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Report abstention variants.** `abstentions` holds `Unconnected`, `Uncovered`, `Disconnected` and `UnapprovedMapping` entries, mapping the `CoverageResult` of `EG-FEDERATED-QUERY-R072.1` plus the unconnected case. A report with an abstention is still returned, never an error. Depends on `EG-CQ-XSRC-R006.1`. | Unit tests build one report per abstention kind and confirm the other services still report. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R006.4 Assemble the report from the federated rows Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Assemble the report from the federated rows.** A pure function from the planned query's rows and premises to `SupplyChainImpactReport`. Depends on `EG-CQ-XSRC-R006.1`, `EG-CQ-XSRC-R005.3`. | A fixture over recorded rows produces the expected report, byte for byte. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R006.5 Serve the report through graph-os Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Serve the report through graph-os.** Cross-repo prerequisite (owning repo: graph-os): expose one intent tool that takes the question and returns `SupplyChainImpactReport`. Per the registry rule, graph-os serves the tool; EG supplies the method. Depends on `EG-CQ-XSRC-R006.4`. | A served call returns a report whose shape matches the typed model. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R007 End-to-end acceptance from real connected data (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**End-to-end acceptance from real connected data (rollup).** "How does the supply chain affect our services?" answered through the served surface, with sources chosen only from the ontology. Rollup: LANDED only once every child is. | Every child is LANDED, including the swap test. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R007.1 Acceptance on recorded connector responses Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Acceptance on recorded connector responses.** Run the question over recorded erpnext-mcp, dockerhub-mcp, gitlab-mcp, container-manager-mcp and uptime-mcp responses. Assert at least one `ServiceImpact` with a supplier, a component version and a source per item, and that every source named in the report appears in an authority row. Depends on `EG-CQ-XSRC-R006.4`. | The test is non-empty and provenance-carrying, run in CI without network. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R007.2 Acceptance against the live connected sources Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Acceptance against the live connected sources.** The same question through graph-os against the connected sources that exist on the day. It reports each unconnected authoritative source as an abstention. Cross-repo prerequisite (owning repo: graph-os): the connected-source list. Depends on `EG-CQ-XSRC-R006.5`. | A run records the report, the sources used and the abstentions. A non-empty answer is required for at least the software supply chain and services sides. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R007.3 Acceptance with the procurement source not connected Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Acceptance with the procurement source not connected.** Run R007.1 with erpnext-mcp absent. Assert the report still gives the software supply-chain impact and carries `Unconnected{erpnext, :Supplier}`. Depends on `EG-CQ-XSRC-R005.4`. | The test asserts the abstention and the unchanged software-side rows. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R007.4 Decisive test: changing only the ontology's authority declaration changes the sources used Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Decisive test: changing only the ontology's authority declaration changes the sources used.** Run the question twice over the same query text. Between runs change one `vg:SourceAuthority` row (for example `:Vulnerability` from gitlab-mcp to github-mcp). Assert the plan and report name the new source and that the query text is byte-identical. This is the exit gate. Depends on `EG-CQ-XSRC-R007.1`. | The test compares query text (equal) and sources used (different) across the two runs. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008 Generalization: three more cross-source questions of the same shape (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Generalization: three more cross-source questions of the same shape (rollup).** Three questions that reuse the authority declaration, source selection and report model. Each child adds only its missing classes, authority rows and a test. Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.1 Which services are exposed by a vulnerability in an image we deploy? (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Which services are exposed by a vulnerability in an image we deploy? (rollup)** Sources: dockerhub-mcp (image, tags), gitlab-mcp and github-mcp (vulnerability findings, advisories), container-manager-mcp and portainer-mcp (what is deployed), uptime-mcp (service). Uses `:ContainerImage`, `:Vulnerability`, `:affectsComponent`, `:usesComponent`. Mostly covered by R002 to R005; the child adds the deployed-image filter. Rollup: LANDED only once every child is. | Both children are LANDED. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.1.1 Query fixture and authority rows: vulnerable deployed image to exposed service Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Query fixture and authority rows: vulnerable deployed image to exposed service.** Add the SPARQL fixture over classes only, and any authority row not already seeded by `EG-CQ-XSRC-R002.6`/`R003.2`. Depends on `EG-CQ-XSRC-R005.3`. | The fixture plans to exactly the sources named above and names no connector. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.1.2 Acceptance: exposed services listed with image, vulnerability and sources Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Acceptance: exposed services listed with image, vulnerability and sources.** Recorded-response test asserting a non-empty list of services with the vulnerable image, the vulnerability identifier, and per-item source. And the typed abstention with the code host disconnected. Depends on `EG-CQ-XSRC-R008.1.1`. | Non-empty, provenance-carrying. Abstention case passes. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.2 Which business capabilities depend on a host that is over its temperature or capacity limit? (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Which business capabilities depend on a host that is over its temperature or capacity limit? (rollup)** Sources: systems-manager-mcp (host capacity), the fan and temperature telemetry via lgtm-mcp (metrics), container-manager-mcp (placement), leanix-mcp and archimate-mcp (capabilities), servicenow-mcp CMDB (service to capability). Uses `:BusinessCapability`, `:Service`, `:runsOn`, `:Host`, `:Rack`, `:CoolingUnit`. MISSING: a temperature observation and a capacity limit on `:Host`; `:supports` (`core-foundation-v1.ttl`) is the candidate link from service to capability, to be confirmed. Rollup: LANDED only once every child is. | All children are LANDED. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.2.1 Add a host limit-breach term to the ontology Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Add a host limit-breach term to the ontology.** `infrastructure-v1.ttl` gains `:temperatureCelsius`, `:temperatureLimitCelsius` and `:capacityUtilization` on `:Host`, with the limit stated as data. MISSING today. No threshold is hard-coded in the query. | The file parses and a unit test lists the terms. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.2.2 SHACL shape: a limit-bearing host carries both reading and limit Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**SHACL shape: a limit-bearing host carries both reading and limit.** `crates/eg-core/ontology/infrastructure-v1.shapes.ttl` (new) refuses a reading with no limit. Depends on `EG-CQ-XSRC-R008.2.1`. | Shape fixtures accept a pair and refuse a reading with no limit. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.2.3 Authority rows and query fixture: capability to service to host over a limit Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Authority rows and query fixture: capability to service to host over a limit.** Authority rows for host readings (lgtm-mcp rank 1, systems-manager-mcp rank 2) and the class-only SPARQL fixture. Confirms whether `:supports` or an `archimate` relationship carries service to capability; records the choice in `plan.md`. Depends on `EG-CQ-XSRC-R008.2.1`. | The fixture plans to the sources named above and names no connector. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.2.4 Acceptance: capabilities at risk listed with the host, reading and limit Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Acceptance: capabilities at risk listed with the host, reading and limit.** Recorded-response test asserting a non-empty list with capability, service, host, reading, limit and per-item source. Abstention when the metrics source is not connected. Depends on `EG-CQ-XSRC-R008.2.3`. | Non-empty, provenance-carrying. Abstention case passes. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.3 Which open incidents or changes touch a service a customer contract depends on? (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Which open incidents or changes touch a service a customer contract depends on? (rollup)** Sources: servicenow-mcp (incidents, changes, CMDB), salesforce-mcp and twenty-mcp (customer accounts and contracts), erpnext-mcp (contracts and issues as `:ErpNextIssue`), uptime-mcp (service). Uses `:Incident`, `:ApplicationEvent`, `:affectsEntity`, `:Service`, `:Organization`. MISSING: `:Customer` as a class (archimate-v1.ttl only mentions it in a comment), `:CustomerContract`, `:ChangeRequest`, and the contract-to-service relation. Rollup: LANDED only once every child is. | All children are LANDED. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.3.1 Add `:CustomerContract`, `:ChangeRequest` and `:coversService` Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Add `:CustomerContract`, `:ChangeRequest` and `:coversService`.** `supply_chain-v1.ttl` or a new `commercial-v1.ttl` adds `:CustomerContract` (to `:Organization` customer), `:ChangeRequest` (subclass of `:ApplicationEvent`) and `:coversService` (contract to service). MISSING today. | The file parses and `:ChangeRequest` entails `:ApplicationEvent`. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.3.2 SHACL shape: a contract names a customer and at least one service Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**SHACL shape: a contract names a customer and at least one service.** The shapes file refuses a `:CustomerContract` with no customer or no `:coversService`. Depends on `EG-CQ-XSRC-R008.3.1`. | Shape fixtures accept a valid contract and refuse both faults. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.3.3 Authority rows and query fixture: open incident or change to service to contract Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Authority rows and query fixture: open incident or change to service to contract.** Authority rows for `:Incident` and `:ChangeRequest` (servicenow-mcp rank 1, erpnext-mcp for `:ErpNextIssue` rank 2) and `:CustomerContract` (salesforce-mcp rank 1, twenty-mcp rank 2), plus the class-only SPARQL fixture. Depends on `EG-CQ-XSRC-R008.3.1`. | The fixture plans to the sources named above and names no connector. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R008.3.4 Acceptance: open incidents and changes listed with the service and contract Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Acceptance: open incidents and changes listed with the service and contract.** Recorded-response test asserting a non-empty list with incident or change, service, contract, customer and per-item source. Abstention when the CRM source is not connected. Depends on `EG-CQ-XSRC-R008.3.3`. | Non-empty, provenance-carrying. Abstention case passes. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R009 Acceptance: high-confidence agent claims against a new external report (rollup) Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Acceptance: high-confidence agent claims against a new external report (rollup).** The question has three parts. First, find each high-confidence claim of my agent from the last 30 days that touches a new external report. Second, cluster the supporting evidence by embedding similarity. Third, run a temporal decay analysis on the contradictions. One UQL program must answer it as one plan, served by arbora through `ARBORA-OPS-R018`. Children `.1` to `.5` deliver it. | Each child requirement has its own verification. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R009.1 Query fixture: claims that touch the report Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Query fixture: claims that touch the report.** `tests/fixtures/cq/xsrc_r009.uql` must hold the program. It must select claims by the agent with confidence at least 0.8 and valid time in the last 30 days. A claim touches the report through a graph edge or a vector similarity of at least 0.75 to a report chunk. | A parser test compiles the fixture to one plan DAG. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R009.2 Evidence clustering Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Evidence clustering.** The program must gather the supporting evidence with `EVIDENCE FOR`. It must group the evidence with the `CLUSTER BY EMBEDDING` stage of `EG-FEDERATED-QUERY-R720.3`. | The served acceptance test of `.4` checks the cluster ids of the fixture evidence. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R009.3 Contradiction decay analysis Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Contradiction decay analysis.** The program must read the contradictions of the selected claims with `CONTRADICTS` of `EG-DECISION-ENGINE-R700.7`. It must weight each contradiction with the `DECAY` stage of `EG-FEDERATED-QUERY-R720.2`. It must return the decayed weight of each contradiction. | The served acceptance test of `.4` checks the decayed weights against fixed values. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R009.4 Served acceptance through arbora Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Served acceptance through arbora.** The test must ingest a report fixture and agent claims through arbora. It must run the program through `ARBORA-OPS-R018`. `EXPLAIN` must report one plan id. The result must hold the expected claims, clusters and decayed weights. | `tests/test_cq_xsrc_r009.py::test_agent_claims_against_report_one_plan` passes against a served engine. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-XSRC-R009.5 Refusal Definition — EG-CQ-XSRC / EG-CQ-XSRC — Cross-source competency: supply chain to servicesCanonical requirement and verification source**Refusal.** A report id with no ingested record must refuse with `CQ_REPORT_NOT_FOUND`. An empty claim window must return an empty typed result and no error. | `tests/test_cq_xsrc_r009.py::test_unknown_report_refuses` asserts the code and the empty-window result. | requirement | EG-CQ-XSRC | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB EG-DATAPLAT-VOCAB — Data-platform vocabulary | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R001 Shared terms and mapping properties (rollup) Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Shared terms and mapping properties (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R001.1 to .4 are LANDED. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R001.1 Add `dp:DataStore`, `dp:storeFamily`, `dp:inStore`, `dp:viaConnection`, `dp:asOf` to the new vocabulary file. Touches `crates/eg-core/ontology/data_platform-v1.ttl` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:DataStore`, `dp:storeFamily`, `dp:inStore`, `dp:viaConnection`, `dp:asOf` to the new vocabulary file. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. | `crates/eg-core/tests/data_platform_vocab.rs::shared_terms_present` loads the file and asserts the five IRIs. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R001.2 Add `dp:StoreMapping` (subclass of `vg:VirtualMapping`) with `dp:contractKind`, `dp:viaOperation`, `dp:accelerationMode`, `dp:materialisationReason`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:StoreMapping` (subclass of `vg:VirtualMapping`) with `dp:contractKind`, `dp:viaOperation`, `dp:accelerationMode`, `dp:materialisationReason`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::store_mapping_subclass_of_virtual_mapping`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R001.3 Add `document` to the `vg:sourceKind` list comment and `sh:in` of the source-connection shape. Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `document` to the `vg:sourceKind` list comment and `sh:in` of the source-connection shape. Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | `crates/eg-core/tests/data_platform_vocab.rs::document_source_kind_accepted` validates a `document` connection and still rejects `ftp`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R001.4 Register `core:data-platform@1` as a core schema source next to `core:virtual-graph@1`. Touches `crates/eg-core/src/graph/schema_sources.rs`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceRegister `core:data-platform@1` as a core schema source next to `core:virtual-graph@1`. Touches `crates/eg-core/src/graph/schema_sources.rs`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::core_source_registered` resolves the source by name and version. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R002 Relational and document store terms (rollup) Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Relational and document store terms (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R002.1 to .4 are LANDED. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R002.1 Add `dp:Database`, `dp:Schema`, `dp:Table`, `dp:View`, `dp:Column`, `dp:ForeignKey`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:Database`, `dp:Schema`, `dp:Table`, `dp:View`, `dp:Column`, `dp:ForeignKey`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::relational_classes_present`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R002.2 Add `dp:inSchema`, `dp:hasColumn`, `dp:referencesTable`, `dp:isPrimaryKey`, `dp:sqlDialect` with domain/range. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:inSchema`, `dp:hasColumn`, `dp:referencesTable`, `dp:isPrimaryKey`, `dp:sqlDialect` with domain/range. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.1`. | `crates/eg-core/tests/data_platform_vocab.rs::relational_properties_domain_range`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R002.3 Add `dp:Collection`, `dp:DocumentField`, `dp:fieldPath`, `dp:fieldType`, `dp:presenceRatio`, `dp:documentCount`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:Collection`, `dp:DocumentField`, `dp:fieldPath`, `dp:fieldType`, `dp:presenceRatio`, `dp:documentCount`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::document_terms_present`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R002.4 Add a shape: `dp:fieldType` is in the `DocumentFieldType` list (incl. `Mixed`); `dp:presenceRatio` in [0,1]. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.3` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd a shape: `dp:fieldType` is in the `DocumentFieldType` list (incl. `Mixed`); `dp:presenceRatio` in [0,1]. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.3`. | `crates/eg-core/tests/data_platform_vocab.rs::document_field_shape_rejects_ratio_2`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R003 Object and vector store terms (rollup) Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Object and vector store terms (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R003.1 to .3 are LANDED. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R003.1 Add `dp:Bucket`, `dp:StoredObject`, `dp:objectKey`, `dp:byteSize`, `dp:lastModified`; no content property. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:Bucket`, `dp:StoredObject`, `dp:objectKey`, `dp:byteSize`, `dp:lastModified`; no content property. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::object_terms_present_without_content_property`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R003.2 Add `dp:VectorCollection`, `dp:EmbeddingSpace`, `dp:embeddingModel`, `dp:dimensions`, `dp:distanceMetric`, `dp:usesEmbeddingSpace`, `dp:vectorCount`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:VectorCollection`, `dp:EmbeddingSpace`, `dp:embeddingModel`, `dp:dimensions`, `dp:distanceMetric`, `dp:usesEmbeddingSpace`, `dp:vectorCount`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::vector_terms_present`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R003.3 Add a shape: `dp:dimensions` positive integer; exactly one embedding space per vector collection. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R003.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd a shape: `dp:dimensions` positive integer; exactly one embedding space per vector collection. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R003.2`. | `crates/eg-core/tests/data_platform_vocab.rs::vector_dimension_zero_rejected`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R004 Stream, analytics and ML terms (rollup) Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Stream, analytics and ML terms (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R004.1 to .4 are LANDED. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R004.1 Add `dp:Topic`, `dp:Partition`, `dp:ConsumerGroup`, `dp:PartitionLag`, `dp:partitionOf`, `dp:subscribesTo`, `dp:lag`, `dp:groupState`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:Topic`, `dp:Partition`, `dp:ConsumerGroup`, `dp:PartitionLag`, `dp:partitionOf`, `dp:subscribesTo`, `dp:lag`, `dp:groupState`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::stream_terms_present`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R004.2 Add a shape: `dp:lag` integer >= 0 and `dp:asOf` required on `dp:PartitionLag`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R004.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd a shape: `dp:lag` integer >= 0 and `dp:asOf` required on `dp:PartitionLag`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R004.1`. | `crates/eg-core/tests/data_platform_vocab.rs::negative_lag_rejected`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R004.3 Add `dp:AnalyticsSite`, `dp:BehaviorMetric`, `dp:metricName`, `dp:metricValue`, `dp:windowDays`, `dp:dimensionName`, `dp:dimensionValue`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:AnalyticsSite`, `dp:BehaviorMetric`, `dp:metricName`, `dp:metricValue`, `dp:windowDays`, `dp:dimensionName`, `dp:dimensionValue`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::analytics_terms_present`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R004.4 Add `dp:Dataset` as a subclass of the existing core `:Dataset`, `dp:Model` as a general trained-model class (not equivalent to the narrower LLM/embedding `:Model`), `dp:TrainingRun`, `dp:EvaluationResult`, `dp:trainedOn`, `dp:producedModel`, `dp:evaluatedOn`, `dp:baselineRun`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:Dataset` as a subclass of the existing core `:Dataset`, `dp:Model` as a general trained-model class (not equivalent to the narrower LLM/embedding `:Model`), `dp:TrainingRun`, `dp:EvaluationResult`, `dp:trainedOn`, `dp:producedModel`, `dp:evaluatedOn`, `dp:baselineRun`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::ml_terms_present`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R005 Secret metadata only (openbao) (rollup) Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Secret metadata only (openbao) (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R005.1 to .5 are LANDED. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R005.1 Add `dp:SecretEngine`, `dp:SecretPath`, `dp:AccessPolicy`, `dp:RotationState`, `dp:hasRotationState`, `dp:lastRotatedAt`, `dp:currentVersion`, `dp:pathName`, `dp:PolicyPathGrant`, `dp:grantPolicy`, `dp:grantPath`, `dp:grantsCapability`, `dp:leaseExpiresAt`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd `dp:SecretEngine`, `dp:SecretPath`, `dp:AccessPolicy`, `dp:RotationState`, `dp:hasRotationState`, `dp:lastRotatedAt`, `dp:currentVersion`, `dp:pathName`, `dp:PolicyPathGrant`, `dp:grantPolicy`, `dp:grantPath`, `dp:grantsCapability`, `dp:leaseExpiresAt`. Touches `crates/eg-core/ontology/data_platform-v1.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.1`. | `crates/eg-core/tests/data_platform_vocab.rs::secret_metadata_terms_present`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R005.2 Add closed shapes (`sh:closed true`) for the five secret-metadata classes, including `dp:PolicyPathGrant`. Allow only their applicable metadata properties, including shared store/provenance links, and reject every other property. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R005.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd closed shapes (`sh:closed true`) for the five secret-metadata classes, including `dp:PolicyPathGrant`. Allow only their applicable metadata properties, including shared store/provenance links, and reject every other property. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R005.1`. | `crates/eg-core/tests/data_platform_vocab.rs::secret_path_with_extra_property_rejected`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R005.3 Refusal test row: a `dp:SecretPath` carrying a `value` (and one carrying `token`) triple fails validation, and the vocabulary file contains no property named value, secret, token, password, ciphertext or rules. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R005.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceRefusal test row: a `dp:SecretPath` carrying a `value` (and one carrying `token`) triple fails validation, and the vocabulary file contains no property named value, secret, token, password, ciphertext or rules. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R005.2`. | `crates/eg-core/tests/data_platform_vocab.rs::secret_value_refused_and_no_value_property`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R005.4 Add a mapping-validator rule that refuses a `dp:StoreMapping` whose `dp:viaOperation` is `openbao_mcp_kv:kv2_get`, `kv1_get`, `openbao_mcp_logical:read` or `unwrap`. Touches `crates/eg-plan/src/virtual_graph_mapping.rs`. Depends on `EG-DATAPLAT-VOCAB-R005.3` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd a mapping-validator rule that refuses a `dp:StoreMapping` whose `dp:viaOperation` is `openbao_mcp_kv:kv2_get`, `kv1_get`, `openbao_mcp_logical:read` or `unwrap`. Touches `crates/eg-plan/src/virtual_graph_mapping.rs`. Depends on `EG-DATAPLAT-VOCAB-R005.3`. | `crates/eg-core/tests/data_platform_vocab.rs::openbao_value_operation_mapping_refused`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R005.5 Add a shape: each `dp:PolicyPathGrant` has exactly one `dp:grantPolicy` (`dp:AccessPolicy`), exactly one `dp:grantPath` (`dp:SecretPath`), and at least one `dp:grantsCapability` string in `read list create update delete sudo deny`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R005.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd a shape: each `dp:PolicyPathGrant` has exactly one `dp:grantPolicy` (`dp:AccessPolicy`), exactly one `dp:grantPath` (`dp:SecretPath`), and at least one `dp:grantsCapability` string in `read list create update delete sudo deny`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R005.1`. | `crates/eg-core/tests/data_platform_vocab.rs::grants_capability_closed_list` rejects an invalid permission and proves one policy can grant read on path A and deny on path B without mixing the permissions. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R006 Per-connector mapping fixtures (rollup) Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Per-connector mapping fixtures (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R006.1 to .8 are LANDED. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R006.1 Add the `sql` `dp:StoreMapping` fixture for `sql_schema:tables`, `columns`, `foreign_keys`, `constraints` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/sql.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the `sql` `dp:StoreMapping` fixture for `sql_schema:tables`, `columns`, `foreign_keys`, `constraints` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/sql.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_sql_validates`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R006.2 Add the `documentdb` `dp:StoreMapping` fixture for `documentdb_collections:list_collections`, `documentdb_analysis:aggregate` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/documentdb.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the `documentdb` `dp:StoreMapping` fixture for `documentdb_collections:list_collections`, `documentdb_analysis:aggregate` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/documentdb.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_documentdb_validates`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R006.3 Add the `objectstore` `dp:StoreMapping` fixture for `buckets:list`, `objects:list`, `objects:head` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/objectstore.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the `objectstore` `dp:StoreMapping` fixture for `buckets:list`, `objects:list`, `objects:head` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/objectstore.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_objectstore_validates`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R006.4 Add the `vector` `dp:StoreMapping` fixture for `vector_collection_management:list_collections` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/vector.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the `vector` `dp:StoreMapping` fixture for `vector_collection_management:list_collections` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/vector.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_vector_validates`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R006.5 Add the `kafka` `dp:StoreMapping` fixture for `kafka_groups:lags`, `kafka_partitions:list`, `kafka_topics:list` with `dp:accelerationMode` V; M for sustained lag (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/kafka.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the `kafka` `dp:StoreMapping` fixture for `kafka_groups:lags`, `kafka_partitions:list`, `kafka_topics:list` with `dp:accelerationMode` V; M for sustained lag (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/kafka.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_kafka_validates`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R006.6 Add the `openbao` `dp:StoreMapping` fixture for `openbao_mcp_sys:get_mounts`, `openbao_mcp_logical:list` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/openbao.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the `openbao` `dp:StoreMapping` fixture for `openbao_mcp_sys:get_mounts`, `openbao_mcp_logical:list` with `dp:accelerationMode` V (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/openbao.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_openbao_validates`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R006.7 Add the `clarity` `dp:StoreMapping` fixture for `clarity_insights:get_data_export` with `dp:accelerationMode` V up to 3 days; M beyond (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/clarity.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the `clarity` `dp:StoreMapping` fixture for `clarity_insights:get_data_export` with `dp:accelerationMode` V up to 3 days; M beyond (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/clarity.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_clarity_validates`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R006.8 Add the `data-science` `dp:StoreMapping` fixture for `load_dataset`, `dataset_lineage`, `rank_models`, `evaluate_model` with `dp:accelerationMode` V; M for run history (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/data-science.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the `data-science` `dp:StoreMapping` fixture for `load_dataset`, `dataset_lineage`, `rank_models`, `evaluate_model` with `dp:accelerationMode` V; M for run history (reason recorded where M). Touches `crates/eg-core/ontology/fixtures/data_platform/data-science.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mapping_fixture_data_science_validates`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R007 Mode and discovery guards (rollup) Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Mode and discovery guards (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R007.1 to .4 are LANDED. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R007.1 Add a shape rule: `materialised` without `dp:materialisationReason` is a violation; `virtual` needs none. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd a shape rule: `materialised` without `dp:materialisationReason` is a violation; `virtual` needs none. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::materialised_without_reason_rejected`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R007.2 Add a shape rule: `contractKind = mcp-operation` requires `dp:viaOperation`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd a shape rule: `contractKind = mcp-operation` requires `dp:viaOperation`. Touches `crates/eg-core/ontology/data_platform-v1.shapes.ttl`. Depends on `EG-DATAPLAT-VOCAB-R001.2`. | `crates/eg-core/tests/data_platform_vocab.rs::mcp_operation_requires_via_operation`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R007.3 Add a test that no `dp:` term or mapping fixture declares a discovery operation: relational/document entries come from `vg:MetadataContract` only. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R006.1` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd a test that no `dp:` term or mapping fixture declares a discovery operation: relational/document entries come from `vg:MetadataContract` only. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R006.1`. | `crates/eg-core/tests/data_platform_vocab.rs::no_second_discovery_path`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R007.4 Add a test that every fixture mapping not marked `materialised` has no `AccelerationPolicy` and every `materialised` one cites R038. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R006.8` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd a test that every fixture mapping not marked `materialised` has no `AccelerationPolicy` and every `materialised` one cites R038. Touches `crates/eg-core/tests/data_platform_vocab.rs`. Depends on `EG-DATAPLAT-VOCAB-R006.8`. | `crates/eg-core/tests/data_platform_vocab.rs::virtual_default_for_all_eight`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R008 Alignment with package-local ontologies (rollup) Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Alignment with package-local ontologies (rollup).** Becomes LANDED when every child is LANDED. | Children EG-DATAPLAT-VOCAB-R008.1 to .3 are LANDED. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R008.1 Add an alignment table (package term -> `dp:` term, `rdfs:subClassOf` / `owl:equivalentProperty`) for sql and documentdb. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_relational.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd an alignment table (package term -> `dp:` term, `rdfs:subClassOf` / `owl:equivalentProperty`) for sql and documentdb. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_relational.ttl`. Depends on `EG-DATAPLAT-VOCAB-R002.2`. | `crates/eg-core/tests/data_platform_vocab.rs::alignment_relational_resolves`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R008.2 Add the alignment table for objectstore and vector. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_object_vector.ttl`. Depends on `EG-DATAPLAT-VOCAB-R003.2` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the alignment table for objectstore and vector. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_object_vector.ttl`. Depends on `EG-DATAPLAT-VOCAB-R003.2`. | `crates/eg-core/tests/data_platform_vocab.rs::alignment_object_vector_resolves`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R008.3 Add the alignment table for kafka, openbao, clarity, data-science. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_ops_ml.ttl`. Depends on `EG-DATAPLAT-VOCAB-R004.4` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification sourceAdd the alignment table for kafka, openbao, clarity, data-science. Touches `crates/eg-core/ontology/fixtures/data_platform/alignment_ops_ml.ttl`. Depends on `EG-DATAPLAT-VOCAB-R004.4`. | `crates/eg-core/tests/data_platform_vocab.rs::alignment_ops_ml_resolves`. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R009 Connector operations this vocabulary needs (cross-repo rollup) Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Connector operations this vocabulary needs (cross-repo rollup).** Each child is owned by the named repository and is BLOCKED for the dependent competency question until it lands. | Children EG-DATAPLAT-VOCAB-R009.1 to .5 are LANDED. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R009.1 Cross-repo, owner `objectstore-mcp` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Cross-repo, owner `objectstore-mcp`.** Add a last-access (or access-log derived last-read) operation to `objects`. Touches `agent-packages/agents/objectstore-mcp/objectstore_mcp/mcp/mcp_objectstore.py`. | a `head`/`list` result carries `last_accessed` or the operation returns a typed `unsupported` for backends without it. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R009.2 Cross-repo, owner `vector-mcp` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Cross-repo, owner `vector-mcp`.** Add collection stats action (count, dimension, embedding model, distance metric) and get-by-id to `vector_collection_management`. Touches `agent-packages/agents/vector-mcp/vector_mcp/mcp_server.py`. | stats action returns the four fields on a fixture collection. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R009.3 Cross-repo, owner `openbao-mcp` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Cross-repo, owner `openbao-mcp`.** Add a metadata-only operation: KV v2 metadata (path, current version, created/updated time) and policy-to-path capability matrix, no values and no HCL. Touches `agent-packages/agents/openbao-mcp/openbao_mcp/mcp/mcp_secrets.py`. | response schema test asserts no value/data/token key at any depth. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R009.4 Cross-repo, owner `clarity-api` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Cross-repo, owner `clarity-api`.** Name and surface rage-click and dead-click metrics by URL in `get_data_export` results. Touches `agent-packages/agents/clarity-api/clarity_api/mcp/mcp_insights.py`. | fixture export returns the two metrics for the URL dimension. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DATAPLAT-VOCAB-R009.5 Cross-repo, owner `data-science-mcp` Definition — EG-DATAPLAT-VOCAB / EG-DATAPLAT-VOCAB — Data-platform vocabularyCanonical requirement and verification source**Cross-repo, owner `data-science-mcp`.** Add a run-registry read operation returning training runs, their dataset, validation metrics and baseline run. Touches `agent-packages/agents/data-science-mcp/data_science_mcp/mcp_server.py`. | fixture runs list returns metrics and a baseline id. | requirement | EG-DATAPLAT-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE EG-DECISION-ENGINE — Decision engine | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R001 Typed decision ladder with explicit resolution kinds (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed decision ladder with explicit resolution kinds (rollup).** Every decision answer exposes a resolution_kind of constraint, entailment, optimization, statistical, or abstention, selected by applying policy and hard constraints first, then ontology entailment, then bounded exact solving, and falling back to fitted statistics only to rank remaining legal options or abstain. Split (2026-10-09): `.1` the three resolution kinds the production chokepoint actually emits, `.2` the missing Constraint/Entailment production paths. Child `.100` adds a GraphOS pre-surface physical/safety bound decision contract. It does not replace GraphOS's required served surfacing gate. | Unit and integration tests assert the resolution_kind returned for representative constraint, entailment, optimization, statistical, and abstention cases. `.100` requires served bound checks and an explicit GraphOS pre-surface consumer receipt. | requirement | EG-DECISION-ENGINE | SPECIFIED | 52f333ca756e a4804f87c971 d2386535ca97 |
| EG-DECISION-ENGINE-R001.1 `ResolutionKind` is typed with all five variants; the production chokepoint emits Optimization, Statistical, and Abstention Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**`ResolutionKind` is typed with all five variants; the production chokepoint emits Optimization, Statistical, and Abstention.** `ResolutionKind` (crates/eg-types) defines Constraint, Entailment, Optimization, Statistical, and Abstention. The live `Decide`/assemble chokepoint (`crates/eg-compute/src/assemble/conclude.rs`) constructs `ResolutionKind::Optimization` and `ResolutionKind::Abstention`; `stat_decide` constructs `ResolutionKind::Statistical` and `::Abstention`. | `crates/eg-compute/src/assemble/tests/routing.rs` and `crates/eg-types/src/test_support/contract_wave/decision.rs` assert resolution_kind for Optimization/Statistical/Abstention cases. | requirement | EG-DECISION-ENGINE | VERIFIED | b23e8815f42c crates/eg-compute/src/assemble/tests/routing.rs:146 |
| EG-DECISION-ENGINE-R001.2 Remaining scope: production Constraint and Entailment resolution paths Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Remaining scope: production Constraint and Entailment resolution paths.** `conclude.rs` and `stat_decide` never construct `ResolutionKind::Constraint` or `::Entailment` — the only existing `Constraint` construction is `A2ARoutingResolution` (`crates/eg-types/src/decision/rapid_r044.rs`, EG-DECISION-ENGINE-R044.1), which is not wired into the general `Decide`/assemble chokepoint. Add: (a) a constraint-only short-circuit in `conclude.rs` that returns `ResolutionKind::Constraint` when hard constraints alone determine the answer, before solving/statistics run; (b) an ontology-entailment path that returns `ResolutionKind::Entailment` when the answer follows from entailment alone (reusing the existing is_a derivation machinery, EG-DECISION-ENGINE-R003). | Unit and integration tests assert `resolution_kind == Constraint` and `== Entailment` for representative cases through the production `Decide`/assemble chokepoint (not through `A2ARoutingResolution`). | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R002 Evidence class recorded on every decision record Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence class recorded on every decision record.** Each decision record stores an evidence_class: proof, observation or claim. The value comes from its weakest premise. Pack-provided capability annotations therefore appear as claims, not proof. | A negative test confirms a capability derived only from a pack annotation reports evidence_class claim, not proof. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e crates/eg-compute/src/assemble/tests/planted.rs:170 |
| EG-DECISION-ENGINE-R003 Derivation records for entailed answers Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Derivation records for entailed answers.** An is_a derivation record backs an entailment-resolved answer. It names the source and premise class of each edge used. An invented or unsupported ontology edge bars the overall answer from claiming proof-level evidence. | A negative test confirms the engine refuses an answer that depends on a fabricated ontology edge. The engine does not accept it as a proof. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 31c7f9514f41 52f333ca756e crates/eg-types/src/decision/derivation/tests.rs:191 |
| EG-DECISION-ENGINE-R004 Independently verifiable 0-1 integer solver certificate Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Independently verifiable 0-1 integer solver certificate.** The solver in crates/eg-compute/src/solve produces a certificate naming feasibility, objective value, lower bound, optimality gap, solver version, and input digest for every solved assembly, and a separate verifier recomputes and checks that certificate independently of the solve path. | Determinism tests confirm repeated solves are byte-identical and match a committed golden certificate digest, and an exhaustive-search test confirms the solver's optimum matches brute-force search on small models. | requirement | EG-DECISION-ENGINE | VERIFIED | 31c7f9514f41 52f333ca756e b43f33569dd4 crates/eg-compute/tests/solve/determinism.rs:49 crates/eg-compute/tests/solve/determinism.rs:78 crates/eg-compute/tests/solve/exhaustive.rs:40 |
| EG-DECISION-ENGINE-R005 Conformal and risk-controlled statistical guarantees Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Conformal and risk-controlled statistical guarantees.** Statistical heads apply acceptability-set conformal prediction, selective risk control (Learn-then-Test), and adaptive conformal inference to bound miscoverage under drift, abstaining rather than returning an uncalibrated answer when these guarantees cannot be met. | Numeric unit tests fit and evaluate each guarantee and assert the resulting coverage and abstention behavior. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 31c7f9514f41 52f333ca756e crates/eg-numeric/tests/stat_kernels/conformal.rs:210 crates/eg-numeric/tests/stat_kernels/conformal.rs:361 crates/eg-numeric/tests/stat_kernels/risk.rs:246 |
| EG-DECISION-ENGINE-R006 Off-policy evaluation gated on effective sample size Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Off-policy evaluation gated on effective sample size.** Decision evaluation records exact propensities and computes off-policy estimates. It uses clipped or SWITCH importance sampling and doubly robust estimators. It reports effective sample size and refuses to promote a fitted head when that size falls below the configured minimum. | A unit test asserts that off-policy evaluation reports support and effective sample size. It also verifies that the engine blocks promotion below the minimum threshold. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 31c7f9514f41 52f333ca756e crates/eg-numeric/tests/stat_kernels/ope.rs:159 crates/eg-numeric/tests/stat_kernels/ope.rs:204 |
| EG-DECISION-ENGINE-R007 Deterministic cross-target replay of committed decision records Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Deterministic cross-target replay of committed decision records.** A committed decision record replays to byte-identical quantized fixed-point digests using a pinned software floating-point implementation. The same record verifies identically on every supported target platform. | A golden-vector replay test confirms identical digests on the supported targets. Release qualification exercises the full target matrix. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e e0587cbf4693 crates/eg-compute/src/assemble/tests/golden.rs:55 |
| EG-DECISION-ENGINE-R008 Why-chosen and why-not explanations for solved assemblies Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Why-chosen and why-not explanations for solved assemblies.** Every solved assembly can explain why it chose an option. For each visible excluded option, it can explain why not. It uses a bounded re-solve for that option rather than an unbounded search. | Integration tests confirm why-not routing returns a correct, bounded explanation for excluded candidates. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e e0587cbf4693 crates/eg-compute/src/assemble/tests/template.rs:117 |
| EG-DECISION-ENGINE-R009 Learned ranking stays monotone with respect to safety Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Learned ranking stays monotone with respect to safety.** A fitted statistical head may only narrow the set of legal options or cause abstention. It can never widen the legal set. It can never authorize an option that policy and hard constraints have not already permitted. | A negative test confirms that a learned head cannot override or widen the constraint-derived legal set. It also confirms that execution enforces this invariant independently of the head. | requirement | EG-DECISION-ENGINE | VERIFIED | 4952a2edced4 52f333ca756e crates/eg-numeric/tests/decision/scorer.rs:140 |
| EG-DECISION-ENGINE-R010 Typed abstention reason for unmet capability Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed abstention reason for unmet capability.** When no legal assembly satisfies the requested capabilities, the system returns a typed AbstainReason value naming the specific missing capability rather than a generic failure. | Unit tests assert that an unsatisfiable capability request returns an AbstainReason identifying the missing capability. | requirement | EG-DECISION-ENGINE | VERIFIED | 52f333ca756e a4804f87c971 e0587cbf4693 crates/eg-compute/src/assemble/tests/routing.rs:147 |
| EG-DECISION-ENGINE-R011 Work-budgeted search without an arbitrary result cap Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Work-budgeted search without an arbitrary result cap.** The solver in crates/eg-compute/src/solve/search bounds search by a deterministic node budget rather than an arbitrary cap on the number of candidate results, reporting an unresolved or certified-gap result when the budget is exhausted instead of silently truncating the option set. | Adversarial tests confirm that exhausting the budget above the accepted gap yields an unresolved result, that exhausting it within the accepted gap yields a certified gap, and that a parity case exhausts the budget without an incumbent. | requirement | EG-DECISION-ENGINE | VERIFIED | 52f333ca756e b43f33569dd4 e0587cbf4693 crates/eg-compute/tests/solve/adversarial.rs:33 crates/eg-compute/tests/solve/adversarial.rs:57 crates/eg-compute/tests/solve/adversarial.rs:8 |
| EG-DECISION-ENGINE-R012 Shared slate crediting across multiple questions Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Shared slate crediting across multiple questions.** When multiple questions are answered against the same assembly template, the system credits outcomes at the slot level across the shared template, with results aggregated consistently across the related questions. | Template-level unit tests assert slot-level crediting is applied correctly across a shared assembly template. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e 81e90c5f3bde d2386535ca97 src/server/handlers/decide/stat_tests/attribution_tests.rs:128 src/server/handlers/decide/stat_tests/attribution_tests.rs:129 |
| EG-DECISION-ENGINE-R012.1 Slot-level crediting across questions sharing an assembly template Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Slot-level crediting across questions sharing an assembly template.** When multiple questions are answered against the same assembly template, outcomes must be credited at the slot level across the shared template; today only whole- or sub-slate crediting exists. | Test: `crates/eg-types/src/decision/rapid_r012.rs::tests::credits_outcomes_at_the_slot_level_across_a_shared_assembly_template`. | requirement | EG-DECISION-ENGINE | VERIFIED | 81e90c5f3bde src/server/handlers/decide/stat_tests/attribution_tests.rs:129 |
| EG-DECISION-ENGINE-R013 Tenant-visibility filtering before feature computation Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Tenant-visibility filtering before feature computation.** Decision candidates are filtered by tenant and row-level visibility before any feature is computed or counted, and no report or aggregate may expose a candidate, feature value, or statistic derived from a source outside the requesting tenant's visibility. | A negative test confirms that a candidate from another tenant is excluded from decision results and aggregates. | requirement | EG-DECISION-ENGINE | VERIFIED | 14743fbffa3d 2a0d6eae0918 52f333ca756e src/server/persistence/agent_component.rs:1101 |
| EG-DECISION-ENGINE-R014 Composition solved as bounded constraint optimization Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Composition solved as bounded constraint optimization.** Agent or component composition is resolved by lowering covering, implication, exactly-one, knapsack, feature-compatibility, and cardinality requirements into a bounded 0-1 integer program and solving it exactly, rather than by a single unverified model-generated choice. | Exhaustive-search and model-validation tests confirm the lowered constraint model produces correct, verifiable compositions across representative cases. | requirement | EG-DECISION-ENGINE | SPECIFIED | 14743fbffa3d 52f333ca756e b43f33569dd4 crates/eg-compute/tests/solve/exhaustive.rs:41 crates/eg-compute/tests/solve/model_validation.rs:223 |
| EG-DECISION-ENGINE-R015 No generative model weights inside the decision engine (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**No generative model weights inside the decision engine (rollup).** The decision engine contains no large language model weights and performs no free-text generation. Its statistical heads are small fitted models used only to rank legal options or abstain. Split into child requirements by code root. `.1` is a typed, closed StatisticalHeadKind refusing a non-fitted-head name. `.2` wires the ladder's head registry through the typed head-kind parse. | Architecture and dependency review confirms no generative model weights or text-generation calls are present in the decision engine's code paths. | requirement | EG-DECISION-ENGINE | VERIFIED | 0fac721690e2 2763396269d0 3c6b457009e4 40ea81e3e512 52f333ca756e crates/eg-numeric/tests/decision/head_kinds.rs:75 crates/eg-types/src/decision/jobs.rs:615 crates/eg-types/src/decision/jobs.rs:635 crates/eg-types/src/decision/rapid_r015.rs:100 crates/eg-types/src/decision/rapid_r015.rs:117 |
| EG-DECISION-ENGINE-R015.1 Typed, closed StatisticalHeadKind refusing a non-fitted-head name Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed, closed StatisticalHeadKind refusing a non-fitted-head name.** Add the typed, closed `StatisticalHeadKind::parse` (`crates/eg-types/src/decision/rapid_r015.rs`). It refuses any head-kind name outside the two fitted heads the ladder uses, including a generative-model label. | Test: `crates/eg-types/src/decision/rapid_r015.rs::tests::refuses_a_generative_model_name`. | requirement | EG-DECISION-ENGINE | VERIFIED | 0fac721690e2 crates/eg-types/src/decision/rapid_r015.rs:100 |
| EG-DECISION-ENGINE-R015.2 Wire the ladder's head registry through the typed head-kind parse Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wire the ladder's head registry through the typed head-kind parse.** Remaining scope from the split (2026-10-09): wiring the ladder's head registry to construct heads only through this parse. Split into grandchild requirements (2026-10-09). `.1` a total, reversible mapping between the closed `StatisticalHeadKind` and the ladder's production `HeadKind` registry, `.2` routing `DecisionFitRequest` construction through that mapping at admission. | Architecture and dependency review confirms no generative model weights or text-generation calls are present in the decision engine's code paths. | requirement | EG-DECISION-ENGINE | VERIFIED | 2763396269d0 3c6b457009e4 crates/eg-types/src/decision/jobs.rs:615 crates/eg-types/src/decision/jobs.rs:635 crates/eg-types/src/decision/rapid_r015.rs:117 |
| EG-DECISION-ENGINE-R015.2.1 Total, reversible mapping between StatisticalHeadKind and the production HeadKind registry Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Total, reversible mapping between StatisticalHeadKind and the production HeadKind registry.** Add `StatisticalHeadKind::to_head_kind` and `StatisticalHeadKind::from_head_kind` (`crates/eg-types/src/decision/rapid_r015.rs`), connecting the closed, parse-validated name set to the ladder's actual `HeadKind` enum, with the resident-scorer `OptionAttention` variant correctly outside the closed set rather than silently coerced into it. | Test: `crates/eg-types/src/decision/rapid_r015.rs::tests::wires_the_production_head_kind_through_the_closed_registry`. | requirement | EG-DECISION-ENGINE | VERIFIED | 3c6b457009e4 crates/eg-types/src/decision/rapid_r015.rs:117 |
| EG-DECISION-ENGINE-R015.2.2 Route DecisionFitRequest construction through the typed mapping Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Route DecisionFitRequest construction through the typed mapping.** Remaining scope: validate `DecisionFitRequest.head_kind` through `StatisticalHeadKind::from_head_kind` at admission (`crates/eg-types/src/decision/jobs.rs`), deciding how an `OptionAttention` fit request is admitted given it is outside the `.1`/`.2.1` closed set. | Architecture and dependency review confirms no generative model weights or text-generation calls are present in the decision engine's code paths. | requirement | EG-DECISION-ENGINE | VERIFIED | 2763396269d0 crates/eg-types/src/decision/jobs.rs:615 crates/eg-types/src/decision/jobs.rs:635 |
| EG-DECISION-ENGINE-R016 Training restricted to independently evaluated outcomes Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Training restricted to independently evaluated outcomes.** Calibration and training data include only outcomes recorded with exact propensities by approved commit principals; a self-reported or language-model-resolved outcome is excluded from the calibration or training set. | Unit tests confirm that the engine refuses every planted defective label by name. A language-model-resolved abstention never enters the calibration set. | requirement | EG-DECISION-ENGINE | VERIFIED | 14743fbffa3d 2a0d6eae0918 52f333ca756e crates/eg-numeric/tests/decision/admission.rs:32 crates/eg-numeric/tests/decision/admission.rs:87 |
| EG-DECISION-ENGINE-R017 Single write authority per durable decision state kind Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Single write authority per durable decision state kind.** Each durable decision-state kind has exactly one write authority responsible for committing it. Examples include an assembled agent graph, a graph mutation batch, or a published component with its receipt. No second code path may independently mutate that state. | Integration tests confirm only the designated path commits each state kind. They also confirm bypass attempts fail. | requirement | EG-DECISION-ENGINE | VERIFIED | 28a27439cec5 52f333ca756e 9079ca7b0ddd crates/eg-types/src/agent_component.rs:2278 |
| EG-DECISION-ENGINE-R018 Unknown facts never default to zero in the solver Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Unknown facts never default to zero in the solver.** When a cost, latency, or capability fact needed by the solver objective is unknown, the solver treats it as unknown rather than silently substituting zero or a true or false default, and surfaces the gap instead of producing a misleadingly optimal result. | A unit test confirms that an unknown required fact prevents a false-confidence solve rather than being silently defaulted. | requirement | EG-DECISION-ENGINE | VERIFIED | 52f333ca756e c0edc96d1e10 crates/eg-compute/src/assemble/tests/planted.rs:43 crates/eg-compute/src/assemble/tests/topology.rs:143 |
| EG-DECISION-ENGINE-R019 Decision commit re-derives and verifies before writing Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision commit re-derives and verifies before writing.** Committing a decision result re-derives the result, verifies its certificate, checks every pinned component revision, and compares the candidate-universe catalog digest with a compare-and-set, all within one transaction, so a stale catalog or fabricated input fails closed instead of being committed. | Integration tests confirm that a stale catalog or a fabricated input is rejected at commit time while a byte-identical retry commits idempotently. | requirement | EG-DECISION-ENGINE | SPECIFIED | 14743fbffa3d 52f333ca756e d6baf6dfc8c9 src/server/persistence/decision_record/tests.rs:167 src/server/persistence/decision_record/tests.rs:196 src/server/persistence/decision_record/tests.rs:222 |
| EG-DECISION-ENGINE-R020 Bounded, keyed exploration excluded from sensitive questions Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Bounded, keyed exploration excluded from sensitive questions.** Exploratory ranking requires an explicit budget and an unpredictable HMAC-keyed seed, and is unavailable for security, policy, write-back, and irreversible-action questions regardless of the requested budget. | Unit tests verify the keyed seed against a published HMAC test vector and confirm that exploration on a security question is refused by the served path. | requirement | EG-DECISION-ENGINE | SPECIFIED | 2a0d6eae0918 52f333ca756e src/server/handlers/decide/stat_tests.rs:868 |
| EG-DECISION-ENGINE-R021 Versioned feature schema for decision candidates Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Versioned feature schema for decision candidates.** Decision ranking computes a versioned feature set over caller-visible candidates, including vector similarity, candidate-local BM25, entailed coverage, provenance quality, belief confidence, cost and latency, freshness, and outcome statistics, so a feature schema change can be tracked and replayed. | Unit and client tests assert the versioned feature vector is computed correctly for representative candidates. | requirement | EG-DECISION-ENGINE | VERIFIED | 14743fbffa3d 2a0d6eae0918 52f333ca756e crates/eg-numeric/tests/decision/features.rs:63 |
| EG-DECISION-ENGINE-R022 Separation of full-label and bandit-label training regimes Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Separation of full-label and bandit-label training regimes.** Training data distinguishes gold-labelled questions, which provide a full label, from executed-option-only outcomes, which provide a bandit label, and each regime is admitted into fitting only through its own path. | Unit tests in the admission path confirm gold-labelled and bandit-labelled data are routed and validated separately. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e a4e9027b789e crates/eg-numeric/tests/decision/admission.rs:33 crates/eg-numeric/tests/decision/admission.rs:88 |
| EG-DECISION-ENGINE-R023 Hierarchical pooling of outcome statistics with a minimum-sample gate Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hierarchical pooling of outcome statistics with a minimum-sample gate.** Pool outcome statistics hierarchically by kind, capability class and option using a Beta-Binomial model. A pool below its configured sample minimum cannot support fitted-head promotion. | A unit test confirms insufficient pooled support for an option blocks promotion. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e a4e9027b789e crates/eg-numeric/tests/decision/fit_eval.rs:204 |
| EG-DECISION-ENGINE-R024 Multi-class and binary calibration utilities Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Multi-class and binary calibration utilities.** Decision confidence uses temperature, vector, or Dirichlet scaling for multi-class outputs. It uses isotonic calibration only for the binary entity-resolution case. The engine records the calibration method on the resulting receipt. | A unit test confirms pooled calibration output is recorded on the fit receipt. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e a4e9027b789e crates/eg-numeric/tests/decision/fit_eval.rs:236 |
| EG-DECISION-ENGINE-R025 Drift detection via out-of-distribution checks and adaptive conformal bounds Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Drift detection via out-of-distribution checks and adaptive conformal bounds.** The decision engine detects drift by checking incoming features for out-of-distribution values and by bounding miscoverage with adaptive conformal inference, abstaining rather than ranking when drift is detected. | A unit test confirms that an out-of-distribution feature causes the head to abstain. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e a4e9027b789e crates/eg-numeric/tests/decision/ladder.rs:302 |
| EG-DECISION-ENGINE-R026 Inverse-probability-weighted audit sampling of acted decisions Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Inverse-probability-weighted audit sampling of acted decisions.** A sample of acted decisions is selected for audit using inverse-probability weighting at a fixed five-percent rate, and every audited decision record carries an audit flag usable by downstream calibration. | Unit tests assert that evaluated records carry the audit flag and that calibration correctly applies the inverse-probability weighting. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e 81ea985399b0 a4e9027b789e crates/eg-numeric/src/decision/targets.rs:82 crates/eg-numeric/tests/decision/ladder.rs:326 |
| EG-DECISION-ENGINE-R026.1 Calibration-weighting half of audit sampling is tested in-crate Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Calibration-weighting half of audit sampling is tested in-crate.** The audit-flag sampling half of inverse-probability-weighted audit sampling has a bound test, but the calibration-weighting half (`pub(crate) audit_weight`/targets) has no in-crate `#[cfg(test)]` test confirming calibration correctly applies the inverse-probability weight. | Test: `crates/eg-numeric/src/decision/audit.rs::tests::calibration_applies_the_pub_crate_inverse_probability_audit_weight`. | requirement | EG-DECISION-ENGINE | VERIFIED | 81ea985399b0 crates/eg-numeric/src/decision/targets.rs:82 |
| EG-DECISION-ENGINE-R027 WeightedFeatures and ListwiseLogistic fitted decision heads Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**WeightedFeatures and ListwiseLogistic fitted decision heads.** The decision engine supports a WeightedFeatures head, which is advisory only and never calibrated, and a ListwiseLogistic head, which is a deterministic, bit-for-bit reproducible optimizer; a further Kolmogorov-Arnold listwise head is not yet included. | Unit tests confirm a fit is bit-for-bit reproducible and certifies an act threshold, and that the WeightedFeatures head remains advisory and is never calibrated. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e crates/eg-numeric/tests/decision/fit_eval.rs:53 crates/eg-numeric/tests/decision/fit_eval.rs:79 |
| EG-DECISION-ENGINE-R028 Natural-language template routing without a generative model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Natural-language template routing without a generative model.** A natural-language decision request is routed to a matching NlTemplate using candidate-local BM25, embedding, or ontology-label similarity rather than a generative model call. | Unit tests cover natural-language template matching; end-to-end served routing is proven when the serving path is exercised. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 52f333ca756e 9ea2c1ac6a24 crates/eg-numeric/src/decision/bm25.rs:92 src/server/handlers/decide/stat_tests/nl_tests.rs:59 |
| EG-DECISION-ENGINE-R029 Decision-based retrieval-plan selection Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision-based retrieval-plan selection.** The decision ladder selects among retrieval plans, such as LeanRAG, reciprocal-rank fusion, or direct SPARQL querying, for a given request using the same typed decision mechanism as other question families. | An integration test asserts the correct retrieval plan is selected for representative request shapes. | requirement | EG-DECISION-ENGINE | SPECIFIED | 52f333ca756e 5951a4a6272e 9f300857d769 b2d01ed93bd8 crates/eg-types/src/decision/statistical/retrieval_plan.rs:132 |
| EG-DECISION-ENGINE-R030 Decision-based ingestion path routing Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision-based ingestion path routing.** Ingestion requests are routed to a fast, medium, or slow processing path through the same typed decision mechanism used for other question families, rather than a hard-coded rule. | An integration test confirms ingestion routing selects the expected path for representative inputs. | requirement | EG-DECISION-ENGINE | VERIFIED | 15f6e8dff987 28ca65b7e45b 2b5963a7d670 52f333ca756e 5951a4a6272e crates/eg-types/src/decision/statistical/ingestion_lane.rs:90 |
| EG-DECISION-ENGINE-R031 Expected-value scheduling for enrichment work Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Expected-value scheduling for enrichment work.** Enrichment scheduling selects candidate work by comparing expected value against cost through the typed decision mechanism, rather than a fixed priority order. | An integration test confirms enrichment scheduling selects the higher expected-value option under representative cost scenarios. | requirement | EG-DECISION-ENGINE | SPECIFIED | 7db76f6142e3 aa3e35c45f82 b2d01ed93bd8 b6eb6a62d9dc fa780d3e101a crates/eg-types/src/decision/statistical/enrichment_schedule.rs:126 |
| EG-DECISION-ENGINE-R032 Entity-resolution candidates with conformal guarantees (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Entity-resolution candidates with conformal guarantees (rollup).** Entity-resolution (owl:sameAs) candidate decisions use the binary entity-matching head with isotonic calibration and report a conformal guarantee validated against a gold label set, abstaining when that guarantee cannot be met. Split (2026-10-09): `.1` the declared-but-unused QuestionKind, `.2` the full ResolveEntity decision path. | A unit test against a gold-labelled set confirms the reported conformal guarantee holds and that insufficient confidence results in abstention. | requirement | EG-DECISION-ENGINE | SPECIFIED | a1bb9fb9503e d2386535ca97 fa780d3e101a |
| EG-DECISION-ENGINE-R032.1 `QuestionKind::ResolveEntity` is declared Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**`QuestionKind::ResolveEntity` is declared.** `QuestionKind::ResolveEntity` is declared in `crates/eg-types/src/decision/statistical.rs`. No code constructs, matches, or tests it anywhere in the repo. There is no entity-matching head, isotonic calibration, or conformal-guarantee code for this kind. | Compiles as part of the `QuestionKind` enum. No test exists (none is claimed). | requirement | EG-DECISION-ENGINE | VERIFIED | b23e8815f42c crates/eg-types/src/decision/statistical.rs:381 |
| EG-DECISION-ENGINE-R032.2 Remaining scope: ResolveEntity decision path with conformal guarantee Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Remaining scope: ResolveEntity decision path with conformal guarantee.** Build the full path: a binary entity-matching head trained/scored over owl:sameAs candidate pairs, isotonic calibration of its score, a conformal guarantee computed against a gold-labelled set, and abstention when the guarantee cannot be met — dispatched through `Decide` on `QuestionKind::ResolveEntity`. | A unit test against a gold-labelled set confirms the reported conformal guarantee holds and that insufficient confidence results in abstention, exercised through `QuestionKind::ResolveEntity` end to end. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R033 Decision-based schema mapping for SQL sources (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision-based schema mapping for SQL sources (rollup).** Mapping a source column to an ontology property for SQL ingestion and pack content is resolved through the typed decision mechanism, producing a proposed mapping with its evidence class rather than an unverified direct assignment. Split (2026-10-09): `.1` the declared-but-unused QuestionKind, `.2` the full SchemaMapping decision path. | An integration test confirms a representative column set maps to the expected ontology properties with correct evidence classification. | requirement | EG-DECISION-ENGINE | SPECIFIED | a1bb9fb9503e d2386535ca97 fa780d3e101a |
| EG-DECISION-ENGINE-R033.1 `QuestionKind::SchemaMapping` is declared Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**`QuestionKind::SchemaMapping` is declared.** `QuestionKind::SchemaMapping` is declared in `crates/eg-types/src/decision/statistical.rs`. No code constructs, matches, or tests it anywhere in the repo; there is no SQL-column-to-ontology-property decision path. | Compiles as part of the `QuestionKind` enum; no test exists (none is claimed). | requirement | EG-DECISION-ENGINE | VERIFIED | b23e8815f42c crates/eg-types/src/decision/statistical.rs:388 |
| EG-DECISION-ENGINE-R033.2 Remaining scope: SchemaMapping decision path for SQL ingestion Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Remaining scope: SchemaMapping decision path for SQL ingestion.** Build the full path: given a SQL source column (name, type, sample content) and the ontology's candidate properties, resolve the mapping through `Decide` on `QuestionKind::SchemaMapping`, producing a proposed mapping and its evidence class (proof/observation/claim) rather than an unverified direct assignment, for both SQL ingestion and pack content. | An integration test maps representative columns to the expected ontology properties. It checks evidence classification through `QuestionKind::SchemaMapping` end to end. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R034 Proposal-only contradiction-handling suggestions Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Proposal-only contradiction-handling suggestions.** When the truth-maintenance system detects a contradiction, the decision engine may propose a resolution but never performs an automatic retraction. Any retraction requires a separate, explicit authorization step. | A negative test confirms that a detected contradiction produces a proposal only and that no automatic retraction occurs. | requirement | EG-DECISION-ENGINE | VERIFIED | 94da44835d59 9ea2c1ac6a24 fa780d3e101a crates/eg-epistemic/src/query.rs:661 |
| EG-DECISION-ENGINE-R035 Decision-based routing for execution configuration Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision-based routing for execution configuration.** This repository's graph.decide() method accepts requests to select among candidate models, prompts, skills, tools, harness modes, account modes, or sandbox configurations and returns a ranked or constrained choice with its evidence class; the consuming execution environment applies that choice. | A contract test confirms graph.decide() returns a valid typed choice and evidence class for each supported routing category. | requirement | EG-DECISION-ENGINE | SPECIFIED | 7db76f6142e3 fa780d3e101a src/server/handlers/decide/stat_tests/consumer_tests.rs:421 |
| EG-DECISION-ENGINE-R036 graph.assemble() as the authority for agent composition Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**graph.assemble() as the authority for agent composition.** graph.assemble() is the sole method for composing an agent graph from typed tasks and capabilities, replacing a model-generated composition choice with a verifiable constraint-solved result. | An integration test confirms graph.assemble() produces a legal, certificate-backed agent graph for representative composition requests. | requirement | EG-DECISION-ENGINE | SPECIFIED | 9ea2c1ac6a24 d6baf6dfc8c9 fa780d3e101a crates/eg-compute/src/assemble/tests/golden.rs:56 |
| EG-DECISION-ENGINE-R037 Escalated abstentions re-enter as claims Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Escalated abstentions re-enter as claims.** When a typed abstention is escalated to a language model or a human reviewer and a resolution is produced, that resolution re-enters the decision engine only as a claim-class input, never as a proof or observation. | A negative test confirms a resolution produced by escalation is recorded with evidence_class claim. | requirement | EG-DECISION-ENGINE | VERIFIED | 2ae20b268539 8475bc4d611a fa780d3e101a src/server/handlers/decide/stat_tests/consumer_tests.rs:225 |
| EG-DECISION-ENGINE-R038 Advisory pre-tool risk scoring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Advisory pre-tool risk scoring.** Before a tool invocation, the decision engine can return an advisory risk score for the candidate action. The score informs but never itself authorizes or blocks execution. | A unit test confirms the risk score is returned as advisory and does not gate execution on its own. | requirement | EG-DECISION-ENGINE | VERIFIED | 1570bfef96aa 4034a361535b 81e90c5f3bde fa780d3e101a src/server/handlers/decide/stat_tests/pretool_risk_tests.rs:26 src/server/handlers/decide/stat_tests/pretool_risk_tests.rs:27 |
| EG-DECISION-ENGINE-R038.1 Typed ToolInvocation / pre-tool risk concept exists Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed ToolInvocation / pre-tool risk concept exists.** No risk/pretool/ToolInvocation concept exists in the engine. Add the typed representation a caller can score before dispatching a tool invocation, advisory only. | Test: `crates/eg-types/src/decision/rapid_r038.rs::tests::returns_an_advisory_risk_score_for_a_candidate_tool_invocation_without_gating_execution`. | requirement | EG-DECISION-ENGINE | VERIFIED | 81e90c5f3bde src/server/handlers/decide/stat_tests/pretool_risk_tests.rs:27 |
| EG-DECISION-ENGINE-R039 Cost-aware routing using accounting data (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Cost-aware routing using accounting data (rollup).** Routing decisions use cost information from the usage and cost accounting subsystem. They prefer lower-cost legal options that satisfy the same constraints. Split (2026-10-09): `.1` the missing-data abstention path that landed, `.2` the missing cost-preference ranking. | An integration test confirms a routing decision prefers the lower-cost legal option when accounting data distinguishes candidates. | requirement | EG-DECISION-ENGINE | SPECIFIED | 0cbda8f2af96 d2386535ca97 fa780d3e101a |
| EG-DECISION-ENGINE-R039.1 Routing abstains naming the fact when L5 accounting data is missing Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Routing abstains naming the fact when L5 accounting data is missing.** `cost_routing_without_l5_accounting_abstains_naming_the_fact` (EH-039, `src/server/handlers/decide/stat_tests/consumer_tests.rs`) confirms that when there is no L5 cost-accounting data for the candidates, the routing decision abstains and names the missing-data fact rather than guessing. | Test: `src/server/handlers/decide/stat_tests/consumer_tests.rs::cost_routing_without_l5_accounting_abstains_naming_the_fact`. | requirement | EG-DECISION-ENGINE | VERIFIED | a742d4439964 src/server/handlers/decide/stat_tests/consumer_tests.rs:288 |
| EG-DECISION-ENGINE-R039.2 Remaining scope: cost-preference ranking when accounting data is present Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Remaining scope: cost-preference ranking when accounting data is present.** No production code path ranks or prefers options by a cost-like feature when L5 accounting data is present — this needs a published scoring head over observed/accounted cost (consuming `ObservedCost`, see AU-CONTROL-R006) feeding the deterministic ladder, since the exploration policy currently samples uniformly over legal options rather than preferring the cheaper one. | An integration test confirms a routing decision prefers the lower-cost legal option when accounting data distinguishes candidates (the original R039 acceptance test, now bound to this child). | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R040 Guarded promotion of fitted heads via publish receipt Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Guarded promotion of fitted heads via publish receipt.** A fitted decision head is promoted to active use only through the component-publish path gated on a matching DecisionEval receipt. A receipt that does not match the evaluated digest causes promotion to be refused. | Unit tests confirm a mismatched receipt is refused with an evaluation-receipt-mismatch error while a matching receipt allows publish. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 8475bc4d611a fa780d3e101a src/server/handlers/decide/stat_tests/scorer_tests.rs:80 |
| EG-DECISION-ENGINE-R041 Connector event triage through Decide Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Connector event triage through Decide.** EG classifies inbound connector events by routing them through the decision ladder in evaluate-only mode, returning a proposal and its evidence class without taking any action on the connector's behalf. A sampled subset of these evaluations is logged for audit. | An integration test submits synthetic connector events, calls the evaluate-only triage path, and asserts no side effect occurs while a sampled fraction of evaluations is recorded. | requirement | EG-DECISION-ENGINE | VERIFIED | a742d4439964 d2386535ca97 f420578b85d2 fa780d3e101a src/server/handlers/decide/stat_tests/connector_triage_tests.rs:24 src/server/handlers/decide/stat_tests/connector_triage_tests.rs:25 |
| EG-DECISION-ENGINE-R041.1 Connector-event evaluate-only triage path with sampled audit logging Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Connector-event evaluate-only triage path with sampled audit logging.** No connector-event evaluate-only triage path or sampled-audit mechanism exists. Inbound connector events must be classified via the decision ladder in evaluate-only mode with a sampled fraction logged for audit. | Test: `src/server/handlers/decide/stat_tests/consumer_tests.rs::connector_event_triage_is_evaluate_only_and_logs_a_sampled_fraction_for_audit`. | requirement | EG-DECISION-ENGINE | VERIFIED | a742d4439964 src/server/handlers/decide/stat_tests/connector_triage_tests.rs:24 |
| EG-DECISION-ENGINE-R042 Connector tool-choice advisory via Decide Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Connector tool-choice advisory via Decide.** Decide evaluates which internal tool a connector should use for a given task and returns a proposal with evidence only; the connector's own deterministic authorization path, not Decide, governs whether any resulting write-back actually occurs. | A test exercises tool-choice evaluation for a connector task and confirms the proposal alone cannot trigger a write-back without passing the separate deterministic authorization check. | requirement | EG-DECISION-ENGINE | SPECIFIED | 67d04f5e9087 e8eaaf916a40 fa780d3e101a src/server/handlers/decide/stat_tests/connector_toolchoice_tests.rs:24 |
| EG-DECISION-ENGINE-R043 Write-back proposals routed through Decide Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Write-back proposals routed through Decide.** EG's decision ladder can produce a write-back proposal with supporting evidence for a connector action. The proposal never authorizes the write itself. Any exploration or statistical head that generates the proposal stays outside the authorization step. That deterministic step must separately approve the write. | A negative test asserts a Decide-sourced write-back proposal has no external effect. The effect occurs only after the connector's own deterministic authorization check passes. | requirement | EG-DECISION-ENGINE | SPECIFIED | 21f73899e76c e8eaaf916a40 fa780d3e101a src/server/handlers/decide/stat_tests/connector_writeback_tests.rs:25 |
| EG-DECISION-ENGINE-R044 A2A task routing through the decision ladder (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**A2A task routing through the decision ladder (rollup).** Inbound A2A tasks are routed to an existing or assembled agent graph. Routing applies the same typed decision ladder used for other question families. It returns a routing resolution with its resolution kind and evidence class rather than an unexplained match. Split into child requirements by code root. `.1` typed A2ARoutingResolution refusal over ResolutionKind/EvidenceClass, `.2` wire A2A task submission through the typed routing resolution. | An integration test submits inbound A2A tasks and asserts each is routed to a graph through a recorded decision with a resolution kind and evidence class. | requirement | EG-DECISION-ENGINE | SPECIFIED | fa780d3e101a |
| EG-DECISION-ENGINE-R044.1 Typed A2ARoutingResolution refusal over ResolutionKind/EvidenceClass Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed A2ARoutingResolution refusal over ResolutionKind/EvidenceClass.** Add the typed `A2ARoutingResolution::new` refusal (`crates/eg-types/src/decision/rapid_r044.rs`) over the existing `ResolutionKind`/`EvidenceClass`, refusing an empty graph id and an abstention claiming proof-grade evidence. | Test: `crates/eg-types/src/decision/rapid_r044.rs::tests::refuses_an_abstention_claiming_proof_grade_evidence`. | requirement | EG-DECISION-ENGINE | VERIFIED | 0fac721690e2 crates/eg-types/src/decision/rapid_r044.rs:97 |
| EG-DECISION-ENGINE-R044.2 Wire A2A task submission through the typed routing resolution Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wire A2A task submission through the typed routing resolution.** Remaining scope from the split (2026-10-09): the A2A task-submission entry point that constructs one of these per inbound task and an integration test over the served path. Split into grandchild requirements (2026-10-09): `.1` a typed registry-lookup routing function over known graph ids, `.2` the served A2A task-submission entry point calling it with an integration test. | An integration test submits inbound A2A tasks and asserts each is routed to a graph through a recorded decision with a resolution kind and evidence class. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R044.2.1 Typed registry-lookup routing function over known graph ids Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed registry-lookup routing function over known graph ids.** Add `A2ARoutingResolution::route` (`crates/eg-types/src/decision/rapid_r044.rs`): given the known graph-id registry and a requested id, resolves to the matching graph as a Constraint/Observation resolution or abstains as Claim-grade evidence, always through `::new`. | Test: `crates/eg-types/src/decision/rapid_r044.rs::tests::routes_to_a_known_graph_and_abstains_otherwise`. | requirement | EG-DECISION-ENGINE | VERIFIED | 3c6b457009e4 crates/eg-types/src/decision/rapid_r044.rs:111 |
| EG-DECISION-ENGINE-R044.2.2 Served A2A task-submission entry point Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Served A2A task-submission entry point.** Remaining scope: the actual inbound A2A task-submission handler that builds the known-graph registry per request and calls `A2ARoutingResolution::route`, with an integration test over the served path. | An integration test submits inbound A2A tasks and asserts each is routed to a graph through a recorded decision with a resolution kind and evidence class. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R045 Smallest covering tool subset within a context budget Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Smallest covering tool subset within a context budget.** Decide selects the smallest tool subset that still covers every required capability within a caller-specified context budget, so a multiplexer can expose fewer tools to a caller without losing coverage. | A test constructs a capability requirement set with a token budget and asserts the returned subset is minimal, covers every required capability, and stays within budget. | requirement | EG-DECISION-ENGINE | VERIFIED | 0dfbaa95ea36 961b1785319c e8eaaf916a40 fa780d3e101a crates/eg-types/src/decision/statistical/tool_subset.rs:140 crates/eg-types/src/decision/statistical/tool_subset.rs:161 crates/eg-types/src/decision/statistical/tool_subset.rs:189 crates/eg-types/src/decision/statistical/tool_subset.rs:203 src/server/handlers/decide/stat_tests/tool_subset_tests.rs:58 |
| EG-DECISION-ENGINE-R045.1 Typed tool-subset request and greedy covering-set selection Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed tool-subset request and greedy covering-set selection.** EG defines a typed tool-subset request body and a greedy set-cover selection over it, with no server or candidate-source dependency. | Unit tests assert the selection is minimal, covers every required capability, and refuses when coverage or budget cannot be met. | requirement | EG-DECISION-ENGINE | VERIFIED | 0dfbaa95ea36 961b1785319c e8eaaf916a40 crates/eg-types/src/decision/statistical/tool_subset.rs:140 crates/eg-types/src/decision/statistical/tool_subset.rs:161 crates/eg-types/src/decision/statistical/tool_subset.rs:189 crates/eg-types/src/decision/statistical/tool_subset.rs:203 |
| EG-DECISION-ENGINE-R045.2 Tool-subset selection wired into Decide Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Tool-subset selection wired into Decide.** EG wires the R045.1 selection into a dedicated Decide question kind, reading tool candidates from the agent library and returning the selected subset on the served decision record. | A served test submits a tool-subset question and asserts the returned record's selected subset is minimal, covers every required capability, and stays within the caller's budget. | requirement | EG-DECISION-ENGINE | VERIFIED | 0dfbaa95ea36 e8eaaf916a40 src/server/handlers/decide/stat_tests/tool_subset_tests.rs:58 |
| EG-DECISION-ENGINE-R046 Swarm topology decisions via the decision ladder Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Swarm topology decisions via the decision ladder.** EG answers swarm-topology questions by applying its typed decision ladder to capacity and shape constraints, returning a proposed topology or a typed abstention together with its evidence; EG itself never acquires or leases capacity as part of answering the question. | A test exercises topology decision requests and asserts a constraint-checked proposal or abstention is returned with no capacity lease taken before separate acquisition. | requirement | EG-DECISION-ENGINE | SPECIFIED | 2d087761c964 e8eaaf916a40 fa780d3e101a crates/eg-compute/src/assemble/tests/topology.rs:115 crates/eg-compute/src/assemble/tests/topology.rs:95 |
| EG-DECISION-ENGINE-R047 DecisionRecord v1 contract: types and methods Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**DecisionRecord v1 contract: types and methods.** EG defines versioned DecisionRecord v1 types, the AgentAssemble and DecisionCommit methods, a DecisionRecord component kind, and a decide feature flag, introduced through a single count-pinned schema change so generated contracts stay consistent across languages. | A contract-generation test confirms the Rust, Python, and wire descriptors for AgentAssemble and DecisionCommit are generated, fresh, and each has exactly one reachable handler. | requirement | EG-DECISION-ENGINE | VERIFIED | a4804f87c971 dc8d8d712d7f fa780d3e101a crates/eg-capabilities/tests/invariants.rs:257 |
| EG-DECISION-ENGINE-R048 Entailment derivation with weakest-premise evidence class Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Entailment derivation with weakest-premise evidence class.** EG records is_a derivation entries for task-to-capability closure and assigns each derivation the weakest premise evidence class among its inputs, and an independent verifier re-checks claim-premised task mappings against those derivations. | Unit tests build derivation chains with mixed premise classes and assert the verifier recomputes the same weakest-premise conclusion. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 dc8d8d712d7f fa780d3e101a crates/eg-compute/src/assemble/tests/routing.rs:187 crates/eg-types/src/decision/derivation/tests.rs:219 |
| EG-DECISION-ENGINE-R049 Exact 0-1 solver with certificate and verifier Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Exact 0-1 solver with certificate and verifier.** EG solves legal assemblies with a bounded 0-1 integer program. It preprocesses, finds a greedy incumbent, and uses branch-and-bound. It also uses a Lagrangian covering bound and work-node budget. EG emits a certificate for independent verification. The `verify_certificate` routine and brute-force oracle check it. The solver also supports template enumeration and no-good-cut re-solves. | Solver tests compare optima and certificates with exhaustive enumeration on small instances. They confirm `verify_certificate` rejects corrupted certificates. | requirement | EG-DECISION-ENGINE | VERIFIED | 4b11f62898df dc8d8d712d7f fa780d3e101a crates/eg-compute/tests/solve/exhaustive.rs:42 crates/eg-compute/tests/solve/tamper_proof.rs:252 |
| EG-DECISION-ENGINE-R050 Typed optional model and tool facts Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed optional model and tool facts.** EG represents model and tool facts such as modality, cost, latency, and schema digests as typed optional fields on the component schema, and the unread provides field is removed. | A schema test confirms provides no longer exists and a stored-component test round-trips the typed optional facts. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 dc8d8d712d7f fa780d3e101a crates/eg-types/src/agent_component.rs:1970 |
| EG-DECISION-ENGINE-R051 AgentAssemble and DecisionCommit handlers with audit lines Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**AgentAssemble and DecisionCommit handlers with audit lines.** EG's AgentAssemble and DecisionCommit handlers enforce one agent graph per commit, refuse any pack-provided DecisionRecord component, and emit an audit line for each commit outcome. | Handler tests cover a successful commit, a rejected pack-sourced DecisionRecord, a fabricated record, a cross-tenant record, and retired, withdrawn, or denied commit attempts. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 dc8d8d712d7f fa780d3e101a src/server/persistence/decision_record/tests.rs:168 src/server/persistence/decision_record/tests.rs:223 src/server/persistence/decision_record/tests.rs:242 |
| EG-DECISION-ENGINE-R052 Routing acceptance fixture with golden vectors Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Routing acceptance fixture with golden vectors.** EG ships a routing acceptance fixture. It covers acceptability sets, planted bad inputs, oracle comparison, golden result vectors and a latency report. It also tests a link from the committed record to its outcome. | The fixture suite runs oracle, planted-input and golden-vector cases. It also verifies the outcome link against the stored golden file. | requirement | EG-DECISION-ENGINE | VERIFIED | 2421a2a2e25e 2a0d6eae0918 fa780d3e101a crates/eg-compute/src/assemble/tests/golden.rs:57 crates/eg-compute/src/assemble/tests/oracle.rs:123 crates/eg-compute/src/assemble/tests/oracle.rs:141 crates/eg-compute/src/assemble/tests/planted.rs:43 crates/eg-compute/src/assemble/tests/routing.rs:148 |
| EG-DECISION-ENGINE-R053 Gold set of labelled requirement-to-assembly items Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Gold set of labelled requirement-to-assembly items.** EG maintains a labelled gold set mapping typed requirements to acceptable assemblies, sized to validate the decision ladder, with a documented path to grow coverage per evidence class before any statistical calibration claim is made. | A synthetic export test confirms the gold set loads, each item is labelled, and class coverage is reported. | requirement | EG-DECISION-ENGINE | VERIFIED | 2421a2a2e25e 2a0d6eae0918 fa780d3e101a tests/synthetic/test_synthetic_decision_export.py:40 |
| EG-DECISION-ENGINE-R054 Statistical contract: Decide, DecisionFit, DecisionEval Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Statistical contract: Decide, DecisionFit, DecisionEval.** EG defines the Decide, DecisionFit, and DecisionEval methods together with a DecisionRecord v2 schema, and generates the corresponding TTL and SHACL ontology artifacts from that contract. | A contract-surface test confirms all three methods are served and listed, and a generation check confirms the TTL and SHACL files match the contract. | requirement | EG-DECISION-ENGINE | SPECIFIED | 2a0d6eae0918 8d4f409785b2 fa780d3e101a crates/eg-capabilities/tests/invariants.rs:536 |
| EG-DECISION-ENGINE-R054.1 TTL/SHACL generation artifact for the Decide/DecisionFit/DecisionEval contract exists Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**TTL/SHACL generation artifact for the Decide/DecisionFit/DecisionEval contract exists.** No TTL/SHACL generation artifact exists for the Decide, DecisionFit, and DecisionEval contract and DecisionRecord v2 schema. | Test: `contract/tests/decide_contract_generation.rs::ttl_and_shacl_artifacts_are_generated_and_match_the_decide_fit_eval_contract`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R055 Pinned deterministic numeric stack for calibration Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Pinned deterministic numeric stack for calibration.** EG's numeric layer pins its soft-float math library version and uses quantised fixed-point arithmetic so that calibration, conformal, risk-control, and off-policy-evaluation computations produce identical results across every supported target. | A cross-target golden-vector test replays the same inputs through the numeric kernels and asserts byte-identical digests on every supported target. | requirement | EG-DECISION-ENGINE | VERIFIED | 2421a2a2e25e b43f33569dd4 fa780d3e101a crates/eg-numeric/tests/decision/scorer.rs:109 crates/eg-numeric/tests/stat_kernels/kernels.rs:117 |
| EG-DECISION-ENGINE-R056 Statistical-path release of the exact solver (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Statistical-path release of the exact solver (rollup).** The exact 0-1 solver and its certificate verification apply to the statistical decision path with the same deterministic guarantees as the core assembly solver. Split into child requirements by code root: `.1` typed StatisticalSolverCertificate refusal on a stale model digest, `.2` route the statistical path through the exact 0-1 solver and this certificate. | Solver tests on the statistical feature set confirm certificate verification and deterministic branching hold as they do for the core assembly path. | requirement | EG-DECISION-ENGINE | SPECIFIED | 65afe57d3c4e fa780d3e101a |
| EG-DECISION-ENGINE-R056.1 Typed StatisticalSolverCertificate refusal on a stale model digest Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed StatisticalSolverCertificate refusal on a stale model digest.** Add the typed `StatisticalSolverCertificate::verify` refusal on a stale model digest (`crates/eg-types/src/decision/rapid_r056.rs`), giving the statistical path the same certificate-verification shape as the core assembly solver. | Test: `crates/eg-types/src/decision/rapid_r056.rs::tests::refuses_a_stale_model_digest`. | requirement | EG-DECISION-ENGINE | VERIFIED | 0fac721690e2 crates/eg-types/src/decision/rapid_r056.rs:83 |
| EG-DECISION-ENGINE-R056.2 Route the statistical path through the exact 0-1 solver and this certificate Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Route the statistical path through the exact 0-1 solver and this certificate.** Remaining scope from the split (2026-10-09): routing an actual statistical-path solve through the exact 0-1 solver and this certificate shape. Split into grandchild requirements (2026-10-09): `.1` a validating certificate constructor refusing a branch count over the solver's own node budget, `.2` an actual statistical-path call into `eg-compute`'s exact 0-1 solver producing this certificate. | Solver tests on the statistical feature set confirm certificate verification and deterministic branching hold as they do for the core assembly path. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R056.2.1 Validating certificate constructor bound to the solver's node budget Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Validating certificate constructor bound to the solver's node budget.** Add `StatisticalSolverCertificate::solved` (`crates/eg-types/src/decision/rapid_r056.rs`), refusing a reported branch count above the deterministic solver's own node budget -- the same node-budget guarantee `EG-DECISION-ENGINE-R011` gives the core assembly path. | Test: `crates/eg-types/src/decision/rapid_r056.rs::tests::refuses_a_certificate_exceeding_the_solver_node_budget`. | requirement | EG-DECISION-ENGINE | VERIFIED | 3c6b457009e4 crates/eg-types/src/decision/rapid_r056.rs:100 |
| EG-DECISION-ENGINE-R056.2.2 Statistical-path call into the exact 0-1 solver Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Statistical-path call into the exact 0-1 solver.** Remaining scope: an actual statistical-path solve that calls `eg-compute`'s exact 0-1 solver (`crates/eg-compute/src/solve/search`) and reports its result through `StatisticalSolverCertificate::solved`. | Solver tests on the statistical feature set confirm certificate verification and deterministic branching hold as they do for the core assembly path. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R057 Decision executor with CandidateSource and DecideText Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision executor with CandidateSource and DecideText.** EG's dedicated decision executor accepts candidates from a CandidateSource spanning the component library and the graph, parses DecideText requests with typed parameters, and scores candidates with the WeightedFeatures head. | Executor tests run a fit-evaluate-publish-decide cycle end to end and a negative test confirms graph-sourced candidates from a foreign tenant are refused. | requirement | EG-DECISION-ENGINE | VERIFIED | 2a0d6eae0918 8d4f409785b2 fa780d3e101a src/server/handlers/decide/stat_tests.rs:979 |
| EG-DECISION-ENGINE-R058 Graph-sourced decision records with RLS-routed reads Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Graph-sourced decision records with RLS-routed reads.** EG can source a decision record summary from the graph, store it in content-addressed blob storage, enforce row-level visibility on reads, and apply a policy-set retention window distinct from library-sourced records. | A storage test writes a graph-sourced record and confirms content-addressed storage, visibility-filtered reads, and retention expiry on schedule. | requirement | EG-DECISION-ENGINE | VERIFIED | 25cb8189575d 8d4f409785b2 bda8269797ab fa780d3e101a src/server/handlers/decide/stat_tests.rs:1111 |
| EG-DECISION-ENGINE-R059 Outcome aggregate with independent-evaluation join Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Outcome aggregate with independent-evaluation join.** EG maintains an outcome aggregate index linked to its admission records, joins only independently evaluated outcomes into that aggregate, applies censoring for incomplete observations, and enforces a minimum fidelity floor before an aggregate is used. | A test seeds self-reported and independently evaluated outcomes and asserts only the independently evaluated ones update the aggregate, with low-fidelity or censored data excluded. | requirement | EG-DECISION-ENGINE | SPECIFIED | 3e6d786460c5 fa780d3e101a crates/eg-numeric/src/decision/aggregate.rs:268 |
| EG-DECISION-ENGINE-R060 DecisionFit and DecisionEval jobs with gated promotion Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**DecisionFit and DecisionEval jobs with gated promotion.** EG runs DecisionFit and DecisionEval as jobs that fit a ListwiseLogistic head within an explicit exploration budget, sample a fraction of acted decisions for audit, and promote a fitted head only through the component-publish-plus-receipt path. | A job test runs fit, evaluate, and replay, and asserts promotion without a matching receipt is refused as a conflict. | requirement | EG-DECISION-ENGINE | VERIFIED | 25cb8189575d 2a0d6eae0918 fa780d3e101a crates/eg-numeric/tests/decision/scorer_promotion.rs:179 crates/eg-types/src/agent_component.rs:2307 |
| EG-DECISION-ENGINE-R061 Assembly facts extended for the statistical path Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Assembly facts extended for the statistical path.** EG exposes typed assembly-time facts to both decision paths. The exact solver derivation layer and statistical path receive the same typed values. | A test confirms both paths read matching typed facts. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 25cb8189575d 8f38ed7cc3dc fe3b87b09054 crates/eg-types/src/test_support/decision.rs:128 |
| EG-DECISION-ENGINE-R061.1 Shared AgentComponentEntry cost/latency fixture Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Shared AgentComponentEntry cost/latency fixture.** EG provides one shared `test-support` fixture building an `AgentComponentEntry` with a declared cost and latency, for the exact-solver and statistical paths to read identically. | A unit test converts the fixture to `CandidateFacts` and asserts its declared cost and latency round-trip intact. | requirement | EG-DECISION-ENGINE | VERIFIED | 25cb8189575d 8f38ed7cc3dc fe3b87b09054 crates/eg-types/src/test_support/decision.rs:128 |
| EG-DECISION-ENGINE-R062 NlTemplate selection without a language model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**NlTemplate selection without a language model.** EG selects an NlTemplate and fills its slots using candidate-local similarity matching rather than a language model, and records any fallback to an external model as a claim rather than a proof. | A template-selection test asserts slot filling succeeds from similarity matching alone and a fallback path is recorded with claim-level evidence. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 2ffc3594800b src/server/handlers/decide/stat_tests/nl_tests.rs:58 |
| EG-DECISION-ENGINE-R063 Typed client wrappers and documentation for Decide Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed client wrappers and documentation for Decide.** EG ships generated typed client wrappers for the decide, decision-fit, and decision-eval calls together with their request and response types, plus documentation and usage examples backed by acceptance tests. | Generated-client tests exercise each wrapper against a running instance and a documentation build confirms the example pages render. | requirement | EG-DECISION-ENGINE | VERIFIED | 15acf1a959e5 1e9ea1ef3790 25cb8189575d 2a0d6eae0918 394f82a01e83 crates/eg-capabilities/src/contract/python/tests.rs:818 tests/test_generated_models.py:139 tests/test_generated_models.py:176 |
| EG-DECISION-ENGINE-R064 Optional read views of decision records Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Optional read views of decision records.** EG may expose SPARQL, GraphQL, and pgwire read views over committed decision records, subject to the same tenant visibility rules as other decision reads. | A read-path test queries a committed record through each exposed view and confirms the results match and respect tenant visibility. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 25cb8189575d 857e20c63775 8d4f409785b2 src/server/handlers/decide/stat_tests/consumer_tests.rs:594 |
| EG-DECISION-ENGINE-R065 Decision record size and shape limits Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision record size and shape limits.** EG caps a DecisionRecord at 64 KiB, 64 candidates, and 32 required capabilities; a record exceeding any limit is refused at commit time with a typed RecordTooLarge abstention rather than a truncated or partial write. | A boundary test commits records at and just above each limit and asserts acceptance at the boundary and a typed refusal with no partial write above it. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 2a0d6eae0918 8d4f409785b2 crates/eg-compute/src/assemble/tests/planted.rs:301 |
| EG-DECISION-ENGINE-R066 Retention split between library and graph-sourced records Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Retention split between library and graph-sourced records.** EG keeps library-sourced decision records indefinitely, applies a policy-set retention window to graph-sourced statistical records, and treats high-frequency low-stakes decisions as evaluate-only so they are never persisted as committed records. | A retention test confirms a library-sourced record is never deleted, a graph-sourced record expires on its configured window, and an evaluate-only decision leaves no committed record. | requirement | EG-DECISION-ENGINE | SPECIFIED | 1e9ea1ef3790 2a0d6eae0918 d51d225674e1 |
| EG-DECISION-ENGINE-R066.1 Preserve library inputs Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Preserve library inputs.** `stat_retention.rs` must exclude library-sourced records from compaction and retirement. | `stat_tests/retention_tests.rs::library_records_survive_every_retention_window` verifies unchanged stored bytes. | requirement | EG-DECISION-ENGINE | VERIFIED | 4e60c54e9e49 c6d7108187aa src/server/handlers/decide/stat_tests/retention_tests.rs:64 |
| EG-DECISION-ENGINE-R066.2 Expire graph inputs Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Expire graph inputs.** `stat_retention.rs` must compact and retire graph inputs at configured window boundaries. | `stat_tests/retention_tests.rs::graph_inputs_expire_at_the_configured_boundaries` checks exact boundaries and retained summary digests. | requirement | EG-DECISION-ENGINE | VERIFIED | 4e60c54e9e49 c6d7108187aa src/server/handlers/decide/stat_tests/retention_tests.rs:93 |
| EG-DECISION-ENGINE-R066.3 Evaluate without persistence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evaluate without persistence.** `stat_decide.rs` must return low-stakes decisions without committed records. | `stat_tests/retention_tests.rs::evaluate_only_leaves_no_committed_records` checks repeated served decisions and both record stores. | requirement | EG-DECISION-ENGINE | VERIFIED | 4e60c54e9e49 c6d7108187aa src/server/handlers/decide/stat_tests/retention_tests.rs:129 |
| EG-DECISION-ENGINE-R066.4 Expire graph records Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Expire graph records.** `stat_retention.rs` must expire graph summaries on a configured policy window. Input retirement alone is insufficient. | Planned: `stat_tests/retention_tests.rs::graph_summaries_expire_on_policy_window`. No summary-expiry policy or implementation exists. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R067 Decision record versioning stays decodable Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision record versioning stays decodable.** Every DecisionRecord version remains decodable indefinitely, each version ships its own golden vectors, an unrecognised future version is refused rather than guessed at, and a rolling redeploy drains in-flight requests before switching versions. | A version test decodes golden vectors for every supported version and confirms an unrecognised version returns a typed refusal. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 2a0d6eae0918 d51d225674e1 crates/eg-types/src/decision/topology/tests.rs:92 |
| EG-DECISION-ENGINE-R068 Outcome link via the existing synthesis-evidence pin Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Outcome link via the existing synthesis-evidence pin.** EG links an agent graph's outcome back to its decision record through the existing AgentGraphDraft synthesis_evidence pin, without adding new fields to the run-event or outcome-bundle types. | A test publishes a graph and asserts it resolves to its originating decision record solely through the synthesis_evidence pin. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 2a0d6eae0918 c4c13898a493 src/server/persistence/decision_record/tests.rs:262 |
| EG-DECISION-ENGINE-R069 DecisionShape enforcement inside the commit handler Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**DecisionShape enforcement inside the commit handler.** EG validates every committed decision record against its DecisionShape SHACL shape inside the commit handler itself, failing closed on a violation independently of the separate opt-in integrity-check guard. | Commit-handler tests include at least one known-bad record and assert the shape check rejects it even when the opt-in guard is disabled. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 2a0d6eae0918 c4c13898a493 src/server/handlers/decide/shape.rs:134 |
| EG-DECISION-ENGINE-R070 Bounded no-good-cut re-solve for post-solve validators Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Bounded no-good-cut re-solve for post-solve validators.** When a post-solve validator such as template or graph validation rejects a solved assembly, EG adds a no-good cut and re-solves within a bounded number of rounds, terminating with a typed result rather than looping indefinitely. | A test forces repeated post-solve validator failures and asserts the re-solve loop terminates after its bounded round count. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 2a0d6eae0918 456b8d06fc91 crates/eg-compute/src/assemble/tests/planted.rs:257 |
| EG-DECISION-ENGINE-R071 DecideText parser kept separate from the UQL core Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**DecideText parser kept separate from the UQL core.** DecideText is parsed by its own quote-aware, typed-parameter front end that shares no code with the ordinary UQL parser or its operation and plan types, so decision clauses cannot be expressed through the general query path. | A parser test confirms the ordinary UQL parser refuses decision clauses by name while DecideText parses the same clauses successfully. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 2a0d6eae0918 456b8d06fc91 crates/eg-plan/src/decide_text/tests.rs:124 |
| EG-DECISION-ENGINE-R072 Decision observability spans and metrics Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision observability spans and metrics.** EG emits tracing spans and metrics covering the distribution of resolution kinds, the abstention rate, the distribution of evidence classes, solver node count and optimality gap, effective sample size, and latency percentiles for decision requests. | An instrumentation test confirms each listed span or metric is emitted for a representative decision request. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 2a0d6eae0918 7e2feaaad52d d51d225674e1 crates/eg-compute/tests/solve/instrumentation.rs:8 |
| EG-DECISION-ENGINE-R072.1 Solver node count and optimality gap are emitted on the Assemble/solver path Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Solver node count and optimality gap are emitted on the Assemble/solver path.** Emit one completion event with solver node count and the absolute scalarized objective gap when checked incumbent-minus-bound is available and nonnegative; omit missing, invalid, or overflowing gaps. Do not record model or tenant data. | Test: `crates/eg-compute/tests/solve/instrumentation.rs::assemble_emits_solver_node_count_and_optimality_gap_metrics`. | requirement | EG-DECISION-ENGINE | VERIFIED | 7e2feaaad52d crates/eg-compute/tests/solve/instrumentation.rs:8 |
| EG-DECISION-ENGINE-R073 Decision-owned storage tables and outbox events (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision-owned storage tables and outbox events (rollup).** EG stores decision-pack state in five dedicated owner tables, refuses to open a pack stored in an outdated format, issues a receipt covering every intent in a batch, resolves batch pin references, handles components marked Withdrawn, enforces compare-and-set on the current head, and emits an outbox event per affected component. | Storage tests cover a fresh open, a stale-format refusal, a multi-intent receipt, a withdrawn-component read, head compare-and-set contention, and the resulting outbox events. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 4c25220f6e1b 771c32a45353 795a1ea18fa6 a0743ba9b542 crates/eg-capabilities/src/error_routing.rs:367 src/server/handlers/admin/connector_pack/tests/content_model.rs:372 src/server/handlers/admin/connector_pack/tests/content_model.rs:407 src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs:29 src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs:74 |
| EG-DECISION-ENGINE-R073.1 One durable outbox event per imported component Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**One durable outbox event per imported component.** A served multi-component import stores one validated component-revision event per affected component, followed by one pack-import event, under the receipt's batch identity; repeating the identical pack creates no additional owner or outbox rows. | Test: `src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs::multi_component_import_emits_one_durable_event_per_component`. | requirement | EG-DECISION-ENGINE | VERIFIED | 771c32a45353 src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs:29 |
| EG-DECISION-ENGINE-R073.2 Competing served imports share one head compare-and-set Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Competing served imports share one head compare-and-set.** Two distinct imports over the same prior head have exactly one winner. The loser gets PACK_HEAD_CONFLICT, and retrying that stale head changes no component, holder, import or outbox rows. | Test: `src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs::competing_imports_have_one_head_winner_without_loser_effects`. | requirement | EG-DECISION-ENGINE | VERIFIED | 771c32a45353 795a1ea18fa6 a0743ba9b542 src/server/handlers/admin/connector_pack/tests/storage_acceptance.rs:74 |
| EG-DECISION-ENGINE-R073.3 Fresh owner open and outdated-format refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Fresh owner open and outdated-format refusal.** The 21-table Agent Library registry includes five ConnectorPack tables. Production open must initialize them empty and preserve them on reopen. The lineage gate must refuse genuine predecessors before catalog access without changing file bytes. | Tests: `src/server/persistence/agent_library/open_tests.rs::fresh_open_initializes_all_pack_tables_and_reopens_empty` and `production_open_refuses_each_genuine_predecessor_without_writing`. | requirement | EG-DECISION-ENGINE | VERIFIED | a93e5bd00d51 src/server/persistence/agent_library/open_tests.rs:49 src/server/persistence/agent_library/open_tests.rs:6 |
| EG-DECISION-ENGINE-R073.4 Receipt covers every batch intent Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Receipt covers every batch intent.** The committed receipt binds every component and pack intent, including order, topic, key, payload and headers. | `storage_acceptance::receipt::committed_multi_intent_receipt_binds_all_effects_and_survives_replay` reads typed owner evidence after signed import. It detects omitted, reordered and modified intents, then checks admitted replay preserves the receipt. | requirement | EG-DECISION-ENGINE | VERIFIED | bb72cb292060 d1d4e74f5520 src/server/handlers/admin/connector_pack/tests/storage_acceptance/receipt.rs:137 |
| EG-DECISION-ENGINE-R073.5 Batch pins and withdrawn-component reads Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Batch pins and withdrawn-component reads.** Batch references must pin committed transitive revisions. Current Search must exclude withdrawn components and retain published controls. Historical pinned Content remains readable. New pins must refuse withdrawn components. | Tests: the transitive-chain and diamond regressions in `content_model.rs`, and `withdrawal.rs::withdrawn_tool_leaves_search_but_keeps_historical_content`. | requirement | EG-DECISION-ENGINE | VERIFIED | 4c25220f6e1b a93e5bd00d51 aea4fe89bd19 crates/eg-capabilities/src/error_routing.rs:367 src/server/handlers/admin/connector_pack/tests/content_model.rs:372 src/server/handlers/admin/connector_pack/tests/content_model.rs:407 src/server/handlers/admin/connector_pack/tests/withdrawal.rs:45 |
| EG-DECISION-ENGINE-R074 Agent-slot component-kind closure rule kept current Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Agent-slot component-kind closure rule kept current.** EG's documented rule for which component kinds may be referenced from an agent slot stays consistent with the actual kind set, including shape, A2A agent-card, and decision kinds, so no kind that can appear in a slot is missing from the rule. | `tests/test_decision_static_contracts.py::test_agent_slot_kinds_are_documented_in_closure_rule` checks every enum and slot kind against the documented closure rule. Adversarial fixtures reject missing kinds and new undocumented slot references. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 51f9c8eb6f1d a4804f87c971 tests/test_decision_static_contracts.py:145 |
| EG-DECISION-ENGINE-R075 Component-id uniqueness and forbidden decision kinds (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Component-id uniqueness and forbidden decision kinds (rollup).** EG enforces that every component id is unique within its scope and refuses to import a pack entry whose kind is reserved for decision-owned state, such as DecisionRecord, DecisionHead, or DecisionPolicy. Split into child requirements by code root: `.1` check_unique_component_ids rejects a duplicate component id, `.2` wire the duplicate-id check into the real pack-import entry point. | Import tests assert a duplicate component id is rejected and a pack entry using a reserved decision kind is refused before any state change. | requirement | EG-DECISION-ENGINE | VERIFIED | 0ea0a0dcfa62 1e9ea1ef3790 d16ee611a394 e8aaa8ae5ccd crates/eg-types/src/connector_pack/rapid_r075.rs:43 src/server/handlers/admin/connector_pack/import/validation.rs:956 |
| EG-DECISION-ENGINE-R075.1 check_unique_component_ids rejects a duplicate component id Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**check_unique_component_ids rejects a duplicate component id.** Add `check_unique_component_ids` (`crates/eg-types/src/connector_pack/rapid_r075.rs`), the duplicate-component-id rejection the existing `PackViolationCode::DuplicateComponentId` code names but no test previously exercised. `PackEntryKind` already structurally excludes decision-owned kinds (no `DecisionRecord`/`DecisionHead`/`DecisionPolicy` variant exists). | Test: `crates/eg-types/src/connector_pack/rapid_r075.rs::tests::refuses_a_duplicate_component_id`. | requirement | EG-DECISION-ENGINE | VERIFIED | e8aaa8ae5ccd crates/eg-types/src/connector_pack/rapid_r075.rs:43 |
| EG-DECISION-ENGINE-R075.2 Wire the duplicate-id check into the real pack-import entry point Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wire the duplicate-id check into the real pack-import entry point.** Remaining scope from the split (2026-10-09): wiring the check into the real pack-import entry point. | Import tests assert a duplicate component id is rejected and a pack entry using a reserved decision kind is refused before any state change. | requirement | EG-DECISION-ENGINE | VERIFIED | d16ee611a394 src/server/handlers/admin/connector_pack/import/validation.rs:956 |
| EG-DECISION-ENGINE-R076 Opt-in nested models for decision result markers Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Opt-in nested models for decision result markers.** EG's Python decision client represents decision-type result markers with opt-in nested Pydantic models, scoped to this specification's decision types only, ahead of any broader client-model migration. | A client test confirms decision-type responses deserialize into the nested Pydantic models while other response types are unaffected. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 bad0283526ba tests/test_decision_client.py:152 |
| EG-DECISION-ENGINE-R077 Component schema version bump to add decision kinds Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Component schema version bump to add decision kinds.** EG raises the shared component schema from version 2 to version 3 under a single numbering authority, so the new Withdrawn state and the new decision component kinds land in one schema change rather than in separate changes. | A schema migration test confirms every writer agrees on version 3 and that Withdrawn and the new kinds decode correctly from the bumped schema. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 9ffc5197866a a1bb9fb9503e crates/eg-types/src/agent_component.rs:2335 |
| EG-DECISION-ENGINE-R078 Contract freeze reissued with the decide feature (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Contract freeze reissued with the decide feature (rollup).** EG reissues its generated contract freeze to include the decide feature, so the frozen contract artifact reflects every decision method and type this specification introduces. Split into child requirements by code root: `.1` the producer check that refuses a stale profile, `.2` the reissued artifact itself. | A contract-freshness check confirms the reissued freeze file matches the current generated output including the decide feature. | requirement | EG-DECISION-ENGINE | VERIFIED | 1527a97f2118 1e9ea1ef3790 1f2d473cf663 45beac8d810b e8aaa8ae5ccd crates/eg-capabilities/src/contract.rs:637 crates/eg-capabilities/src/contract.rs:665 |
| EG-DECISION-ENGINE-R078.1 Typed refusal for a feature-profile freeze omitting an enabled feature Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed refusal for a feature-profile freeze omitting an enabled feature.** The hand-maintained `feature_profile()` list in `crates/eg-capabilities/src/contract.rs` can omit a shipped feature. A typed `MissingFrozenFeature` error and `require_feature_frozen` check refuse omissions. The check accepts a profile that names the feature. Add `decide` to the enumeration. The generator’s `canonical-ledger` profile enables the existing marker. Canonical generation and workspace `--all-features` produce the same frozen feature list. | A unit test covers profiles with missing and present features. A `decide`-gated test confirms the compiled profile includes `decide`. | requirement | EG-DECISION-ENGINE | VERIFIED | 1527a97f2118 1f2d473cf663 crates/eg-capabilities/src/contract.rs:637 crates/eg-capabilities/src/contract.rs:665 |
| EG-DECISION-ENGINE-R078.2 Reissue the committed contract freeze artifacts with the decide feature Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reissue the committed contract freeze artifacts with the decide feature.** `contract/FREEZE-RECEIPT.json` and `contract/receipt.json` are regenerated under the authorized generation ceremony with the `decide` feature enabled and committed, so `feature_profile` in the frozen artifact names `decide`. | The existing `package_surface_is_complete_identical_and_receipt_bound` test, run with `--all-features`, passes against the freshly committed artifacts. | requirement | EG-DECISION-ENGINE | VERIFIED | 1527a97f2118 45beac8d810b e8aaa8ae5ccd crates/eg-capabilities/src/contract.rs:665 |
| EG-DECISION-ENGINE-R079 Per-unit embedding admission classifier for ingestion Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Per-unit embedding admission classifier for ingestion.** Ingestion applies a deterministic per-unit classifier before embedding any derived text: it admits prose, document, and comment content while excluding generated, lockfile, vendored, and minified content, skips embedding when an exact, BM25, or graph lookup already answers the content, deduplicates near-identical text by entropy and content hash, enforces size bounds, and for SQL columns embeds only high-cardinality free text rather than enumerations, foreign keys, timestamps, booleans, or numeric columns. Retrieval telemetry feeds back into the classifier to demote content classes that are never retrieved. | A classifier test feeds each excluded content class and asserts no embedding call is made, while an eligible class embeds and a cheaper-index hit is skipped. | requirement | EG-DECISION-ENGINE | SPECIFIED | 1e9ea1ef3790 dd6d5b55fb20 |
| EG-DECISION-ENGINE-R079.1 Typed content-class taxonomy and pure admission gate (producer slice of R079) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed content-class taxonomy and pure admission gate (producer slice of R079).** A closed `ContentClass` enum fixes the taxonomy -- prose, document, and comment as eligible; generated, lockfile, vendored, and minified as excluded -- behind a single pure `admits()` gate, so every later ingestion call site consults one deterministic registry instead of an ad hoc per-site check. Real ingestion wiring, the embedding client, cheaper-index skip, entropy/hash dedup, size bounds, SQL-column cardinality, and retrieval-telemetry feedback are out of scope for this slice and remain open under `R079`. | A unit test feeds each excluded content class and asserts `admits() == false`, and feeds each eligible class and asserts `admits() == true`. | requirement | EG-DECISION-ENGINE | VERIFIED | d51d225674e1 dd6d5b55fb20 crates/eg-types/src/decision/ingestion_admission.rs:109 |
| EG-DECISION-ENGINE-R079.2 Embedding admission at the ingestion boundary Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Embedding admission at the ingestion boundary.** Add the served ingestion fixture in `tests/test_decision_ingestion_acceptance.py` against the existing ingestion-to-embedding path and content-class gate. Eligible content can embed; excluded classes and sufficient exact, BM25, or graph hits make no embedding call. | Planned `tests/test_decision_ingestion_acceptance.py::test_ingestion_embedding_admission_and_cheaper_index_skip`; not implemented or executed acceptance evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R079.3 Duplicate and size admission Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Duplicate and size admission.** Add the served fixture in `tests/test_decision_ingestion_acceptance.py` proving entropy/content-hash deduplication and size bounds before an embedding call. Retain the parent requirement for near-identical content. | Planned `tests/test_decision_ingestion_acceptance.py::test_duplicate_and_oversized_units_do_not_embed`; not implemented or executed acceptance evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R079.4 SQL column admission Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**SQL column admission.** Add the served fixture in `tests/test_decision_ingestion_acceptance.py` proving that ingestion admits high-cardinality free-text SQL columns and excludes enumerations, foreign keys, timestamps, booleans, and numeric columns. | Planned `tests/test_decision_ingestion_acceptance.py::test_sql_column_kinds_and_cardinality_control_embedding`; not implemented or executed acceptance evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R079.5 Retrieval feedback admission Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Retrieval feedback admission.** Add the served fixture in `tests/test_decision_ingestion_acceptance.py` proving that retrieval-use telemetry demotes never-retrieved content classes at the ingestion admission path. The fixture must exercise the production admission path rather than only the typed taxonomy. | Planned `tests/test_decision_ingestion_acceptance.py::test_retrieval_feedback_demotes_unused_content`; not implemented or executed acceptance evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R080 Ingestion cost ladder with provenance rungs Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Ingestion cost ladder with provenance rungs.** Ingestion derives each fact through the cheapest sufficient rung of a six-level cost ladder covering AST extraction, symbol or type resolution, statistical or community derivation, classical machine-learning or named-entity modelling, embeddings, and finally a language model, tagging each fact with its rung's provenance class. A higher rung runs only when every lower rung abstains, and no rung may overwrite a fact a lower, more deterministic rung already established. Split producer-first into `EG-DECISION-ENGINE-R080.1` (the typed model); further child slices wire in the real per-rung extractors. | A ladder test seeds inputs answerable at each rung and asserts the fact is produced by the lowest sufficient rung with the matching provenance tag, and that a higher rung never overwrites an existing deterministic fact. | requirement | EG-DECISION-ENGINE | SPECIFIED | 1e0050b97b3a 1e9ea1ef3790 |
| EG-DECISION-ENGINE-R080.1 Typed provenance-rung model and overwrite-protection rule Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed provenance-rung model and overwrite-protection rule.** `crates/eg-types/src/decision/ingestion_ladder.rs` defines the six-level `ProvenanceRung` enum (cheapest first) and a pure `resolve_rung` function: a candidate fact from a higher (more expensive) rung never overwrites a fact a lower rung already established, and between two candidates the lowest-rung one wins. The real per-rung extractors (AST walking, symbol resolution, embeddings, an LLM call) are out of scope for this slice. | A unit test resolves a deterministic fact against a higher-rung guess and asserts the deterministic fact survives, and resolves a higher-rung guess against a later lower-rung fact and asserts the lower-rung fact replaces it. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e0050b97b3a crates/eg-types/src/decision/ingestion_ladder.rs:64 crates/eg-types/src/decision/ingestion_ladder.rs:72 crates/eg-types/src/decision/ingestion_ladder.rs:90 |
| EG-DECISION-ENGINE-R080.2 Served enrichment ladder qualification Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Served enrichment ladder qualification.** Add the served fixture in `tests/test_decision_ingestion_acceptance.py` against the existing ingestion and enrichment entry points. For each of the six parent rungs, require every cheaper rung to abstain before escalation, persist the actual producing rung, and refuse overwrite of a cheaper established fact. The producer-only `resolve_rung` test does not discharge this integration acceptance. | Planned `tests/test_decision_ingestion_acceptance.py::test_real_extractors_follow_the_lowest_sufficient_rung`; not implemented or executed acceptance evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R081 Confidence-weighted community detection excluding similarity edges Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Confidence-weighted community detection excluding similarity edges.** Community detection computes edge weights from the entity resolver's confidence score, so a scoped match binds a community more strongly than a unique-guess match, instead of leaving every edge unweighted. The structural adjacency used to detect communities excludes, or heavily discounts, similar_to resemblance edges, since two code shapes looking alike is not a structural relationship. | A unit test compares community assignments across inputs with varying resolver confidence and asserts that adding similar_to edges does not change community membership. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 9ffc5197866a b5fe3c140c21 crates/eg-compute/src/algorithms/tests.rs:200 crates/eg-compute/src/algorithms/tests.rs:663 |
| EG-DECISION-ENGINE-R082 Single-pass option-marker scoring head for Decide Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Single-pass option-marker scoring head for Decide.** The eg-decision scoring head encodes the decision state once and scores every candidate option at its own marker position within that single forward pass, applying softmax across the option-marker outputs in-process rather than iterating a decoder once per option. | A unit test issues one encoder pass over more than one option and asserts all option scores are returned together and sum to one under softmax, with no per-option re-encoding. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 4952a2edced4 9ffc5197866a crates/eg-numeric/tests/decision/scorer.rs:192 |
| EG-DECISION-ENGINE-R083 Options encode structured facts, not option-label text (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Options encode structured facts, not option-label text (rollup).** The decision scorer encodes each candidate option from the structured facts attached to its IRI, including SHACL shape, declared capabilities, and cost and latency facts, rather than from a serialized text label, so the encoded feature width is bounded by a declared cardinality instead of a token budget. Split into child requirements by code root: `.1` typed OptionFacts encoding bounded by declared capability cardinality, `.2` wire OptionFacts encoding into the real FeatureMatrix computation. | A test scores an option set large enough to exceed a plausible text-token budget and asserts scoring still succeeds because feature width is bounded by cardinality, not text length. | requirement | EG-DECISION-ENGINE | SPECIFIED | 1e9ea1ef3790 7a89c881dad4 e9da9f0a77e1 crates/eg-numeric/tests/decision/scorer.rs:367 |
| EG-DECISION-ENGINE-R083.1 Typed OptionFacts encoding bounded by declared capability cardinality Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed OptionFacts encoding bounded by declared capability cardinality.** Add the typed `OptionFacts::encode` (`crates/eg-numeric/src/decision/rapid_r083.rs`), bounded by the declared `MAX_OPTION_CAPABILITIES` cardinality rather than by any text-token budget. | Test: `crates/eg-numeric/src/decision/rapid_r083.rs::tests::scores_an_option_whose_capability_text_would_exceed_a_token_budget`. | requirement | EG-DECISION-ENGINE | VERIFIED | e8aaa8ae5ccd crates/eg-numeric/src/decision/rapid_r083.rs:64 |
| EG-DECISION-ENGINE-R083.2 Wire OptionFacts encoding into the real FeatureMatrix computation Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wire OptionFacts encoding into the real FeatureMatrix computation.** Remaining scope from the split (2026-10-09): wiring this encoding into the real `FeatureMatrix` computation in `decision::features`. | A test scores an option set large enough to exceed a plausible text-token budget and asserts scoring still succeeds because feature width is bounded by cardinality, not text length. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R084 Conformal calibration as primary rung over temperature scaling Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Conformal calibration as primary rung over temperature scaling.** Decide calibrates confidence using eg-numeric's conformal prediction as the primary mechanism, reporting distribution-free empirical coverage and a principled abstention threshold, and falls back to size-specific temperature scaling only when the exchangeability assumption conformal coverage needs does not hold. Every calibrated decision reports both expected calibration error and empirical coverage. | An integration test measures expected calibration error and empirical coverage across option sets of varying size and asserts the declared coverage target holds without a size-specific temperature parameter. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 481fa6ea2c55 4952a2edced4 7765cab2e500 crates/eg-numeric/tests/decision/calibration_coverage.rs:37 |
| EG-DECISION-ENGINE-R084.1 ECE/coverage measurement across option sets of varying size Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**ECE/coverage measurement across option sets of varying size.** No expected-calibration-error/coverage measurement exists across option sets of varying size. Fixtures are fixed at 3 options, so the declared coverage-holds-without-a-size-specific-parameter claim is untested. | Test: `tests/decision/calibration_coverage.rs::measures_ece_and_empirical_coverage_across_option_sets_of_varying_size`. | requirement | EG-DECISION-ENGINE | VERIFIED | 481fa6ea2c55 7765cab2e500 crates/eg-numeric/tests/decision/calibration_coverage.rs:37 |
| EG-DECISION-ENGINE-R085 Legal option sets are derived from the ontology, never received as-is Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Legal option sets are derived from the ontology, never received as-is.** EG derives the candidate option set from SHACL shapes and a bounded SPARQL shortlist query rather than accepting a caller-supplied option list, so only type-valid, policy-admissible candidates are ever scored. A learned ranking rung may narrow this set or abstain but can never add an option the derivation excluded. | A negative test supplies a caller-asserted option that violates a SHACL shape or policy constraint and asserts it never appears in the derived option set presented to the scorer. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 29da53bfbe8d crates/eg-numeric/src/decision/legal_option_filter.rs:57 |
| EG-DECISION-ENGINE-R085.1 Typed legal-option-set filter (producer-first split of R085) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed legal-option-set filter (producer-first split of R085).** A pure, typed filter derives the legal option set from a caller-supplied candidate list and an admissibility predicate, excluding every candidate the predicate rejects, as the type-level contract ahead of the real SHACL-shape / SPARQL-shortlist-backed predicate (`R085.2`). | A negative test constructs a candidate set containing one option that fails a fixture admissibility predicate and asserts it is excluded from the derived set, plus a positive case that an admissible option passes through. | requirement | EG-DECISION-ENGINE | VERIFIED | 29da53bfbe8d crates/eg-numeric/src/decision/legal_option_filter.rs:57 |
| EG-DECISION-ENGINE-R085.2 Remaining scope of EG-DECISION-ENGINE-R085 (slice .2): Legal option sets are derived from the ontology, never received as-is Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Remaining scope of EG-DECISION-ENGINE-R085 (slice .2): Legal option sets are derived from the ontology, never received as-is.** Child slice of `EG-DECISION-ENGINE-R085` (see tasks.md). | A negative test supplies a caller-asserted option that violates a SHACL shape or policy constraint and asserts it never appears in the derived option set presented to the scorer | requirement | EG-DECISION-ENGINE | VERIFIED | 29da53bfbe8d crates/eg-numeric/src/decision/legal_option_filter.rs:57 |
| EG-DECISION-ENGINE-R086 DecisionFit promotion protocol reports nine metrics Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**DecisionFit promotion protocol reports nine metrics.** Before a fitted head may be promoted, DecisionEval reports accuracy, soft accuracy, Brier score and score mean absolute error alongside empirical coverage paired with expected calibration error, abstention rate paired with accuracy on answered decisions, cost per decision, decision stability where the same state and option set always produce the same answer, and calibration drift measured over bitemporal history, computed per tenant and per domain over a fixed evaluation workflow set. | A promotion-gate test asserts a receipt missing any of the nine metrics, or showing decision instability for a repeated identical request, blocks promotion. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 4952a2edced4 dc6a3c243a1f crates/eg-numeric/tests/decision/scorer_promotion.rs:180 |
| EG-DECISION-ENGINE-R087 Scorer always receives a bounded shortlist, never a full catalog Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Scorer always receives a bounded shortlist, never a full catalog.** EG always shortlists candidates with a bounded SPARQL LIMIT before handing an option set to the statistical scorer, so the scorer never receives an unbounded catalog of candidates. | A test against a large candidate catalog asserts the scorer's input option set never exceeds the declared shortlist bound. | requirement | EG-DECISION-ENGINE | VERIFIED | 1e9ea1ef3790 4952a2edced4 dc6a3c243a1f crates/eg-numeric/tests/decision/scorer.rs:171 |
| EG-DECISION-ENGINE-R088 Belief-as-of-t exposed as a Decide primitive over prefixes Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Belief-as-of-t exposed as a Decide primitive over prefixes.** Decide exposes a primitive that computes a belief or probability as of a given point in a sequence, such as a conversation prefix, using the existing bitemporal AS OF query over temporal slices rather than a bespoke per-domain sequential model. | A unit test evaluates belief as of successive prefixes of a recorded sequence and asserts the results match direct bitemporal AS OF queries at the corresponding points. | requirement | EG-DECISION-ENGINE | SPECIFIED | 1e9ea1ef3790 4034a361535b 4952a2edced4 crates/eg-numeric/tests/decision/scorer.rs:215 |
| EG-DECISION-ENGINE-R088.1 Belief-as-of-t uses the bitemporal AS OF mechanism, not a bespoke per-feature recompute Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Belief-as-of-t uses the bitemporal AS OF mechanism, not a bespoke per-feature recompute.** Belief-as-of-t is currently a bespoke per-feature recompute. It does not go through the required bitemporal AS OF query mechanism over temporal slices. | Test: `crates/eg-types/src/decision/rapid_r088.rs::tests::belief_as_of_successive_prefixes_matches_direct_bitemporal_as_of_queries`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R089 Learned ranking never replaces the constraint-first decision ladder Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Learned ranking never replaces the constraint-first decision ladder.** A statistical rung in the decision ladder may only rank or narrow the option set that the constraint, entailment and optimization steps have already produced, or abstain; it is never the mechanism that determines which options are legal. | A test disables the statistical scorer and asserts the constraint, entailment and optimization steps still produce the identical legal option set, with only ranking or abstention behavior affected. | requirement | EG-DECISION-ENGINE | VERIFIED | 19b44d216062 1e9ea1ef3790 aaef8290c8e2 crates/eg-numeric/tests/decision/ladder.rs:257 |
| EG-DECISION-ENGINE-R090 Resident native decision-scorer head in eg-decision Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Resident native decision-scorer head in eg-decision.** eg-decision implements its option-attention scoring head natively in Rust as a small resident model, on the order of 700,000 parameters and a few megabytes, serving a decision in single-digit milliseconds on CPU, compiled directly into the engine binary with no Python runtime, sidecar process, inter-process hop, or GPU dependency required. Children `.1`, `.2`, and `.3` preserve this scope: declared budgets, compiled execution, and measured resource acceptance. | A benchmark measures the compiled scorer's per-decision CPU latency and binary footprint. It asserts both stay within the declared resident budget. | requirement | EG-DECISION-ENGINE | VERIFIED | 010477d72b7f 19b44d216062 1e9ea1ef3790 26be257523bc 29de5f09030f crates/eg-numeric/benches/decision_resident_scorer.rs:218 crates/eg-types/src/decision/statistical/scorer.rs:156 crates/eg-types/src/decision/statistical/scorer.rs:164 crates/eg-types/src/decision/statistical/scorer.rs:172 crates/eg-types/src/decision/statistical/scorer.rs:180 |
| EG-DECISION-ENGINE-R090.1 Typed resident-scorer budget (producer-first split of R090) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed resident-scorer budget (producer-first split of R090).** `eg-types::decision::statistical::scorer` defines `ResidentScorerBudget` and a `RESIDENT_SCORER_CEILING` ("on the order of 700,000 parameters and a few megabytes", single-digit-millisecond `p99`), with `ResidentScorerBudget::declare` refusing any declared budget that exceeds the ceiling, as the type-level contract ahead of the real compiled-benchmark harness (a further child). | A test declares a budget at the ceiling and asserts it is accepted, and a negative test declares a budget over the parameter and latency ceilings and asserts both are refused. | requirement | EG-DECISION-ENGINE | VERIFIED | 010477d72b7f 19b44d216062 d68c292be084 crates/eg-types/src/decision/statistical/scorer.rs:156 crates/eg-types/src/decision/statistical/scorer.rs:164 crates/eg-types/src/decision/statistical/scorer.rs:172 crates/eg-types/src/decision/statistical/scorer.rs:180 crates/eg-types/src/decision/statistical/scorer.rs:189 |
| EG-DECISION-ENGINE-R090.2 Compiled resident scorer execution Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Compiled resident scorer execution.** The engine must execute the native option-attention scorer in process. Execution must require no Python runtime, sidecar, inter-process hop, or GPU. Code roots: `crates/eg-numeric/src/decision/scorer/` and `src/server/handlers/decide/`. | Planned test: `tests/test_decision_resident_scorer.py::test_compiled_engine_scores_without_external_runtime`. The test must exercise the engine binary and verify equivalent deterministic scores without external runtimes. | requirement | EG-DECISION-ENGINE | VERIFIED | 26be257523bc tests/test_decision_resident_scorer.py:143 |
| EG-DECISION-ENGINE-R090.3 Measured resident scorer resource budget Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Measured resident scorer resource budget.** The compiled scorer must satisfy the declared parameter, memory, and CPU latency limits. The benchmark must measure per-decision p99 latency and resident model footprint. Code root: `crates/eg-numeric/benches/decision_resident_scorer.rs`. | Planned benchmark: `crates/eg-numeric/benches/decision_resident_scorer.rs::resident_scorer_meets_declared_budget`. It must report parameter count, model bytes, binary footprint, and p99 CPU latency against `RESIDENT_SCORER_CEILING`. | requirement | EG-DECISION-ENGINE | VERIFIED | 29de5f09030f 9f5da56a6f62 crates/eg-numeric/benches/decision_resident_scorer.rs:218 |
| EG-DECISION-ENGINE-R091 Resident scorer is bit-reproducible via fixed-point arithmetic Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Resident scorer is bit-reproducible via fixed-point arithmetic.** The resident decision-scorer head computes entirely in fixed-point integer arithmetic, following eg-numeric's no-floating-point-transcendental discipline, so scoring the same recorded decision input reproduces byte-identical results across machines and over time rather than only remaining stable within a single run. | A golden-vector test replays a committed DecisionRecord on a different machine or build and asserts the recomputed score is byte-identical to the recorded value. | requirement | EG-DECISION-ENGINE | VERIFIED | 4952a2edced4 534f763afc81 crates/eg-numeric/tests/decision/scorer.rs:109 |
| EG-DECISION-ENGINE-R092 Scorer selection and structured encoding apply ladder-wide Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Scorer selection and structured encoding apply ladder-wide.** Across every decision question, the statistical scorer selects only among options the deterministic constraint, entailment and optimization rungs have already derived and can never introduce a new option, and every option is encoded from its structured ontology features rather than natural-language text, so scoring is not limited by option-label language or length. | A cross-question test exercises two distinct decision question types and asserts both enforce select-only-from-derived-options behavior and structured, non-text option encoding. | requirement | EG-DECISION-ENGINE | VERIFIED | 534f763afc81 e9e12f168722 src/server/handlers/decide/stat_tests/scorer_tests.rs:190 |
| EG-DECISION-ENGINE-R093 Resident scorer is trained from the served synthetic-episode generator Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Resident scorer is trained from the served synthetic-episode generator.** Training data for the resident decision-scorer head comes from EG's seeded, ground-truth-bearing synthetic episode generator exercised through the real served request path, rather than manually authored synthetic examples, so training labels originate from the same engine the scorer runs inside. Split per the rapid-delivery contract: `.1` is the typed provenance model and its validation/refusal tests below; `.2` wires `export_gold_corpus` to actually drive episodes through a served client and tag them `SOURCE_SERVED`, and is not yet built. | A test confirms a training run consumes episodes produced by the synthetic generator's served path and that each episode carries a verifiable ground-truth label. | requirement | EG-DECISION-ENGINE | SPECIFIED | 163a1e6bc8ad 534f763afc81 |
| EG-DECISION-ENGINE-R093.1 Typed served-path provenance and ground-truth verification Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed served-path provenance and ground-truth verification.** A gold-corpus item's label carries an explicit provenance source (`SOURCE_IN_PROCESS` vs. `SOURCE_SERVED`), and `verify_ground_truth` refuses any item claiming `SOURCE_SERVED` whose acceptable set is empty or not a subset of its own candidates. | Unit tests confirm `verify_ground_truth` accepts a well-formed served-path item, ignores a non-served item, and refuses (raises `UnverifiableGroundTruthError`) a served item with an empty or leaking acceptable set. | requirement | EG-DECISION-ENGINE | VERIFIED | 163a1e6bc8ad 19b44d216062 tests/synthetic/test_synthetic_decision_export.py:63 tests/synthetic/test_synthetic_decision_export.py:71 tests/synthetic/test_synthetic_decision_export.py:78 tests/synthetic/test_synthetic_decision_export.py:85 |
| EG-DECISION-ENGINE-R093.2 Served corpus export Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Served corpus export.** Children `.2.1` through `.2.3` track the remaining served export and training acceptance. | Each child must pass before this rollup is complete. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R093.2.1 Collect served episode results Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Collect served episode results.** `epistemic_graph/testing/synthetic/decision_export.py::export_gold_corpus` must collect seeded episode results through the existing served client. | Planned: `tests/synthetic/test_synthetic_decision_export.py::test_corpus_collects_seeded_served_results`. Record client calls and compare their results with exported candidates. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R093.2.2 Bind served labels to collected results Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Bind served labels to collected results.** `epistemic_graph/testing/synthetic/decision_export.py` must assign `SOURCE_SERVED` only to collected served results and validate each ground-truth label. | Planned: `tests/synthetic/test_synthetic_decision_export.py::test_served_labels_require_collected_results`. Refuse forged served provenance, empty acceptable sets, and labels outside collected candidates. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R093.2.3 Verify served corpus training Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Verify served corpus training.** `tests/synthetic/test_served_corpus_training.py` must exercise corpus export through a real server and consume it in training. | Planned: `tests/synthetic/test_served_corpus_training.py::test_training_consumes_served_ground_truth`. Check each consumed episode against the server response and its verifiable label. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R094 Decision scoring requires no GPU or model-server dependency Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision scoring requires no GPU or model-server dependency.** The resident decision scorer runs on CPU inside every instance of the engine, requiring no GPU, model-serving sidecar, or separate inference cluster, and retraining it is a short, self-contained job rather than a cluster-scale undertaking. | A deployment test runs the engine, including decision scoring, with no GPU device or model-server sidecar present and confirms decisions are still served. | requirement | EG-DECISION-ENGINE | VERIFIED | 534f763afc81 af5dc5ad78bd src/server/handlers/decide/stat_tests/scorer_tests.rs:275 |
| EG-DECISION-ENGINE-R095 Solver certificate digest matches its committed golden vector Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Solver certificate digest matches its committed golden vector.** The solver's certificate digest, recomputed for the fixed reference input in crates/eg-compute/tests/solve/determinism.rs, matches the committed golden digest, and this golden-vector check runs as part of the publication gate rather than being limited to within-run stability checks. | The determinism test suite, including the certificate-digest golden-vector test and the repeated-solves byte-identical test, runs and passes as part of the publication gate. | requirement | EG-DECISION-ENGINE | VERIFIED | 534f763afc81 be0f1acb05c6 dc6a3c243a1f crates/eg-compute/tests/solve/determinism.rs:50 crates/eg-compute/tests/solve/determinism.rs:79 |
| EG-DECISION-ENGINE-R096 Community-detection wire contract carries edge weight and quality function Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Community-detection wire contract carries edge weight and quality function.** The community-detection request contract carries a weight, and optional properties, on each edge and an explicit quality-function selector, not only a modularity resolution parameter, so confidence-weighted edges and alternative quality functions reach the kernel through the default request path rather than only a rarer fallback path. | A contract test constructs a community-detection request with weighted edges and a non-default quality-function selector and asserts the kernel receives and applies both. | requirement | EG-DECISION-ENGINE | VERIFIED | 03bb9b81b3a4 2a0d6eae0918 534f763afc81 crates/eg-compute/src/algorithms/tests.rs:662 crates/eg-compute/src/algorithms/tests.rs:717 |
| EG-DECISION-ENGINE-R097 Replay-nonce rejection and blob GC grace period behave correctly Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Replay-nonce rejection and blob GC grace period behave correctly.** The transport anti-replay record in src/server/contract_wave.rs rejects a request that reuses a nonce already recorded, regardless of which served surface presented it, and the blob garbage collector in graph_pipeline.rs reclaims an unreferenced blob only after its configured grace period has elapsed, not immediately on dereference. | Reachability and garbage-collection tests use a distinct nonce per request and advance time past the configured grace period before asserting reclamation, matching the anti-replay record's and collector's actual contracts. | requirement | EG-DECISION-ENGINE | VERIFIED | 03bb9b81b3a4 534f763afc81 be0f1acb05c6 src/server/auth.rs:2151 src/server/blob/store/tests.rs:369 |
| EG-DECISION-ENGINE-R098 Decide ladder excludes generative free-text models by design Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decide ladder excludes generative free-text models by design.** EG's decision ladder provides legal-option derivation, calibrated probabilities, cost-sensitive choice, provenance, abstention, templated natural-language responses through NlTemplate, and a constrained, typed DecideText and UQL surface, without an in-engine generative language model or autoregressive text generation. The bounded resident scorer selects and ranks typed options and does not generate free text. | A contract test confirms DecideText and NlTemplate responses are produced only from fixed templates and typed slot values, never from free-form generated text. | requirement | EG-DECISION-ENGINE | VERIFIED | 534f763afc81 fa3eda2b7961 src/server/handlers/decide/stat_tests/nl_tests.rs:143 src/server/handlers/decide/stat_tests/nl_tests.rs:58 |
| EG-DECISION-ENGINE-R099 Wikidata alignment connector supplies entity-resolution keys Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wikidata alignment connector supplies entity-resolution keys.** A connector aligns EG's Region, Country, Taxon, Food and Nutrient entities to Wikidata using wikidataId and skos:exactMatch, supplying the entity-resolution keys consumed by EG-DECISION-ENGINE-R032, and a schema_mappings definition maps the same connector's fields to world_model-v1 properties, validated against the world-model SHACL shapes. | A SHACL validation test checks the produced schema_mappings data against the world-model shapes, and an entity-resolution test confirms the Wikidata-aligned keys resolve the expected entities. | requirement | EG-DECISION-ENGINE | SPECIFIED | 534f763afc81 a1bb9fb9503e |
| EG-DECISION-ENGINE-R099.1 Wikidata alignment connector and schema_mappings SHACL validation exist Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wikidata alignment connector and schema_mappings SHACL validation exist.** No Wikidata connector, schema_mappings data, or SHACL test exists supplying the Region/Country/Taxon/Food/Nutrient entity-resolution keys EG-DECISION-ENGINE-R032 consumes. | Test: `tests/connectors/wikidata_alignment.rs::schema_mappings_validate_against_world_model_shacl_shapes_and_resolve_expected_entities`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100 Retrieval decisions join cited evidence with independent outcomes Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Retrieval decisions join cited evidence with independent outcomes.** EG joins each retrieval DecisionRecord's cited evidence with an independently evaluated outcome and persists the resulting hard-negative examples durably for reuse in later training and evaluation. Extension .100 defines pinned retrieval-evaluation and exact context-span inputs; `.101` defines grounded topic coverage and soft-label unsupported-claim evaluation. Neither replaces the independent-outcome join or hard-negative persistence. | The original integration test records a retrieval decision, attaches an independent outcome and reads the hard-negative example. `.100` verifies pinned labels, metrics, context offsets and refusal behavior. `.101` verifies scoped topic coverage, soft-label arithmetic and empty-denominator refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | 03bb9b81b3a4 534f763afc81 e429630278b8 src/server/handlers/decide/stat_tests/retrieval_tests.rs:208 |
| EG-DECISION-ENGINE-R101 Query-side embedding adapter head promoted via DecisionEval Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Query-side embedding adapter head promoted via DecisionEval.** EG applies a low-rank adapter to the query embedding after row-level-security filtering and before the approximate nearest-neighbor probe, and promotes a fitted adapter head only on a passing DecisionEval receipt, consistent with the guarded publish path used for other fitted heads. | A test asserts the adapter applies only to post-filter query vectors and that an adapter head without a passing DecisionEval receipt cannot be promoted. | requirement | EG-DECISION-ENGINE | VERIFIED | 03bb9b81b3a4 534f763afc81 e429630278b8 src/server/handlers/decide/stat_tests/learning_tests.rs:145 |
| EG-DECISION-ENGINE-R102 Schema repair proposals pass a decided mapping and shadow-branch check Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Schema repair proposals pass a decided mapping and shadow-branch check.** EG's decision ladder evaluates a schema-repair mapping into a candidate GraphSchema or pack, validates the candidate with an ABox consistency check, and requires the candidate to be ingested on a shadow branch and explicitly approved before it is activated against the live schema. Rollup: split into `.1` (below) per SPEC-SIZING §5; a further child wires `GraphSchemaOp::AttachApproved` to a real shadow-branch ingest. | An integration test runs a schema-repair proposal through the mapping, ABox check, shadow-branch ingest and approval sequence and asserts activation only occurs after approval. | requirement | EG-DECISION-ENGINE | SPECIFIED | 202b90167359 534f763afc81 |
| EG-DECISION-ENGINE-R102.1 Typed schema-repair activation gate (producer-first split of R102) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed schema-repair activation gate (producer-first split of R102).** `eg-types::graph_schema::shadow_branch` defines `SchemaRepairStep` and `SchemaRepairActivation`, whose `checked_for_activation` refuses activation unless mapping-decided, ABox-check-passed, shadow-branch-ingested and approved steps are all recorded in that exact order, as the type-level contract ahead of the real mapping ladder and shadow-branch ingest wiring (further children). | A positive test records every step in order and asserts activation succeeds; negative tests omit the shadow-branch-ingest step and reorder approval ahead of it, and assert both are refused. | requirement | EG-DECISION-ENGINE | VERIFIED | 202b90167359 9c5b587a7145 crates/eg-types/src/graph_schema/shadow_branch.rs:109 crates/eg-types/src/graph_schema/shadow_branch.rs:88 crates/eg-types/src/graph_schema/shadow_branch.rs:95 |
| EG-DECISION-ENGINE-R102.2 Served shadow repair qualification Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Served shadow repair qualification.** Wire and test the full schema-repair sequence at `src/server/graph_schema/approved.rs`. The sequence is decided mapping, ABox validation, real shadow-branch ingestion, then approval before activation. Reuse the existing approval lease and schema owner. A recorded step enum alone is not evidence of shadow ingestion. | Planned `src/server/graph_schema/approved/tests.rs::schema_repair_requires_real_shadow_ingest_before_activation`; not implemented or executed acceptance evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R103 Calibrated per-horizon flip confidence with conformal abstention Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Calibrated per-horizon flip confidence with conformal abstention.** EG's finance decision questions report a calibrated confidence for a predicted directional flip at each forecast horizon and abstain, using the same conformal abstention mechanism as other statistical decision rungs, when coverage cannot be guaranteed at that horizon. | A test evaluates flip predictions across multiple horizons and asserts each reports a calibrated confidence and abstains whenever conformal coverage fails at that horizon. | requirement | EG-DECISION-ENGINE | VERIFIED | 532418b7e55b 534f763afc81 9c5b587a7145 crates/eg-compute/src/finance/market/record_tests.rs:299 |
| EG-DECISION-ENGINE-R104 DecideText shares the UQL lexer and grammar family Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**DecideText shares the UQL lexer and grammar family.** DecideText is parsed by the same lexer and grammar family as UQL, supporting dollar-prefixed parameters, a quote-aware candidate block, structured parse errors, and a shared grammar table, rather than a separate bespoke parser. | A parser test runs the same grammar-table-driven fixtures against DecideText and UQL inputs and asserts both produce structured errors in the same shape. | requirement | EG-DECISION-ENGINE | VERIFIED | 534f763afc81 857e20c63775 9c5b587a7145 crates/eg-plan/src/decide_text/tests.rs:145 |
| EG-DECISION-ENGINE-R105 GraphSchema.attach publishes the swarm-topology ontology Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**GraphSchema.attach publishes the swarm-topology ontology.** EG's GraphSchema.attach publishes the swarm-topology TBox and SHACL shapes as a versioned schema package, and SHACL positive and negative fixtures prove the shapes accept valid swarm-topology facts and reject invalid ones. | A SHACL fixture test attaches the swarm-topology schema and asserts the positive fixtures validate and the negative fixtures fail validation. | requirement | EG-DECISION-ENGINE | VERIFIED | 4ded009c7d6e 534f763afc81 src/server/graph_schema/swarm_topology_tests.rs:128 |
| EG-DECISION-ENGINE-R106 AgentGraph templates carry topology facts for standard shapes Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**AgentGraph templates carry topology facts for standard shapes.** EG's AgentGraph template representation supports the standard agent arrangement shapes used by downstream topology templates, including single-agent, pipeline, fan-out/join, supervisor-to-workers, critique-loop and council arrangements, and carries topology facts on each template for validation against the swarm-topology schema. | A contract test constructs an AgentGraph template for each standard shape and asserts its topology facts validate against the swarm-topology SHACL shapes. | requirement | EG-DECISION-ENGINE | SPECIFIED | 534f763afc81 ca2bc11e6d73 src/server/graph_schema/swarm_topology_tests.rs:128 |
| EG-DECISION-ENGINE-R107 Typed topology contract in eg-types with versioned goldens Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed topology contract in eg-types with versioned goldens.** eg-types defines a typed topology contract of at most twelve types in crates/eg-types/src/decision/topology.rs, adds a topology field to AssemblyRequirements and to template facts, increments the decision record version with accompanying v1 golden fixtures, and generates the matching Python bindings and capability pin. | Generated-contract and golden-fixture tests confirm the new topology types, the incremented record version, and the regenerated Python bindings stay in sync. | requirement | EG-DECISION-ENGINE | VERIFIED | 534f763afc81 9c5b587a7145 c0edc96d1e10 crates/eg-types/src/decision/topology/tests.rs:56 crates/eg-types/src/decision/topology/tests.rs:68 |
| EG-DECISION-ENGINE-R108 Publish-time topology-shape validation fails closed Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Publish-time topology-shape validation fails closed.** Publishing an agent template runs a programmatic TemplateTopologyShape validation hook from the admin agent handler, implemented in src/server/handlers/decide/topology_shape.rs, and rejects any template whose topology does not validate rather than publishing it unchecked. | A negative test publishes a template with an invalid topology shape and asserts the publish request is rejected rather than silently accepted. | requirement | EG-DECISION-ENGINE | VERIFIED | 534f763afc81 9c5b587a7145 c0edc96d1e10 src/server/handlers/decide/topology_shape/tests.rs:77 |
| EG-DECISION-ENGINE-R109 OWL entailment derives topology admissibility before assembly Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**OWL entailment derives topology admissibility before assembly.** Agent assembly runs an admissibility entailment stage in crates/eg-compute/src/assemble/topology/admissible.rs that includes the composed schema digest among its inputs, derives a TopologyAdmissible fact through OWL derivation, and eliminates any topology option the derivation does not admit. | A test varies the composed schema digest and asserts the derived TopologyAdmissible facts and eliminated topology options change accordingly. | requirement | EG-DECISION-ENGINE | VERIFIED | 47990cdbcb2b 534f763afc81 c0edc96d1e10 src/server/handlers/decide/topology_schema.rs:213 |
| EG-DECISION-ENGINE-R109.1 Topology admissibility entailment test varies the composed schema digest Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Topology admissibility entailment test varies the composed schema digest.** Entailment lives in `topology_schema.rs::entail`, not the named `admissible.rs`, and no test varies the composed schema digest to show the derived TopologyAdmissible facts and eliminated options actually change. | Test: `crates/eg-compute/src/assemble/topology/admissible.rs::tests::varying_the_composed_schema_digest_changes_derived_topology_admissibility`. | requirement | EG-DECISION-ENGINE | VERIFIED | 47990cdbcb2b src/server/handlers/decide/topology_schema.rs:213 |
| EG-DECISION-ENGINE-R110 Topology optimization model rows with a brute-force oracle Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Topology optimization model rows with a brute-force oracle.** The topology assembly model in crates/eg-compute/src/assemble/topology/model.rs encodes one-hot width and round variables plus lease, deadline, demand, verify and capacity rows using precomputed tables, and a brute-force oracle checks the model's solutions against small instances of at most twenty variables. | A property test compares the solver's output against the brute-force oracle for topology instances up to twenty variables and asserts they agree. | requirement | EG-DECISION-ENGINE | VERIFIED | 1bd4d6b1cdea 1e1a100670b5 534f763afc81 c0edc96d1e10 crates/eg-compute/src/assemble/tests/topology_oracle.rs:144 |
| EG-DECISION-ENGINE-R110.1 Topology brute-force oracle property test covers n<=20 variables Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Topology brute-force oracle property test covers n<=20 variables.** The assembly test compares deterministic topology instances against independent exhaustive enumeration. Actual model and certificate counts include twenty variables. | Test: `crates/eg-compute/src/assemble/tests/topology_oracle.rs::property_oracle_agrees_with_the_solver_for_instances_up_to_twenty_variables`. | requirement | EG-DECISION-ENGINE | VERIFIED | 1bd4d6b1cdea 1e1a100670b5 crates/eg-compute/src/assemble/tests/topology_oracle.rs:144 |
| EG-DECISION-ENGINE-R111 Decide exposes the topology decision as a single typed question Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decide exposes the topology decision as a single typed question.** EG's decision ladder exposes swarm-topology selection as a single typed Decide question that callers ask directly, returning a derived, calibrated and recorded answer in place of a heuristic success-rate estimate computed outside the ladder. | A contract test issues a topology Decide request and asserts the response is a typed DecisionRecord rather than a heuristic score computed outside the ladder. | requirement | EG-DECISION-ENGINE | SPECIFIED | 534f763afc81 c0edc96d1e10 |
| EG-DECISION-ENGINE-R111.1 Topology selection is exposed as its own standalone typed Decide question Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Topology selection is exposed as its own standalone typed Decide question.** No dispatch-level standalone typed Topology Decide question exists; topology selection is still only reachable inside `graph.assemble()`. | Test: `src/server/handlers/decide/stat_tests/consumer_tests.rs::a_standalone_topology_decide_question_returns_a_typed_decision_record`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R112 Capacity premise derives headroom observations by priority Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Capacity premise derives headroom observations by priority.** src/server/handlers/decide/capacity_premise.rs derives headroom observations from capacity status at the requesting priority level, and reports infeasibility using a typed Infeasible result named by the specific lease constraint that could not be met. | A test exhausts capacity at a given priority and asserts the response is a typed, lease-named Infeasible result rather than a generic failure. | requirement | EG-DECISION-ENGINE | VERIFIED | 26a0f185448a 534f763afc81 c0edc96d1e10 crates/eg-compute/src/assemble/tests/topology.rs:116 |
| EG-DECISION-ENGINE-R113 EG commits capacity acquisition atomically with synthesis evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**EG commits capacity acquisition atomically with synthesis evidence.** EG's decision commit path for a topology-backed run publishes synthesis evidence alongside the committed record and performs capacity acquisition as a single all-or-nothing operation, so a caller denied capacity can request exactly one further decision rather than partially holding resources. Rollup: split into `.1` (below) per SPEC-SIZING §5; `.2` tracks the atomic runtime commit; `.3` tracks retry enforcement. | A test simulates a denied capacity acquisition and asserts no partial capacity is held and that exactly one further decision request is accepted. | requirement | EG-DECISION-ENGINE | SPECIFIED | 202b90167359 534f763afc81 |
| EG-DECISION-ENGINE-R113.1 Typed atomic capacity/synthesis-evidence commit outcome (producer-first split of R113) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed atomic capacity/synthesis-evidence commit outcome (producer-first split of R113).** `eg-types::decision::topology::capacity_commit` defines `CapacitySynthesisCommit` (`Committed`/`Denied`) and `RetryAllowance`, whose `from_capacity_decision` refuses a `Committed` outcome without a lease and published synthesis evidence, and refuses a `Denied` outcome holding any lease or published evidence, granting exactly one further decision on denial. | A positive test commits an accepted decision with a lease and evidence; negative tests refuse a denial holding a partial lease and an acceptance missing published evidence, and assert a denial's retry allowance is exactly one. | requirement | EG-DECISION-ENGINE | VERIFIED | 202b90167359 93183139d2e2 crates/eg-types/src/decision/topology/capacity_commit.rs:110 crates/eg-types/src/decision/topology/capacity_commit.rs:125 crates/eg-types/src/decision/topology/capacity_commit.rs:137 crates/eg-types/src/decision/topology/capacity_commit.rs:149 crates/eg-types/src/decision/topology/capacity_commit.rs:174 |
| EG-DECISION-ENGINE-R113.2 Atomic commit transaction Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Atomic commit transaction.** Rollup of `.2.1` to `.2.4`. Targets: `src/server/persistence/decision_record.rs`, `src/server/persistence/agent_graph/write.rs`, and `src/redb_store/capacity_lease.rs`. The shared transaction path is absent. Implementation remains blocked on the owner-boundary decision documented in `test-spec.md`. | Planned tests in `src/server/persistence/decision_record/tests.rs`: `topology_commit_publishes_capacity_and_evidence`, `topology_capacity_denial_leaves_no_commit_parts`, and `topology_commit_recovery_preserves_atomic_outcome`. The handler refusal test is `.2.1`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R113.2.1 Refuse an unsupported transaction boundary Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refuse an unsupported transaction boundary.** In `src/server/handlers/decide/commit.rs`, refuse topology acquisition before writes when no shared transaction authority exists. This guard does not implement the atomic transaction. | `src/server/handlers/decide/commit.rs::tests::topology_commit_refuses_uncoordinated_owners` checks both owners. The guard targets solved plans with positive lease demand. Ordinary records retain their commit path. | requirement | EG-DECISION-ENGINE | VERIFIED | 347eb303fcc7 src/server/handlers/decide/commit/tests.rs:121 |
| EG-DECISION-ENGINE-R113.2.2 Accepted transaction fixture Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Accepted transaction fixture.** Add one success fixture in `src/server/persistence/decision_record/tests.rs`. The fixture checks the record, lease, and graph evidence after one accepted topology commit. Production targets are the three files named in `.2`. | Planned `src/server/persistence/decision_record/tests.rs::topology_commit_publishes_capacity_and_evidence` checks all three durable outputs. This fixture depends on the missing shared transaction path. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R113.2.3 Denied transaction fixture Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Denied transaction fixture.** Add one refusal fixture in `src/server/persistence/decision_record/tests.rs`. Capacity denial must leave no new record, lease, or graph evidence. Production targets are the three files named in `.2`. | Planned `src/server/persistence/decision_record/tests.rs::topology_capacity_denial_leaves_no_commit_parts` checks both stores after denial. This fixture depends on the missing shared transaction path. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R113.2.4 Transaction recovery fixture Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Transaction recovery fixture.** Add one restart fixture in `src/server/persistence/decision_record/tests.rs`. Restart after each participant boundary and check the same atomic outcome. Production targets are the three files named in `.2`. | Planned `src/server/persistence/decision_record/tests.rs::topology_commit_recovery_preserves_atomic_outcome` refuses visible partial state after restart. This fixture depends on the missing shared transaction and recovery paths. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R113.3 One retry after capacity denial Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**One retry after capacity denial.** Rollup of `.3.1` to `.3.3`. Targets: `crates/eg-types/src/decision/topology/capacity_commit.rs`, `src/server/persistence/decision_record.rs`, and `src/server/handlers/decide/commit.rs`. The handler must consume an authoritative denial allowance before the next decision. | Planned tests: `retry_allowance_consumes_once`, `topology_denial_allowance_consumption_survives_restart`, and `topology_denial_accepts_one_followup_request`. Child rows name their exact test files. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R113.3.1 Consume the typed allowance once Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Consume the typed allowance once.** In `crates/eg-types/src/decision/topology/retry_allowance.rs`, re-exported by `capacity_commit.rs`, add a checked transition from one remaining decision to zero. A second consumption must fail. | `crates/eg-types/src/decision/topology/retry_allowance.rs::tests::retry_allowance_consumes_once` checks the successful transition and repeated refusal. This model test does not prove runtime enforcement. | requirement | EG-DECISION-ENGINE | VERIFIED | cb8662f24bef crates/eg-types/src/decision/topology/retry_allowance.rs:35 crates/eg-types/src/decision/topology/retry_allowance.rs:49 |
| EG-DECISION-ENGINE-R113.3.2 Durable consumption fixture Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Durable consumption fixture.** Add one test in `src/server/persistence/decision_record/tests.rs` for consumption by tenant and denied decision identity. Production target: `src/server/persistence/decision_record.rs`. A restart must not restore the consumed allowance. | Planned `src/server/persistence/decision_record/tests.rs::topology_denial_allowance_consumption_survives_restart` checks initial use, reopen, and refusal. The durable denial record and consume operation remain absent. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R113.3.3 Handler retry fixture Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Handler retry fixture.** Add one request test in `src/server/handlers/decide/commit.rs`. The handler permits one further decision after denial and refuses repeated or concurrent consumption. Production target: the same file. This test depends on `.3.2`. | Planned `src/server/handlers/decide/commit.rs::tests::topology_denial_accepts_one_followup_request` checks first use, replay, concurrent use, and tenant binding. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R114 Subagent allowance negotiation reads EG's topology facts Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Subagent allowance negotiation reads EG's topology facts.** The typed topology facts EG attaches to a committed decision record are the input a caller's subagent-allowance negotiation reads to decide how many subagents may run, rather than the negotiation computing its own separate topology estimate. | A contract test confirms a subagent-allowance negotiation consumes the topology-facts field of a committed EG decision record. | requirement | EG-DECISION-ENGINE | VERIFIED | 26b04e133dfd 534f763afc81 c0edc96d1e10 crates/eg-compute/src/assemble/tests/topology.rs:196 |
| EG-DECISION-ENGINE-R116 Consumers reach EG only through the versioned client contract Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Consumers reach EG only through the versioned client contract.** EG publishes a single versioned client contract that external consumers use for every decision and engine call, so no consumer needs a separate bespoke facade, in-process engine object, or private transport path to reach EG's decision ladder. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R116.1` (the typed consumer-call-path gate) and `EG-DECISION-ENGINE-R116.2` (wiring every generated client method through it, plus the contract test). R116 is LANDED when both children are. | A contract test confirms a consumer using only the published EG client contract can perform the same calls that previously required a bespoke in-process facade, with no direct engine import required. | requirement | EG-DECISION-ENGINE | SPECIFIED | 534f763afc81 |
| EG-DECISION-ENGINE-R116.1 A typed gate admits only the published client-contract call path Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**A typed gate admits only the published client-contract call path.** A `ConsumerCallPath` type distinguishes the published, versioned contract path from a bespoke in-process facade or private transport; `admit_call_path` admits the former (with a non-empty contract version) and refuses the latter unconditionally. Adds no server surface. | Unit tests assert the published contract path is admitted, a bespoke facade is always refused, and an empty contract version is refused. | requirement | EG-DECISION-ENGINE | VERIFIED | 253a69935dfd 26b04e133dfd crates/eg-capabilities/src/contract/access_path.rs:45 crates/eg-capabilities/src/contract/access_path.rs:54 crates/eg-capabilities/src/contract/access_path.rs:64 |
| EG-DECISION-ENGINE-R116.2 Every generated client method is wired through the contract-only gate Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Every generated client method is wired through the contract-only gate.** Every decision and engine call the generated client exposes is routed through `EG-DECISION-ENGINE-R116.1`'s `admit_call_path` before dispatch, so no bespoke facade or private transport path can reach EG's decision ladder. Depends on `EG-DECISION-ENGINE-R116.1`. | A contract test confirms a consumer using only the published EG client contract can perform the same calls that previously required a bespoke in-process facade, with no direct engine import required. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R117 DERIVE series functions share one incremental kernel Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**DERIVE series functions share one incremental kernel.** eg-tsdb/src/derive implements lag, diff, return, log-return, and rolling mean, standard deviation, sum, min, max, rank, correlation, exponentially weighted moving average, z-score, ratio, and weighted-sum functions as checkpointed incremental kernels, with UQL's DERIVE clause, SQL window functions, and the matching PromQL functions all calling the same kernel rather than duplicating it, and a single shared rolling z-score and exponentially weighted moving average implementation. DecisionEval reports each feature's predictive power as rolling rank information coefficient, information-coefficient decay, information ratio with an effective sample size, and a bootstrap confidence interval. | A test compares UQL DERIVE, SQL window and PromQL outputs for the same function against a Python reference golden and asserts agreement, and a DecisionEval report test asserts all four feature-power metrics are present. | requirement | EG-DECISION-ENGINE | SPECIFIED | 534f763afc81 9480759eb7c2 |
| EG-DECISION-ENGINE-R117.1 UQL/SQL/PromQL golden-equivalence and 4-metric DecisionEval report test Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**UQL/SQL/PromQL golden-equivalence and 4-metric DecisionEval report test.** No UQL/SQL/PromQL golden-equivalence test or 4-metric DecisionEval report test exists for the DERIVE series functions. | Test: `crates/eg-tsdb/tests/derive_golden.rs::uql_sql_promql_outputs_agree_on_golden_reference_and_decisioneval_reports_all_four_feature_power_metrics`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R118 Reputation view backs source reliability across all readers Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reputation view backs source reliability across all readers.** EG materializes a read-only reputation relation from Decide's hierarchical Beta-Binomial option pools and proper-score forecaster records, including Brier score, log score, Murphy decomposition and calibration error, time-discounted and gated by a minimum sample size, formed only from independently evaluated outcome labels. AuthorityPolicy.source_reliability, RetrievalCandidate.source_reliability and UQL's SOURCE RELIABILITY clause all read this same materialization, and evidence fusion lives in eg-epistemic with the finance signal method kept as a thin adapter rather than a second fusion implementation. | A test asserts a sparse or unverified pool abstains rather than returning a default reliability, and that AuthorityPolicy, RetrievalCandidate and UQL SOURCE RELIABILITY all return identical values for the same source. | requirement | EG-DECISION-ENGINE | SPECIFIED | 1f6d512ae013 28fbbbe2ee1e 534f763afc81 7e14801e08c3 9a85c8a49fd4 |
| EG-DECISION-ENGINE-R118.1 Reputation-view test exists outside the unrelated privacy regression fixture Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reputation-view test exists outside the unrelated privacy regression fixture.** No real test of the reputation materialization existed. Only incidental fixture text inside an unrelated privacy regression test touched this path. Split into `EG-DECISION-ENGINE-R118.1.1` (in-crate) and `EG-DECISION-ENGINE-R118.1.2` (cross-surface agreement). | Delivered by the two child rows. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R118.1.1 A sparse pool abstains in the reputation materialization Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**A sparse pool abstains in the reputation materialization.** `learn_reputation` (`crates/eg-numeric/src/risk/reputation.rs`) returns `Reputation::InsufficientHistory` for a subject below the sample gate while a dense peer in the same pool is `Reputation::Estimated`. | Test: `crates/eg-numeric/src/risk/reputation.rs::tests::sparse_pool_abstains_while_a_dense_peer_is_estimated`. | requirement | EG-DECISION-ENGINE | VERIFIED | ac824430b1d8 crates/eg-numeric/src/risk/reputation.rs:316 |
| EG-DECISION-ENGINE-R118.1.2 AuthorityPolicy, RetrievalCandidate and UQL SOURCE RELIABILITY agree on the abstention Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**AuthorityPolicy, RetrievalCandidate and UQL SOURCE RELIABILITY agree on the abstention.** Remaining scope: one cross-crate test (eg-epistemic, eg-numeric, eg-plan) showing `AuthorityPolicy.source_reliability`, `RetrievalCandidate.source_reliability` and UQL's SOURCE RELIABILITY clause read the same materialized value and all abstain for a sparse pool. | Test: a cross-surface test asserting all three readers agree on a sparse-pool abstention (to be written). | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R119 Walk-forward replay seals deflated Sharpe and PBO evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Walk-forward replay seals deflated Sharpe and PBO evidence.** DecisionEval's walk-forward replay mode reads a bitemporal AS OF snapshot for every fold, refits only on that fold's training history, and records input, head and policy digests plus per-option contributions and a resume point so an interrupted replay can continue. Each run is sealed as a content-addressed EvaluationRun reporting a deflated Sharpe ratio using the real trial count, a probability of backtest overfitting figure, and a Diebold-Mariano comparison against a pinned incumbent, with finance BacktestRun as a specialization of this same sealed, verified, no-look-ahead contract, and a policy-dependent environment is refused and routed to off-policy evaluation instead. | A replay test runs walk-forward folds over bitemporal snapshots and asserts the sealed EvaluationRun's trial count, backtest-overfitting probability and Diebold-Mariano figures match independently recomputed values, and that a policy-dependent environment is rejected. | requirement | EG-DECISION-ENGINE | VERIFIED | 4034a361535b 534f763afc81 a85c8425c9f4 src/server/handlers/decide/stat_tests/replay_tests.rs:187 src/server/handlers/decide/stat_tests/replay_tests.rs:246 |
| EG-DECISION-ENGINE-R120 Admission anchors are limited to persisted write paths Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Admission anchors are limited to persisted write paths.** A component counts as an admission anchor in the pinned-reference-resolution check only when it performs a persisted write; a read-only helper, a replay helper, or a decision-record's internal closure does not count as a separate admission point. | A test exercises a read helper, a replay helper and a persisted write path and asserts only the write path is counted as a component's admission anchor. | requirement | EG-DECISION-ENGINE | VERIFIED | 18f72d26730a 3c39771e7a44 534f763afc81 tests/test_pinned_reference_resolution.py:144 |
| EG-DECISION-ENGINE-R121 Typed Claim and Evidence structures back evidence class Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed Claim and Evidence structures back evidence class.** EG represents claim and evidence provenance as typed Claim and Evidence data structures carried through the decision pipeline, not as naming-convention string labels, so every decision answer's evidence_class (proof, observation, or claim) is derived from structured data rather than inferred from field names. Rollup of `EG-DECISION-ENGINE-R121.1` and `EG-DECISION-ENGINE-R121.2`; both remain necessary. | A unit test constructs a decision answer and asserts evidence_class is computed from the typed Claim/Evidence structure, failing if a mislabeled string alone could produce a different class. | requirement | EG-DECISION-ENGINE | SPECIFIED | 534f763afc81 a1bb9fb9503e |
| EG-DECISION-ENGINE-R121.1 Assembly answers use typed premise classes Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Assembly answers use typed premise classes.** Reuse `PremiseRef` in `crates/eg-compute/src/assemble/conclude.rs`. Misleading field names and subject IRIs must not change evidence class. | `crates/eg-compute/src/assemble/tests/evidence.rs::assembly_evidence_uses_typed_premises_not_labels` constructs and replays actual assembly answers across all three classes. | requirement | EG-DECISION-ENGINE | VERIFIED | a8e597dccba7 crates/eg-compute/src/assemble/tests/evidence.rs:8 |
| EG-DECISION-ENGINE-R121.2 Graph candidate provenance reaches statistical answers Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Graph candidate provenance reaches statistical answers.** Reuse typed graph nodes in `src/server/handlers/decide/candidates.rs` and `stat_decide.rs`. Preserve source identity and snapshot evidence through record sealing and replay. Graph rows currently carry text and numeric features only. | Planned `src/server/handlers/decide/stat_tests/classes_tests.rs::graph_claim_and_evidence_control_answer_class` exercises typed graph rows, misleading labels, malformed provenance, and replay. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R122 Synthetic decision data stays separate from calibration Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Synthetic decision data stays separate from calibration.** EG runs synthetic decision data with outcomes known by construction through its full decision pipeline and flags the resulting records as synthetic, so synthetic evaluations are never merged with real-world calibration statistics. | An integration test runs the synthetic suite end to end and asserts synthetic-origin records are excluded from real-world calibration aggregates. | requirement | EG-DECISION-ENGINE | VERIFIED | 0c9f08ddbbae 534f763afc81 cfbe22464008 src/server/handlers/decide/stat_tests.rs:569 |
| EG-DECISION-ENGINE-R123 Solve DTOs canonical in eg-types, no duplicate copies Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Solve DTOs canonical in eg-types, no duplicate copies.** The solver data types under eg-types/src/solve/** are the single canonical definition of the solver's request and result shapes. Any other crate re-exports them from eg-types instead of maintaining its own copy. | `tests/test_decision_static_contracts.py::test_solve_dtos_have_no_second_definition` scans Rust sources for duplicate canonical DTO declarations. Adversarial fixtures reject added structs, enums, and aliases. Reviewed unrelated domain homonyms remain distinct. | requirement | EG-DECISION-ENGINE | VERIFIED | 51f9c8eb6f1d 534f763afc81 a4804f87c971 tests/test_decision_static_contracts.py:87 |
| EG-DECISION-ENGINE-R124 eg-numeric statistical kernel tests compile and run Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**eg-numeric statistical kernel tests compile and run.** Every statistical kernel implementation in eg-numeric is exercised by a compiled test entry point (tests/stat_kernels.rs) so the crate's test suite builds and runs all kernel test files, clippy.toml's declared self-check file exists and matches what clippy actually runs, and confidence-level and statistical-power assertions in those tests use correctly calibrated values. | The eg-numeric test suite compiles and executes tests/stat_kernels.rs with all five kernel test files included, and clippy runs against the declared self-check file. | requirement | EG-DECISION-ENGINE | VERIFIED | 30405ee73d13 534f763afc81 a1bb9fb9503e crates/eg-numeric/tests/stat_kernels/clippy_policy.rs:34 crates/eg-numeric/tests/stat_kernels/clippy_policy.rs:50 |
| EG-DECISION-ENGINE-R125 Telemetry binds to ontology entities as BehaviourObservation Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Telemetry binds to ontology entities as BehaviourObservation.** EG binds incoming telemetry events to their corresponding ontology entities and rolls them up into BehaviourObservation facts that downstream decision and reputation computations can read. | An integration test ingests sample telemetry, confirms correct entity binding, and asserts the resulting BehaviourObservation rollup facts are queryable. | requirement | EG-DECISION-ENGINE | VERIFIED | 30405ee73d13 534f763afc81 cae7ecad71e2 tests/served_telemetry_facts.rs:232 |
| EG-DECISION-ENGINE-R126 Capability coverage answers which components can serve a task Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Capability coverage answers which components can serve a task.** EG extends `AgentAssemble` (EG-DECISION-ENGINE-R036) with a read-only coverage query. The query takes native task IRIs and returns the capability closure of each task. For each capability, it lists the visible Agent Library templates and registered A2A agent cards that cover it. Each entry carries its derivation premises and their evidence class. A2A agent cards stay claims. The query uses no model and ranks nothing. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R126.1` (the pure capability-coverage derivation) and `EG-DECISION-ENGINE-R126.2` (the served query and its generated client). R126 is LANDED when both children are. | A served fixture proves closure, per-capability covering components, premise classes, visibility filtering and the absence of invisible components. | requirement | EG-DECISION-ENGINE | VERIFIED | 1b6af1990ea8 253a69935dfd 2b7d88e9b456 30405ee73d13 4b6e3e19af6b crates/eg-types/src/decision/derivation/tests.rs:138 src/server/handlers/decide/coverage_tests.rs:152 src/server/handlers/decide/coverage_tests.rs:232 tests/test_capability_coverage_client.py:28 tests/test_capability_coverage_client.py:37 |
| EG-DECISION-ENGINE-R126.1 Capability coverage is a pure function of required capabilities and candidate facts Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Capability coverage is a pure function of required capabilities and candidate facts.** `eg-types`'s `decision::derivation` module computes, for each of a task closure's required capabilities, every visible Agent Library candidate that covers it (reusing `coverage_chain`, the same chain `AgentAssemble` already proves) paired with its evidence class, and every registered A2A agent card that self-declares it, always at claim strength. Adds no server surface and no ranking. | Unit tests assert the join: only covering library candidates and self-declaring A2A cards appear, and a library entry's evidence class matches the weakest premise of its chain. | requirement | EG-DECISION-ENGINE | VERIFIED | 253a69935dfd e5edf018cbba crates/eg-types/src/decision/derivation/tests.rs:138 |
| EG-DECISION-ENGINE-R126.2 The capability-coverage query is served beside `AgentAssemble` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The capability-coverage query is served beside `AgentAssemble`.** A read-only method accepts native task IRIs, resolves the tenant's visible Agent Library candidates and registered A2A cards, calls `EG-DECISION-ENGINE-R126.1`'s `capability_coverage`, and returns the result with a generated client method. Depends on `EG-DECISION-ENGINE-R126.1`. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R126.2.1` (the served RPC: `Method` variant, dispatch wiring and handler) and `EG-DECISION-ENGINE-R126.2.2` (the generated client, cut once the orchestrator regenerates the contract). R126.2 is LANDED when both children are. | A served fixture proves closure, per-capability covering components, premise classes, visibility filtering and the absence of invisible components. | requirement | EG-DECISION-ENGINE | VERIFIED | 1b6af1990ea8 253a69935dfd 2b7d88e9b456 30405ee73d13 4b6e3e19af6b src/server/handlers/decide/coverage_tests.rs:152 src/server/handlers/decide/coverage_tests.rs:232 tests/test_capability_coverage_client.py:28 tests/test_capability_coverage_client.py:37 |
| EG-DECISION-ENGINE-R126.2.1 The capability-coverage query answers over the wire Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The capability-coverage query answers over the wire.** A new `Method` variant carries native task IRIs; dispatch routes it to a handler beside `handle_agent_assemble` that resolves the tenant's visible Agent Library candidates and registered A2A agent cards (the existing `A2aAgentCard`-kind `AgentComponent`s) from the same Agent Library store `AgentAssemble` reads, and calls `EG-DECISION-ENGINE-R126.1`'s `capability_coverage_query`. No generated client yet. Depends on `EG-DECISION-ENGINE-R126.1`. | A served fixture proves closure, per-capability covering components, premise classes, visibility filtering and the absence of invisible components, driven directly against the dispatcher. | requirement | EG-DECISION-ENGINE | VERIFIED | 1b6af1990ea8 2b7d88e9b456 9c778cfdfff0 fcb2e15d572c src/server/handlers/decide/coverage_tests.rs:152 src/server/handlers/decide/coverage_tests.rs:232 |
| EG-DECISION-ENGINE-R126.2.2 The capability-coverage query gets a generated client method Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The capability-coverage query gets a generated client method.** Once `EG-DECISION-ENGINE-R126.2.1` is wired, `gen_contract` is rerun to publish the method's request/response subschema and regenerate `crates/eg-capabilities/generated/method_catalog.rs` and the client bindings. Depends on `EG-DECISION-ENGINE-R126.2.1`; requires a build-host `cargo run -p eg-capabilities --features contract --bin gen_contract` the delivering lane does not itself run. | The regenerated generated-client contract test exercises the method end to end. | requirement | EG-DECISION-ENGINE | VERIFIED | 4b6e3e19af6b tests/test_capability_coverage_client.py:28 tests/test_capability_coverage_client.py:37 |
| EG-DECISION-ENGINE-R127 Guardrail entailment lists the rules a task must follow Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Guardrail entailment lists the rules a task must follow.** EG returns the governance rules, standards and SHACL shapes that apply to a task class by ontology entailment. Each rule carries the entailment path and its source generation. The answer is advisory; enforcement stays with the owning policy gate. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R127.1` (the pure entailment function) and `EG-DECISION-ENGINE-R127.2` (the served query and its generated client). R127 is LANDED when both children are. | A fixture proves entailed rules for a subclassed task, no rule for an unrelated task, and stable premises after restart. | requirement | EG-DECISION-ENGINE | VERIFIED | 18a745706c46 2110b293cdf0 253a69935dfd 30405ee73d13 334c101eb64f crates/eg-types/src/decision/guardrail.rs:254 crates/eg-types/src/decision/guardrail.rs:292 crates/eg-types/src/decision/guardrail.rs:317 crates/eg-types/src/decision/guardrail.rs:324 src/server/handlers/decide/guardrail_tests.rs:139 |
| EG-DECISION-ENGINE-R127.1 Guardrail entailment is a pure function of a task IRI and a rule set Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Guardrail entailment is a pure function of a task IRI and a rule set.** `eg-types`'s `decision::guardrail` module decides, for a task IRI and a set of `GuardrailRule`s each naming the task class they govern, which rules are entailed by task-class subsumption (reusing `agent_ontology::broader_chain`, the same subclass-entailment primitive `coverage_chain` already proves capability coverage with), each with its entailment path and source generation. Adds no server surface. | Unit tests assert a rule on the task's own class or an ancestor is entailed with the correct path, a rule on an unrelated class is never entailed, and the same inputs always produce the same premises. | requirement | EG-DECISION-ENGINE | VERIFIED | 18a745706c46 253a69935dfd 30405ee73d13 crates/eg-types/src/decision/guardrail.rs:292 crates/eg-types/src/decision/guardrail.rs:317 crates/eg-types/src/decision/guardrail.rs:324 |
| EG-DECISION-ENGINE-R127.2 The guardrail-entailment query is served, backed by a stored rule set Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The guardrail-entailment query is served, backed by a stored rule set.** A read-only method accepts a task IRI, reads the tenant's published `GuardrailRule`s, calls `EG-DECISION-ENGINE-R127.1`'s `entailed_guardrails`, and returns the result with a generated client method. Depends on `EG-DECISION-ENGINE-R127.1`. The query reuses the Agent Library component publish path and its tenant-bound snapshot reader. Split per the dependency-first sizing rule (producer before consumer): `EG-DECISION-ENGINE-R127.2.1` (the `GuardrailRule` storage/publish path), `EG-DECISION-ENGINE-R127.2.2` (the served RPC) and `EG-DECISION-ENGINE-R127.2.3` (the generated client). R127.2 is LANDED when all three children are. | A fixture proves entailed rules for a subclassed task, no rule for an unrelated task, and stable premises after restart. | requirement | EG-DECISION-ENGINE | VERIFIED | 2110b293cdf0 253a69935dfd 30405ee73d13 334c101eb64f 45beac8d810b crates/eg-types/src/decision/guardrail.rs:254 src/server/handlers/decide/guardrail_tests.rs:139 src/server/handlers/decide/guardrail_tests.rs:161 src/server/handlers/decide/guardrail_tests.rs:78 src/server/persistence/guardrail_rule/tests.rs:46 |
| EG-DECISION-ENGINE-R127.2.1 A `GuardrailRule` can be published and read back per tenant Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**A `GuardrailRule` can be published and read back per tenant.** Adds the storage component kind and the publish/list path a `GuardrailRule` (`rule_id`, `applies_to_class`, `source_generation`) needs before any query can read a tenant's rule set, mirroring how Agent Library components are published today. Malformed rule attributes fail publish with the declared `MALFORMED_GUARDRAIL_RULE` code on `AgentComponent`; unrelated methods do not inherit that allowance. Adds no new served query. | A persistence test publishes a `GuardrailRule` and reads it back unchanged after a restart. | requirement | EG-DECISION-ENGINE | VERIFIED | 334c101eb64f 45beac8d810b eff92845d271 src/server/persistence/guardrail_rule/tests.rs:46 src/server/persistence/guardrail_rule/tests.rs:79 |
| EG-DECISION-ENGINE-R127.2.2 The guardrail-entailment query answers over the wire Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The guardrail-entailment query answers over the wire.** A new `Method` variant carries a task IRI; dispatch routes it to a handler that reads the tenant's published `GuardrailRule`s via `EG-DECISION-ENGINE-R127.2.1`'s storage path and calls `EG-DECISION-ENGINE-R127.1`'s `guardrail_entailment_query`. The typed read is `GuardrailEntailment`, binds the requested tenant to the verified caller before opening the rule snapshot, and returns the ontology digest, rule generations and entailment paths. It uses the existing `agent:assemble-read` authority and never changes the owning enforcement policy. Retired and withdrawn heads and other tenants are invisible. Generated bindings are owned by R127.2.3. Depends on `EG-DECISION-ENGINE-R127.1` and `EG-DECISION-ENGINE-R127.2.1`. | A fixture proves entailed rules for a subclassed task, no rule for an unrelated task, and stable premises after restart, driven directly against the dispatcher. | requirement | EG-DECISION-ENGINE | VERIFIED | e7580aeb141f crates/eg-types/src/decision/guardrail.rs:254 src/server/handlers/decide/guardrail_tests.rs:139 src/server/handlers/decide/guardrail_tests.rs:161 src/server/handlers/decide/guardrail_tests.rs:78 |
| EG-DECISION-ENGINE-R127.2.3 The guardrail-entailment query gets a generated client method Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The guardrail-entailment query gets a generated client method.** Once `EG-DECISION-ENGINE-R127.2.2` is wired, `gen_contract` is rerun to publish the method's request/response subschema and regenerate `crates/eg-capabilities/generated/method_catalog.rs` and the client bindings. Depends on `EG-DECISION-ENGINE-R127.2.2`. The native `cargo run -p eg-capabilities --features contract --bin gen_contract` command owns every generated artifact, including the Python request validator and typed result decoder. | The regenerated generated-client contract test exercises the method end to end. | requirement | EG-DECISION-ENGINE | VERIFIED | 2110b293cdf0 d13f43cd3e1f f5677b486e1f tests/test_guardrail_entailment_served.py:49 |
| EG-DECISION-ENGINE-R128 HarnessConfig decision answers how to configure an agent run Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**HarnessConfig decision answers how to configure an agent run.** One new `Decide` question kind, `harness_config`, returns the context policy, plan scaffold and action space for a model profile, a task class, a usable context budget and a request priority. It reuses the decision ladder and the `ToolSubset` selection. It is not a planner. Children `.1` through `.15` split it by producer, behaviour, wiring and proof. R128 is LANDED when all children are. | Test: A served test submits one `harness_config` question and asserts the committed record names all three parts with premises. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R128.1 The question kind exists in the enum Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The question kind exists in the enum.** `QuestionKind` at `crates/eg-types/src/decision/statistical.rs:57` must gain the variant `HarnessConfig`, serialised as `harness_config`, with a doc comment that cites R128 and states the question is evaluate-only. | Test: `crates/eg-types/src/decision/statistical.rs::question_kind_declared_tests::harness_config_kind_serialises_snake_case` | requirement | EG-DECISION-ENGINE | VERIFIED | c7da75413a3c crates/eg-types/src/decision/statistical.rs:369 src/server/handlers/decide/stat_tests/harness_config_tests.rs:57 src/server/handlers/decide/stat_tests/harness_config_tests.rs:98 |
| EG-DECISION-ENGINE-R128.2 The request carries typed params Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The request carries typed params.** A new module `crates/eg-types/src/decision/statistical/harness_config.rs` must define `HarnessConfigRequestBody` with `model_profile_ref` (iri), `task_class` (iri), `usable_context_budget_tokens` (int), `priority` and an optional `expected_trajectory_tokens` (int). Each param name must match a `DecideRequest.params` entry, as `tool_subset.rs:29` does. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::body_requires_every_input` | requirement | EG-DECISION-ENGINE | VERIFIED | 5b6086e4075d crates/eg-types/src/decision/statistical/harness_config.rs:407 crates/eg-types/src/decision/statistical/harness_config.rs:434 crates/eg-types/src/decision/statistical/harness_config.rs:453 |
| EG-DECISION-ENGINE-R128.3 The answer type states each part and its abstention Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The answer type states each part and its abstention.** `harness_config.rs` must define `HarnessConfigAnswer` with `context_policy` (`none`, `elide`, `elide_then_summarize`), `soft_threshold`, `hard_threshold` and `recent_window_fraction` (Q32 fractions), `plan_scaffold` (`on`, `off`), `action_space` (`tool_set`, `shell_only`) and `tool_subset`. Each part must be `Decided` or `Abstained { missing_fact, conservative_default }`. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::answer_round_trips_through_serde` | requirement | EG-DECISION-ENGINE | VERIFIED | a565bdb085f2 c0466b57ce04 crates/eg-types/src/decision/statistical/harness_config.rs:536 crates/eg-types/src/decision/statistical/harness_config.rs:566 crates/eg-types/src/decision/statistical/harness_config.rs:593 |
| EG-DECISION-ENGINE-R128.4 Named defaults hold the thresholds and are replaceable Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Named defaults hold the thresholds and are replaceable.** `harness_config.rs` must define `HarnessDefaults` with `soft_threshold` 0.6, `hard_threshold` 0.85 and `recent_window_fraction` 0.3. The handler must read a tenant policy override through `resolve_policy` before it uses a default. Each value used must appear as a premise. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::policy_override_replaces_default` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R128.5 Context policy follows budget pressure Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Context policy follows budget pressure.** A pure function `decide_context_policy` must compute pressure as `expected_trajectory_tokens` divided by `contextWindowTokens`. It must return `none` only when the profile window makes overflow impossible for the task class, otherwise `elide_then_summarize` with the `HarnessDefaults` thresholds. A missing window or trajectory estimate must abstain with default `elide_then_summarize`. | Test: `crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs::context_policy_none_only_when_overflow_impossible` | requirement | EG-DECISION-ENGINE | VERIFIED | 2e4e94789ddf crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:27 crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:50 crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:7 crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:78 crates/eg-types/src/decision/statistical/harness_config/context_policy/tests.rs:90 |
| EG-DECISION-ENGINE-R128.6 Plan scaffold follows stopping behaviour Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Plan scaffold follows stopping behaviour.** A pure function `decide_plan_scaffold` must return `on` for `stops_early` (premise: accuracy) and for `over_verifies` (premise: cost). It must return `off` only for `balanced` when the cited evaluation run records a no-gain plan-scaffold ablation. A missing fact must abstain with default `on`. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::plan_scaffold_rules` | requirement | EG-DECISION-ENGINE | VERIFIED | 4cd26ef35745 crates/eg-types/src/decision/statistical/harness_config.rs:302 crates/eg-types/src/decision/statistical/harness_config.rs:345 crates/eg-types/src/decision/statistical/harness_config.rs:374 |
| EG-DECISION-ENGINE-R128.7 Action space follows shell proficiency and task class Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Action space follows shell proficiency and task class.** A pure function `decide_action_space` must return `shell_only` only when `shellProficiency` is `high` and the task class is `shellCentric`. Otherwise it must return `tool_set`. A missing `shellProficiency` or `shellCentric` must abstain with default `tool_set`. | Test: `crates/eg-types/src/decision/statistical/harness_config.rs::tests::shell_only_needs_both_facts` | requirement | EG-DECISION-ENGINE | VERIFIED | a565bdb085f2 crates/eg-types/src/decision/statistical/harness_config.rs:639 |
| EG-DECISION-ENGINE-R128.8 The handler reads model and task facts Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The handler reads model and task facts.** A new handler `src/server/handlers/decide/stat_harness_config.rs` must read the model profile by `model_profile_ref` through `ctx.store` (`AgentLibraryStore`, the store `read_candidates` at `candidates.rs:415` uses). It must read `shellCentric` from the task class. An unknown profile reference must refuse with `StatisticalErrorCode::ParameterInvalid`. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::unknown_profile_is_refused` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R128.9 The action-space part reuses the tool-subset selection Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The action-space part reuses the tool-subset selection.** `stat_harness_config.rs` must call `tool_subset::smallest_covering_subset` (`tool_subset.rs:59`) for a `tool_set` result. It must pass the declared candidates and `usable_context_budget_tokens` as the budget. A `ToolSubsetRefusal` must become an abstention on `tool_subset`. A `shell_only` result must carry an empty subset. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::tool_set_reuses_covering_subset` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R128.10 The dispatch hook routes the new kind Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The dispatch hook routes the new kind.** `stat_decide.rs:134` must match `harness_config_outcome(request)` beside `tool_subset_outcome(request)` and seal the result through `seal` (`stat_decide.rs:372`). `Method::Decide` at `src/server/dispatch/router/decision_plane.rs:95` must need no new method variant. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::decide_routes_harness_config` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R128.11 Premises and why-not explain every part Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Premises and why-not explain every part.** The handler must emit one premise per rule input and per default used. It must emit one why-not entry for each rejected option of each part. A part answered by a conservative default must emit a `Claim`-class premise naming the missing fact. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::premises_and_why_not_cover_each_part` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R128.12 The outcome encodes decided and abstained parts Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The outcome encodes decided and abstained parts.** The handler must seal a `StatisticalOutcome::Advisory` (`outcome.rs:101`) with one `ScoredOption` per decided part, using the option id `<part>:<value>`. When every part abstains, it must seal `StatisticalOutcome::Abstained` (`outcome.rs:107`). The record must read `ResolutionKind::Statistical` or `Abstention` accordingly. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::all_parts_abstained_seals_abstention` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R128.13 The committed answer is accepted by the commit path Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The committed answer is accepted by the commit path.** `handle_decision_commit` must accept and re-derive a sealed `harness_config` record without a kind-specific branch. A test must commit the record and read it back with identical premises. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::harness_config_record_commits` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R128.13.1 Typed harness evaluation evidence is part of sealed statistical inputs Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed harness evaluation evidence is part of sealed statistical inputs.** An optional evidence object retains the resolved model-profile dependency, typed request body and complete HarnessConfigAnswer, including per-part abstentions. Absent evidence is omitted from serialization so legacy input and record digests remain unchanged. Commit replay rejects attached evidence even on supported question kinds. Evidence is data for future replay, not authority; the unsupported evaluator and advisory-commit refusals remain in force. | Run typed roundtrip, legacy serialization/digest compatibility and changed-evidence digest tests in the harness-config producer module. Also run `src/server/handlers/decide/stat_tests/harness_config_tests.rs::harness_config_replay_refuses_a_relabelled_generic_record` through native dispatch. It commits the valid route control, then refuses rehashed injected evidence and verifies no mutated record exists. Acceptance requires both test groups to pass on the exact source. No deployed execution is claimed. | requirement | EG-DECISION-ENGINE | VERIFIED | cfe7d38376a4 crates/eg-types/src/decision/statistical/harness_config.rs:682 crates/eg-types/src/decision/statistical/harness_config.rs:694 src/server/handlers/decide/stat_tests/harness_config_tests.rs:99 |
| EG-DECISION-ENGINE-R128.13.2 Re-derive and persist the complete HarnessConfig answer Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Re-derive and persist the complete HarnessConfig answer.** Preserve R128.13 beyond its evidence type. The shared evaluator must resolve each pinned premise and independently reproduce the complete answer before commit. Commit must reject forged answers, changed premises and unsupported evidence. Read back the stored record with identical premises. This child remains unimplemented; R128.13.1 does not satisfy it. | Planned native regression: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::harness_config_record_commits`, with changed-premise and forged-answer refusal cases. No execution result is claimed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R128.14 The generated contract and clients carry the kind Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The generated contract and clients carry the kind.** `gen_contract` must be rerun so `contract/schemas/method.request.json` and the `result.*.json` schemas list `harness_config` beside `tool_subset`. The Python DTO in `crates/eg-capabilities/src/contract/python/dto.rs` and the JS and Go codecs under `clients/` must regenerate. The `gen_contract --check` step at `.github/workflows/release.yml:210` must pass. | Test: `crates/eg-capabilities/tests/contract_generated.rs::question_kind_lists_harness_config` | requirement | EG-DECISION-ENGINE | VERIFIED | c7da75413a3c crates/eg-capabilities/tests/contract_generated.rs:44 |
| EG-DECISION-ENGINE-R128.15 End-to-end proof uses the served path Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**End-to-end proof uses the served path.** A served test must publish a model profile with measured facts, submit `Method::Decide` for `harness_config` over the wire, and assert the answer, premises and the unchanged tool-subset result. A second case must submit a profile without `shellProficiency` and assert the `tool_set` abstention. | Test: `tests/decide/test_harness_config_served.py::test_harness_config_end_to_end` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R129 Promoted rules cannot contradict a stored invariant (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Promoted rules cannot contradict a stored invariant (rollup).** The engine must check every rule promoted from repeated human overrides against stored invariants. Statistical consensus must never promote a rule that contradicts an invariant. | Test: `crates/eg-types/src/decision/guardrail.rs::tests::promotion_obeys_invariants` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R129.1 Locate and wire the attach point Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Locate and wire the attach point.** The implementer must find where a proposal from R034 becomes an active rule and record `file:line` in `plan.md`. | Test: `src/server/handlers/decide/stat_tests/rule_promotion_tests.rs::attach_point_is_reached` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R129.2 Typed `RulePromotionVerdict` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed `RulePromotionVerdict`.** Add `RulePromotionVerdict { Promotable, RejectedInvariant { invariant_iri } }` to `crates/eg-types/src/decision/guardrail.rs`. | Test: `crates/eg-types/src/decision/guardrail.rs::tests::verdict_serialises_snake_case` | requirement | EG-DECISION-ENGINE | VERIFIED | dcd3f241e93c crates/eg-types/src/decision/guardrail.rs:215 crates/eg-types/src/decision/guardrail.rs:239 |
| EG-DECISION-ENGINE-R129.3 Pure invariant check Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Pure invariant check.** Add `check_rule_against_invariants(rule, invariants)` to `guardrail.rs`. It must name the first contradicted invariant IRI. | Test: `crates/eg-types/src/decision/guardrail.rs::tests::first_contradicted_invariant_is_named` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R129.4 Consensus gives no override Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Consensus gives no override.** The check must run before any confidence threshold. A rule with full human agreement that contradicts an invariant must still be rejected. | Test: `crates/eg-types/src/decision/guardrail.rs::tests::full_consensus_does_not_override` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R129.5 Wire the check into promotion Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wire the check into promotion.** The promotion path must call `check_rule_against_invariants` and persist a `RejectedInvariant` record for audit. It must not activate the rule. | Test: `src/server/handlers/decide/stat_tests/rule_promotion_tests.rs::rejected_rule_is_audited_not_active` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R129.6 End-to-end proof over the wire Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**End-to-end proof over the wire.** A served test must submit five overrides of a rule that violates a stored invariant and assert rejection. A compatible rule must promote. | Test: `tests/decide/test_rule_promotion_served.py::test_invariant_blocks_promotion` | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R130 Calibrated candidate ranking with item-level tie-break (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Calibrated candidate ranking with item-level tie-break (rollup).** The engine ranks candidates by a calibrated relevance score. Candidates that share one code receive an item-level tie-break score instead of one shared score. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R130.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `RankedCandidate{id, calibrated_score, code, tie_break_score, evidence_class}` and `TieBreakPolicy` in `crates/eg-epistemic/src/ranking.rs`. Closed values of `TieBreakPolicy` are `ItemScore` and `StableId`. Proving test: `crates/eg-epistemic/src/ranking.rs::tests::ranked_candidate_round_trips`. | A serde round trip keeps every field and rejects an unknown policy value. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R130.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Extend `rank` so the calibrated score orders candidates before sequence likelihood. Candidates with equal codes must be ordered by `tie_break_score`. Each rule is a named replaceable default: `calibrated_first` and `item_level_tie_break`. Proving test: `crates/eg-epistemic/src/ranking.rs::tests::equal_codes_order_by_item_score`. | Three candidates with one code and distinct item scores return in item-score order; the same input gives byte-identical output twice. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R130.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The behavior attaches at `crates/eg-epistemic/src/ranking.rs:116` (`rank`). Today only the re-export at `crates/eg-epistemic/src/lib.rs:97` and unit tests reference it. This row creates the call site in the statistical `Decide` path (`crates/eg-compute/src/assemble/conclude.rs`). Proving test: `tests/decide/test_ranked_decide_served.py::test_decide_orders_by_calibrated_score`. | The served `Decide` answer lists options in calibrated order, and a search shows one production caller of `rank`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R130.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** When a candidate lacks a calibrated score, the engine must abstain for that option with reason `uncalibrated_candidate`. It must not substitute a likelihood. Proving test: `crates/eg-epistemic/src/ranking.rs::tests::uncalibrated_candidate_abstains`. | A candidate without a calibration receipt yields a typed abstention, and the ranked list omits it. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R130.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each ranked option must carry `calibrated_score`, `tie_break_applied` and `tie_break_policy` as decision premises in the decision record. The record must state the weakest evidence class of the premises. Proving test: `crates/eg-compute/src/assemble/tests/ranking_premises.rs::premises_name_tie_break`. | The decision record for a tied pair contains `tie_break_applied=true` and the policy name. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R130.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method with a ranking question. The test `tests/decide/test_ranked_decide_served.py::test_tied_codes_resolve_by_item_score` submits tied candidates. It passes through the wired `rank` call and observes the item-score order and the premises in the returned record. | The served answer orders tied candidates by item score and exposes the premises. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R131 Limit guard pipeline refuses an order with a typed reason (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Limit guard pipeline refuses an order with a typed reason (rollup).** The engine checks every proposed action against configured limits first. A breach refuses with a typed reason and records an observation linked to the affected signal. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R131.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `LimitRule{id, metric, bound, scope}` and `LimitBreach{rule_id, observed, bound, signal_iri}` in `crates/eg-types/src/decision/limit_guard.rs`. Closed `metric` values are `position_size`, `drawdown` and `sector_concentration`. Proving test: `crates/eg-types/src/decision/limit_guard.rs::tests::limit_types_round_trip`. | A serde round trip keeps every field and rejects an unknown metric. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R131.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `check_limits(action, rules)` returning every breach in rule order. Each metric check is a named replaceable default, and a request may only tighten a bound. Proving test: `crates/eg-types/src/decision/limit_guard.rs::tests::check_returns_all_breaches`. | An action that breaches two limits returns two breaches; a loosening request bound is ignored. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R131.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The check attaches at `crates/eg-types/src/decision/guardrail.rs:201` (`guardrail_entailment_query`), which already reads the stored rule set. A second call site is created in the `Decide` chokepoint `crates/eg-compute/src/assemble/conclude.rs`, before an option becomes `Advisory`. Proving test: `tests/decide/test_limit_guard_served.py::test_breach_refuses`. | A breaching option never reaches an advisory answer in the served response. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R131.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A breach must return `ResolutionKind::Abstention` with reason `limit_breach` naming the rule id. The engine must not perform the action. Proving test: `crates/eg-compute/src/assemble/tests/limit_refusal.rs::breach_abstains_with_rule_id`. | The abstention names the first breached rule and carries no executable option. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R131.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must store each breach as an observation node. An edge links it to the affected signal. The observation carries `rule_id`, `observed` and `bound`. Proving test: `crates/eg-compute/src/assemble/tests/limit_refusal.rs::breach_observation_links_signal`. | A graph query from the signal returns the breach observation with its three fields. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R131.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method. The test `tests/decide/test_limit_guard_served.py::test_oversize_order_refused_and_recorded` submits an oversize order. It passes through the wired check and observes the typed refusal and the stored observation node. | The served answer refuses with `limit_breach` and the observation exists. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R132 Retrieved entries carry a trust tier and a poisoned-entry check gates premises (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Retrieved entries carry a trust tier and a poisoned-entry check gates premises (rollup).** A retrieved memory or knowledge entry carries provenance and a trust tier. A lower-tier entry must not override a higher-tier fact. A poisoned-entry check must pass before the engine uses an entry as a premise. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R132.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `TrustTier` (closed values `verified`, `attested`, `unverified`) and `EntryTrust{tier, source_digest, observed_at}` in new `crates/eg-types/src/decision/entry_trust.rs`. `PremiseClass` at `crates/eg-types/src/decision/record/premise.rs:17` grades premise strength, not retrieved-entry origin. `Provenance` at `crates/eg-modality/src/provenance.rs:22` holds a confidence only. Proving test: `crates/eg-types/src/decision/entry_trust.rs::tests::entry_trust_round_trips`. | A serde round trip keeps every field and rejects an unknown tier. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R132.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `admit_entries(entries, policy)` in `entry_trust.rs`. An entry of a lower tier must not replace a higher-tier entry on the same subject and fact key. Each rule is a named replaceable default: `tier_order` and `poison_check`. `poison_check` refuses an entry whose source digest is absent from the source record. It also refuses an unverified entry that contradicts a verified fact. The monotone rule at `crates/eg-types/src/decision/ingestion_ladder.rs:46` (`resolve_rung`) is the pattern to reuse. Proving test: `crates/eg-types/src/decision/entry_trust.rs::tests::lower_tier_never_overrides_higher`. | A verified fact survives an unverified contradiction. An entry with an unknown source digest is refused. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R132.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** `admit_entries` attaches in `crates/eg-compute/src/assemble/conclude.rs:180`, where premises are built from the required capabilities, before any retrieved entry becomes a premise. The caller is `decide_one` at `conclude.rs:93`, reached from `conclude.rs:87` and `template.rs:74`, and served by `handle_decide` at `src/server/handlers/decide/stat_decide.rs:48`. No production caller of `resolve_rung` exists today. The trust check creates the call site at `conclude.rs:180`. Proving test: `crates/eg-compute/src/assemble/tests/entry_trust_wiring.rs::admit_runs_before_premises`. | The served `Decide` path calls `admit_entries` once per decision. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R132.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A refused entry must not become a premise. When a required premise has only refused entries, the engine must abstain with `AbstainReason::PoisonedEntry` naming the entry id and the failed check. `AbstainReason` is exported from `crates/eg-types/src/decision/record/outcome.rs`. Proving test: `crates/eg-compute/src/assemble/tests/entry_trust_refusal.rs::poisoned_only_premise_abstains`. | The abstention names the entry id and carries no executable option. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R132.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** `PremiseRef` at `crates/eg-types/src/decision/record/premise.rs:89` gains an optional `trust_tier`. The engine must record each refused or overridden entry in the decision record with its tier and check name. Replay must reproduce the same record. Proving test: `crates/eg-compute/src/assemble/tests/entry_trust_refusal.rs::refused_entries_are_recorded`. | The record lists every refused entry with tier and check name. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R132.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method. The test submits a decision whose candidate set holds a verified fact and an unverified contradicting entry. It passes through the wired check at `conclude.rs:180` and observes that the verified fact is the premise and the unverified entry is recorded as refused. Proving test: `tests/decide/test_entry_trust_served.py::test_unverified_entry_cannot_override_verified`. | The served answer uses the verified fact and lists the refused entry. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R133 The engine stores each agent run as a trace fact and decides its runtime quotas (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The engine stores each agent run as a trace fact and decides its runtime quotas (rollup).** The engine stores an execution trace for each agent run as a typed fact. The engine decides the wall time, memory, process count and grace period of a run and hands them to the harness. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R133.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `RunTraceRecord{run_id, task_signature, steps, outcome, started_at}` and `RuntimeQuota{wall_time_ms, memory_bytes, process_count, grace_ms}` in new `crates/eg-types/src/decision/run_governance.rs`. Add `QuestionKind::RuntimeQuota` at `crates/eg-types/src/decision/statistical.rs:58`. Proving test: `crates/eg-types/src/decision/run_governance.rs::tests::quota_round_trips`. | A serde round trip keeps every field and rejects an unknown field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R133.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add the pure function `decide_runtime_quota(task_class, policy, request)` in `run_governance.rs`. For each field resolve an effective default D and hard tenant ceiling C with D <= C. Named replaceable `QuotaDefaults` are `wall_time_ms` 600000, `memory_bytes` 2147483648, `process_count` 32 and `grace_ms` 10000. First refuse any requested R > C; otherwise use min(D, R), or D when omitted. Increases above D through C are ignored and reductions below D tighten the quota. Proving test: `crates/eg-types/src/decision/run_governance.rs::tests::request_only_tightens_quota`. | For D=10 and C=20, omission returns 10, R=5 returns 5, R=15 and R=20 return 10, and R=21 refuses before clamping. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R133.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; a new `runtime_quota_outcome` is matched beside it. The caller is `Method::Decide` through `handle_decide` at `stat_decide.rs:48`. `Decide` remains read-only. A separate served `CommitWorkItemResult` reuses `lower_terminal_outcome_extensions` in `src/server/mutation_batch/terminal_outcome.rs:22` and `apply_commit_work_item_result_row` in `src/redb_store/work_item/commit.rs:211`; trace receipts and their produced link may materialize only after the successful fenced terminal CAS in the same transaction. `RunTraceRecord` adaptation and produced-link materialization are new work; `outcome_bundle.rs:56` is a participant-domain constant, not a write call. Proving test: `src/server/handlers/decide/stat_tests/runtime_quota_tests.rs::decide_routes_runtime_quota`. | The served `Decide` answer for `RuntimeQuota` returns the four values. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R133.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A quota request above any hard tenant ceiling must refuse with `StatisticalErrorCode::ParameterInvalid` before clamping or missing-task fallback. A missing task class must abstain with the effective defaults D (resolved under C) and a `Claim`-class premise naming the missing fact. Proving test: `src/server/handlers/decide/stat_tests/runtime_quota_tests.rs::missing_task_class_abstains_to_default`. | The abstention carries effective defaults and names the missing task class; an above-ceiling request still refuses when the task class is missing. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R133.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The terminal commit must adapt `RunTraceRecord` into a `RunTrace` receipt and materialize its execution-unit `produced` link after the fenced terminal CAS in `src/redb_store/work_item/commit.rs:343`. Reuse the pure node/edge descriptors from `project` at `crates/eg-durable/src/project.rs:68`; adaptation and link materialization are new, and `project` performs no writes. Each decided quota value must appear as a premise, and each default used must be named. Proving test: `src/redb_store/work_item/commit.rs::tests::run_trace_is_linked_to_unit`. | After a successful terminal commit, a graph query from the execution unit returns the trace node; a fenced refusal, no-op or retry scheduling creates no trace or link. The decision record lists each default used. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R133.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The test `tests/decide/test_runtime_quota_served.py::test_quota_and_trace_end_to_end` first queries quotas through served `Decide` with a `RuntimeQuota` question, then commits the run summary through served `CommitWorkItemResult` with the terminal outcome extension. It inspects quota premises and queries the persisted execution-unit-to-trace link after the fenced terminal commit. Proving test: `tests/decide/test_runtime_quota_served.py::test_quota_and_trace_end_to_end`. | Decide returns tightened quotas without a trace write; the subsequent successful CommitWorkItemResult stores the trace and produced link, while an invalid fence stores neither. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134 The engine selects tools, decomposes tasks and plans over the skill library (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The engine selects tools, decomposes tasks and plans over the skill library (rollup).** The engine chooses the tools for a run by relevance search over the fleet catalog. It decomposes a task into independent subtasks, routes each to a specialist and picks the aggregation operator. It plans over the skill library from skill metadata only. Children `.1` to `.8` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `Subtask{id, text, independent, depends_on}`, `AggregationOp` (closed values `concat`, `majority_vote`, `reduce`, `first_valid`), `SkillStep{subtask_id, skill_id, depends_on}` and `TaskPlan` in new `crates/eg-types/src/decision/task_plan.rs`. Add `QuestionKind::ToolRelevance` and `QuestionKind::TaskPlan` at `crates/eg-types/src/decision/statistical.rs:58`. Proving test: `crates/eg-types/src/decision/task_plan.rs::tests::task_plan_round_trips`. | A serde round trip keeps every field and rejects an unknown aggregation value. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `rank_tools_by_relevance(query, catalog, required_capabilities, context_budget_tokens, policy)` in `task_plan.rs`. First filter by `relevance_floor`, rank descending by relevance with tool-id ties, and retain `top_k` candidates. Then pass those candidates and the explicit required capabilities and token budget to the existing R045 `smallest_covering_subset` at `crates/eg-types/src/decision/statistical/tool_subset.rs:59`. Its selection remains greedy uncovered-capability gain per token, then lower token cost and tool id; relevance is a prefilter, not the subset objective. Preserve its coverage/budget refusals after filtering. The defaults are `top_k` 12 and `relevance_floor` 0.2. The existing code to move is `agent_utilities/capabilities/fleet_tool_search.py:54`. Proving test: `crates/eg-types/src/decision/task_plan.rs::tests::relevant_tools_fit_budget`. | Assert floor/top-k filtering first, then the exact R045 coverage-per-token selection and deterministic cost/id ties within the budget. Include a lower-relevance retained tool that wins on coverage per token and a filtered catalog that cannot cover required capabilities; do not assert relevance optimality. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.3 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `decompose_task(task, facts, policy)` in `task_plan.rs`. It returns subtasks, routes each to a specialist, sets `independent` per subtask and chooses an `AggregationOp`. `TopologyRequirements.subtasks` at `topology.rs:110` receives the independent count. Each rule is a named replaceable default: `independence_test` and `default_aggregation`. The existing code to move is `agent_utilities/graph/planning/__init__.py:165`. Proving test: `crates/eg-types/src/decision/task_plan.rs::tests::independent_subtasks_set_flag_and_operator`. | Two independent subtasks yield `independent=true` for both and a `majority_vote` or `concat` operator. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.4 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `plan_over_skills(query, skill_index, policy)` in `task_plan.rs`. It decomposes the query into atomic subtasks. It retrieves one skill per subtask from skill metadata only. It merges or splits subtasks when the retrieved skills show a different granularity. It orders steps by `depends_on`. The existing code to move is `agent_utilities/decide/consumers/task_planner.py:211`. Proving test: `crates/eg-types/src/decision/task_plan.rs::tests::plan_respects_dependencies`. | Every step appears after the steps it depends on, and each step names one skill. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.5 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The decisions attach in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; `tool_relevance_outcome` and `task_plan_outcome` are matched beside it. The topology question is already posed at `crates/eg-compute/src/assemble/topology.rs:54` (`pose`), called from `conclude.rs:99`. The skill index is read through `AgentLibraryStore` at `src/server/handlers/decide/candidates.rs:415`. The match arms create the call site. Proving test: `src/server/handlers/decide/stat_tests/task_plan_tests.rs::decide_routes_task_plan`. | The served `Decide` answer for each new kind returns a typed plan or tool list. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.6 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A subtask with no skill above `relevance_floor` must abstain with `no_skill_for_subtask` naming the subtask id. A dependency cycle must refuse with `plan_cycle`. An empty catalog must abstain with `empty_catalog`. Proving test: `src/server/handlers/decide/stat_tests/task_plan_tests.rs::uncovered_subtask_abstains`. | The abstention names the first uncovered subtask and carries no plan. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.7 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit one premise per subtask holding the chosen skill, its relevance score and the independence flag. It must emit the aggregation operator and the default used as premises. The record must state the weakest evidence class. Proving test: `src/server/handlers/decide/stat_tests/task_plan_tests.rs::premises_name_skill_and_flag`. | The decision record lists skill, score and flag for every subtask. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.8 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method with a `TaskPlan` question. The test `tests/decide/test_task_plan_served.py::test_plan_end_to_end` publishes a skill index and submits a query. It passes through the wired dispatch and observes the ordered steps, the flags and the aggregation operator. Proving test: `tests/decide/test_task_plan_served.py::test_plan_end_to_end`. | The served answer returns dependency-ordered skill steps with premises. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135 A successful run compiles into a stored program keyed by task signature (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**A successful run compiles into a stored program keyed by task signature (rollup).** The engine compiles a successful run into a stored state-machine program keyed by task signature. Literals become parameters, and a program holds at most 40 steps. The engine returns a program by task signature. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `CompiledProgram{task_signature, steps, parameters, source_run_id}`, `ProgramStep{state, action, next}` and `MAX_PROGRAM_STEPS` (40) in new `crates/eg-types/src/decision/program_store.rs`. Add `QuestionKind::ProgramLookup` at `crates/eg-types/src/decision/statistical.rs:58`. Proving test: `crates/eg-types/src/decision/program_store.rs::tests::program_round_trips`. | A serde round trip keeps every field and rejects a program with more than 40 steps. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `compile_program(trace, policy)` in `program_store.rs`. It replaces each literal in the trace with a named parameter and keeps the step order. The named replaceable defaults are `max_steps` 40 and `literal_to_parameter`. `lookup_program(store, task_signature)` returns the stored program or none. The existing code to move is `agent_utilities/observability/replay_engine.py:48`. Proving test: `crates/eg-types/src/decision/program_store.rs::tests::literals_become_parameters`. | Two traces that differ only in literals compile to one program with parameters. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The lookup attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `program_lookup_outcome` is matched beside `tool_subset_outcome`. Programs are stored through `AgentLibraryStore`, the store `read_candidates` uses at `src/server/handlers/decide/candidates.rs:415`. The commit path is `handle_decision_commit`. The match arm and the store write create the call site. Proving test: `src/server/handlers/decide/stat_tests/program_store_tests.rs::decide_routes_program_lookup`. | The served `Decide` answer for `ProgramLookup` returns the stored program. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A run that did not succeed must refuse with `run_not_successful`. A trace that compiles to more than 40 steps must refuse with `program_too_long`. A lookup with no stored program must abstain with `no_program`. Proving test: `src/server/handlers/decide/stat_tests/program_store_tests.rs::overlong_trace_is_refused`. | The refusal names the reason and the step count, and nothing is stored. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit premises for the task signature, the step count, the parameter count and the source run id. A stored program must link to its source `RunTrace` node from `EG-DECISION-ENGINE-R133`. Proving test: `src/server/handlers/decide/stat_tests/program_store_tests.rs::program_links_source_trace`. | A graph query from the program returns its source trace node. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method with a `ProgramLookup` question. The test `tests/decide/test_program_store_served.py::test_compile_then_lookup` commits a successful trace, then looks up its signature. It passes through the wired dispatch and observes the stored program with parameters. Proving test: `tests/decide/test_program_store_served.py::test_compile_then_lookup`. | The second call returns the program committed by the first. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136 The engine gives the round verdict and allocates models per evolution stage (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The engine gives the round verdict and allocates models per evolution stage (rollup).** The engine compares the next round's task outcomes with the declared prediction and returns a verdict. The engine allocates a model to each evolution stage under a run budget and hands the harness the allocation and the limit. Children `.1` to `.7` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `PredictionDeclaration{round, fixes, regressions}`, `RoundVerdict` (closed values `verified`, `falsified`, `unverified`) and `EvolutionDefaults{rounds, flip_fraction}` in new `crates/eg-types/src/decision/evolution_round.rs`. Add `StageAllocation{stage, model_ref, impact}` and `RunBudget{max_cost, max_stronger_stages}`. Add `QuestionKind::RoundVerdict` and `QuestionKind::StageAllocation` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/evolution_round.rs::tests::round_types_round_trip`. | A serde round trip keeps every field and rejects an unknown verdict. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `decide_round_verdict(prediction, outcomes, defaults)` in `evolution_round.rs`. Evaluate declared-direction and opposite-direction fractions separately against `flip_fraction`. Return `verified` only when the declared-direction threshold alone is met; return `falsified` only when the opposite-direction threshold alone is met. If both thresholds or neither threshold is met, return `unverified`. The defaults are `rounds` 1 and `flip_fraction` 0.5. Proving test: `crates/eg-types/src/decision/evolution_round.rs::tests::verdict_follows_flip_fraction`. | At flip_fraction=0.5, six of ten flipping as declared and four opposite yields `verified`; four as declared and six opposite yields `falsified`; five each yields `unverified`. Neither threshold met also yields `unverified`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.3 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `allocate_stage_models(stages, models, budget)` in `evolution_round.rs`. It gives a stronger model only to the highest-impact stages while the cost stays within `max_cost`. Every other stage gets the cheapest adequate model. The named replaceable default is `impact_first`. The existing code to move is `agent_utilities/decide/consumers/routing.py:58`. Proving test: `crates/eg-types/src/decision/evolution_round.rs::tests::stronger_models_go_to_high_impact_stages`. | With a budget for one stronger stage, only the top-impact stage gets the stronger model. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.4 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Both decisions attach in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; `round_verdict_outcome` and `stage_allocation_outcome` are matched beside it. The caller is `Method::Decide` through `handle_decide` at `stat_decide.rs:48`. Model facts come from the model profile read at `candidates.rs:415`. The match arms create the call site. Proving test: `src/server/handlers/decide/stat_tests/evolution_round_tests.rs::decide_routes_round_kinds`. | The served `Decide` answer for each kind returns a typed verdict or allocation. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.5 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A prediction with no declared tasks must abstain with `no_prediction`. A budget below the cheapest allocation must refuse with `budget_below_minimum` naming the shortfall. A missing impact estimate must abstain to the cheapest adequate model. Proving test: `src/server/handlers/decide/stat_tests/evolution_round_tests.rs::empty_prediction_abstains`. | The abstention names the missing input and carries no verdict. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.6 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit premises for the flip fraction used, the counts of tasks that flipped each way and the verdict. For an allocation it must emit the budget, the cost and each stage's impact. Defaults used must be named. Proving test: `src/server/handlers/decide/stat_tests/evolution_round_tests.rs::premises_name_counts_and_budget`. | The decision record lists the counts, the budget and each default used. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.7 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method with a `RoundVerdict` question, then a `StageAllocation` question. The test `tests/decide/test_evolution_round_served.py::test_verdict_and_allocation` submits a prediction with outcomes and a stage list. It passes through the wired dispatch and observes the verdict and the allocation within the budget. Proving test: `tests/decide/test_evolution_round_served.py::test_verdict_and_allocation`. | The served answers return the verdict and an allocation within the limit. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137 The engine decides the context budget and the limits of recursive parallel work (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The engine decides the context budget and the limits of recursive parallel work (rollup).** The engine decides the context policy, the window budget and the over-window margin. It decomposes an over-window prompt recursively under a depth and cost budget. It fixes the depth, item, cost and model-call limits of parallel-map work. Children `.1` to `.6` retain those obligations. Children `.7` to `.12` add certified multi-resolution context-package selection under window, reserved output, caller, monetary and latency budgets. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `ParallelMapLimits{max_depth, max_items, max_cost, max_model_calls}`, `WindowBudget{window_tokens, over_window_fraction}` and `OverWindowPlan{exceeds, chunks, depth}` in new `crates/eg-types/src/decision/context_budget.rs`. Add `QuestionKind::ContextBudget` at `statistical.rs:58`. `ContextPolicy` at `crates/eg-types/src/decision/statistical/harness_config.rs:81` is reused. Proving test: `crates/eg-types/src/decision/context_budget.rs::tests::context_budget_round_trips`. | A serde round trip keeps every field and rejects an unknown field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `decide_over_window(prompt_tokens, budget, limits)` in `context_budget.rs`. The prompt exceeds the window when `prompt_tokens` passes `over_window_fraction` of `window_tokens`. The plan then splits the prompt into chunks, depth by depth, until each chunk fits or `max_depth` or `max_cost` is reached. The named replaceable defaults are `over_window_fraction` 0.8, `max_items` 1000, `max_depth` 3 and `max_model_calls` 1000. The existing code to move is `agent_utilities/rlm/config.py:60` and `agent_utilities/knowledge_graph/retrieval/context_knapsack.py:422`. Proving test: `crates/eg-types/src/decision/context_budget.rs::tests::over_window_prompt_is_split_within_limits`. | A prompt at 0.9 of the window yields a plan whose chunks each fit and whose depth stays within the limit. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; `context_budget_outcome` is matched beside it. The context policy comes from the `harness_config` decision of `EG-DECISION-ENGINE-R128.5`. The window comes from the model profile read at `candidates.rs:415`. The match arm creates the call site. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::decide_routes_context_budget`. | The served `Decide` answer for `ContextBudget` returns the policy, the budget and the plan. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A prompt that cannot fit within `max_depth` and `max_cost` must refuse with `budget_exhausted` naming the limit reached. A work list above `max_items` must refuse with `too_many_items`. A missing window size must abstain with the policy default. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::too_many_items_is_refused`. | The refusal names the limit and the observed count, and carries no plan. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit premises for the window, the prompt size, the fraction used and each limit applied. Each default used must be named. The record must state the weakest evidence class. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::premises_name_window_and_limits`. | The decision record lists the window, the fraction and every default used. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method with a `ContextBudget` question. The test `tests/decide/test_context_budget_served.py::test_over_window_plan_end_to_end` publishes a model profile and submits an over-window prompt size. It passes through the wired dispatch and observes the plan and the limits handed to the harness. Proving test: `tests/decide/test_context_budget_served.py::test_over_window_plan_end_to_end`. | The served answer returns a chunk plan within the limits. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.7 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Extend the planned `crates/eg-types/src/decision/context_budget.rs` with typed package records. `ContextPackageCandidate` carries a stable candidate id, evidence-unit/resolution group, resolution, source id and cited range. It also carries source revision/content digest, tokenizer identity/version, exact measured token weight, value and measurement provenance. `ContextPackageBudget` carries window tokens, reserved output tokens and an optional caller token ceiling. It carries monetary ceiling, per-input-token price, latency ceiling and token throughput with units and known/unknown facts. `ContextPackageSelection` carries chosen candidate ids, effective capacity, token/cost/latency totals, objective, input/model/certificate digests and verified status. The request includes the marginal value floor and deterministic solver budget. These are planned records, not existing wire fields. Proving test: `crates/eg-types/src/decision/context_budget.rs::tests::package_records_round_trip`. | Round trips preserve every constraint, source/range/revision and measurement identity. Validation rejects duplicate candidate ids, inconsistent resolution groups and malformed ranges. Negative/nonfinite measurements and arithmetic overflow refuse before solving. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.8 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Lower package candidates to the existing bounded 0-1 solver model under R014. Select at most one resolution per evidence unit. Limit total exact token weight to `max(0, min(window - reserved_output, caller_ceiling, floor(money / price), floor(latency * throughput)))`. Include each optional ceiling only when supplied and its required facts are known. Use checked, unit-normalized arithmetic and round capacity downward to whole tokens without exceeding any ceiling. A known zero price makes monetary capacity unbounded. Known zero throughput makes latency capacity zero. Missing rates for active ceilings remain unknown under R018. Preserve the source objective: maximize summed net value `round_ties_even((value - floor_per_token * weight) * 1_000_000)`, then minimize total tokens. Record scale/rounding and stable candidate order. Reuse `crates/eg-compute/src/solve/model/` constraint primitives and `solve::solve`; add no selector authority. Proving test: `crates/eg-compute/src/solve/tests/context_package.rs::matches_tiny_multiresolution_oracle` (planned). | Exhaustive tiny models match the optimum and fewer-token tie-break. Independent window, output reservation, caller, money and latency cases each become the tightest bound; fractional and zero-capacity boundaries never overrun. Changing candidate order must not change objective or totals; remaining ties use the recorded stable order. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.9 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend the planned `ContextBudget` arm beside `tool_subset_outcome` in `src/server/handlers/decide/stat_decide.rs:134` to accept package records. Lower and solve them through the existing EG solver. Independently verify the certificate before sealing the served `Decide` result. Reuse R004/R049 through `crates/eg-compute/src/solve/search/mod.rs:29` and `crates/eg-compute/src/solve/verify/mod.rs:23`. Preserve existing tenant, policy, candidate visibility and record-sealing checks. The current dispatch lacks this arm. A generic `Solve` response is not the completed `ContextBudget` contract. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::decide_routes_package_selection` (planned). | An authenticated served `Decide` request reaches package lowering, solver, independent verifier and sealed typed answer. The test rejects an unwired helper or local selection that replaces any step. Package selection, whole-prompt fit and R137.1–.6 recursive decomposition remain distinct operations. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.10 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The planned package handler in `src/server/handlers/decide/stat_decide.rs` returns typed outcomes naming the candidate, fact or bound. Outcomes include `invalid_measurement`, `missing_required_fact`, `no_admissible_package`, `stale_source`, `work_budget_exhausted` and `certificate_unacceptable`. They carry no certified package. Missing tokenizer/mandatory window, missing rates for active ceilings and unknown objective facts cannot become zero or estimates (R018). An empty selection abstains. Exhausted deterministic search preserves R011 unresolved/gap evidence. Only an independently verified optimal result with zero gap satisfies this package's certified optimum acceptance. A greedy fallback or feasible incumbent alone cannot qualify as certified. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::package_refusals_are_typed` (planned). | Negative cases cover invalid/missing measurements, no fitting nonempty package, empty/zero-capacity results and stale revisions. Work exhaustion tests cover no incumbent and unacceptable gaps. Certificate tests corrupt the proof, digests and selection bindings. No refusal silently relaxes a ceiling or returns a certified selection. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.11 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Extend the planned `context_budget.rs` package result and the `stat_decide.rs` sealed record. Bind the complete candidate universe, including unchosen resolutions, with source/range/revision and content digests. Bind tokenizer measurements/provenance, full original budget, derived capacity and objective/rounding policy. Bind solver configuration/version, model digest and independently checked certificate digest/status. Recompute chosen token, monetary and latency totals from those inputs. Totals unavailable because an unused rate is unknown stay explicitly unknown. The consumer contract is AU-CONTEXT-R004: apply the exact chosen ids/resolutions without reranking or substituting content, and retain citations. A changed source or budget requires a fresh decision. Proving test: `src/server/handlers/decide/stat_tests/context_budget_tests.rs::package_evidence_binds_inputs` (planned). | Changes to unchosen candidates, token weights, tokenizer, cited ranges or revisions invalidate reuse. So do changes to active rates, output reservation, ceilings or objective. Independent recomputation checks selection, totals and certificate against the bound model. The record states the weakest evidence class and all defaults used. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.12 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Add `tests/decide/test_context_package_served.py::test_certified_package_end_to_end`. Enter the real served `Decide` method with a `ContextBudget` package request. Observe the typed, verified selection through the R137.9 dispatch. Cross-repository acceptance depends on AU-CONTEXT-R004's served context-compile consumer applying that result unchanged. Source/range/revision citations must survive. Link its public receipt; the consumer implementation belongs to its owner. A tiny multi-resolution exhaustive oracle proves optimality and fewer-token ties. Isolate each capacity and refusal from R137.8/R137.10. Proving test: `tests/decide/test_context_package_served.py::test_certified_package_end_to_end` (planned). | The EG served receipt records source SHA, features/configuration, exact command, input/model/certificate digests and results. The linked AU receipt records its SHA, served caller and applied package/citations. Cover reserved output, monetary/latency ceilings, caller/window limits, fractional rounding, zero capacity, unknown rates, stale sources and rejected certificates. Unit-only solves, mock transports, greedy fits, planned test names and documentation commits do not establish this proof. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R138 The engine holds red-team records and returns a verdict for each probe (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**The engine holds red-team records and returns a verdict for each probe (rollup).** The engine holds the red-team attack, transform and scorer records. It selects scorers for each probe and returns the verdict. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R138.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `RedTeamAttack{id, category, goal}`, `RedTeamTransform{id, kind}`, `RedTeamScorer{id, category, threshold}` and `ProbeVerdict` (closed values `resisted`, `compromised`, `inconclusive`) in new `crates/eg-types/src/decision/red_team.rs`. Add `QuestionKind::ProbeVerdict` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/red_team.rs::tests::red_team_records_round_trip`. | A serde round trip keeps every field and rejects an unknown verdict. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R138.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `select_scorers(attack, scorers, policy)` and `decide_probe_verdict(results, policy)` in `red_team.rs`. A scorer is selected when its category matches the attack category. The verdict is `compromised` when any selected scorer passes its threshold, `resisted` when all fail it, otherwise `inconclusive`. The named replaceable defaults are `category_match` and `any_scorer_compromises`. The existing code to move is `agent_utilities/harness/reliability_scorers.py:1`. Proving test: `crates/eg-types/src/decision/red_team.rs::tests::one_passing_scorer_compromises`. | One passing scorer among three yields `compromised`; three failing scorers yield `resisted`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R138.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:134`, where `tool_subset_outcome` is matched; `probe_verdict_outcome` is matched beside it. The records are stored and read through `AgentLibraryStore`, the store `read_candidates` uses at `src/server/handlers/decide/candidates.rs:415`. The match arm and the record store create the call site. Proving test: `src/server/handlers/decide/stat_tests/red_team_tests.rs::decide_routes_probe_verdict`. | The served `Decide` answer for `ProbeVerdict` returns the selected scorers and the verdict. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R138.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A probe whose attack category has no scorer must abstain with `no_scorer_for_category` naming the category. A scorer result with a missing score must count as `inconclusive`, not as `resisted`. Proving test: `src/server/handlers/decide/stat_tests/red_team_tests.rs::missing_scorer_abstains`. | The abstention names the category and carries no verdict. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R138.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit one premise per selected scorer holding its score and threshold. It must emit the attack and transform ids. The record must state the weakest evidence class. Proving test: `src/server/handlers/decide/stat_tests/red_team_tests.rs::premises_name_scorers_and_scores`. | The decision record lists each scorer with score and threshold. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R138.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method with a `ProbeVerdict` question. The test `tests/decide/test_red_team_served.py::test_probe_verdict_end_to_end` publishes attack, transform and scorer records and submits probe results. It passes through the wired dispatch and observes the selected scorers and the verdict. Proving test: `tests/decide/test_red_team_served.py::test_probe_verdict_end_to_end`. | The served answer returns the verdict with premises for each scorer. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R139 Comparative-analysis plan producer (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Comparative-analysis plan producer (rollup).** EG emits a revision-pinned plan for zero-model vector discovery, selective synthesis in one or two model-service calls, and high-weight-only deep extraction. Every stage has an explicit call budget and the plan has a total ceiling. EG returns a plan and premises; AU owns generation and the separate invocation receipt. R080.1 and R136.3 are adjacent reusable mechanisms, not comparative-analysis coverage. | Served `Method::Decide` returns the plan with zero model calls during discovery; AU invokes only budgeted synthesis/extraction. Stale inputs and exhausted budgets refuse before a later call. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R139.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `ComparativeAnalysisRequest`, `ComparativeCandidate{candidate_id, candidate_revision, score, importance}`, `ComparativeAnalysisStage`, `ComparativeStageBudget`, `ComparativeAnalysisPlan`, `ComparativeAnalysisRefusal` and `ComparativeAnalysisEvidence`; add `QuestionKind::ComparativeAnalysisPlan` serialized as `comparative_analysis_plan`. Define `ComparativeAnalysisPlan` fields `plan_digest`, `tenant_id`, `space_id`, `space_revision`, `query_vector_digest`, `unified_query_result_digest`, `candidates`, `policy_version`, `synthesis_importance_threshold`, `extraction_importance_threshold`, `stage_budgets` and `total_call_ceiling`. Each ordered candidate has `candidate_id`, `candidate_revision`, `score` and `importance`. Each ordered stage budget has `stage` and `max_calls`. Reuse the existing 64-candidate decision limit. The EG plan contains no generated text or AU execution receipt. | Round-trip every binding, candidate, threshold, stage budget and question kind; reject malformed, duplicate and over-limit candidates. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R139.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Reuse only caller-supplied, revision-pinned vectors and completed `UnifiedQuery` results; discovery makes exactly zero model-service calls and does not synthesize embeddings. Preserve visible-candidate stable order. Versioned defaults select synthesis candidates at normalized importance `>= 0.50` and extraction candidates at `>= 0.80`. Budgets are discovery `0`, synthesis `1` or `2`, extraction `0–64`; stage sums must fit an explicit total ceiling. The AU caller must not retry implicitly or issue an unbudgeted subcall. | Prove zero-call discovery, inclusive thresholds, stable ties, one/two-call synthesis, high-weight-only extraction, and refusal before it crosses a stage or total budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R139.3 Wiring and authority Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring and authority.** Add the question to public `Method::Decide`: wire dispatch -> `src/server/handlers/decide/statistical.rs::handle_decide` -> `src/server/handlers/decide/stat_decide.rs::handle_decide`. EG validates pinned inputs and returns only a plan/refusal; it never invokes a model or treats AU output as EG-produced. AU may invoke only after plan receipt, at its existing `agent_utilities/knowledge_graph/retrieval/context_compiler_serving.py::compiled_chat_completion` boundary. `AU-HARNESS-R024.3` trace digests do not establish a comparative-analysis consumer contract. | Actual Decide dispatch returns a plan without calling a model transport. Current AU main defines no R139 consumer or receipt at this boundary. The pending dependency is reserved as `AU-SEMANTIC-R030` and `.1`–`.6` in `specs/au-semantic-client`; its owner must define and serve-test it. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R139.4 Typed refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed refusal.** Before returning a consumable plan, refuse missing/stale query inputs or candidate revisions; invisible, malformed, duplicate or over-limit candidates; importance outside `[0,1]`; invalid threshold ordering; absent/invalid stage budgets; and stage sums above total. A stage that cannot fit its remaining ceiling refuses with stage, requested and remaining calls. Never clamp, return a partial plan or make a model call on refusal. | Served negative cases cover stale bindings, invalid values, and each stage/total exhaustion; observe typed refusal and zero model calls. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R139.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind plan digest to tenant/space revision, query-vector/result digests, exact visible candidate IDs/scores/weights/order, policy and thresholds, and stage/total budgets. The proposed AU receipt fields are `plan_digest`, `run_id`, `caller_id`, `actual_stage_calls` (ordered `{stage, call_count}` entries), `request_digest`, `result_digest`, `status` (`completed` or `refused`) and `refusal_code` (refusal only; `result_digest` is absent on refusal). AU validates each stage and total ceiling. EG records premises and plan only and cannot mint or attest this receipt. | Mutating a bound input changes the plan digest; AU receipt validation rejects a mismatched plan or calls above budget. EG stores no generated output and makes no claim about AU execution evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R139.6 Served acceptance Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Served acceptance.** Exercise the authenticated EG `Method::Decide` producer positively and with stale/over-budget refusals, then exercise the separate served AU consumer receiving the plan and invoking its configured service only within synthesis/extraction budgets. Use the real adapters, not only the pure planner. Preserve R080.1/R136.3 as adjacent mechanisms. | EG: `tests/decide/test_comparative_analysis_served.py::test_plan_and_refusal_through_served_decide`. AU: `tests/decide/test_comparative_analysis_consumer.py::test_served_consumer_obeys_plan_and_binds_invocation_receipt`. The AU consumer and receipt remain pending the reserved `AU-SEMANTIC-R030` definition and owner-served test. Both exact source SHAs and receipts are required for an end-to-end claim. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.101 Grounded topic coverage and probability-scored unsupported claims Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Grounded topic coverage and probability-scored unsupported claims.** Extend `DecisionEval` with `GroundedAnswerSubmit` and `GroundedAnswerEvaluationV1`. Bind corpus/query/answer/claim/citation revisions and digests. Record scope (`single_document`, `local_multi_document`, `global_corpus`), evaluator/policy revisions and independent label-set revision/digest. Each query carries a nonempty `ExpectedTopicSetV1` of unique required topic ids. For each expected topic, bind answer claim ids mapped to it and per-claim/per-citation support votes. A topic is covered only when a mapped answer claim cites a source labeled supporting. Its valid support-vote fraction must meet `minimum_topic_support_probability`. Fewer than `minimum_valid_votes` refuses scoring. Return exact `expected_topic_ids` and `covered_topic_ids`. Per scope, coverage is `sum(|covered_topic_ids|) / sum(|expected_topic_ids|)` over the complete pinned query set, not an average of per-query ratios. Require exactly one `GroundedClaimPredictionV1` per scored claim. Bind claim/answer/input digests and pinned scorer id/revision/artifact digest. The scorer cannot access evaluation labels. It supplies fixed-point predicted unsupported probability `p_i` in [0,1]. Independently labeled votes bind unique annotator refs and `unsupported_votes`/`supported_votes`. Set target `q_i = unsupported_votes / valid_votes_i`. `C` is the complete required claim set. Each claim needs exactly one prediction and at least one valid independent vote. Missing/extra claims or predictions, duplicate annotator votes, empty `C`, or zero total vote weight refuses before scoring. Report weighted soft-label Brier score `sum(valid_votes_i * (p_i - q_i)^2) / sum(valid_votes_i)` for `i ∈ C`, with numerator, positive denominator `sum(valid_votes_i)`, fixed-point precision and one final rounding rule bound to policy. Label votes never stand in for detector predictions. Preserve R100's independent-outcome hard-negative join. `Method::UnifiedQuery` supplies retrieved evidence and `Method::DecisionEval` seals the receipt. The scorer and AU answer/topic/label producers must bind their independent provenance. WebUI remains a consumer. Source objective EG:18 SHA-256 `d978b4b4201059c2e7bcc7a78def0d5845cf7db1e361f2f50ee57f8bcc5733ae`. | Serve fixtures with known expected/covered topic sets and non-unanimous labels. Independently recompute each scope's summed topic numerator and denominator. Recompute weighted Brier numerator and positive vote denominator from distinct predictions and votes. Hold labels fixed and vary only `p_i`. The Brier score must change by the formula while topic coverage remains constant. Refuse empty query, topic or claim sets. Refuse missing/extra predictions or labels, duplicate annotator refs, zero vote denominator or probabilities outside [0,1]. Also refuse label access by the scorer and stale answer/corpus/evidence/scorer/evaluator/policy revisions or digests. Read back exact prediction, label, topic-set and score bindings. AU/scorer producer receipts remain separately required. No implementation is claimed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R001.100 Quantitative physical/safety bounds before recommendation surfacing Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Quantitative physical/safety bounds before recommendation surfacing.** Extend `Method::Decide` with `RecommendationSafetyV1`. Bind recommendation id/revision/digest, candidate result refs and policy id/revision/digest. Each `SafetyBoundV1` binds its id/revision/digest, metric id/unit, comparison operator, limit and measured value/source revision. Return each checked bound and a verdict (`pass` or `withheld`). Include the exact violated bound id, configured limit and measured value on refusal. Missing, stale, non-finite, unit-incompatible or unmeasured bounds, unsupported comparison operators and any out-of-bound metric withhold the recommendation. EG emits the bound evaluation result only. GraphOS must invoke and validate it before surfacing a recommendation. Its exact producer/consumer operation and served receipt are a pending companion prerequisite, not covered by this EG definition. Preserve partial `AU-HARNESS-R021.4/.6/.7`. Those do not prove a pre-surface gate. Source objective GRAPHOS:19 SHA-256 `cd33b64c1d759f3c7dd0a83112b77955d25a49c69d20288fe4c917716c711ff6`. | Served cases place an in-bound and out-of-bound recommendation through `Decide`. Verify exact units, values, limits and the withheld bound id. Refuse absent/stale bounds, NaN/infinity, unit mismatch, unsupported comparison operator, missing measurement and stale recommendation/policy digests. Assert GraphOS cannot surface until it supplies the separately served pre-surface validation receipt. That GraphOS operation remains pending and this requirement does not claim it exists. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.7 Pre-plan test evidence, verifier scores and successful-cycle reuse Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Pre-plan test evidence, verifier scores and successful-cycle reuse.** Define the AU-supplied `PrePlanTestReceiptV1` as `{tenant_id, run_id, repository_id, repository_revision, command_id, command_digest, started_at_ms, completed_at_ms, exit_code, artifact_manifest_digest, artifact_count, result_digest}`. Planning and verification bind the same receipt id/digest. `tests_ran` is true only when command and repository revision match and completion precedes planning. `artifacts_exist` is true only when the non-empty manifest is independently readable at its pinned digest. The verifier returns both booleans, their evidence refs and a policy revision. A reusable pattern requires exit code zero. Both checks must be true. Persist that pattern in the existing `CompiledProgram`/`AgentLibraryStore` model and index it through the existing `ProgramLookup` path (`compile_program` → `AgentLibraryStore` → `handle_decide`). Do not add a second program store. Refuse missing, stale, mismatched or unreadable receipts. Failed tests or artifact checks also block pattern promotion. The AU pre-plan producer/verifier-consumer ID and receipt schema remain pending. `AU-HARNESS-R022.2` is adjacent run-experience coverage, not this contract. Preserve `EG-DECISION-ENGINE-R135.2`, `.3`, `.5`. Source record AU:18 SHA-256 `90828a09b388b9910d870ce944aa2baeb561af14d8f7bf88b48a4d51c4da877f`. | Planned served tests through `handle_decide` and `ProgramLookup`: valid pre-plan evidence is present in both plan and verifier result and only a successful cycle is promoted. Refuse command/revision mismatch, late receipt, unreadable or empty artifact manifest, and nonzero exit. Preserve the prior library. Independently read back receipt, pattern and source trace refs. AU producer/verifier receipts remain a separate dependency. This definition claims no runtime evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R106.1 Council positions are coordinated into one evidence-bound decision Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Council positions are coordinated into one evidence-bound decision.** Extend the existing `Method::Decide` request with `CouncilCoordinationV1`: each closed `CouncilPositionV1` carries `{council_id, topology_revision, position_id, persona_id, persona_revision, option_id, claim_digest, evidence_refs[], constraint_refs[]}`. Each evidence ref carries `{id, revision, digest}`. Bind a caller-pinned `CouncilPolicyV1` id/revision, declared quorum and deterministic conflict rule. The sealed result returns `{council_id, topology_revision, input_position_ids, accepted_position_ids, rejected_position_ids, outcome, abstention_reason, policy_revision, positions_digest, decision_digest}` and retains every participating position ref. `outcome` is selected or abstained. Abstention reason is a closed enum for no quorum, unresolved conflict, missing evidence or policy refusal. Attach the typed branch to existing `Decide`/`handle_decide` and decision sealing. Validate council shape through `AgentGraphDraft.topology` and `topology_shape.rs`. `swarm:loopsBackTo` still describes topology, not position coordination. Refuse missing or duplicate positions and mismatched topology/council. Refuse stale evidence, unauthorized refs, incomplete input coverage or invalid policy without a decision. AU persona-position execution has no reviewed producer contract/id; `AU-CONTROL-R010` supplies topology facts only and is not credited for position production. Preserve `EG-DECISION-ENGINE-R106` and `EG-ORCH-VOCAB-R006.3`. Source record AU:19 SHA-256 `0bce81c137b521ea446644d2880498e23d67c3ab5701f09ba3f67a4b2c0e00fc`. | Planned served tests through `Method::Decide`: coherent quorum returns a sealed result containing all input positions and their evidence digests. Conflicting positions produce the policy-defined choice or typed abstention. Missing, duplicate, stale, cross-tenant or topology-mismatched positions refuse. Independently read back the decision and position refs. AU position-producer acceptance remains a separate pending dependency. No runtime receipt is claimed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R106.2 AU position producer identity and execution-to-decision linkage Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**AU position producer identity and execution-to-decision linkage.** Name AU persona-position execution producer from AU-CONTROL spec. Bind AU-CONTROL-R010 persona execution to EG-DECISION-ENGINE-R106.1 council coordination. Each position producer records producer id/revision/digest; EG sealer records consumer id/revision/digest. AU position producer delivers position facts with persona id and option; EG coordinates and seals at handle_decide. Source record AU:19 SHA-256 `3b7f2e1a9d8c5f4a6e3b2d1c9a8f7e6d5c4b3a2f`. | Served Decide through Method::Decide shows produced position ids and AU producer identity. Sealed decision includes producer digests. Missing or unrecognized position producer refuses. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.13 Measured tool-output and graph-size signals select recursive mode in the decision ladder Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Measured tool-output and graph-size signals select recursive mode in the decision ladder.** Extend `Method::Decide` with `QuestionKind::ContextBudget` and closed `ContextBudgetSignalsV1`: `{run_id, tool_output_bytes, tool_output_digest, tool_call_ref, graph_snapshot_ref, graph_node_count, observed_at_ms, signal_digest}` plus a tenant-bound trace/snapshot revision. A pinned `ContextBudgetPolicyV1` supplies versioned byte and node-count thresholds and the decision-ladder mapping. The result binds both observations and policy revisions and returns `{selected_mode: direct|recursive, selected_rung, reason_codes, inputs_digest}`. The ladder is the only selector, not a separate router. Wire the new decision arm beside `tool_subset_outcome` in `src/server/handlers/decide/stat_decide.rs::handle_decide`; AU `run_full_rlm` consumes the `DecisionBatch` before choosing direct or recursive execution. Missing, negative, stale, digest-mismatched or cross-tenant observations, and absent policy refuse before execution. This mode choice is separate from R137.7-.12 context-package selection. `AU-HARNESS-R026.3/.4` remain adjacent spans/context coverage. The exact AU observation-producer contract/id binding these two measurements is pending and not implied. Preserve `EG-DECISION-ENGINE-R137.1-.3`. Source record AU:25 SHA-256 `9724fcb9db21705fe9ac6a4b26d6d27280f55bf8a22bf11907b3ad9449383290`. | Planned served tests through `handle_decide` and `run_full_rlm`: vary tool-output bytes and graph-node count independently around each pinned threshold, then jointly. Assert the decision-ladder mode and consumed input digests. Missing, stale, negative, altered-digest or cross-tenant observations refuse before model execution. Keep package-selection tests for R137.7-.12 independent. AU observation and run-consumer receipts remain separate dependencies. No runtime evidence is claimed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.9 Reviewed residual `AU:34` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:34`.** The EG-owned portion of the source objective . An explicit skill tree and outcome-tuned EG exploration over that tree are absent. AU-HARNESS-R022.3 says retrieval ranks locally, while AU-CONTEXT-R001 assigns ranking/feedback to EG. Resolve this authority conflict. The EG contract SHALL meet this residual through the following reviewed closure: Define TaskPlanSkillNodeV1. Bind task_plan_id/revision/digest, skill_id and nullable parent_skill_id. Bind context_match_policy_revision and evidence refs. Bind prior_outcome_refs with source revisions/digests. Record score, rank and ranking_policy_revision. EG emits relevant skills in a deterministic tree. A versioned score/rank policy binds the comparison operator and tie rule. Missing or unpinned policy refuses. Outcome feedback changes later breadth only through R140.102 and its pinned policy/outcome set. Original source objective. Select multiple relevant skills from a tree for each task. Tune selection from run outcomes, so exploration can use more than one skill. Producer/consumer boundary. EG plan_over_skills -> AgentLibraryStore -> served TaskPlan; AU experience feedback lacks a named EG selection-policy update consumer. Preserve existing coverage `EG-DECISION-ENGINE-R134.4`, `EG-DECISION-ENGINE-R134.5`, `AU-HARNESS-R022.3`, `AU-CONTEXT-R001`. Owner source hash: `ced4d0bb75fa260e4291aea5f71c28b407a95fc3e06047666e1278b043a3cdbd`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.9-ranked-plan. Served Decide(TaskPlan) returns multiple skill nodes. Each has stable parent links, cited context matches, pinned outcome refs, score/rank and plan digest. Equal scores use the declared tie-break. Refuse missing/stale context or outcome evidence and malformed/cyclic parent links. AU application of this rank is not asserted. Attach the proposed result at plan_over_skills -> AgentLibraryStore -> served TaskPlan. AU-HARNESS-R022.3 local ranking and AU-CONTEXT-R001 feedback authority remain existing adjacent obligations. The AU consumer that applies EG rank and the feedback-to-R140.102 receipt contract are not yet specified. Keep SPECIFIED pending those owner definitions and served evidence. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.14 Reviewed residual `AU:37` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:37`.** The EG-owned portion of the source objective . The judge checks retained values, methods and validation steps. It does not compare held-out answers with full-context answers under a declared tolerance. The EG contract SHALL meet this residual through the following reviewed closure: Define PairedContextEvaluationV1. Bind the held_out_query_set id/revision/digest, raw_context revision/digest and candidate_context revision/digest. Bind evaluator/model revision and each query's raw/candidate answer digests. Record the quality metric, aggregation rule, tolerance and policy revision. Require a complete per-query verdict set. Replace raw context only when all queries are present and the aggregate satisfies the declared tolerance. Any failed or incomplete evaluation retains the raw revision. Original source objective. Compress long run context into updatable memory only when held-out answer quality stays within declared tolerance. Otherwise retain the full context. Producer/consumer boundary. AU ContextManager.before_model_request -> run_agent replaces context only after its summary gate. No held-out paired-answer verdict is a named prerequisite. Preserve existing coverage `AU-HARNESS-R013.5`, `AU-HARNESS-R013.10`, `AU-HARNESS-R013.12`, `AU-HARNESS-R013.13`. Owner source hash: `7e1405981aa8b697a73eb7e8c3c3170be8edefc674c23beef740884450fc1add`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R137.14-paired-context. a complete held-out set within the declared tolerance permits the replacement verdict. A beyond-tolerance result, missing query or stale context/evaluator digest refuses. Undefined metric, aggregation or tolerance also refuses. An incomplete verdict set leaves the active raw-context revision unchanged. AU ContextManager.before_model_request -> run_agent is the existing replacement point. The AU held-out evaluator and receipt schema are absent. So is the consumer that atomically applies EG acceptance. R013.5/.10/.12/.13 remain adjacent coverage, not evidence of this gate. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.10 Reviewed residual `AU:39` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:39`.** The EG-owned portion of the source objective . There is no summary-only sub-run return schema, parent-remaining-context bound or explicit rejection of raw/oversized returns. Generic spans do not bind delegation decision, child run and accepted summary as one trajectory. The EG contract SHALL meet this residual through the following reviewed closure: Define ChildSummaryV1. Bind plan/decision id and digest, parent run id and child run id. Record the expected child-id set and summary artifact kind/schema/version/digest. Bind the exact tokenizer revision, summary token count and source/result evidence refs. A parent budget record binds remaining context tokens at dispatch and the maximum aggregate child-summary tokens. Child output exposed to the parent contains only the declared summary artifact, never raw transcript. The accepted fan-out receipt accounts for every child as one summary or named failure gap. Original source objective. A main run delegates subtasks to sub-runs. Each child returns only contract-bounded summaries. The main run conserves context budget and records delegation decisions as trajectories. Producer/consumer boundary. AU _fork_fanout -> FanoutResult and parallel workspace synthesis; EG decides plans. The bounded child-summary producer/parent consumer boundary is absent. Preserve existing coverage `AU-CONTROL-R043.2`, `AU-CONTROL-R043.5`, `AU-HARNESS-R020.4`, `AU-HARNESS-R024.1`. Owner source hash: `742906721351687d032991b4e9c0255baf7a6c480e21ac7a616975d40e38ce84`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.10-bounded-child-summary. valid summary-only children whose checked token total fits the parent remaining budget are linked to decision, child and summary digests. Refuse raw or oversized output and missing, duplicate or unknown children. Refuse tokenizer/budget revision mismatch or totals above the bound before parent synthesis. AU _fork_fanout -> FanoutResult and parallel workspace synthesis are the observed attachment points; EG owns TaskPlan authority. AU summary producer, parent remaining-context budget field and consumer validation/readback receipt are missing. AU-CONTROL-R043.2/.5, AU-HARNESS-R020.4 and AU-HARNESS-R024.1 remain adjacent. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.15 Reviewed residual `AU:40` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:40`.** The EG-owned portion of the source objective . A primitive handle and span digests omit recursive sub-model input/output signatures, tool bindings and boundary validation. The trace also lacks signature/model/tool linkage. The EG contract SHALL meet this residual through the following reviewed closure: Define RecursiveCallV1 request/result records. Bind parent run/span, call id and signature id/revision/digest. Record typed input schema/digest, admitted tool id/revision set and selected model id/revision. Bind typed output schema/digest and terminal status. Validate input and tool membership before dispatch and output against the same signature before recording success. Bind all revisions/digests in the recursive trace. Original source objective. A recursive runtime lets a model call sub-models through typed signatures and tools. The run trace records interpretable trajectories. Producer/consumer boundary. AU run_full_rlm -> RLMEnvironment.run_parallel_sub_calls executes EG limits. Span instrumentation records calls. No recursive-call signature producer/validator is named. Preserve existing coverage `AU-HARNESS-R026.1`, `AU-HARNESS-R026.4`, `AU-HARNESS-R024.1`, `AU-HARNESS-R024.3`, `EG-ORCH-VOCAB-R005`. Owner source hash: `4edb15328650ebf084f0ab1d073b092e5b684aafad9b7b1ca7f412859390b923`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R137.15-signature-boundary. an admitted typed call records matching signature/model/tool/input/output digests. Refuse unknown or changed signatures and unadmitted tools. Refuse malformed input/output, missing parent span or revision mismatch before accepting a result. AU run_full_rlm -> RLMEnvironment.run_parallel_sub_calls is the observed execution point. EG resource limits and span instrumentation are adjacent only. No AU recursive signature producer/validator receipt or exact EG-to-AU call contract is named. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.11 Reviewed residual `AU:45` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:45`.** The EG-owned portion of the source objective . Depth/item bounds do not define an execution horizon or per-step budget. They do not split excess steps before execution or checkpoint credit across sub-horizons. The EG contract SHALL meet this residual through the following reviewed closure: Define HorizonPartitionV1 for one committed TaskPlan revision. Bind ordered step ids and dependency edges. Set positive max_steps_per_horizon, per-step budget policy id/revision/unit and a credit ceiling. Partition only at dependency-safe boundaries before start. Each completed horizon returns a durable credit checkpoint with plan/horizon ids, consumed/reserved/remaining amounts, budget revision and digest. Require a versioned accounting rule for debits. Original source objective. Long tasks decompose into sub-horizons under a declared per-step budget with checkpointed credit. A plan whose step count exceeds the configured horizon is split before execution, not attempted whole. Producer/consumer boundary. EG decompose_task/TaskPlan -> AU bounded map primitives. The horizon partition and durable credit receipt are not a named producer/consumer interface. Preserve existing coverage `AU-HARNESS-R026.1`, `AU-HARNESS-R026.2`, `EG-DECISION-ENGINE-R134.3`, `EG-DECISION-ENGINE-R134.4`. Owner source hash: `c1bfd61241a0fd02ada2816f173a3b9568da5b48e490e76058fd740b356886da`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.11-horizon-credit. a plan within the limit remains one horizon. A longer valid plan is split at dependency-safe boundaries and its checkpoint balances reconcile exactly. Refuse an unsplittable dependency component or absent/invalid budget rule. Refuse over-credit horizons, missing checkpoints and stale plan revisions before the next start. EG decompose_task/TaskPlan feeds AU bounded map primitives, but no named partition/credit receipt interface exists. AU durable checkpoint/debit semantics and the consumer that blocks start on a missing receipt remain unspecified. Do not substitute Finance forecast horizons or solver budgets. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R059.1 Reviewed residual `AU:57` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:57`.** The EG-owned portion of the source objective . No merged skill tree binds candidates across model backbones to independent per-skill evaluations. It also lacks a robustness/transferability estimate across those backbones. The EG contract SHALL meet this residual through the following reviewed closure: Define BackboneSkillEvaluationV1 rows. Key each by candidate id and canonical skill identity. Bind source model/backbone id/revision and task-distribution id/revision. Bind evaluation dataset id/revision/digest, metric id/revision, sample count and result digest. An aggregate may be emitted only with complete independent rows for every declared backbone and a versioned transferability policy. Publish the full per-backbone evidence with the aggregate, not a bare score. Original source objective. Merge skill candidates from multiple models into one tree. Aggregate independent evaluations into a robust estimate of effectiveness and transferability across backbones. Producer/consumer boundary. AU experience/skill candidates -> EG admission-linked outcome aggregate. The shared tree and backbone-bound per-skill evaluation join remain unnamed. Preserve existing coverage `AU-HARNESS-R022.1`, `AU-HARNESS-R022.2`, `EG-DECISION-ENGINE-R059`. Owner source hash: `0c7c2eed61e3cfe6fe6c863c75fb66092f3a8bea97e3942b635c7b69f715d3a9`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R059.1-backbone-evidence. complete independent evaluations for the same canonical skill identity produce a result that lists every backbone and policy revision. Refuse missing/duplicate backbone rows, candidate identity mismatch, reused non-independent evidence, incomplete dataset coverage or absent metric/transferability aggregation policy. AU supplies experience/skill candidates; EG R059 is the existing independent-outcome admission path. No shared canonical skill merge key, robust aggregation/threshold decision, or AU multi-backbone evaluation producer is specified. These decisions are explicit holds. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.12 Reviewed residual `AU:85` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:85`.** The EG-owned portion of the source objective . Hard-task alternative trajectories and deliberative summary aggregation. Explicit width/depth decision ladder and remeasurement against a single-trajectory baseline. The EG contract SHALL meet this residual through the following reviewed closure: Define TrajectoryDecisionV1. Bind one task/plan digest and policy revision. Record chosen width/depth and ordered trajectory ids. Bind the identical input snapshot digest per arm, single-trajectory baseline id, per-arm outcome/evaluation refs and paired comparison receipt. The decision names the selection and evaluation policies. It does not prescribe an unsupported scoring formula. A pass requires complete paired arms over the same task/input and an explicit R018 comparison verdict. Original source objective. Hard tasks run in two stages: parallel reasoning over multiple trajectories, then a summarization step aggregating them. Width and depth are chosen by the decision ladder and re-measured against a single-trajectory baseline. Producer/consumer boundary. R134 plan explicitly connects Decide TaskPlan to AU-CONTROL-R042/R043; R137 plan connects ContextBudget to AU-CONTEXT-R004/AU-HARNESS-R026. AU-HARNESS-R018 has run_agent paired arms. These dependencies lack the alternative-trajectory/summarization/baseline binding. Preserve existing coverage `AU-HARNESS-R020.4`, `EG-DECISION-ENGINE-R134.1`, `EG-DECISION-ENGINE-R134.3`, `AU-CONTROL-R007`, `EG-DECISION-ENGINE-R137.1`, `EG-DECISION-ENGINE-R137.3`, `AU-HARNESS-R018.1`, `AU-HARNESS-R018.2`, `AU-HARNESS-R018.5`. Owner source hash: `a28929a50cbfcb691664403ce456fbf9dc38d6bd64b34424932e4fa22f9cbda1`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.12-paired-trajectories. selected width/depth and all trajectory/baseline ids bind to the same plan and input snapshot. Each arm has an outcome and the paired R018 verdict is readable. Refuse missing/mismatched arm, baseline, policy revision or result, and refuse any claim of improvement without the declared paired verdict. Existing points are Decide(TaskPlan), AU-CONTROL-R042/R043, AU-HARNESS-R020.4, and paired arms in AU-HARNESS-R018.1/.2/.5. AU trajectory generation, summary aggregation and EG selection-policy consumer receipt are absent. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.13 Reviewed residual `AU:91` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:91`.** The EG-owned portion of the source objective . Distinct analyst roles provide cited findings to one decision role. Required abstention on unresolved conflict or missing citations. The EG contract SHALL meet this residual through the following reviewed closure: Define AnalystFindingV1. Bind task/plan digest, expected analyst id/role and finding id. Record claim text/digest, cited evidence ids/revisions/digests and source spans. Define SynthesisResultV1. Include the complete expected analyst-id set and all finding ids. Record each analyst outcome, cited evidence, conflicts and final decision-role id. Return a supported conclusion or typed abstention reason. Never drop a failed or absent analyst from accounting. Original source objective. Parallel analyst roles produce structured, cited findings for one decision role. That role abstains when findings conflict or lack citations. Producer/consumer boundary. EG R134.5 plans TaskPlan through served Decide; AU R020.5 constructs worker slots through _dispatch_parallel_batch. The selected aggregation consumer lacks a cited-finding/conflict abstention contract. Preserve existing coverage `EG-DECISION-ENGINE-R134.3`, `AU-HARNESS-R020.1`, `AU-HARNESS-R020.4`, `AU-HARNESS-R020.2`, `EG-DECISION-ENGINE-R134.6`. Owner source hash: `f5ddb0ac9b0329ac031c01c56c49ee03c922a991dbf2d0e29c111515424d3455`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.13-cited-synthesis. cited compatible findings produce a result that accounts for every expected analyst. Refuse missing/duplicate analysts and unsupported findings. Refuse unresolved conflict, invalid citation, plan mismatch or absent decision role. Abstain without recommendation. EG R134.5 served Decide(TaskPlan) is the planning point; AU R020.5 _dispatch_parallel_batch constructs worker slots. The exact AU finding producer/collector and aggregation consumer contract is missing. Existing fan-out clauses do not prove it. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R029.1 Reviewed residual `AU:93` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:93`.** The EG-owned portion of the source objective . Replaceable search-grounding provider independently selected from reasoning model and bound to a committed route. Unavailable committed provider must refuse rather than substitute. The EG contract SHALL meet this residual through the following reviewed closure: Define RetrievalProviderBindingV1 in the committed retrieval plan. Bind provider id/revision/config digest, query/request digest and tenant scope. Identify reasoning model id/revision separately. The binding has an explicit no-substitution policy. Execution evidence records the exact provider, binding digest, request/result digests and provider revision. Original source objective. Search grounding is a replaceable provider selected through the committed routing decision, independent of the reasoning model. An unavailable provider is refused, not silently substituted. Producer/consumer boundary. Preserve ARBORA-OPS-R021.2.1 retrieval.search and its tenant-scoped retriever. EG must produce the committed provider binding and the SDK/GraphOS consumer must execute that exact provider. That edge is missing. Preserve existing coverage `EG-DECISION-ENGINE-R029`, `ARBORA-OPS-R021.2.1`. Owner source hash: `c9552392eb813763a83fc96fb48ad1bd18fd805ef608736f1dae5d48ab12c984`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R029.1-exact-provider. independently vary provider and reasoning-model ids while verifying the committed provider is executed. If the bound provider is unavailable, stale, unauthorized or mismatched, refuse before retrieval and record zero calls to alternate providers. Preserve ARBORA-OPS-R021.2.1 retrieval.search and its tenant-scoped retriever. EG must commit the provider binding. The SDK/GraphOS consumer contract that executes and receipts that exact binding is not defined. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.14 Reviewed residual `AU:105` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:105`.** The EG-owned portion of the source objective . Search planner explores candidate solution branches using experience memory, fuses branch solutions and records every branch outcome for later retrieval. The EG contract SHALL meet this residual through the following reviewed closure: Define BranchOutcomeV1. Bind branch id, parent task/plan digest and branch input digest. Record experience snapshot revision and ordered fusion position. Include terminal outcome or named failure gap and immutable result digest. The fusion receipt lists every planned branch in deterministic order. It binds the versioned fusion-policy id/revision, all outcome refs and fused result digest. A later branch retrieval records the exact outcome refs and revisions it consumed. Original source objective. A search-based planner explores solution branches using experience memory. It fuses branch results and records each outcome for later retrieval. Producer/consumer boundary. Use the same missing branch-experience producer and committed planning consumer identified for AU:84. Existing attachment points are R134.5 Decide, R020.5 worker execution and R022.4 run outcome distillation. Preserve existing coverage `EG-DECISION-ENGINE-R134.3`, `AU-HARNESS-R022.3`, `AU-HARNESS-R020.4`, `AU-HARNESS-R022.1`, `AU-HARNESS-R022.6`. Owner source hash: `4fd31dd504f158f43bcf77d81a39c2419303a538b32553a77a39f6b5a575e9d2`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.14-branch-readback. a complete branch set produces an ordered fusion receipt and independent readback for every outcome. A later branch cites the exact pinned prior outcome. Refuse missing/duplicate branch, changed parent/input/snapshot, omitted failure gap, absent fusion policy, or stale readback. Existing points are Decide R134.5, AU R020.5 worker execution and AU R022.4 outcome distillation. The AU branch-experience producer, committed-plan consumer and durable per-outcome receipt schema remain missing. Do not substitute R140.102 breadth adaptation. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R020.1 Reviewed residual `AU:110` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `AU:110`.** The EG-owned portion of the source objective . Separate per-agent exploitation trajectory pool and generated exploration pool. Explore only when context has no matching past trajectory. Define CandidatePoolV1. Bind tenant/agent id, task/context feature digest and policy revision. Record candidate ids and each candidate's source revisions. The selection receipt partitions candidates into exploitation (matched prior trajectories) and exploration (eligible only when no match exists). It records context-match policy revision, evidence refs and deterministic tie-break. Cross-agent history is never eligible. Original source objective. Each agent keeps past trajectories in an exploitation pool and generated candidates in an exploration pool. Use exploration only when no trajectory matches the context. Producer/consumer boundary. EG owns candidate selection and orchestration evidence; AU R022 supplies run experience. No per-agent two-pool producer or context-miss-only selection contract exists. Preserve existing coverage `AU-HARNESS-R022.1`, `EG-DECISION-ENGINE-R020`, `AU-HARNESS-R022.3`. Owner source hash: `dafa8396b5a7c2a168253c7be219718c78186266610e5a91e7dc318d35fc552b`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R020.1-agent-isolated-pools. a same-agent matching trajectory selects from the exploitation pool and excludes exploration. A declared no-match case may select from exploration. Refuse missing match policy/evidence and cross-tenant or cross-agent history. Bind result to the candidate snapshot. EG owns candidate selection and AU-HARNESS-R022.1/.3 provide adjacent experience inputs. No AU per-agent pool producer or context-match evidence contract exists. Exact match dimensions/threshold must be supplied by that owner policy before implementation. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R133.7 Reviewed residual `EG:13` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `EG:13`.** The EG-owned portion of the source objective . Define recursive code/subcall/intermediate node/edge identity and verifier/improvement read-and-critique contracts. The EG contract SHALL meet this residual through the following reviewed closure: Define RecursiveTraceNodeV1. Bind run id/revision, step id/revision and parent node id. Record ordered child ids and input/output/evidence refs/digests. Include source revision and trace snapshot id. Define TraceCritiqueQueryV1 with root node, authorized projection, snapshot revision, filters and opaque cursor. The response includes the complete selected ancestry and source refs. Parent/child links must be complete and acyclic within the selected snapshot. Original source objective. Store each recursive-reasoning trajectory as typed graph nodes. Include code runs, sub-calls and intermediates for verifier and improvement critique. Producer/consumer boundary. Terminal CommitWorkItemResult adapts traces after fenced CAS; AddNode validates traces. Graph queries read them. Recursive hierarchy production and critique consumption are absent. Preserve existing coverage `EG-DECISION-ENGINE-R133.1`, `EG-ORCH-VOCAB-R013.1`, `EG-DECISION-ENGINE-R133.5`, `EG-ORCH-VOCAB-R013.5`, `EG-ORCH-VOCAB-R009.15`, `EG-ORCH-VOCAB-R013.6`. Owner source hash: `9e0be988c182da3c7f440c14d2fc8e56f60426e543e3f53ba39f250f235e6c8d`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R133.7-trace-critique. ingest and independently read back a nested trace, then critique it at the same authorized snapshot with complete ancestry. Refuse incomplete ancestry, cycle, stale cursor/snapshot, missing digest or unauthorized projection without returning protected fields. Terminal CommitWorkItemResult adapts traces, AddNode validates records and graph queries read them. The recursive node producer and named authorized critique-query operation/consumer are absent. Existing fencing/projection rules remain binding. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.1 Reviewed residual `EG:16` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `EG:16`.** The EG-owned portion of the source objective . Define attributed agent-error/human-correction ingestion and lineage from examples to fitted adapters before existing promotion. The EG contract SHALL meet this residual through the following reviewed closure: Define FeedbackEventV1. Bind stable event id and decision id/revision/digest. Record option/action id, actor id and outcome/evidence refs/digests. Include event time and source revision. A versioned mapping policy converts only a complete joined event into a fit example. Deduplication is by event id plus source revision. Bind example-set digest to R100 fitting, resulting adapter id/revision to R101, and publish admission to R040. Original source objective. A promoted adapter adjusts embeddings from feedback signals. Signals include agent errors and human corrections, closing a feedback loop into vector space. Unpromoted adjustments never alter served results. Producer/consumer boundary. R100 persists examples, R101 applies promoted post-RLS/pre-ANN query adapters, R040 gates publish. Signal production and example-to-fit linkage are absent. Preserve existing coverage `EG-DECISION-ENGINE-R100`, `EG-DECISION-ENGINE-R101`, `EG-DECISION-ENGINE-R040`. Owner source hash: `eca485ffdff9cea5394130b53e12a0edc235e342ab01accc36ad9d06f496daa8`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R100.1-feedback-join. an authorized complete event is read back as exactly one fit example bound to the expected R100 dataset digest. Replaying the same event is idempotent. Refuse duplicate identities with changed content or missing decision/option/outcome joins. Refuse invalid mapping policy, stale source revision or evidence mismatch before fitting. R100 persists examples, R101 applies a promoted adapter post-RLS/pre-ANN and R040 gates publish. The AU signal producer and outcome-to-label mapping policy are not specified. Do not treat an independent outcome record as the producer contract. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R088.2 Reviewed residual `EG:17` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `EG:17`.** The EG-owned portion of the source objective . Define event cursor/period, forecasts, adaptation and no-future-event visibility at the simulator/harness boundary. The EG contract SHALL meet this residual through the following reviewed closure: Define ReplayEventV1. Bind event id, strictly ordered sequence number and event time. Record state snapshot id/revision/digest, observed action id, outcome/evidence refs and source revision. Replay uses an AS OF snapshot and opaque deterministic cursor. The sealed ReplayReceipt binds ordered event digests, cursor, policy id/revision and result digest. Identical duplicate delivery is idempotent. A conflicting duplicate or sequence gap refuses. When the environment is policy-dependent, route to R119 off-policy evaluation. Original source objective. Evaluation replays real-world events chronologically over a simulated period. The agent forecasts outcomes and adapts as information arrives. No future event is visible before its turn. Producer/consumer boundary. DecisionEval owns AS OF and fold replay. A real-world event simulator feeding an AU adaptive harness is undefined. Policy-dependent environments must respect R119 off-policy routing. Preserve existing coverage `EG-DECISION-ENGINE-R088`, `EG-DECISION-ENGINE-R119`, `EG-DECISION-ENGINE-R088.1`. Owner source hash: `d01db99df0c6c22b37f82cd815e129956fa151e7da2b670b73348ca5058e629e`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R088.2-ordered-replay. replay a fixed event sequence and resume from its receipt/cursor to the same event order and sealed digest. Refuse gaps, out-of-order events, conflicting duplicate ids, changed snapshots or policy-dependent on-policy claims without R119 routing. DecisionEval provides AS OF and fold replay. The real-world event simulator and AU adaptive-harness producer/consumer are undefined. This row specifies EG replay envelope and refusal only, not an external event source. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.16 Reviewed residual `EG:26` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `EG:26`.** The EG-owned portion of the source objective . The statement that only window/chunking budgets exist is stale. R137.7-.12 cover exact-token package sizing and monetary/model-price bounds. The remaining gap is an explicit task-complexity input and selection policy. Bind the caller ceiling to current remaining tokens, including consumed and reserved tokens. R128 task-class pressure does not itself prove that joint payload-sizing linkage. Extend ContextBudgetSignalsV1 with task-complexity feature set/digest and complexity-policy id/revision. At a pinned snapshot, derive remaining tokens as the total ceiling minus committed and reserved consumption. Use the same tokenizer revision. Return both operands and the checked result. Bind the complexity decision and remaining budget to the sealed ContextPackageSelection and its R137.7-.12 solver certificate. R128.5 task-class pressure remains a separate input. Original source objective. Adapt retrieval payload size per request to task complexity, remaining token budget and model cost. Never exceed the remaining budget. Producer/consumer boundary. Planned served Decide(ContextBudget) -> existing solver -> independent certificate verifier -> sealed ContextPackageSelection -> AU-CONTEXT-R004 context-compile consumer. R137.11/.12 explicitly name the consumer. Current dispatch absence is stated in R137.9. Preserve existing coverage `EG-DECISION-ENGINE-R137.7`, `EG-DECISION-ENGINE-R137.8`, `EG-DECISION-ENGINE-R137.10`, `EG-DECISION-ENGINE-R137.9`, `EG-DECISION-ENGINE-R137.11`, `EG-DECISION-ENGINE-R137.12`. Owner source hash: `ccbc35ba3595763696c824434868079aeb401ce8b601041e913b323a2d2fb575`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R137.16-complexity-and-remaining-budget. vary complexity while holding model cost and remaining tokens fixed, then vary remaining tokens while holding complexity fixed. Verify the declared policy and certified package bind both decisions. Refuse missing/invalid policy, tokenizer or snapshot mismatch, negative/overflowing remainder, or package cost above remaining tokens. Planned Decide(ContextBudget) -> existing solver -> independent certificate verifier -> sealed ContextPackageSelection -> AU-CONTEXT-R004. R137.11/.12 name the consumer. The dispatch and receipt binding remain pending as recorded in R137.9. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R029.2 Reviewed residual `EG:30` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `EG:30`.** The EG-owned portion of the source objective . The complete candidate universe is not necessarily the complete available-source universe. No exhaustive, explicit omitted-source report with relevance/budget reasons is required. Displaced authority-conflict sources cover only one omission cause. Define AvailableContextSourceV1. Bind authorized source id/revision/digest and relevance evidence. Record authority class, token/cost estimate and enumeration snapshot. ContextSourceSelectionV1 returns complete selected and omitted partitions with reason enum IRRELEVANT, OVER_BUDGET, AUTHORITY_DISPLACED, or UNAUTHORIZED, plus deterministic policy revision and source snapshot digest. Every enumerated source appears exactly once. Protected source identifiers are omitted from unauthorized caller-visible details. Original source objective. An agent loads task-relevant context from available sources within a stated budget. It does not load the full persistent memory. Omitted sources are reported. Producer/consumer boundary. Served Decide(ContextBudget) -> certified package -> AU-CONTEXT-R004 context compile. Ontology source selection R072 and source-authority conflict handling supply distinct inputs. Preserve existing coverage `EG-DECISION-ENGINE-R029`, `EG-DECISION-ENGINE-R137.7`, `EG-DECISION-ENGINE-R137.8`, `EG-DECISION-ENGINE-R137.11`, `EG-DECISION-ENGINE-R137.12`, `EG-FEDERATED-QUERY-R072`, `EG-SRC-AUTH-R010.6`. Owner source hash: `05fcbe47e588141000ec329927406270abd30b590d2624f22e9239079f829d38`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R029.2-complete-source-partition. the same served compile journey includes relevant selected sources and omitted examples for irrelevance, over-budget and authority displacement. Every authorized source is accounted for once. Refuse incomplete enumeration, duplicate source, unknown reason, stale budget/authority snapshot or unauthorized disclosure. Served Decide(ContextBudget) -> certified package -> AU-CONTEXT-R004 context compile; R072 ontology selection and EG-SRC-AUTH-R010.6 provide distinct source inputs. The AU consumer receipt for the exhaustive partition is not named. Preserve the parent retrieval/authorization obligations. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.15 Reviewed residual `EG:36` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `EG:36`.** The EG-owned portion of the source objective . No duration/weight-based longest-path calculation or critical-chain output is required. A DAG and dependency order alone do not define critical-path scheduling. For each TaskPlan DAG step, require positive duration_ms and nonnegative integer priority_weight. Bind source evidence, weight-policy id/revision and input digest. Compute checked integer path totals from duration_ms multiplied by priority_weight using the declared weight scale. Return ordered critical_chain_step_ids, total_weighted_duration_ms, policy revision, plan revision and input digest. Ties choose the lexicographically smallest step-id sequence. Original source objective. Task scheduling computes critical paths over plan graphs using topological order and longest path, and reports the critical chain. Cyclic plans are rejected. Producer/consumer boundary. Served Decide(TaskPlan) -> plan_over_skills -> typed TaskPlan -> execution consumer. Critical-chain fields and computation remain to be defined. Preserve existing coverage `EG-DECISION-ENGINE-R134.1`, `EG-DECISION-ENGINE-R134.4`, `EG-DECISION-ENGINE-R134.5`, `EG-DECISION-ENGINE-R134.6`, `EG-DECISION-ENGINE-R134.8`, `EG-ORCH-VOCAB-R006`. Owner source hash: `6e1f0c3ab1626a00c8392e8a304b4c4a28a86d0aee8fff1933317bbdb4893966`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R134.15-weighted-critical-chain. a branched DAG returns the independently calculated longest weighted path and total, source-duration/weight provenance, and deterministic tie result. Refuse cycles and missing/invalid duration or weight. Refuse absent scale policy, stale source evidence or checked multiplication/sum overflow before emitting TaskPlan. Attach the proposed fields to served Decide(TaskPlan) -> plan_over_skills -> typed TaskPlan. The execution consumer schema for critical-chain fields is not defined. The decision producer and consumer remain SPECIFIED pending that schema. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.8 Reviewed residual `EG:52` Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reviewed residual `EG:52`.** The EG-owned portion of the source objective . Successful-trace compilation is not on-demand compilation from natural-language or graph-stored workflow definitions. Persisted ProgramStep lacks a reusable agent-configuration contract. Compile failure reports run failure/size instead of the missing workflow step. The EG contract SHALL meet this residual through the following reviewed closure: Define WorkflowCompileRequestV1. Bind source kind (NL or graph), exact source revision/digest and workflow identifier. Record compiler id/revision and referenced step/agent-config ids. The deduplicated CompiledWorkflowV1 binds the canonical typed step graph digest and each agent configuration id/revision/digest. Define `semantic_reuse_key_v1` as the exact tuple `{canonical_typed_step_graph_digest, compiler_id, compiler_revision, sorted_agent_config_refs}`, where each sorted config ref is `{id, revision, digest}` and sorting is lexicographic by config id. Exclude source kind, source revision/digest and source-to-step mapping from the key. Retain them in a separate WorkflowCompileReceiptV1 bound to source provenance, reuse key and compiled program id. A missing referenced step returns MISSING_WORKFLOW_STEP with the exact id/source location and publishes no partial program. Reuse one NL/graph program only when canonical graph digest, compiler id/revision and sorted agent-config refs match. Different source provenance remains in separate compile receipts, and no source equivalence is inferred from text alone. Original source objective. Workflows written in natural language or stored in the knowledge graph compile on demand to typed graph flows. Compiled steps and agent configurations are saved for fast routing on reuse, and a compile failure names the missing step. Producer/consumer boundary. Served Decide(TaskPlan) and ProgramLookup -> AgentLibraryStore/handle_decision_commit -> harness; SourceIngest is the workflow ingestion authority. A definition-to-program compiler between those surfaces remains unspecified. Preserve existing coverage `EG-DECISION-ENGINE-R134.1`, `EG-DECISION-ENGINE-R134.4`, `EG-DECISION-ENGINE-R134.5`, `EG-DECISION-ENGINE-R134.6`, `EG-DECISION-ENGINE-R135.1`, `EG-DECISION-ENGINE-R135.2`, `EG-DECISION-ENGINE-R135.3`, `EG-DECISION-ENGINE-R135.4`, `EG-DECISION-ENGINE-R135.5`, `EG-DECISION-ENGINE-R135.6`, `EG-ORCH-VOCAB-R006`, `EG-REPO-INGEST-R002`. Owner source hash: `1ee5f2b5bd5bc45c9b9ff8ccaab8de944ed41eceab17a8c1e88cc86d4725e2dc`. This remains SPECIFIED pending separately reviewed implementation and served evidence. | Planned acceptance only: Case R135.8-workflow-compile. Identical graph digests, compiler id/revision and sorted config refs identify one semantic reuse key. The key returns a complete stored configuration across NL/graph inputs. Keep a separate source-kind/revision/digest/mapping receipt for each. A new source revision with unchanged semantic inputs reuses the program but records new provenance. A changed graph, compiler, or config ref changes the key. Refuse a missing step with the exact diagnostic, stale source/config/compiler revision, or partial program publication. Proposed attach points are served Decide(TaskPlan), ProgramLookup and AgentLibraryStore/handle_decision_commit; SourceIngest remains the workflow ingestion authority. The compiler interface and stored configuration schema between these surfaces are unspecified. No implementation, served test, or receipt is claimed by this SPECIFIED definition. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.9 Producer/consumer identity and receipt binding for pre-plan test results Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Producer/consumer identity and receipt binding for pre-plan test results.** Name AU pre-plan test producer from AU-HARNESS spec and verifier consumer at handle_decide. Bind AU-HARNESS-R022.8 to EG-DECISION-ENGINE-R135.7 with explicit identity. Each party records producer id/revision/digest and consumer id/revision/digest. AU pre-plan producer delivers test receipt with command and artifact digests; EG verifier consumes at ProgramLookup decision point. Source record AU:18 SHA-256 `9c5f2e1a8d7c4b3f6e2a1d9c8b7a6f5e4d3c2b1a`. | Served Decide through ProgramLookup shows producer and consumer identity digests. Cross-reference validation succeeds. Missing producer or consumer identity refuses. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.10 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define InsightRecordV1 in the program store. It binds insight text, source_run_ids, context signature, success counts and selection revision. Every insight must name at least one source run. | A schema test rejects an insight with no source run. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.11 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The engine must consolidate submitted insights and rank them by context match and success. It must select insights for a task context. Ties must order by insight id. | A fixture of insights yields the expected consolidation and selection order. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.12 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The Harness observes outcomes and submits them to the engine. The engine owns storage, consolidation and selection. The Harness applies selected insights when it compiles model context. The selection attaches in handle_decide beside the program lookup. | A served Decide call returns selected insights with their source runs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.13 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The engine must refuse a submission that has no source run. It must refuse a selection request with an unknown context signature. Each refusal must carry a typed reason. | Each refusal case returns its typed reason and stores nothing. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.14 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit premises for the selected insights, their source runs and the selection revision. The Harness must record which insights it injected. | A trace links each injected insight to its source runs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R135.15 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served Decide wire method. The integration test is tests/decide/test_insight_selection_served.py::test_post_run_write_then_context_injection. It writes after a run, selects later, and checks injection with source-run provenance. A source-less submission must refuse. | That test passes against the served engine. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R042.100 Tool-path outcome history and repeated-failure skip rule Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Tool-path outcome history and repeated-failure skip rule.** Model `ToolPathHistory` by tenant, connector, capability and stable path id/version. Bind observation window, sample/success/failure counts, as-of time and source invocation ids. Behavior ranks only already-admitted equivalent paths by observed success rate. Skip a path only when the versioned decision policy declares a minimum sample and failure threshold and both are met. Missing, stale or undersampled history is `unknown` and cannot suppress a path. Wiring adds the evidence to the existing R042 Decide advisory and consumes current attempt outcomes from SDK `ordered_equivalent_fallback`. It must not replace the SDK declared fallback order or execute writes. Evidence binds policy, candidate paths and observation window. Producer/consumer boundary. EG R042 remains evaluate-only connector tool-choice advisory; SDK owns ordered transport fallback and current attempt outcomes. Preserve existing parent obligations: `EG-DECISION-ENGINE-R042; SDK-SOURCE-INGEST-R012.2; preserve deterministic admitted fallback`. Source record `AU:28` SHA-256 `9dac8e5f41f6948885215836733ce3116b8246ca5c9c4725a12a62bdb11cb400`. Parent `R042` remains unchanged. | Planned served acceptance. In served Decide, prefer adequately sampled higher-success paths. Skip threshold-qualified repeated failures. Preserve declared order for missing, stale or undersampled history. Verify the advisory cannot trigger write-back and every score recomputes from its bound counts. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R042.101 Per-model measured tool necessity and every-call mismatch trace Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Per-model measured tool necessity and every-call mismatch trace.** Define `ToolNecessityMeasurement`. Bind model id/revision, tool/capability id and task-cohort digest. Record paired enabled/disabled trial identities, outcome metric, sample counts, threshold, measurement time and digest. A measurement is `necessary`, `not_necessary` or `unknown` only under the declared minimum-sample and outcome-delta policy. No data, stale model revision or insufficient pairs yields `unknown`. Compare every AU tool-call decision to the current model/tool measurement. Emit a mismatch trace event with run, step, decision, model revision, measurement digest and mismatch kind (`unnecessary_call` or `omitted_necessary_tool`). The EG R042 decision remains authoritative; AU consumes at the existing per-tool span path. Producer/consumer boundary. R134.2 relevance is only a candidate prefilter. AU-HARNESS-R018.5 generic profile metrics do not measure tool necessity. AU run_agent per-tool spans are the consumer boundary. Preserve existing parent obligations: `EG-DECISION-ENGINE-R134.2; AU-HARNESS-R018.5; AU-HARNESS-R024.2/.4`. Source record `AU:86` SHA-256 `38315c5f9a088c33c4b81b88b813ed851f97f454d788c9fb07185c88c752f979`. Parent `R042` remains unchanged. | Planned served acceptance. For each paired fixture, show necessary/not-necessary/unknown results. At the AU call boundary prove every disagreement creates a linked trace event and matching decisions create none. Stale or insufficient evidence must not become a necessity verdict. Served EG and AU receipts remain separate and linked by decision/measurement ids. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R129.100 Human correction to approved, versioned behavioral rule lifecycle Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Human correction to approved, versioned behavioral rule lifecycle.** Bind a correction to tenant, run, original output id/digest and correction author/time. A proposal carries rule id, proposed version, scope, source output, predecessor version and lifecycle state. It remains inactive until explicit approval and the existing R129 invariant gate both pass. Invariant compliance is necessary but never substitutes for approval. Activation supersedes the declared prior version atomically. Revocation names the active version and prevents future use while retaining audit history. AU future invocations consume only the approved current version and return its id/version in the run trace. Producer/consumer boundary. Extend R129 promotion authority and AU future-invocation application; R034 contradiction-retraction remains separate. Preserve existing parent obligations: `EG-DECISION-ENGINE-R129/.3/.5; EG-DECISION-ENGINE-R034`. Source record `AU:38` SHA-256 `1d54abebd7cbc92bd3d6c397f334b42d602b4c3b9f77e0091f1c683774701d72`. Parent `R129` remains unchanged. | Planned served acceptance. Served tests cover correction/output mismatch refusal and proposal-only state. They cover approval plus invariant pass, invariant rejection, version replacement and revocation. Future invocations use only the approved version. Every state transition reads back with actor, version and source-output lineage. Existing R129 invariant behavior stays mandatory. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.100 Public aggregation operation bound to FanoutResult and fleet receipts Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Public aggregation operation bound to FanoutResult and fleet receipts.** Define the generated `AggregateFanout/v1` request. Bind the selected existing `AggregationOp`, TaskPlan digest and AU `FanoutResult` identity. Include expected subtask ids and GraphOS durable instance-receipt ids/digests. Define the result with operation/version, ordered input receipts, one typed aggregate artifact/schema version, result digest and graph revision. EG applies the already-selected operator to the complete receipt set. It adds no fan-out width, concurrency policy or second aggregation authority. A served independent readback resolves the returned artifact by tenant/id/revision and compares the digest before success. Producer/consumer boundary. AU owns FanoutResult production; GraphOS `agents.run` owns durable instance receipts and capacity/refusal. EG owns selected operator and public application/readback contract only. Preserve existing R134.1/.3 and ARBORA-FLEET-R024.5-.9. Preserve existing parent obligations: `EG-DECISION-ENGINE-R134.1/.3; AU-CONTROL-R043.2/.3; ARBORA-FLEET-R024.5-.9`. Source record `AU:30` SHA-256 `8f2ff3030a71d67b20cd19301f0ed8cef75e975403595cec4060abf9fa8952c1`. Parent `R134` remains unchanged. | Planned served acceptance. At served `agents.run` -> AU `_fork_fanout` -> EG aggregation, test all-success results and named failure gaps. Refuse missing, duplicate or stale receipts and concurrent-budget excess. Independently read back the artifact. The output must bind the same selected operation/version and exact AU/GraphOS receipt set. No extrapolated capacity claim is added. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.101 Designated coordinator delivers one complete structured artifact Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Designated coordinator delivers one complete structured artifact.** Extend the existing task plan with one designated `coordinator_id` and a typed final-artifact declaration (schema id/version and artifact kind). The coordinator receives the complete FanoutResult and produces exactly one artifact. Bind each expected subtask id to its result or named failure gap. No result may disappear in synthesis. The artifact and delivery receipt bind plan digest, coordinator, child receipt ids, schema version, artifact digest and final readback identity. Reuse R134 aggregation and AU fan-out. Do not add a second orchestrator. Producer/consumer boundary. EG-selected TaskPlan/AggregationOp -> AU `_fork_fanout` FanoutResult -> named coordinator -> one final artifact. Retains AU-CONTROL-R043.2/.4 named gaps. Preserve existing parent obligations: `EG-DECISION-ENGINE-R134.1/.3; AU-CONTROL-R043.2/.4; AU-HARNESS-R020.4/.8`. Source record `AU:94` SHA-256 `19331af6d24dacefccebddcae637919b39cb111b800e3bd239a68b42b8ad10c7`. Parent `R134` remains unchanged. | Planned served acceptance. The served fan-out test sends multiple outputs and a named failed gap through the coordinator. Read back one structured artifact. Refuse absent coordinator, missing/duplicate child accounting, schema-invalid artifact or mismatched digest. Verify a non-coordinator cannot finalize and every child is accounted for. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.100 Relevance-triggered instruction disclosure with separate initial/runtime versions Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Relevance-triggered instruction disclosure with separate initial/runtime versions.** Define an EG disclosure decision/event bound to instruction-set id, immutable version/digest, relevance trigger, decision id and scope. Initial rules are a distinct phase delivered before the first agent action. Runtime refinements are disclosed only when their declared relevance trigger occurs. Each event records phase, trigger, instruction version/digest, run and sequence, plus applied/refused outcome. EG owns relevance selection; AU run loop applies the exact selected version and records the event. No duplicate local context selector is introduced. Producer/consumer boundary. Existing EG context/decision authority -> AU run loop. General context selection, reminder and trace counters do not cover disclosure. AU sole writer owns runtime application. Preserve existing parent obligations: `EG-DECISION-ENGINE-R137; AU-HARNESS-R024.2/.6`. Source record `AU:59` SHA-256 `0b55041f0517baa9de449e3d712356a0e252cd194365e09ae559e9067cc8eb1f`. Parent `R137` remains unchanged. | Planned served acceptance. Through served Decide and the AU run-loop consumer, prove initial instructions precede execution. Withhold runtime refinement before its trigger, disclose it at the trigger and trace-link each disclosure. Stale or unauthorized instruction revisions refuse without application. Verify distinct initial/runtime tags and exact version readback. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.101 Held-out question identity and full/compressed answer comparison in replacement gate Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Held-out question identity and full/compressed answer comparison in replacement gate.** Extend this existing replacement gate with held-out question identity. Bind full and compressed answer digests for comparison. Record declared tolerance for answer quality degradation. Define typed verdict when paired answer comparison fails. Retain raw context when paired verdict fails. Prove tests compare identified held-out questions. Producer/consumer boundary. AU ContextManager gates context replacement; EG verdict controls raw/summary selection. Preserve AU-HARNESS-R013 validation contracts. Source record `AU:37` SHA-256 hash pending. | Served replacement gate accepts full answer and summary. Degradation below tolerance retains raw context. Failed paired verdict returns typed refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R137.102 Recursive call signature producer and validation at every boundary Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Recursive call signature producer and validation at every boundary.** Extend existing recursive request/result contracts with input/output and admitted tool signatures. Bind primitive/function handle and span digests. Record each recursive sub-model's typed input/output signature and tool binding. Validate signature at every call boundary with refusal on mismatch. Define signature/model/tool trace binding through execution. Producer/consumer boundary. AU run_full_rlm/RLMEnvironment executes within EG limits. EG records and validates signatures. Preserve AU-HARNESS-R026 request tracing. Source record `AU:40` SHA-256 hash pending. | Served recursive calls bind all signatures and tool admits. Mismatched signature refuses with evidence of expected/actual. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.102 Delegation quality threshold over a stable outcome window Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Delegation quality threshold over a stable outcome window.** Define an EG delegation-admission verdict. Bind task class, quality metric, declared threshold and observation-window start/end. Record sample count, outcome-set digest and policy revision. Admit delegation only when the measured quality over the complete stable window meets the declared threshold. Insufficient samples, gaps, mixed revisions or stale evidence return typed not-ready/refusal. AU executes delegation only against the committed verdict. Do not substitute retrieval saturation, generic test coverage or a free-floating data-plane window. Producer/consumer boundary. EG owns authoritative TaskPlan/delegation admission; AU executes the admitted plan. Existing retrieval quality-saturation logic is adjacent only. Preserve existing parent obligations: `EG-DECISION-ENGINE-R134.1/.3; EG-FEDERATED-QUERY-R082`. Source record `AU:24` SHA-256 `7cbecf865c6185e23ec202d541c5f8d33388338af413ac06209709c619fbe200`. Parent `R134` remains unchanged. | Planned served acceptance. Served Decide matrix proves below-threshold and unstable/incomplete windows refuse, while a complete above-threshold window admits. Mutate a sample, threshold, metric or policy revision and require a new verdict. AU consumer demonstrates no delegation effect on refusal. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.103 Summary-only sub-run return schema and parent-remaining context Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Summary-only sub-run return schema and parent-remaining context.** Extend the existing fan-out result and trace contract with summary fields. Bind parent budget enforcement and decision/child/summary links atomically. Define typed rejection of raw oversized returns. Record each sub-run's summary digest and parent-context remainder. Producer/consumer boundary. EG decides delegation; AU summary producer returns only the bounded result. Preserve existing fan-out obligations and planning authority. Source record `AU:39` SHA-256 hash pending owner validation. | Served fan-out routes the typed summary and budget enforcement. Oversized/raw result refusal is typed. Parent remainder is retained after verdict fails. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.104 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define AnswerCandidateRankingV1 under the decide contract. It binds candidate ids, pairwise comparison records, verifier_present as false, global order, tie rule, retained ids and revision actions. | A schema test round-trips the record and rejects a missing tie rule. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.105 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The engine must compare answer candidates pairwise without a verifier. It must derive one global order. Equal scores must order by the lowest candidate id. The engine must retain the top k candidates and must propose bounded revisions for the others. | A fixture of four candidates yields the expected order, retention and revision actions. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.106 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The ranking attaches in handle_decide beside the existing task-plan decisions. The served response carries the ranking. A readback call returns the recorded ranking by decision id. | A served Decide call returns the ranking, and the readback returns the same record. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.107 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The engine must refuse a ranking request that names a verifier, has fewer than two candidates, or exceeds the revision bound. Each refusal must carry a typed reason. | Each refusal case returns its typed reason and records no ranking. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.108 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit one premise per pairwise comparison and one for the global order. It must record the retained set and every revision action. | A trace shows the premises, the retained set and the revision actions. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.109 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served Decide wire method. The integration test is tests/decide/test_answer_ranking_served.py::test_revisions_only_for_non_retained. It observes revisions only for non-retained candidates and reads the ranking back. | That test passes against the served engine. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.100 Trace-derived fix admission requires paired before/after regression receipts Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Trace-derived fix admission requires paired before/after regression receipts.** Define a correction proposal bound to failed-run trace digest, proposed fix revision, exact regression-test identity and test environment. Require a before receipt showing the test fails at the declared pre-fix revision. Require an after receipt showing it passes at the declared post-fix revision. Both receipts bind test digest, source revision and run identity. Mismatch, missing receipt or reversed outcome refuses. Reuse existing correction/admission authority and preserve propose-only flow. Producer/consumer boundary. AU CorrectionProposal/study_admit supplies trace and benchmark; EG decides admission. Generic benchmark lift does not replace paired proof. Preserve existing parent obligations: `EG-DECISION-ENGINE-R136.1-.6; AU-HARNESS-R004.1; AU-HARNESS-R019.9/.10`. Source record `AU:32` SHA-256 `1d12449ecff9c30c5999933324f1f705fd826539eba6182f3e6d2773c263fec3`. Parent `R136` remains unchanged. | Planned served acceptance. Positive paired test uses identical test digest and environment across before/after revisions and proves fail then pass. Negative cases alter either revision/test digest, omit a receipt, pass before or fail after. Each refuses admission. Read back the admitted proposal with both receipt links. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R031.100 Paper relevance admission against platform goals and graph content Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Paper relevance admission against platform goals and graph content.** Define an EG per-paper admission request/decision. Bind paper locator/content digest, summary digest and platform-goal/graph-snapshot revisions. Record relevance dimensions/scores, threshold and selected claim ids. Select a paper for ingestion only when it meets the relevance rule against platform goals and current graph content. The verdict names the scored evidence and selected claims. Excluded papers produce no graph write. This definition covers scoring/admission only, not scheduled retrieve. Producer/consumer boundary. GraphOS owns six-hour durable scheduler; SDK owns paper retrieve/provider receipts; EG owns relevance scoring/admission and selected-claim contract. Preserve existing parent obligations: `EG-DECISION-ENGINE-R031; ARBORA-OPS-R022.2; SDK-SOURCE-INGEST-R005`. Source record `AU:41` SHA-256 `8c69b66d62c833b4da482e38a51efa624c3e3fc924d6fd6d3e2ef114378a8527`. Parent `R031` remains unchanged. | Planned served acceptance. For served EG admission, test a paper relevant to both goals and graph. Also test one relevant to only one, below threshold and duplicate/stale snapshots. Only the both-relevant accepted record yields a selected-claim ingestion request. Read back the decision and source bindings. Do not claim six-hour schedule or provider retrieve is implemented. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R036.100 Typed substitutable prompt, tool, memory and control-flow primitives Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed substitutable prompt, tool, memory and control-flow primitives.** Extend graph.assemble primitives to a closed typed union covering prompt, tool, memory and control-flow components. Each primitive exposes identity/version, input/output schema digest, capability/effect declaration and substitution compatibility contract. A candidate harness graph is accepted only when every edge type-checks and replacement preserves declared capabilities/effects. Recorded run traces can create improvement proposals for each primitive kind, but proposals never mutate active composition. Producer/consumer boundary. EG graph.assemble is composition authority; AU HarnessPort executes selected composition. Existing prompt-only optimization proposal path remains and typed HarnessPort is preserved. Preserve existing parent obligations: `EG-DECISION-ENGINE-R036; AU-CONTROL-R002; AU-HARNESS-R007/.011`. Source record `AU:46` SHA-256 `04556089bf2790a52c59ede225b6212ccd90c0f7ca1dfad07b869ac9de6a19a1`. Parent `R036` remains unchanged. | Planned served acceptance. Test substitution for all four primitive classes. Include compatible/incompatible schema/effect changes. Keep trace-derived proposals inactive until normal admission. Served assembly receipt names each primitive/version and compatibility proof. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.101 Per-criterion report revision nonregression Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Per-criterion report revision nonregression.** Bind each report revision to a stable rubric digest and criterion ids. Record prior satisfaction states, new evidence/outcome ids and independent grader revision. For every previously satisfied criterion, the new revision must preserve satisfaction. A regression blocks promotion and records the failing criterion. Self-reflection text is not a measured outcome. Use AU ContinuousEvaluationEngine reports as inputs and preserve EG R136 round verdict authority. Producer/consumer boundary. AU ContinuousEvaluationEngine produces per-criterion evidence/report revisions; EG evaluates the bound round verdict. Aggregate divergence and self-reflection are not criterion-level nonregression. Preserve existing parent obligations: `EG-DECISION-ENGINE-R136.1/.2/.4; AU-HARNESS-R021.3/.6`. Source record `AU:47` SHA-256 `9f72c0e6cb8d476050ffde54043ba0e37a063bfda05eb3e27020312cd9eeb69b`. Parent `R136` remains unchanged. | Planned served acceptance. Start the served sequence with satisfied and unsatisfied criteria. Apply process-level feedback. Accept nonregressing revisions and refuse a previously satisfied criterion regression. Mutating rubric or prior report digest invalidates the comparison. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R121.100 Step verification binds uncertainty and trace proof before continuation Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Step verification binds uncertainty and trace proof before continuation.** Define a `StepVerification`. Bind run/step id, input/output digests and evidence ids. Record verifier/policy revision, uncertainty interval and proof/trace digest. Each reasoning step receives a typed verdict (`verified`, `failed`, `uncertain`). Only `verified` steps may feed dependent conclusions. A failed or uncertain step and all derived dependents are withheld/refused with the dependency chain named. Reuse typed Claim/Evidence provenance. A Claim class alone does not imply step verification. Producer/consumer boundary. EG owns proof/evidence/verdict; AU run execution gates continuation on the returned verdict. Existing Claim/Evidence and ordered trace digest semantics remain intact. Preserve existing parent obligations: `EG-DECISION-ENGINE-R121 typed Claim/Evidence; AU run-step continuation owner`. Source record `AU:54` SHA-256 `78c1b58ee2c97f19ad4834981d1b75adeb89c82881710aed055a0cc6f5c36760`. Parent `R121` remains unchanged. | Planned served acceptance. The served AU/EG chain verifies a supported step and rejects an under-evidenced step. Downstream conclusions must be absent for failed/uncertain dependencies. Alter proof digest, evidence revision or uncertainty bounds and require re-verification. Trace readback shows the entire dependency chain. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R138.100 Adversarial generated-code verifier is a mandatory admission gate Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Adversarial generated-code verifier is a mandatory admission gate.** Define a changeset-bound adversarial verifier request over generated artifact digest, declared tests, threat/attack policy revision and verifier revision. Its receipt enumerates attempted break cases and edge-case ids with fixed/retested state. Require a complete verifier receipt for generated-code admission. Fix each surfaced edge case against a new artifact digest and recheck it. Unresolved, missing, stale or mismatched cases block acceptance. Keep materialization under existing governed write authority. Producer/consumer boundary. AU generates/proposes code and verifier evidence; EG admission consumes it. Existing governed write path retains materialization authority. ProbeVerdict R138.1-.6 is a separate red-team probe capability. Preserve existing parent obligations: `EG-DECISION-ENGINE-R138.1-.6; existing correction/evaluation admission and governed write path`. Source record `AU:55` SHA-256 `3d07d9e40d19b8d4502fcbf3fc2e682f67bcdeaa0730d5d698f7af32767bb785`. Parent `R138` remains unchanged. | Planned served acceptance. Served admission accepts only a complete receipt matching the proposed artifact digest. Every edge case must be resolved and retested. Negative cases include skipped verifier, unresolved edge case, stale artifact, changed tests and failed recheck. None can activate/write code. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R136.102 Outcome, rubric and artifact-bound criterion grading required before proposal admission Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Outcome, rubric and artifact-bound criterion grading required before proposal admission.** Require proposal evidence bound to declared outcome and immutable rubric id/version/digest. Bind the exact graded artifact id/digest and grader revision. Include a score/verdict and evidence reference for every rubric criterion. Every required criterion must be graded. Missing, ungraded, mismatched or stale artifacts return a typed refusal before any proposal is admitted. Aggregate score cannot hide a missing criterion. Producer/consumer boundary. AU study_admit/ContinuousEvaluationEngine supplies the report; EG decision verdict controls admission. Preserve R019/R021 evidence and per-criterion R136.101 behavior. Preserve existing parent obligations: `EG-DECISION-ENGINE-R136.1/.2/.4; AU-HARNESS-R019.9/.10; AU-HARNESS-R021.1/.6/.7`. Source record `AU:56` SHA-256 `712793000145f8e6b1c3ac1de647e91256312eb601def299653a9671de2757ba`. Parent `R136` remains unchanged. | Planned served acceptance. Serve one fully graded report admitted against a proposal. Refuse missing outcome/rubric, ungraded criteria, wrong artifact digest, stale rubric or absent grade evidence. Read back the proposal and prove no admission side effect on refusal. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R138.101 Five-class semantic changeset review with evidence and impact filtering Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Five-class semantic changeset review with evidence and impact filtering.** Define a review request bound to base/head revisions and changed-file digest. The semantic review evaluates injection, authentication bypass, data exposure, cryptographic flaws and business-logic flaws. Each finding carries class, affected path/range, exploit/impact evidence, severity, confidence and trace to reviewed artifact. A versioned impact policy filters low-impact false positives with a retained disposition. No high-impact or unreviewed class may be silently dropped. This is distinct from R138 probe scorer selection. Producer/consumer boundary. EG owns review verdict/schema. Named GraphOS authenticated changeset-review producer/consumer must be served and linked separately. Existing R138.3 probe endpoint is not that consumer. Preserve existing parent obligations: `EG-DECISION-ENGINE-R138.1/.2/.5; GraphOS changeset review owner pending exact served integration`. Source record `AU:83` SHA-256 `0c5f2631be262ba69472eb94841b7acfbcfd6d0cb379382c528ccd0efb4d22e7`. Parent `R138` remains unchanged. | Planned served acceptance. Served review fixtures include one finding from each class, one evidence-backed low-impact false positive, and an injected high-impact finding. Verify five-class coverage, changed-range binding, evidence retention and filtering disposition. Reject missing revision, unsupported class, absent proof or silently omitted high-impact findings. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R036.101 Compose discovered coding-agent facts with skill transformations Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Compose discovered coding-agent facts with skill transformations.** Extend graph.assemble with verified coding-agent facts: identity, capability and path-discovery receipt/revision. Include ordered skill transformation ids/versions and input/output schema digests. EG chooses only from supplied verified facts and emits a deterministic composition plan binding agent, skills and artifact contract. It never scans PATH or renders a UI. AU owns executable discovery; WebUI owns sandboxed frame rendering. Producer/consumer boundary. EG composition authority -> AU PATH discovery and skill execution -> WebUI isolated generated-artifact frame. Existing DESIGN guidance does not provide these producer/consumer receipts. Preserve existing parent obligations: `EG-DECISION-ENGINE-R036; AU-CONTROL-R003; AU-HARNESS-R009; WEBUI-DESIGN-R001; WEBUI-APPS-R001`. Source record `AU:107` SHA-256 `d179fc0eb33039df3a87efe8a59ce2a635f0e39f360c58f925011448d0401cdc`. Parent `R036` remains unchanged. | Planned served acceptance. Served EG assembly accepts verified agent/skill facts and returns a plan with exact revisions and transformation order. Refuse absent/stale discovery receipts, incompatible transformation schemas or changed artifact digest. Separate AU discovery receipt and WebUI sandbox receipt must be linked for end-to-end closure. No runtime implementation is claimed. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R014.100 Choose the smallest adequate legal solution from explicit size and cost facts Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Choose the smallest adequate legal solution from explicit size and cost facts.** Extend bounded composition with candidate source-size facts: exact artifact bytes and line count. Bind measured per-run cost, adequacy verdict and legal/policy constraints to candidate/revision. First exclude candidates failing required behavior, tests, policy or legal constraints. Among adequate candidates apply the declared size/cost objective and emit each measured fact and tie-break. Unknown size/cost or adequacy evidence cannot be treated as zero. This child does not settle the shortcut-comment policy, which remains held for coordinator resolution. Producer/consumer boundary. Reuse R014 exact bounded solver/graph.assemble authority. AU records execution cost. Code-size measurement and candidate adequacy feed EG. Preserve legal/policy constraints and hold comment-style conflict. Preserve existing parent obligations: `EG-DECISION-ENGINE-R014 existing bounded composition semantics; AU-HARNESS-R009; AU-CONTROL-R006; AU108 comment-policy conflict held`. Source record `AU:108` SHA-256 `2dfb2ab7469f19faf03d91782fa276ed2c613dec2e1d1fce2c629e5b8974b476`. Parent `R014` remains unchanged. | Planned served acceptance. Tiny exhaustive candidates prove the selected result is the smallest/cost-optimal eligible composition under the declared objective and constraints. Test equal-size/cost ties, unknown facts, inadequate smaller candidate and illegal candidate refusal. The output preserves separate size and cost measurements. No test imposes or removes shortcut comments. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R147 Index-time distillation of language-model relevance judgments (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Index-time distillation of language-model relevance judgments (rollup).** Index-time scoring replaces query-time model calls. Define teacher-quality ranking scores persisted per document. Declare score identity, revision and fidelity bounds. Define query-time ranking that accepts pre-computed scores. Children `.1`–`.6` deliver it. | Served ranking chains distilled scores from index; no models called. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R147.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `TeacherJudgmentV1{document_id, score, fidelity, scorer_id, scorer_revision}`, `DistilledRankerV1{candidate_ids, scores, score_digest}`, `QueryTimeRankingV1{top_k, no_model_call_contract}`. Each score binds document id, exact value, fidelity bounds and scorer provenance. No query-time model is permitted. Proving test: `crates/eg-types/src/decision/distilled_ranker.rs::tests::distilled_scores_round_trip`. | Round-trip preserves all field types; rejects missing scorer/digest. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R147.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Index builds a fully populated scorer and persists all document scores. Query-time ranking selects top-K by stored score only. No dynamic reranking, feature computation or model inference occurs at query time. Score lookup is O(1) per candidate. Preserve existing retrieval flow and collection boundaries. Proving test: `crates/eg-types/src/decision/distilled_ranker.rs::tests::no_query_time_calls`. | Query-time code path makes no model transport call. Top-K selection uses exact stored scores. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R147.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Index producer computes teacher scores offline. Route through index-time ETL. Query consumer reads stored scores in `src/server/handlers/query/planning.rs:424`. No fallback to live scoring permitted. Proving test: `src/server/handlers/query/federated_tests.rs::distilled_ranking_wired`. | Served query returns only stored scores. Missing scores are handled by refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R147.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Missing document score, stale scorer revision or zero score count refuse. Refusing before ranking. Invalid top-K bounds refuse. Proving test: `src/server/handlers/query/federated_tests.rs::missing_score_refuses`. | Negative cases cover absent documents, stale scorer, invalid K. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R147.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind scorer id/revision/digest, all document ids and scores, fidelity bounds and persisted-score timestamp. Record that no live scoring occurred. Proving test: `src/server/handlers/query/federated_tests.rs::distilled_evidence_binds_scorer`. | Decision records scorer version, score count and zero-model-call proof. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R147.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::UnifiedQuery` with distilled ranking. Observe top-K results from persisted scores. Cross-owner: AU consumer accepts no-model-call contract. Proving test: `tests/query/test_distilled_ranking_served.py::test_index_time_scoring_and_query_ranking`. | Query served with stored scores; zero model calls recorded. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R148 Typed command-config/mode schema and loading/replay contract (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed command-config/mode schema and loading/replay contract (rollup).** Define versioned command/config/inference-mode producer. EG decides mode; AU command loader applies config. Define reproducible receipt bound to config and inputs. Children `.1`–`.6` deliver it. | Served decision binds config schema; AU receipt proves replay. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R148.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `CommandConfigV1{schema_id, mode_id, config_digest, settings_hash}`, `ModeDecisionV1{mode, config, validation_rules}`, `ConfigReplayReceiptV1{config_digest, input_digest, result_digest}`. Config schema is versioned and bound to mode. Each config is immutable and hashable. Proving test: `crates/eg-types/src/decision/command_config.rs::tests::config_round_trip`. | Round-trip preserves schema, mode, settings and hash. Rejects unknown schema. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R148.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** EG selects mode and config based on decision inputs. Config is immutable after decision. AU loader validates config against declared schema before application. Repeated same-input invocation must produce identical result/receipt. Invalid config is refused at load time. Proving test: `crates/eg-types/src/decision/command_config.rs::tests::replay_idempotence`. | Same input/config yields same output digest. Changed config yields different result. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R148.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend `Method::Decide` to route mode selection through existing EG decision path. Wire schema validation into AU `HarnessConfig` loader. Config is supplied immutably to execution. Proving test: `src/server/handlers/decide/stat_tests/command_config_tests.rs::decide_routes_mode`. | Served decision returns mode and validated config. AU receipt links applied config. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R148.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Unknown schema, stale mode revision or invalid config against schema refuse before execution. Changed config between decision and invocation refuses. Proving test: `src/server/handlers/decide/stat_tests/command_config_tests.rs::invalid_config_refuses`. | Negative cases cover schema mismatch, stale mode, changed config. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R148.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind schema id/version/digest, mode id, config digest and settings hash. Record validation rules applied and AU loader acceptance. Proving test: `src/server/handlers/decide/stat_tests/command_config_tests.rs::config_evidence_binds_schema`. | Decision record lists schema, mode and validation outcome. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R148.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::Decide` mode selection. Apply config through AU command loader. Verify replay and result stability. Proving test: `tests/decide/test_command_config_served.py::test_mode_decision_and_replay`. | EG served decision; AU loader validates and applies config. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R149 Search-state record combining transcript, evidence, constraints and claims (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Search-state record combining transcript, evidence, constraints and claims (rollup).** Define unified search-state binding all four dimensions. No continuation contract restores incomplete state. Define context-eviction readback acceptance. Children `.1`–`.6` deliver it. | Served search continuation reads complete four-field state. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R149.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `SearchStateV1{transcript_digest, evidence_set_digest, active_constraints, open_claims, state_version, timestamp}`. Include all four fields immutably. Transcript is conversation history digest. Evidence set is all cited sources digest. Constraints are current search rules. Claims are unresolved questions. Proving test: `crates/eg-types/src/decision/search_state.rs::tests::state_round_trip`. | Round-trip preserves all four fields and version/timestamp. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R149.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Capture state atomically after each message. State restores all four components after context eviction. No field may be partially recovered or reconstructed. State version increments on any change. Proving test: `crates/eg-types/src/decision/search_state.rs::tests::eviction_readback`. | Eviction + readback recovers identical transcript, evidence, constraints. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R149.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend AU harness continuation interface to accept and emit complete search state. Route through durable memory store for persistence. Proving test: `src/server/handlers/query/search_tests.rs::state_continuation_wired`. | AU consumer reads state; durable store persists all fields. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R149.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Incomplete state, missing field or stale version refuses continuation. Proving test: `src/server/handlers/query/search_tests.rs::incomplete_state_refuses`. | Negative cases cover missing transcript, evidence, constraints. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R149.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind all four field digests, state version and recovery timestamp. Proving test: `src/server/handlers/query/search_tests.rs::state_evidence`. | Record lists all four field digests and version. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R149.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve search continuation with complete state. Observe all four fields restored post-eviction. Proving test: `tests/query/test_search_state_served.py::test_eviction_and_recovery`. | Continuation restored identical transcript, evidence, constraints. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R150 Session-note capture and reuse with stale/conflict behavior (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Session-note capture and reuse with stale/conflict behavior (rollup).** Define automatic session-note capture from prior runs. Extend memory/context consumer to apply captured notes. Define stale and conflicting note behavior. Children `.1`–`.6` deliver it. | Served context includes automatically captured prior session notes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R150.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `SessionNoteV1{note_digest, session_id, user_id, task_id, timestamp, relevance_score}`, `NoteCacheV1{current_notes, stale_notes, conflict_notes}`. Notes are tenant-isolated and content-addressed. Relevance is a [0,1] score from content matching. Conflicts arise when different outcomes occur for identical input. Proving test: `crates/eg-types/src/decision/session_notes.rs::tests::notes_round_trip`. | Round-trip preserves all note fields and relevance. Rejects unknown user. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R150.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Capture notes automatically from successful runs. Apply notes when relevance exceeds threshold (default 0.7). Stale notes (>7 days) are marked but retained for audit. Conflicting notes (same input, different output) are both retained with conflict flag. No note overwrites another; all precedents stay visible. Proving test: `crates/eg-types/src/decision/session_notes.rs::tests::capture_and_apply`. | Relevant notes applied; stale notes marked; conflicts visible. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R150.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend AU context consumer to read captured notes from EG memory. Route through authorized memory dispatch respecting tenant isolation. Proving test: `src/server/handlers/decide/memory_tests.rs::notes_wired`. | Authorized context read includes captured notes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R150.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Missing user id, invalid relevance (not in [0,1]) or unauthorized user refuses note read. Stale >14 days are archived but may be retrieved. Proving test: `src/server/handlers/decide/memory_tests.rs::unauthorized_refuses`. | Negative cases cover invalid user, relevance out of range. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R150.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind user/task/session ids, note digest, capture timestamp and applied relevance score. Record whether note was stale/conflicting. Proving test: `src/server/handlers/decide/memory_tests.rs::notes_evidence`. | Record lists applied notes with relevance and staleness. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R150.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve authenticated query with automatic session-note capture. Apply relevant notes to context. Observe stale/conflict handling. Proving test: `tests/query/test_session_notes_served.py::test_capture_and_reuse`. | Query served with captured notes; conflicts visible to consumer. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R151 Importance-weighted penalty resisting feature loss and post-sync consolidation (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Importance-weighted penalty resisting feature loss and post-sync consolidation (rollup).** Define importance evidence for each feature. Apply weighted penalty to loss. Separate consolidation from routing. Children `.1`–`.6` deliver it. | Serve feature importance; post-sync consolidation queued separately. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R151.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `FeatureImportanceV1{feature_id, importance_weight, evidence_digest}`, `PenaltyObjectiveV1{loss_coefficient, importance_scale}`. Importance is [0,1] normalized. Each feature binds measured importance and evidence source. Penalty objective combines loss and importance linearly. Proving test: `crates/eg-types/src/decision/importance_penalty.rs::tests::importance_round_trip`. | Round-trip preserves feature id, weight, evidence. Rejects weight outside [0,1]. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R151.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Compute weighted loss = loss_component + importance_scale * importance_weight * feature_loss. High-importance features incur higher penalty on loss. Preserve low-importance feature variability. Proving test: `crates/eg-types/src/decision/importance_penalty.rs::tests::penalty_respects_importance`. | High-importance feature loss incurs larger penalty than identical low-importance loss. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R151.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend embedding producer to emit feature importance. Route penalty through EG solver. Separate post-sync consolidation trigger from routing logic. Proving test: `src/server/handlers/decide/embedding_tests.rs::penalty_wired`. | Embedded importance; penalty computed; consolidation queued separately. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R151.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Invalid importance (not in [0,1]), missing evidence or zero feature count refuse. Proving test: `src/server/handlers/decide/embedding_tests.rs::invalid_importance_refuses`. | Negative cases cover out-of-range weights, missing evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R151.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind each feature id, importance weight and evidence digest. Record penalty objective and applied loss/importance scales. Proving test: `src/server/handlers/decide/embedding_tests.rs::penalty_evidence`. | Record lists all feature weights, evidence and penalty scale. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R151.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve embedding with importance weights. Apply weighted penalty. Verify post-sync consolidation is queued, not routed. Proving test: `tests/decide/test_importance_penalty_served.py::test_penalty_and_consolidation_queue`. | Penalty computed; consolidation separately queued post-sync. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R140 Trajectory refinement and ranking family (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Trajectory refinement and ranking family (rollup).** Groups complexity-gated K-trajectory deliberation, provenance-preserving experience reinsertion, outcome-driven branch breadth and verifier-free pairwise ranking. Preserve calibrated-ranking requirements in R130 and AU generation/execution ownership. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R141 Memory-change evaluation and rewrite admission (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Memory-change evaluation and rewrite admission (rollup).** Requires fidelity and memory-quality evidence before activating a memory change. Failed candidates preserve the prior active memory. R060 fitted-head promotion remains a separate model gate. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R142 Atomic-before-workflow local-model certification (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Atomic-before-workflow local-model certification (rollup).** Defines the EG attestation producer, AU local-model evaluation consumer and GraphOS validation gate. Existing GraphOS R034 identity bindings and host policy remain authoritative. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R139.100 Graph-backed comparative sources with exact revision provenance Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Graph-backed comparative sources with exact revision provenance.** Extend comparative `StudySource` admission with a `graph_ref` containing tenant, graph, node, revision and content digest. Resolve the exact revision through the authorized graph read/query path. Compare papers and codebases from graph refs alongside existing filesystem sources without copying source bodies. Record ordered source kind, locator/reference, exact revision, digest and comparison membership in the comparative result. Missing, stale, invisible or digest-mismatched graph references refuse before comparison. Preserve filesystem intake and AU study/feature ownership. Preserve existing parent obligations: `EG-DECISION-ENGINE-R139`. Source record `AU:58` SHA-256 `f13717cacb9e87ff76591467e17b5f9d76d44577f62d71b57d57c42bc89d37ba`. | Serve one graph paper, one graph codebase and one filesystem source in the same comparison. Assert exact ordered references, revisions and digests in readback. Refuse stale, unauthorized and mismatched graph refs before comparison, while filesystem-only intake remains valid. AU consumer receipts remain a separate dependency. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R019.100 Decision-wide evidence provenance and human approval before recommendation commit Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Decision-wide evidence provenance and human approval before recommendation commit.** Bind each decision record to its id/revision. Record the simulation, inspection and process-knowledge stream ids/revisions/digests used. Expose an authorized reviewer-readable provenance read. Before any recommendation commit, require an approval receipt bound to decision revision and recommendation digest. Include reviewer principal, approval time and approval-record revision. Missing, stale or mismatched approval refuses before commit. Retain existing R019 re-derivation/CAS and R047 reference semantics. Do not duplicate governed-effect audit rows. Preserve existing parent obligations: `EG-DECISION-ENGINE-R019`. Source record `GRAPHOS:17` SHA-256 `0e4858352b73b18661ed21ef503cc4c4f36e72045c3ffeff8d2094d9f8f8e50a`. | Serve a decision with all three evidence streams and independently read back exact provenance. Refuse a recommendation commit with missing, stale, wrong-reviewer-scope or digest-mismatched approval and prove no decision revision/effect changed. Approve the exact revision, commit once, and verify reviewer provenance and idempotent retry under R019. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R029.100 Typed retrieval command configuration and inference-mode digest binding Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed retrieval command configuration and inference-mode digest binding.** Define a versioned typed command-config document per retrieval command. Bind command id/schema version, typed parameters and referenced inference-mode id/version/digest. EG Decide binds the retrieval plan and inference-mode digest to its decision. AU loads the immutable command file and validates its schema. Its mode digest must match the EG decision before use. AU run evidence binds command/config digest, mode digest, input digest, selected-plan revision and result digest. Missing, malformed, stale or mismatched configuration refuses before execution. File loading remains AU-owned. Preserve existing parent obligations: `EG-DECISION-ENGINE-R029`. Source record `PIPE:22` SHA-256 `0d3964cba3359a3b454f2fd7b61f2b893b3aec0d58613062b859c2201344980c`. | Through the real retrieval command, load a valid file. Assert config/mode/plan digests in the run record. Refuse missing file, invalid typed field, unknown mode and stale/mismatched mode digest before command effects. Repeat the same command/input and verify identical config, mode and decision bindings. Do not assert result determinism beyond declared source behavior. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R140.100 Complexity-gated K-trajectory decision Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Complexity-gated K-trajectory decision.** Extend the existing `Method::Decide` / `QuestionKind::TaskPlan` path from R134.5. Do not execute models in EG. The request binds task id/digest and ordered complexity features. Each feature has id, value, unit and source ref/revision/digest. Bind scorer id/revision/digest and policy id/revision/digest. The policy declares the score calculation/units, threshold, simple branch K=1, and complex-branch permitted K range `[2,max_k]`. Return `TrajectoryBudgetDecisionV1` with decision id/revision/digest, all input and policy digests, score, branch and permitted K. It is a plan for AU, not a deliberation result. AU must bind every alternative and execution receipt to this decision digest. AU-CONTROL-R043 independent-subtask fan-out does not cover this consumer. Missing or stale features/scorer/policy, unpinned score calculation, invalid K, or complex K<2 refuses before AU execution. Preserve existing parent obligations: `EG-DECISION-ENGINE-R140`. Source record AU:44 SHA-256 `74416937af9a4934ae1f5d1a02e30336deb1535189a07f53fb81fb352f81779f`. **Pending owner prerequisite:** AU has no reviewed `orchestrate` consumer field binding the decision digest to K trajectory requests/results. Keep the row SPECIFIED until that contract and served receipt exist. | Named served acceptance: `tests/decide/test_trajectory_refinement_served.py::test_complexity_selects_single_or_bounded_k` proves simple K=1 and no deliberation dispatch, and complex K in `[2,max_k]` with exact plan digest. `::test_complexity_policy_and_k_refusals` covers missing/stale scorer, absent policy and invalid/below-minimum K. AU execution receipt acceptance remains an explicit AU dependency. No producer evidence is inferred. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R140.101 Provenance-preserving trajectory projection and reinsertion Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Provenance-preserving trajectory projection and reinsertion.** The TaskPlan/Decide path binds each source trajectory by run id, candidate id, source revision and trace digest. Return the pinned redaction-policy id/revision/digest and tokenizer id/revision. Record removed reasoning-token half-open ranges, retained task/result/evidence ranges, deterministic shuffle seed, and ordered projected ids. AU performs the projection and deliberation. Return a new candidate id/digest and the exact decision digest. Name every consumed source id/digest in its parent list. Accept the new outcome only after validating source revisions and non-overlapping in-bounds ranges. Also validate policy/tokenizer revisions and complete parent bindings. Source trajectories are immutable. Producer is AU `record_outcome -> SkillGraphPipeline` (AU-HARNESS-R022.4). No AU projection/reinsertion receipt defines these fields. This child does not claim existing implementation. Preserve existing parent obligations: `EG-DECISION-ENGINE-R140`. Source record AU:51 SHA-256 `be286cbd079c08493be1dcc0512aa562b6e2f2fec8d3566437837d91b5f36ba0`. **Pending owner prerequisite:** AU must specify the exact projection and appended-candidate receipt on R022.4 before end-to-end acceptance. | Named acceptance: `tests/decide/test_trajectory_refinement_served.py::test_projection_preserves_sources_and_links_candidate` verifies deterministic projection order, removed/retained ranges and source readback; `::test_projection_refuses_bad_ranges_or_missing_parent` proves range/provenance refusal without source mutation. AU R022.4 receipt and deliberation generation remain separate unserved dependencies. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R140.102 Branch-start experience retrieval and outcome-driven breadth Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Branch-start experience retrieval and outcome-driven breadth.** On the R134.5 `Method::Decide` / `QuestionKind::TaskPlan` path, accept search id, branch id/ordinal, tenant and plan digest. Bind ordered prior-attempt refs, each `{branch_id, outcome_revision, outcome_digest, result_class}`, and `BreadthPolicyV1` id/revision/digest. The policy declares the outcome-to-breadth mapping and an initial breadth used only when history is explicitly absent. Return `BreadthDecisionV1` binding the complete retrieved-history digest, previous breadth, selected breadth, policy, task and decision digests. Stale, unauthorized, cross-tenant or incomplete history refuses and is never interpreted as a zero outcome. AU must put decision id/digest and selected breadth in each branch request. Return an outcome receipt tied to that decision before the next branch adapts. Existing AU attachment points are `_dispatch_parallel_batch -> parallel_batch_processor` (R020.5) and `record_outcome -> SkillGraphPipeline` (R022.4). Neither currently binds this breadth decision. Preserve existing parent obligations: `EG-DECISION-ENGINE-R140`. Source record AU:84 SHA-256 `b56fbf074624786b4a8c2b499f985ecc2d14d1e8349d08781cf28aba07c3abef`. **Pending owner prerequisite:** AU branch-start and outcome receipt fields are not defined. Keep SPECIFIED until reviewed and served. | Named acceptance: `test_later_branch_adapts_from_pinned_outcome` records and reads an earlier outcome at the next branch start. Prove the pinned mapping changes breadth. `test_branch_history_refuses_stale_or_cross_tenant` refuses stale/unauthorized history. `test_no_history_uses_declared_initial_breadth` verifies explicit absence. AU R020.5/R022.4 receipt acceptance remains pending and is not claimed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R140.103 Verifier-free pairwise candidate ranking with bounded revision Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Verifier-free pairwise candidate ranking with bounded revision.** Bind the ordered candidate set and digests to pairwise records. Each record has both candidate ids/digests, judge/model revision, verdict and evidence digest. AU:87 requires global ranking, retained top candidates and bounded revision of the rest. It does not select aggregation rules for cycles, incomplete pairs or ties. Existing R130 calibrated relevance ranking is not a pairwise aggregation rule. Do not assume Bradley–Terry or publish rankings before owner selection of a versioned aggregation policy. It must specify cycle/incomplete-pair/tie cases and keep-count/revision bounds. The existing `Method::Decide` TaskPlan path is the proposed EG decision boundary; AU owns comparison execution and revisions. Missing/unpinned aggregation policy, incomplete policy-required pairs, digest mismatch or absent revision limits refuses before any revision request. Preserve existing parent obligations: `EG-DECISION-ENGINE-R140`. Source record AU:87 SHA-256 `6f67238075c0bf262188d97a1813b18bfb0c71e13c6689a583c788d956287612`. **Exact source decision hold:** AU:87 provides no pairwise aggregation/cycle/tie policy or request bounds. This row remains SPECIFIED until that decision and the AU comparison/revision receipt contract are reviewed. | Named hold acceptance: `tests/decide/test_pairwise_ranking_served.py::test_refuses_unselected_aggregation_policy` verifies no ranking or revisions are emitted without an approved versioned policy. After the source owner chooses the algorithm, add `::test_global_order_retains_top_and_revises_rest` with a complete comparison matrix and exact tie/cycle fixture. No global-ranking success or AU execution is claimed before that decision. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R140.104 TaskPlan trajectory-decision wiring row EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R140.105 Trajectory-refinement hot-path proof row EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R141.100 Fidelity-gated memory rewrite evaluation Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Fidelity-gated memory rewrite evaluation.** Extend `Method::DecisionEval` with `MemoryRewriteSubmit` and typed `MemoryRewriteProposalV1`. Bind tenant/memory id and active/candidate revisions/digests. Record fidelity metric id/revision/specification digest/value and signal/token counts. Bind signal-per-token (`signal_count/token_count`, positive denominator), degradation-history refs/digest and rewrite-policy id/revision/digest. The policy pins fidelity and signal-efficiency thresholds plus the degradation rule. The source does not name the fidelity formula or normalization. The metric id must resolve to an immutable reviewed specification, and missing semantics refuse rather than produce Admit. An unresolved metric specification, missing policy or history, or zero token denominator returns typed refusal. Seal an `Admit` or `Discard` `MemoryRewriteEvaluationV1` receipt with all inputs, metric values and reason codes. A failed gate keeps the active revision/digest and discards the candidate; R059 outcome-aggregate fidelity and R128 context elision are not substitutes. **Exact activation-path hold:** current EG requirements do not identify the authoritative memory store or complete set of memory mutation entrypoints. They do not identify a transaction/CAS where this receipt is mandatory. Do not claim a universal rewrite gate until the owning memory mutator and atomic receipt check are named. Preserve existing parent obligations: `EG-DECISION-ENGINE-R141`. Source record EG:23 SHA-256 `ac1b5df0212beaade03e78502a494148692e1a0007c3fa68ee37a2bb6dbe8cce`. | Named hold acceptance at Method::DecisionEval: test_refuses_unresolved_fidelity_metric refuses an absent/unreviewed fidelity formula or normalization. Test_discards_failed_or_stale_rewrite proves failed policy gates preserve the baseline. A positive Admit fixture is pending review of the fidelity metric semantics. Even after that review, activation/readback remains held until the authoritative memory mutation and atomic CAS path are identified. No active-memory change is claimed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R141.101 Memory-change benchmark receipt before admission Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Memory-change benchmark receipt before admission.** Extend the existing `Method::DecisionEval` job with `DecisionEvalOp::MemoryChangeBenchmarkSubmit`. Bind tenant and baseline/candidate snapshot ids/revisions/digests. Bind versioned dataset id/revision/digest, nonempty query ids, expected evidence refs and reference-answer digests. Record `k` and metric, evaluator and policy ids/revisions/digests. Return recall@k and answer-accuracy numerators, positive denominators, values and input digests. The metric/evaluator specification must define exact numerator, denominator, query aggregation, answer-correctness rule and rounding. The source does not supply these formulas. Absent or unreviewed definitions refuse and block positive admission. Refuse an empty dataset, missing expected evidence/answer, zero denominator or incomplete candidate coverage. Refuse any snapshot/dataset/metric/policy mismatch. Require both policy thresholds on the same baseline, candidate and dataset for admission. Require the matching receipt before activating any add, edit, delete, rewrite or consolidation. R060 fitted-head promotion remains distinct. **Exact activation-path hold:** no current EG spec enumerates authoritative memory mutation APIs. No current EG spec shows this gate on every write path. This row cannot claim universal admission until that operation map and atomic gate point are named. Preserve existing parent obligations: `EG-DECISION-ENGINE-R141`. Source record AU:125 SHA-256 `27a6a74820b2b646163d8f7bd58b94167b9f0a3e423b8bf5210fe6e758deb440`. | Named hold acceptance at Method::DecisionEval: test_refuses_unresolved_metric_semantics refuses absent/unreviewed recall@k and answer-accuracy formulas. After review, `test_binds_metrics_to_same_snapshots` verifies exact numerators and positive denominators. `test_each_failed_metric_blocks_admission` verifies independent threshold failures. These passing cases remain pending the formula decision. The authoritative memory mutation map and atomic gate also remain required before end-to-end admission. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R141.102 DecisionEval memory-change wiring row EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R141.103 Memory-change hot-path proof row EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R142.100 Atomic-before-workflow local-model certification attestation Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Atomic-before-workflow local-model certification attestation.** Add a typed EG evaluation input to existing `Method::DecisionEval`. Bind skill id/revision/digest and classification (`atomic` or `workflow`). Include ordered workflow dependencies plus local model, dataset and criteria-policy ids/revisions/digests. Include the AU run receipt. The receipt must bind those same identities plus run id, per-criterion id/result/evidence digest and completion revision. EG emits an immutable certification attestation only when every criterion passes. The attestation binds the same skill/model/dataset/criteria inputs, result and digest. Workflow evaluation refuses unless each named atomic dependency has a current matching attestation. GraphOS consumes this attestation at its existing `ARBORA-FLEET-R034.7-.12` validation point before normal `orchestrate`/`agents.run` invocation. Certification-mode orchestration is a separately authorized evaluation run and must not be mistaken for normal invocation. EG does not execute the local model or decide host policy. **Pending owner prerequisites:** AU has no reviewed `orchestrate` evaluation-receipt schema for these fields. GraphOS R034 has not yet been shown to consume this EG attestation. Specify both links before claiming end-to-end certification. Preserve existing parent obligations: `EG-DECISION-ENGINE-R142`. Source record GRAPHOS:8 SHA-256 `5df3f5a45d486aeba5765a31b6c6283637adf2bd8ce63a87938eddd28b90f082`. | Named boundary acceptance: `tests/decide/test_local_skill_certification_served.py::test_attests_matching_atomic_evaluation` submits an AU receipt and reads a digest-bound EG attestation. `::test_workflow_requires_current_atomic_attestations` refuses missing/stale/failed dependencies. `::test_stale_input_invalidates_attestation` changes skill/model/dataset/criteria revision and verifies refusal. AU `orchestrate` receipt and GraphOS R034 consumption tests are required owner dependencies and are not claimed here. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R142.101 DecisionEval certification wiring row EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R142.102 Local-model-certification hot-path proof row EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engine: definition unavailable in requirements.md. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R143 Instruction-set disclosure policy and typed event (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Instruction-set disclosure policy and typed event (rollup).** EG owns relevant-context authority. AU runtime applies disclosed instructions. Define the disclosure policy and typed event through existing EG context and AU harness owners, with initial/runtime separation and per-disclosure trace evidence. Children `.1`–`.6` deliver it. | Serve-test each child; cross-owner AU receipt acceptance is pending. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R143.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `InstructionSetDisclosure`, `InitialInstructions`, `RuntimeRefinement`, `DisclosureEvent{trigger, version, timestamp, instructions_hash}`, `DisclosureTrigger` (trigger types: initial, relevance_update, constraint_change, timeout). Initial rules are disclosed once. Runtime refinements are disclosed only on trigger. Each version is immutable and pinned by hash. Proving test: `crates/eg-types/src/decision/instruction_disclosure.rs::tests::disclosure_events_round_trip`. | Types serialize/deserialize correctly; versions are stable and hashable. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R143.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** EG context/decision produces initial and triggered runtime-refinement disclosure events. Define: trigger conditions, initial-disclosure timing, per-event hash, version immutability and per-disclosure trace. Preserve EG decision authority. AU harness applies disclosed instruction set without substitution. Proving test: `crates/eg-types/src/decision/instruction_disclosure.rs::tests::triggers_produce_distinct_versions`. | Initial disclosure precedes execution. Each trigger produces distinct version hash. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R143.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend decision-context path to emit disclosure events. Route through `stat_decide.rs:134` context-decision handler. Record events in served `Decide` result. AU-HARNESS consumer reads events and applies versioned instructions. Proving test: `src/server/handlers/decide/stat_tests/instruction_disclosure_tests.rs::decide_routes_disclosure_events`. | Served decision returns typed events; AU receipt binds applied versions. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R143.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Missing trigger, stale version or hash mismatch refuses disclosure. Undefined instruction set abstains. Proving test: `src/server/handlers/decide/stat_tests/instruction_disclosure_tests.rs::invalid_trigger_or_hash_refuses`. | Negatives cover stale versions, hash collision and missing facts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R143.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind disclosed instruction-set id/version/hash, trigger/timestamp, initial/runtime separation and AU receipt version binding. Proving test: `src/server/handlers/decide/stat_tests/instruction_disclosure_tests.rs::disclosure_binds_version_and_hash`. | Record traces each disclosed version with trigger and hash. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R143.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::Decide` context request. Observe initial disclosure and trigger-based refinements. Cross-owner: AU must bind received disclosure event version/hash to its applied instruction set. Proving test: `tests/decide/test_instruction_disclosure_served.py::test_disclosure_events_and_au_application`. | EG record lists each disclosure; AU receipt links applied versions. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R144 Indexless retrieval operations and cost budgeting (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Indexless retrieval operations and cost budgeting (rollup).** GraphOS retrieval serves GovernedRetriever. EG federated-query returns top-K boundary and budgets row visits. Define: indexless raw-corpus operation, exact file-read/context-verification primitives, per-scan cost reporting and budget refusal. Children `.1`–`.6` deliver it. | Link existing EG retrieval/source-access contracts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R144.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `IndexlessRetrieval{raw_file_read, raw_corpus_scan, context_verify_primitive}`, `PerQueryBudget{max_rows, max_visits, max_cost_units}`, `CostReport{rows_visited, cost_used, remaining_budget}`. Operations are: raw file read (no index), corpus scan (enumerate all), context verification (decode/validate spans). Proving test: `crates/eg-types/src/decision/indexless_retrieval.rs::tests::operations_and_budget_round_trip`. | Types/budgets serialize correctly; costs are measurable. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R144.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Indexless operations succeed within per-query budget. Each operation reports rows and cost incurred. Refusal before budget exhaustion. Preserve authorized source scope. Proving test: `crates/eg-types/src/decision/indexless_retrieval.rs::tests::budget_enforcement`. | Budget=100 rows with 50 visited succeeds; 101 visited refuses. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R144.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend EG retrieval path in federated-query handler to emit indexless operations and cost reports. Route through `Method::UnifiedQuery` answer. Proving test: `src/server/handlers/query/federated_tests.rs::indexless_routes_cost_report`. | Served query returns exact cost and remaining budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R144.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Budget exhaustion refuses with remaining_budget=0 and rows_visited count. Unauthorized sources refuse. Proving test: `src/server/handlers/query/federated_tests.rs::budget_exhaustion_refuses`. | Over-budget and unauthorized scans refuse cleanly. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R144.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind per-query budget, rows/cost/remaining, operation ids and authorization revision. Proving test: `src/server/handlers/query/federated_tests.rs::cost_reports_bind_budget`. | Record traces budget, costs and authorization. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R144.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::UnifiedQuery` with indexless operations. Observe cost reports and budget refusal. Cross-owner: AU/GraphOS exploration consumers apply budgets. Proving test: `tests/query/test_indexless_retrieval_served.py::test_budget_enforcement_and_cost_reporting`. | EG report bounds queries; consumer obeys budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R145 Fidelity-gated memory rewrite decision (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Fidelity-gated memory rewrite decision (rollup).** EG evaluates memory rewrites by fidelity, signal/token metrics and degradation history. Define: original/candidate identities, fidelity/signal-token measurements, degradation history, failed-candidate discard with original retained, and served positive/negative acceptance. Children `.1`–`.6` deliver it. | Store/harness consumers bind rewrite admission receipts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R145.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `MemoryRewriteCandidate`, `FidelityMetric{name, id, value, measured_at}`, `SignalEfficiency{signals_per_token, degradation_history_digest}`, `RewriteAdmissionDecision` (Admit/Discard). Original memory is retained. Discard preserves baseline. Admit requires independent verification. Proving test: `crates/eg-types/src/decision/memory_rewrite.rs::tests::rewrite_types_round_trip`. | Types encode identity, fidelity and decision correctly. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R145.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Compute signal-per-token and fidelity score. Gate by policy thresholds. Degrade failed candidates and discard; retain original. Only verified optimal candidates admit. Proving test: `crates/eg-types/src/decision/memory_rewrite.rs::tests::policy_gates_admission`. | Fidelity above threshold admits; below refuses. Failed candidate discards. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R145.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend `Method::DecisionEval` to route rewrite evaluation through `stat_jobs.rs:30`. Seal typed admission result. Proving test: `src/server/handlers/decide/stat_tests/memory_rewrite_tests.rs::decide_eval_routes_rewrite`. | Served eval returns Admit/Discard decision. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R145.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Stale revisions, unresolved metrics or zero token denominator refuse. Proving test: `src/server/handlers/decide/stat_tests/memory_rewrite_tests.rs::stale_or_invalid_refuses`. | Negative cases refuse cleanly; baseline unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R145.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind original/candidate revisions/digests, fidelity/signal metrics, policy revision and decision reason. Proving test: `src/server/handlers/decide/stat_tests/memory_rewrite_tests.rs::decision_binds_metrics`. | Record names fidelity/signal values and threshold. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R145.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::DecisionEval` rewrite evaluation. Observe admission and discard paths. Cross-owner: store/harness must consume decision before mutation. Proving test: `tests/decide/test_memory_rewrite_served.py::test_fidelity_gates_admission`. | Decision and mutation receipt validation remain pending. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R146 Temporal context queries and confusion detection (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Temporal context queries and confusion detection (rollup).** Retrieval must distinguish storage date, event date and narrative time. Define: temporal fallback-query construction and insufficient-first-pass trigger. Children `.1`–`.6` deliver it. | Extend existing follow-up-query coverage with narrative-time rules. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R146.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `TemporalContext{storage_date, event_date, narrative_time}`, `TemporalConfusion{date_type_mismatch, fallback_trigger}`, `TimeBasedFallback{original_query, fallback_query, time_basis_selected}`. Three-clock confusion occurs when dates disagree. Fallback triggers on insufficient first-pass coverage. Proving test: `crates/eg-types/src/decision/temporal_query.rs::tests::temporal_context_round_trip`. | Types encode all three time dimensions and confusion flags. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R146.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Detect three-clock confusion when storage ≠ event ≠ narrative. Construct bounded fallback query on insufficient coverage. Select time basis (prefer event, fallback to narrative, final fallback to storage). Proving test: `crates/eg-types/src/decision/temporal_query.rs::tests::confusion_detection`. | All three-date-mismatch cases trigger fallback construction. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R146.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend federated-query handler to emit temporal-confusion detection in `Method::UnifiedQuery` answer. Route fallback queries through same path. Proving test: `src/server/handlers/query/federated_tests.rs::temporal_fallback_routes`. | Served query includes confusion detection and fallback results. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R146.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Missing temporal context or unmappable time basis refuses. Proving test: `src/server/handlers/query/federated_tests.rs::missing_time_refuses`. | Undefined narrative time or event date refuses gracefully. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R146.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind original query, selected time basis, detected confusion and fallback-query execution. Proving test: `src/server/handlers/query/federated_tests.rs::temporal_confusion_evidence`. | Record traces which time basis was selected and why. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R146.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::UnifiedQuery` with temporal confusion. Observe fallback queries and coverage improvement. Covering storage/event/narrative-date mismatch cases. Proving test: `tests/query/test_temporal_context_served.py::test_three_clock_confusion_and_fallback`. | First query insufficient; fallback improves coverage. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.100 Pinned retrieval evaluation and authorized context spans Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Pinned retrieval evaluation and authorized context spans.** Extend `DecisionEval` with `RetrievalRankingSubmit` and typed `RetrievalRankingV1` request/receipt. Serve it through `Method::DecisionEval` and `src/server/handlers/decide/jobs.rs`/`stat_jobs.rs`. Bind corpus and binary relevance-label set ids/revisions/digests. Bind a query-set id/revision/digest with at least one query and `k` (1..1000). Record evaluator revision and at least two registered algorithm ids/versions/settings digests. For each algorithm, define `hits_at_k = numerator / denominator`. The numerator counts labeled queries with a relevant top-k item. The denominator is the complete identically labeled query set. Return both integers, the exact query/result digest and metric value. Compare algorithms only on identical input digests. Return typed refusal for empty query sets, zero denominator or missing labels. Also refuse corpus drift, incomplete result coverage and mismatched settings; never fabricate a metric. Add public `Method::RetrievalContextSearch` (`RetrievalContextSearchV1`) on the authenticated query/read path. Return document id/revision/digest and half-open UTF-8 byte offsets into original stored text for every matched n-gram/context span. Search may normalize into a separate NFC index only when it returns that index digest and a validated normalized-to-original byte map. The public offsets always address the stored-text digest, never the normalized buffer. Also return query/index/authorization revisions and an opaque snapshot-bound cursor. Context reads are tenant-authorized, capped at 100 spans and 8 KiB per span. Denied context returns no protected count or offset. Existing `Method::UnifiedQuery`/retrieval paths supply algorithm results; `DecisionEval` seals the evaluation receipt and R100 continues joining cited evidence to independent outcomes/hard negatives. The WebUI comparison panel and labels remain consumers, not truth producers. Consumer: `WEBUI-APPS-R001.1`. WEBUI:6 source objective: “An operator inspects and compares retrieval quality interactively: hits-at-k metrics, n-gram highlighting, side-by-side algorithm comparison and context search.” SHA-256 `3dc3c464a10a5178a413463f2b43baeb015732f5b8df508f6dbab9c37cc1165d`. | Use a fixed served corpus and independently pinned labels. Run two registered retrieval algorithms over the same query set and k. Verify exact hits-at-k numerators/denominators, input/result digests and receipt readback. Search composed and decomposed Unicode plus multibyte text. Verify every returned half-open offset slices the original stored UTF-8 bytes to the exact match and binds that stored-text digest. If NFC indexing is used, verify its separate digest and normalized-to-original byte map. Refuse empty query sets/zero denominator and invalid normalization maps. Also verify bounded contexts. Refuse missing labels, incompatible revisions/settings, incomplete algorithm results, stale cursor and denied context without leaking counts. The WebUI side-by-side consumer must use the exact same evaluation receipt. Local RRF is not relevance truth. No runtime or owner receipt is claimed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R152 KG fact rendering into natural-language text (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**KG fact rendering into natural-language text (rollup).** Retrieved knowledge-graph facts must be rendered as flattened natural-language text rather than raw RDF triples. AU context compiler performs deterministic representation and layout. EG retains selection, budget and retrieval authority. Integrate AU-CONTEXT-R004.3/.6 consumer paths at AU context_compiler_serving.py:565 and core/contextual_model.py:752. | Served context compilation produces natural language text without triple leakage. Citation identity and demonstration-region placement are preserved. Final prompt byte count is exact. Refusals are typed and do not substitute fabricated prose. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R152.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** AU context compiler accepts retrieved KG facts and renders them as flattened natural-language prose. | Contract must specify input/output structures for fact rendering. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R152.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Preserve semantic meaning, source authority and exact final-prompt token count. | Rendered text preserves all material information from source facts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R152.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Map rendered text to source fact identities and citation metadata. | Bidirectional traceability from output prose to source facts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R152.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Refuse unrenderable facts or missing provenance without substituting fabricated prose. | Render errors are explicit refusals, never silent substitutions. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R152.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Golden served examples prove no triple leakage, correct placement outside demonstration regions, complete citations and budget compliance. | Tests cover raw-triple detection, citation accuracy, tenant scope boundaries and prompt length. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R152.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::CompileContext` through AU context_compiler_serving.py. Integration test: `tests/context/test_natural_language_rendering_served.py`. | Retrieved KG facts render as natural-language prose in served contexts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R153 Offline line-numbered table of contents and span-read contracts (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Offline line-numbered table of contents and span-read contracts (rollup).** Source spans and directories do not alone establish offline line numbering, offline construction, or bounded span-read behavior. Define offline line-numbered table-of-contents construction and bounded span-read consumer contracts. Link to existing GraphOS/AU retrieval consumers. Retain existing space/section mappings as partial coverage. | Line-numbered TOC producer and span-read contract are explicit and testable. Consumers bind to exact TOC identities. No implicit line-numbering or file-whole reads. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R153.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Source ingestion produces offline line-numbered tables of contents keyed by source document identity and revision. | TOC must include line ranges for each section or semantic unit. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R153.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Span-read operations use precomputed line ranges without reading whole files. | Bounded reads use offline TOC to avoid redundant disk access. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R153.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** EG immutable document/section records link SDK source ingestion to GraphOS retrieval.space directories to AU exploration. | Each consumer receives TOC identity with requests and references it in responses. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R153.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Refuse span reads when requested range exceeds offline TOC bounds. | Unbounded or missing TOC entries explicitly refuse. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R153.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Served TOC construction and line-range conformance are validated. | Tests verify TOC byte offsets match original files and span reads stay in bounds. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R153.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::RetrievalContextSearch` with offline TOC and bounded span reads. Integration test: `tests/retrieval/test_offline_toc_served.py`. | GraphOS/AU consumers retrieve bounded source spans without reading whole files. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R154 Parameter-free memory/retention scaling and corpus growth semantics (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Parameter-free memory/retention scaling and corpus growth semantics (rollup).** Define continual parameter-free memory and retention, cross-document encoding and corpus-growth and selectivity scaling criteria. EG lifecycle and filtered query operators are infrastructure; missing memory admission/encoding contract joins them with requested guarantees. | Memory layers support unbounded corpus growth without manual tuning. Scaling benchmarks confirm predictable performance. Filtered-scan coverage is retained. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R154.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Memory layers accept and retain cross-document encoded facts without external configuration. | Memory must specify admission criteria and eviction policy. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R154.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Corpus growth is linear in document count and fact density without scaling parameter retuning. | Benchmarks measure memory and query latency as corpus grows. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R154.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Filtered-scan and lifecycle operators feed memory layers and consume retention semantics. | Operators exchange memory state without lossy boundaries. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R154.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Refuse memory operations under OOM or when selectivity constraints cannot be met. | Capacity violations and constraint violations fail explicitly. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R154.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Scaling benchmarks validate linear growth under doubling corpus size. | Tests measure latency and memory footprint over 1..10x baseline corpus. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R154.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::UnifiedQuery` with growing corpus and parameter-free memory. Integration test: `tests/memory/test_parameter_free_scaling_served.py`. | Query latency and accuracy remain predictable as corpus grows. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R155 Memory layers, episode construction and cross-session retrieval (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Memory layers, episode construction and cross-session retrieval (rollup).** Define memory layers, multi-session episode construction and hybrid cross-session retrieval and temporal validation. SourceIngest validates/projects transcripts and UnifiedQuery supports filtered search. Missing episode builder and AU consumer definitions join these paths. | Episode formation uses scoped transcript and search contracts. Temporal validation ensures cross-session consistency. Hybrid retrieval spans both episode and live query scopes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R155.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Sessions produce episodes: ordered, immutable fact sequences with temporal anchors. | Episodes must bind session identity, start/end time and fact count. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R155.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Episodes enable cross-session retrieval: newer queries access older episode facts. | Temporal validation prevents stale/inconsistent multi-session results. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R155.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** SourceIngest validates transcript input; episode builder consumes filtered transcripts; UnifiedQuery retrieves across episode boundaries. | Each consumer names episode identity and temporal constraints. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R155.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Refuse cross-session retrieval when temporal ordering or episode boundaries cannot be established. | Unbounded or inconsistent temporal queries explicitly refuse. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R155.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Multi-session test data validates episode formation and temporal consistency. | Tests verify episode immutability, temporal order and cross-session query correctness. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R155.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::UnifiedQuery` with multi-session episodes. Integration test: `tests/memory/test_cross_session_retrieval_served.py`. | Queries access historical episode facts with correct temporal order. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R156 Skill document procedural compilation without separate workflow files (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Skill document procedural compilation without separate workflow files (rollup).** No reviewed clause compiles procedural steps from skill documents into executable plans or guarantees execution without separate workflow files. EG SourceIngest owns skill_workflow_ingest; AU graph_orchestrate consumes workflows after gap resolution. Missing skill-document-to-executable-plan producer and consumer binding. | Skill documents compile procedurally to AU executable plans. Directory-reference and gap-resolution clauses are retained. AU workflow consumer is named. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R156.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Skill documents define steps, branching and error handling in natural language. | Compiler must extract procedural structure and safety constraints. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R156.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Steps compile to executable AU workflow steps without separate .yml files. | Skill source is the single source of truth for procedural logic. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R156.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** EG SourceIngest documents and AU graph_orchestrate consume compiled workflows. | AU receives compiled plan with skill document digest for traceability. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R156.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Refuse compilation when steps are ambiguous, missing error handlers or lack input/output types. | Incomplete procedures refuse compilation without fallback. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R156.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Golden skill documents compile to deterministic AU plan representations. | Tests verify step ordering, error branching and type safety. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R156.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::CompileSkillWorkflow` with AU graph_orchestrate consumer. Integration test: `tests/skills/test_skill_to_workflow_compilation_served.py`. | AU executes skill-compiled workflows without separate workflow files. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R157 Delegation quality gate and observation window (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Delegation quality gate and observation window (rollup).** EG defines measured quality and delegation threshold. Stable observation window must precede delegation. Quality authority resides in EG. AU executes only admitted delegation. Retrieval-saturation windows govern retrieval, not delegation. | Gate requires explicit quality evidence. Passes above threshold. AU respects refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R157.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `DelegationQualityWindow{start_time, end_time, observation_count}`, `QualityThreshold{metric_name, minimum_value}`, `DelegationAdmission{admitted, quality_evidence_digest}`. Quality window must span enough observations. | Types encode observation window, threshold and admission decision correctly. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R157.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Measure output quality over stable observation window. Gate on declared threshold. Refuse delegation below threshold. Reset window on new measurements. Proving test: `crates/eg-types/src/decision/delegation_quality.rs::tests::quality_gate_admission`. | Quality above threshold admits. Below threshold refuses. Window spans enough samples. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R157.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend `Method::DecisionEval` to route quality measurement through decision authority. Seal typed admission result. Bind AU graph_execute consumer to admitted delegation only. Proving test: `src/server/handlers/decide/stat_tests/delegation_quality_tests.rs::quality_gate_routes`. | Served decision returns Admit/Refuse. AU respects refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R157.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Stale observation window, undefined threshold or insufficient samples refuse. Proving test: `src/server/handlers/decide/stat_tests/delegation_quality_tests.rs::stale_window_refuses`. | Negative cases refuse cleanly without delegating. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R157.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind window start/end times, observation count, quality metric, threshold and admission decision. Proving test: `src/server/handlers/decide/stat_tests/delegation_quality_tests.rs::quality_evidence_binds`. | Record observation count, quality value and threshold. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R157.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::DecisionEval` quality gate. Observe delegation admission and refusal paths. AU consumes only admitted delegation. Proving test: `tests/decide/test_delegation_quality_served.py::test_quality_gate_admits_and_refuses`. | Delegation succeeds above threshold; refuses below. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R158 Per-run error frequency and joint model-width adjustment (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Per-run error frequency and joint model-width adjustment (rollup).** Per-run error frequency within host tenant/child/operation partition must drive joint latency/cost/error model-and-width adjustment. Each adjustment records before/after model, width, budget and rationale. AU observation paths and EG routing decision authority produce separate producer/consumer contracts. | Adjustment contract joins AU observations with EG routing decisions. Before/after model/width recorded per run. Host ceiling and narrow-only enforced. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R158.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `PerRunErrorWindow{run_id, start_time, end_time}`, `ModelWidthAdjustment{before_model, after_model, before_width, after_width, before_budget, after_budget, rationale_digest}`. Window partitions errors by tenant/child/operation. Proving test: `crates/eg-types/src/decision/error_adjustment.rs::tests::adjustment_types_round_trip`. | Types encode adjustment history with exact before/after values. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R158.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Compute per-run error frequency within declared window. Drive joint model and width adjustment. Record all before/after values. Preserve host ceiling. Narrow width only, never widen without capacity increase. Proving test: `crates/eg-types/src/decision/error_adjustment.rs::tests::adjustment_gates_admission`. | Error above policy triggers adjustment. Before/after recorded. Narrowing enforced. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R158.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend existing EG routing and AU continuation contracts. Add per-run adjustment observation window binding. Bind AU ObservedCost and continuation to adjustment receipt. Route adjustment through `stat_jobs.rs:30`. Proving test: `src/server/handlers/decide/stat_tests/error_adjustment_tests.rs::per_run_adjustment_routes`. | Served decision includes adjustment receipt. AU consumes adjustment. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R158.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Unpartitioned errors, undefined adjustment policy or violated host ceiling refuse. Proving test: `src/server/handlers/decide/stat_tests/error_adjustment_tests.rs::invalid_policy_refuses`. | Undefined partitions or ceiling violations refuse cleanly. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R158.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind run identity, error window, before/after model/width/budget, rationale digest and adjustment result. Proving test: `src/server/handlers/decide/stat_tests/error_adjustment_tests.rs::adjustment_evidence_binds`. | Record exact before/after model, width and budget values. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R158.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::DecisionEval` per-run adjustment. Observe error-driven model and width changes. AU consumes adjustment receipt. Proving test: `tests/decide/test_error_adjustment_served.py::test_per_run_adjustment_and_receipt`. | Adjustment recorded and consumed per run. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R159 Tool-routing path success history and preference (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Tool-routing path success history and preference (rollup).** EG defines path identity and success rates. EG applies historical preference; SDK fallback is transport. | Path identity and success-rate measurement in EG routing authority. Historical rates drive preference. SDK fallback order remains transport contract. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R159.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `RoutingPath{connector_id, method_id, parameter_digest}`, `SuccessRateEvidence{path_id, successful_attempts, total_attempts, measurement_window}`, `PathPreferenceRule{window_duration, minimum_samples, prefer_above_rate}`. Proving test: `crates/eg-types/src/decision/path_success.rs::tests::path_identity_round_trip`. | Types encode path identity, rates and preference rules. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R159.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Measure successful attempts per path over declared window. Track total attempts. Prefer paths exceeding minimum-sample threshold. Prefer higher-rate paths within same query. Skip repeated failures under declared rule. Proving test: `crates/eg-types/src/decision/path_success.rs::tests::success_preference_gates`. | Rates above threshold preferred. Repeated failures skipped. Preference within window. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R159.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Bind connector and harness outcome observations to EG routing path-success tracking. Extend EG R039 routing contracts with path identity and success-rate evidence. Preserve SDK ordered_equivalent_fallback as transport contract. Proving test: `src/server/handlers/decide/routing_tests.rs::path_success_routes`. | Served routing decision includes preferred path. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R159.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Unmeasured paths, stale measurement windows or missing outcome data refuse. Proving test: `src/server/handlers/decide/routing_tests.rs::stale_path_data_refuses`. | Missing outcomes and stale windows refuse without defaulting. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R159.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind path identity, success rate numerator/denominator, measurement window and preference applied. Proving test: `src/server/handlers/decide/routing_tests.rs::path_success_evidence_binds`. | Record successful/total attempts and preference decision. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R159.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::DecisionEval` tool routing with path-success preference. Observe preferred and fallback paths. Connector outcomes feed success tracking. Proving test: `tests/decide/test_path_success_served.py::test_success_history_drives_preference`. | Higher-success paths preferred. History accumulates correctly. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R160 Package identity validation and publication refusal (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Package identity validation and publication refusal (rollup).** EG validates rendered packages against recorded runs. Publication refuses invalid packages. | Rendered package validated against run history before publication. Publication refuses invalid packages. Identity evidence persisted. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R160.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `PackageIdentity{content_digest, graph_revision}`, `RenderedPackageValidation{rendered_digest, run_history_digest, validation_passed}`, `PublicationReceipt{package_id, validation_result, publish_timestamp}`. Proving test: `crates/eg-types/src/decision/package_validation.rs::tests::validation_types_round_trip`. | Types encode identity, validation and publication evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R160.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Render skill package from digest/revision. Validate rendered result against recorded runs. Refuse publication if validation fails. Record publication receipt with validation result. Proving test: `crates/eg-types/src/decision/package_validation.rs::tests::validation_gates_publication`. | Invalid packages refuse publication. Valid packages recorded. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R160.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Link existing digest/revision package identity contracts to validation and publication authority. Bind AU record_outcome/SkillGraphPipeline output to validation input. Bind fleet catalog skill_row consumer to publication receipt. Proving test: `src/server/handlers/catalog/validation_tests.rs::package_validation_routes`. | Served catalog returns validated packages only. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R160.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Mismatched rendered/history digests, failed validation or missing run history refuse publication. Proving test: `src/server/handlers/catalog/validation_tests.rs::validation_fails_refuse_publication`. | Invalid packages refuse publication without fallback. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R160.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind content digest, graph revision, rendered digest, run history digest, validation result and publication timestamp. Proving test: `src/server/handlers/catalog/validation_tests.rs::validation_evidence_binds`. | Record which run history validated each published package. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R160.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::PublishSkillPackage` with validation and refusal. Catalog consumer accesses only validated packages. AU produces run history. Proving test: `tests/catalog/test_package_validation_served.py::test_invalid_packages_refuse_publication`. | Only validated packages published. Publication recorded. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R161 Failed-run trace to fix and test binding with revision receipts (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Failed-run trace to fix and test binding with revision receipts (rollup).** Trace generates fix and test. Test binds before/after revision receipts. Mismatch refuses admission. | Trace -> fix -> test -> paired receipts is required. Mismatched receipts refuse. Admission authority preserved in EG. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R161.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define `FailedRunTrace{run_id, error_trace_digest, failure_point}`, `GeneratedFix{trace_id, fix_digest}`, `RegressionTest{fix_id, test_digest, before_revision, after_revision}`, `RevisionReceipt{test_id, revision_id, outcome}`. Proving test: `crates/eg-types/src/decision/trace_fix_binding.rs::tests::binding_types_round_trip`. | Types encode trace, fix, test and revision binding. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R161.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Extract fix from failed trace. Generate regression test with input/output binding. Run test against before-revision (must fail). Run test against after-revision (must pass). Bind both receipts to test identity. Refuse if outcomes mismatch expected pattern. Proving test: `crates/eg-types/src/decision/trace_fix_binding.rs::tests::receipt_binding_gates_admission`. | Test fails on before, passes on after. Receipts bound. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R161.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extend existing correction and admission contracts with trace identity. Bind AU CorrectionProposal and study_admit engine input. Route through existing admission authority. Seal test identity and revision receipts. Proving test: `src/server/handlers/decide/admission_tests.rs::trace_to_test_routes`. | Served correction includes test identity and receipts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R161.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Absent trace, missing test, unexecuted receipts or mismatched outcome pattern refuse. Proving test: `src/server/handlers/decide/admission_tests.rs::incomplete_binding_refuses`. | Incomplete bindings refuse admission without mutation. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R161.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind failed trace digest, generated test digest, before/after revision digests, before/after outcome and admission decision. Proving test: `src/server/handlers/decide/admission_tests.rs::binding_evidence_records`. | Record which trace produced which test and fixes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R161.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Serve `Method::ProposeCorrection` with trace-test binding and receipts. Observe both before/after test execution paths. EG admission authority consumes receipts and decides. Proving test: `tests/decide/test_trace_fix_binding_served.py::test_receipts_gate_correction_admission`. | Receipts bind test to revisions. Mismatches refuse. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R162 Workspace field shielding and declared-input projection at step boundaries (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Workspace field shielding and declared-input projection at step boundaries (rollup).** Shared workspace objects leak undeclared fields across steps. Nested undeclared fields are not explicitly withheld. Step boundaries lack declared-input projection. Shielded fields reject extra fields at read time. Children `.1` to `.6` deliver it. | Field shielding at boundaries. Undeclared nested fields withheld. Schema refusal retained. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R162.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `ShieldedField{name, is_shielded}`, `DeclaredInput{field, required, depth}` and `StepProjection{step_id, declared_fields}` in new `crates/eg-types/src/decision/field_shielding.rs`. Add `QuestionKind::FieldShielding` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/field_shielding.rs::tests::types_round_trip`. | Types encode shielding, projection and nesting depth. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R162.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `apply_field_shielding(object, shielded_fields)` in field_shielding.rs. Remove marked shielded fields recursively. Add `project_declared_inputs(object, step_declaration)` to keep only declared fields per step. Both functions recursively process nested fields. Proving test: `crates/eg-types/src/decision/field_shielding.rs::tests::shielding_removes_nested`. | Shielded and undeclared nested fields are removed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R162.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Attach shielding and projection in `handle_decide` at `stat_decide.rs:134`. Apply before constructing ParallelWorkspace at dispatch. Extend ParallelWorkspace contract with projection boundaries per step. Proving test: `src/server/handlers/decide/stat_tests/field_shielding_tests.rs::shielding_routes`. | Shielding and projection applied before workspace construction. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R162.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Undeclared fields in declared-input projection must refuse with `undeclared_field` naming the field. Nested shielding violations must refuse. Schema-refusal validation at step boundary reads must reject extra fields. Proving test: `src/server/handlers/decide/stat_tests/field_shielding_tests.rs::undeclared_fields_refuse`. | Undeclared fields refuse. Shielding violations prevent read. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R162.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Emit premises for shielded field names, declared input depth and projection applied per step. Record each withheld undeclared nested field. The record must state evidence class. Proving test: `src/server/handlers/decide/stat_tests/field_shielding_tests.rs::shielding_evidence_binds`. | Record withheld fields, depth and shielding per step. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R162.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Entry point is served `Decide` with workspace sharing across steps. Test `tests/decide/test_field_shielding_served.py::test_undeclared_fields_withheld` declares inputs for step two. Step one writes extra nested fields. Step two reads must reject them. Proving test: `tests/decide/test_field_shielding_served.py::test_undeclared_fields_withheld`. | Shielded and undeclared nested fields withheld from reading step. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R163 Graph-ingested papers and codebases in study intake with revision provenance (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Graph-ingested papers and codebases in study intake with revision provenance (rollup).** Study intake reads only filesystem sources. Graph-ingested papers and codebases have no intake contract. Source/query authorities are copied with content bodies. Revision provenance is not recorded per source. Children `.1` to `.6` deliver it. | Graph sources integrated in intake. Exact revisions recorded. Authorities reused. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R163.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `GraphSource{graph_ref, content_type}`, `GraphReference{authority, query, revision, content_digest}` and `IntakeSource{filesystem_path, graph_ref, revision}` in new `crates/eg-types/src/decision/graph_intake.rs`. Add `QuestionKind::GraphIntake` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/graph_intake.rs::tests::intake_types_round_trip`. | Types encode graph sources, queries and revisions. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R163.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Extend StudySource in study_intake.rs to accept both filesystem and graph-reference inputs. Resolve graph references through EG capability graph. Record exact source revision and content digest. Preserve filesystem intake path unchanged. Proving test: `crates/eg-types/src/decision/graph_intake.rs::tests::graph_sources_resolve`. | Graph and filesystem sources both resolve. Revisions recorded. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R163.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Attach graph-reference resolution in `study_compare.compare` at existing EG lookup. Bind IntakeSource to study_fetch_once results. Reuse source/query authorities from graph node rather than copying content bodies. Proving test: `src/server/handlers/decide/stat_tests/graph_intake_tests.rs::graph_intake_routes`. | Served comparison includes graph-sourced papers and revisions. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R163.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Missing graph authority must refuse with `unknown_authority` naming the authority. Missing content revision must refuse. Unresolvable graph-reference must refuse with `resolution_failed`. Proving test: `src/server/handlers/decide/stat_tests/graph_intake_tests.rs::missing_graph_data_refuses`. | Missing authorities and revisions refuse intake. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R163.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind source type (filesystem or graph), graph authority, query used, exact revision and content digest. Record which authority was reused versus copied. The record must state evidence class. Proving test: `src/server/handlers/decide/stat_tests/graph_intake_tests.rs::graph_intake_evidence_binds`. | Record source type, authority, revision and content digest. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R163.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Entry point is served study_compare requesting graph-ingested papers alongside filesystem sources. Test `tests/decide/test_graph_intake_served.py::test_mixed_source_comparison` submits papers from graph and filesystem. Both are resolved and compared. Revisions and authorities are recorded. Proving test: `tests/decide/test_graph_intake_served.py::test_mixed_source_comparison`. | Graph and filesystem sources both appear in comparison results. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R164 Long-horizon branches retrieve and apply prior outcome evidence for breadth adaptation (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Long-horizon branches retrieve and apply prior outcome evidence for breadth adaptation (rollup).** Branches do not retrieve prior attempts or outcomes. Breadth decisions are not adapted from historical results. Branch outcome evidence is not recorded per branch. Long-horizon paths have no breadth adaptation. Children `.1` to `.6` deliver it. | Prior outcomes guide breadth. Adaptation recorded per branch. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R164.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `BranchOutcome{branch_id, attempt_count, success_count, average_cost}`, `OutcomeEvidence{prior_branch_id, outcome, adaptation_applied}` and `BreadthAdaptation{branch_id, prior_breadth, new_breadth, outcome_triggering}` in new `crates/eg-types/src/decision/branch_outcomes.rs`. Add `QuestionKind::BranchOutcome` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/branch_outcomes.rs::tests::outcome_types_round_trip`. | Types encode outcomes, evidence and breadth adaptation. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R164.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `retrieve_branch_outcomes(branch_candidates, history)` in branch_outcomes.rs. Look up prior attempts for each candidate branch. Add `adapt_breadth(outcomes, policy)` to compute new breadth from success rate evidence. Apply new breadth to branch start. Proving test: `crates/eg-types/src/decision/branch_outcomes.rs::tests::breadth_adapts_from_outcomes`. | Higher success rates increase breadth. Failed branches narrow. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R164.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Integrate outcome retrieval at branch start in TaskPlan dispatch. Attach breadth adaptation in `handle_decide` at `stat_decide.rs:134`. Bind AU execution recording to TaskPlan breadth outcome. Extend R022.4 SkillGraphPipeline to receive outcome feedback. Proving test: `src/server/handlers/decide/stat_tests/branch_outcomes_tests.rs::breadth_adapts_from_history`. | Served TaskPlan reflects prior outcome breadth adaptation. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R164.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Missing prior outcome history must refuse with `no_outcome_history`. Breadth adaptation outside configured limits must refuse with `breadth_limit_exceeded`. Contradiction between early and later outcome evidence must refuse. Proving test: `src/server/handlers/decide/stat_tests/branch_outcomes_tests.rs::inconsistent_outcomes_refuse`. | Missing or contradictory outcomes refuse planning. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R164.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind prior branch outcomes, success count, average cost and adapted breadth value. Record which earlier branch outcome triggered breadth change. Link to recorded AU execution outcomes. The record must state evidence class. Proving test: `src/server/handlers/decide/stat_tests/branch_outcomes_tests.rs::outcome_evidence_records`. | Record prior outcomes, adaptation and triggering evidence. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R164.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Entry point is served TaskPlan for a long-horizon branching query. Test `tests/decide/test_branch_outcomes_served.py::test_breadth_adapts_from_prior` submits branches with recorded prior outcomes. Later branch breadth reflects earlier success. Outcomes are retrieved and recorded. Proving test: `tests/decide/test_branch_outcomes_served.py::test_breadth_adapts_from_prior`. | Earlier branch success increases later branch breadth. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R165 Per-model empirical tool necessity measurement and decision comparison tracing (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Per-model empirical tool necessity measurement and decision comparison tracing (rollup).** Tool decisions lack provenanced necessity measurement per model. Decision comparison is not implemented. Tool mismatches are not traced. Unknown and stale measurements have no handling. Children `.1` to `.6` deliver it. | Tool necessity measured per model. Mismatches traced. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R165.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `ToolNecessity{tool_id, model_id, necessity_score, measurement_timestamp, provenance}`, `ToolComparison{tool_id, necessity_score, decision_score, agreement}` and `TraceMismatch{tool_id, necessity_score, model_call_id, reason}` in new `crates/eg-types/src/decision/tool_necessity.rs`. Add `QuestionKind::ToolNecessity` at `statistical.rs:58`. Proving test: `crates/eg-types/src/decision/tool_necessity.rs::tests::necessity_types_round_trip`. | Types encode measurement, comparison and mismatch. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R165.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `measure_tool_necessity(tool_id, model_id, context)` in tool_necessity.rs. Compute necessity empirically per model. Add `compare_tool_decision(necessity, model_decision, policy)` to check agreement. Record provenance, timestamp and measurement version. Handle unknown and stale measurements explicitly. Proving test: `crates/eg-types/src/decision/tool_necessity.rs::tests::necessity_comparison_detects_mismatch`. | Mismatches between necessity and decision are detected. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R165.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Integrate tool necessity measurement in `handle_decide` at `stat_decide.rs:134`. Attach comparison consumer at existing per-tool span path in AU integration. Bind necessity contract to decision contract. Record tool decision call alongside necessity measurement. Proving test: `src/server/handlers/decide/stat_tests/tool_necessity_tests.rs::necessity_comparison_routes`. | Served tool decision includes necessity score and comparison. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R165.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Unknown measurement versions must not default or estimate. Stale measurements (older than configured window) must refuse with `stale_measurement`. Tool id mismatch must refuse. Model id mismatch must refuse with `model_mismatch`. Proving test: `src/server/handlers/decide/stat_tests/tool_necessity_tests.rs::unknown_measurements_refuse`. | Unknown and stale measurements refuse. No estimation. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R165.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind tool id, model id, measured necessity score, decision score and measurement timestamp. Record comparison result and any mismatch with linked trace. Trace includes model_call_id and mismatch reason. Record measurement provenance and version. Proving test: `src/server/handlers/decide/stat_tests/tool_necessity_tests.rs::mismatch_traces_link`. | Every mismatch links to trace. Provenance recorded. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R165.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Entry point is served tool decision in per-tool span path. Test `tests/decide/test_tool_necessity_served.py::test_necessity_mismatch_trace` submits tool request. Necessity measured per model. Decision compared. Mismatch traced with linked model_call. Proving test: `tests/decide/test_tool_necessity_served.py::test_necessity_mismatch_trace`. | Tool necessity and decision comparison appear in trace. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R166 Workflow registration and lazy engine initialization (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Workflow registration and lazy engine initialization (rollup).** The workflow registry must hold registered workflows and start its engine only on first use. The GraphOS host keeps its semantic workflow match and the AU orchestrate path keeps its execute_workflow edge. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R166.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define a workflow registration record with a workflow id, a version and a content digest. The registry must expose a read by that identity. | Registration and read return the same id, version and digest. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R166.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The registry must not start the workflow engine at registration time. The registry must start the engine once on the first invocation and reuse it afterwards. | Counter shows zero starts before first use and exactly one start after several invocations. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R166.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The AU orchestrate path must resolve each workflow through this registry before execution. The host semantic match must keep returning registry identities. | Invocation through the real orchestrate entry resolves the registered record. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R166.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The registry must refuse an unknown workflow id with a typed error before any engine start. The registry must not fall back to a default workflow. | Unknown id refuses and the start counter stays at zero. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R166.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The registry must record the resolved workflow identity and the engine start event on each invocation receipt. | Receipt readback shows identity and a single start event. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R166.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served graph_orchestrate execute_workflow call. The integration test is `tests/workflows/test_registry_lazy_init_served.py::test_registered_invocation_lazy_init`. | The test covers no eager start, one first-use start, registered invocation and unknown-workflow refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R167 Skill upgrade compatibility and declared migration (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Skill upgrade compatibility and declared migration (rollup).** Skill admission must compare the previous and new consumer contracts on every upgrade. The GraphOS invoke certification step keeps its place before dispatch, and EG keeps selection and scoring. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R167.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define a skill upgrade receipt with the previous consumer contract digest, the new consumer contract digest and an optional declared migration id. | Receipt readback shows both digests and the migration id. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R167.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Admission must accept an upgrade whose new contract is compatible with the previous one. Admission must accept a breaking upgrade only with a declared migration identity. | Compatible upgrade and declared-migration upgrade both admit. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R167.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The check must run in skill admission before the invoke certification step dispatches. The host must read the receipt at that step. | Invoke reads the receipt from the real admission path. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R167.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Admission must refuse a breaking upgrade that lacks a declared migration before any effect. Admission must not add a compatibility wrapper. | Breaking upgrade without migration refuses and no effect row exists. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R167.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit one premise for the contract comparison and one for the migration identity. | Premises name both digests and the migration id. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R167.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served skill invoke path. The integration test is `tests/skills/test_upgrade_compat_served.py::test_upgrade_admission`. | The test covers compatible upgrade, breaking upgrade without migration and declared migration. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R168 Typed agent lifecycle model across construction, transition, persistence and serialization (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Typed agent lifecycle model across construction, transition, persistence and serialization (rollup).** The engine must own one typed agent lifecycle model that the generated client types reuse. The harness must not add a parallel wire authority. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R168.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define the agent state type and its lifecycle states. Name the construction, transition, persistence and serialization boundaries. Bind each boundary to the existing generated strict client types. | Readback lists each boundary and its bound generated type. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R168.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The engine must validate state at construction and on every transition. Persistence and serialization must preserve every field of the state. | Valid construction and transition succeed. A persisted state reads back equal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R168.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The harness port and run contract must construct and advance the agent through this model. The engine must not add a second wire type. | The run path imports the model from the generated types only. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R168.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The engine must refuse malformed state at construction, on transition and on read from storage. The engine must not repair or default the state. | Each malformed case refuses with a typed reason and writes nothing. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R168.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit one premise per transition naming the prior state, the next state and the state digest. | Premises name both states and the digest. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R168.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served agent run path. The integration test is `tests/lifecycle/test_agent_lifecycle_served.py::test_agent_lifecycle_roundtrip`. | The test covers construction, transition, persistence, serialization, malformed refusal and a full lifecycle roundtrip. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R169 Every-output checker feedback loop with durable continuation and explicit stop (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Every-output checker feedback loop with durable continuation and explicit stop (rollup).** The harness must grade each output and turn checker findings into the next instruction. The loop must repeat until no fix remains or an explicit bound is reached. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R169.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define a feedback record with the output digest, the checker report digest, the findings and the next instruction. Define a continuation record and a stop reason. | Readback shows all fields and one stop reason. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R169.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The harness must grade every output, not one output per evaluation round. The next instruction must derive only from the findings. The loop must stop on no findings or on the explicit round bound. | A run with fixes repeats. A run with none stops. A run at the bound stops. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R169.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The engine must hold the continuation in durable state. The host loop status, run and pause facade must read it. The existing scope and idempotency checks must still fail closed. | The facade reports the continuation after a restart. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R169.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The loop must refuse a missing bound, an ungraded output and a replayed idempotency key. The loop must not continue after a refusal. | Each case refuses and the continuation does not advance. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R169.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit one premise per round with the findings digest and the instruction digest. | Premises name both digests for every round. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R169.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served loop run path. The integration test is `tests/loops/test_checker_feedback_served.py::test_feedback_loop_stops`. | The test covers repeat, no-fix stop, bound stop, restart resume and replay refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R170 Team coordination fallback and graph-discoverable team records (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Team coordination fallback and graph-discoverable team records (rollup).** The coordinator must fall back to team coordination when the primary session channel is unavailable. Library membership must not stand in for team membership. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R170.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define a team record with team id, members, and the persisted task status of each task. Define a channel-unavailable signal. | Readback shows members and task status. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R170.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The coordinator must start team coordination when the primary channel is unavailable. Task status must persist in the durable task store. | An unavailable channel starts the team path. Status survives a restart. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R170.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The host agent-to-agent endpoint and task store must write the record. The engine must project the team, members and task status into the graph beside the agent library projection. | A graph query finds the team, its members and each task status. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R170.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The coordinator must refuse to treat a library member as a team member without an explicit team binding. The coordinator must not fall back while the channel is available. | Each case refuses and writes no team record. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R170.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit one premise for the channel signal and one for the team membership. | Premises name the signal and the member set. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R170.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served team coordination path. The integration test is `tests/a2a/test_team_fallback_served.py::test_fallback_and_team_record`. | The test covers fallback, team record discovery and restart acceptance. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R171 Planning admission requires an architecture and wiring gap comparison (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Planning admission requires an architecture and wiring gap comparison (rollup).** The engine must compare the architecture view with the study gap proposals before it admits a plan. The engine must refuse any plan feature that lacks a hot-path attach point. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R171.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Define a planning admission request with the architecture view digest, the gap proposal digests and the plan features. Define an attach point for each feature. | Readback shows the digests and one attach point per feature. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R171.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The engine must run the comparison before admission and not after. Every new feature must name its hot-path attach point. The engine must reuse the served architecture view and not derive it again. | A fully wired plan admits. The comparison runs first. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R171.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The study consumer must submit gap proposals to this admission. The engine must read the existing architecture view and capability query. | The admission reads the view from the served query. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R171.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The engine must refuse a plan with no comparison, a stale view, or a feature without an attach point. The engine must name the feature. | Each case refuses with the feature name and admits nothing. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R171.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit one premise for the comparison and one per feature attach point. | Premises name the view digest and each attach point. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R171.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served planning admission path. The integration test is `tests/planning/test_wiring_admission_served.py::test_unwired_feature_refused`. | The test covers admitted, unwired-refused and stale-view cases. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172 Capability designation index moved from agent-utilities (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Capability designation index moved from agent-utilities (rollup).** EG owns capability designation. Given a task embedding and optional required capabilities, the engine selects the agents, tools and skills that handle the task. The engine filters by capability, tenant and policy. It ranks by cosine similarity, a learned outcome reward and an ontology prior. It explains why each candidate is eligible. This replaces the deleted AU module `agent_utilities/knowledge_graph/retrieval/capability_index.py` (`CapabilityIndex`, `Designation`, `compute_eligibility`) and its feeders. The EG implementation is native Rust only. No designation, scoring or reward logic goes into `epistemic_graph/` beyond the generated client binding. Children `.1` to `.11` deliver it. Child `.13` applies scoped adapters and drift refresh to the index. Producer: the engine-resident index. Consumer: the AU run loop through a typed designation port that receives EG answers. | See each child. R172 is LANDED when every child is VERIFIED. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `crates/eg-types/src/decision/capability_designation.rs`. Define `CapabilityRecordV1{tenant_id: Option<TenantId>, entity_id, entity_kind (closed: agent, tool, skill), capabilities: BTreeSet<CapabilityIri>, ontology_type: Option<ClassIri>, policy_tags: BTreeSet<String>, swappable_with: BTreeSet<EntityId>, embedding_version, dim: u16, record_revision: u64}`. A record with no tenant is a commons record. Define `CapabilityRewardV1{tenant_id, entity_id, reward_q32, outcome_count: u64, generation: u32, updated_revision}`; the neutral value is 0.5. Define `CapabilityDesignationQuestionV1{tenant_id, query_vector{embedding_version, dim, f32le_b64}, required_capabilities, required_policy_tags, k: u8, weights{reward_q32, prior_q32}, ontology_prior: Option<Vec<(EntityId, q32)>>}`. Define `CapabilityDesignationV1{designations: Vec<DesignatedCapabilityV1>, candidate_pool_size, capability_filtered, index_epoch, embedding_version}`. Each `DesignatedCapabilityV1` binds `entity_id, score_q32, cosine_q32, reward_q32, prior_q32, ontology_type, capabilities, alternatives, eligibility: CapabilityEligibilityV1`. `CapabilityEligibilityV1` keeps the field set of AU `compute_eligibility`. The capability fields are capabilities, required_caps, missing_caps and capabilities_matched. The tenant fields are tenant, required_tenant and a tri-state tenant_match. The policy fields are policy_tags, required_policy_tags, missing_policy_tags and policy_matched. The other fields are reward, ontology_type, eligible and subsumption_paths. Scores and weights are Q32 integers on the wire. Only the query vector is f32, as little-endian base64. Proving test: `crates/eg-types/src/decision/capability_designation.rs::tests::designation_types_round_trip`. | A serde round trip keeps every field. It rejects an unknown entity kind, a dim of zero, and a base64 vector whose length is not `4 * dim`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add the resident index in new module `crates/eg-compute/src/capability_index/`. It reuses `eg-ann` (`flat` and `hnsw`) and stores nothing itself. Keep one index per tenant shard plus one commons shard. Intern entity ids and capability IRIs to dense `u32` ids. Store capability postings as compressed bitmaps (`capability -> bitmap of entity ids`). Store policy-tag postings the same way. Store vectors in a columnar SQ8 arena (one byte per dimension) with an f32 re-score tier for the final top-k. Metadata is a struct-of-arrays indexed by the dense id. Apply each record change as an incremental upsert or tombstone. Never rebuild the index for one change. Compact tombstones when they exceed 20 percent (named default `tombstone_compact_ratio`). Build is O(N log N) for the ANN graph. Build is O(N c) for postings, with c capabilities per record. A capability filter costs one bitmap intersection per required capability, plus a union over subsumed subtypes. If the filtered pool is at most `flat_threshold` (default 4096), rank by an exact SQ8 scan with f32 re-score. Otherwise, run filtered HNSW traversal with the bitmap as the admit predicate. If `eg-ann` hnsw search has no predicate, add one. Readers use a lock-free snapshot (an atomically swapped `Arc` per shard). One writer per shard publishes a new epoch after each change batch. The query path takes no global lock. Memory is bounded by `max_records_per_shard` (default 1,000,000); an upsert past the bound refuses. It does not evict silently. This replaces AU `CapabilityIndex.add`, `remove`, `build_from_edges`, `_candidate_ids` and the 4096-entry LRU cache. Proving test: `crates/eg-compute/src/capability_index/tests.rs::incremental_upsert_and_tombstone_match_rebuild`. | Build an index by N incremental upserts and deletes. It returns the same top-k as a full rebuild of the surviving records. A change touches only the changed id. A bound overflow refuses with no partial write. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.3 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `compute_capability_eligibility(record, question, projection)` in `capability_designation.rs` as a pure function. Each rule is a named replaceable default. `capability_rule`: the record meets a required capability T when it declares T. It also meets T when it declares a subtype of T. The composed GraphSchema `rdfs:subClassOf` closure defines subtypes. The first matching declared class in sorted order gives the reported subsumption path. `tenant_rule`: a commons record is visible to every tenant; a record of a different tenant is never a candidate. Tenant filtering runs before any score or count (R013). `policy_rule`: fail-closed; a record must carry every required policy tag, and an untagged record fails any non-empty requirement. `eligible` is the AND of the gates that the question asked for. An omitted filter never disqualifies. The subsumption projection comes from the engine's own `OwlReason` closure at the question's schema digest. It is not supplied by the caller. This replaces AU `compute_eligibility`, `_satisfied_required_caps`, `_tenant_match`, `_is_eligible` and `CapabilityIndex.explain`. AU acceptance cases: `tests/retrieval/test_capability_index.py::test_injected_hierarchy_matches_declared_subtype`, `::test_policy_filter_excludes_ineligible_candidate`, `::test_tenant_filter_scopes_candidates_but_admits_unscoped`, `::test_combined_capability_tenant_policy_filters`, `::test_explain_reports_eligible_candidate_features`, `::test_explain_reports_why_an_ineligible_candidate_was_excluded`. Proving test: `crates/eg-types/src/decision/capability_designation.rs::tests::eligibility_gates_match_au_cases`. | Each listed AU case, re-expressed as a fixture, gives the same eligible verdict, missing sets and subsumption path. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.4 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `rank_capability_candidates(pool, question, rewards, policy)` in `crates/eg-compute/src/capability_index/rank.rs`. L2-normalize the stored and query vectors; similarity is the inner product. Each rule is a named replaceable default. `oversample_rule`: take `min(pool_size, max(k, 4k))` candidates by pure cosine. `reward_blend`: add `reward_weight * (reward - 0.5)`; default `reward_weight` 0.15. `prior_blend`: add `prior_weight * (prior - 0.5)`; default `prior_weight` 0.15. `default_ontology_prior` applies when the question gives no prior and records carry an ontology type. The modal type of the oversampled pool gets 1.0. Other types get 0.5. With no stored types, the prior is off. A weight of zero turns its term off. With both terms off the order is pure cosine. Ties order by entity id, ascending. Return at most k designations, each with its swappable alternatives sorted by id. This replaces AU `CapabilityIndex.designate`, `_blend_ranked`, `_resolve_ontology_prior`, `_rank_brute_force`, `_rank_via_hnsw` and `alternatives`. AU acceptance cases: `tests/retrieval/test_capability_index.py::test_ranking_returns_planted_top1`, `::test_capability_filter_shrinks_results`, `::test_alternatives_returns_swappable_partner`, and all five cases in `tests/retrieval/test_kg_2_44b_ontology_prior.py`. Proving test: `crates/eg-compute/src/capability_index/tests.rs::blend_order_matches_au_cases`. | Fixtures show planted top-1 recovery and type-coherent top-k. They show exact cosine parity with both weights at zero. They show an explicit prior that overrides the default, and id-ordered ties. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.5 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `apply_capability_outcome(reward, outcome, policy)` in `capability_designation.rs`. The outcome is `success: bool` (1 or 0) or an explicit reward clamped to [0, 1]. The update is an exponential moving average: `new = (1 - alpha) * old + alpha * observed`, with named default `alpha` 0.3 and neutral start 0.5. All arithmetic is Q32 fixed point, so replay is deterministic (R007). `generation_erasure` applies when a writer upserts a record again with a changed vector. If the cosine distance to the stored vector is above 0.25, reset the reward to neutral. Then increment `generation`. `selective_erase(ids)` resets only the named ids and is order-independent. `decay(factor)` moves every reward toward 0.5 by `0.5 + (r - 0.5) * factor`, with default factor 0.99. A durable reward seeds a record only when the shard has no newer reward for it. Rewards persist in a new Agent Library table `capability_reward` through `AgentLibraryStore` in redb. They survive restart. This replaces AU `record_outcome`, `reward_of`, `_maybe_erase_stale_reward`, `selective_erase_rewards`, `decay_rewards`, and the AU durable EMA in `retrieval/durable_outcome_store.py`. AU acceptance cases: all five cases in `tests/retrieval/test_reward_writeback.py`, `tests/retrieval/test_capability_index.py::test_material_reembed_erases_stale_reward`, `::test_selective_erase_rewards_is_targeted_and_order_independent`, and `tests/unit/graph/test_capability_routing_x4.py::test_bandit_prefers_the_historically_better_tool_over_a_marginally_closer_one`. Proving test: `crates/eg-types/src/decision/capability_designation.rs::tests::reward_ema_erasure_and_decay`. | Fixtures show a bounded EMA. A material re-embed resets reward, and a minor re-embed keeps it. Fixtures also show targeted erasure, decay toward neutral, and a reward that survives store reopen. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.6 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Each shard pins one `embedding_version` and one `dim` at its first record. A record or question with a different version or dim is refused. A shard with zero live records releases the pin. A re-index can then fill it under a new version. Re-indexing to a new version builds a second shard generation beside the live one and swaps it atomically. Readers never see a mixed generation. This replaces AU `_pin_or_check_embedding_version`, `_check_query_embedding_version` and the drained-pin release in `CapabilityIndex.remove`. Proving test: `crates/eg-compute/src/capability_index/tests.rs::version_pin_refuses_mixed_spaces`. | A mismatched version or dim refuses on upsert and on question. A drained shard accepts a new version. A generation swap is atomic to readers. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.7 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Add `QuestionKind::CapabilityDesignation` at `crates/eg-types/src/decision/statistical.rs:58`. Add `capability_designation_outcome` in new `src/server/handlers/decide/stat_capability_designation.rs`. Match it in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:137`, beside `tool_subset_outcome`. The served method is the existing `Decide`; its answer carries `CapabilityDesignationV1` in the decision record. Outcomes use the existing `DecisionLog` method with a new op `capability_outcome{tenant_id, entity_id, success | reward_q32, decision_id, source_ids}`. It returns the updated `CapabilityRewardV1`. The engine keeps the index current from its own committed changes. The existing CDC feed sends Agent Library writes to the shard writer. It also sends changes to agent, tool and skill nodes. There is no client-side feed and no client-side index. Rerun `gen_contract` so the generated client has `send_decide` for the new kind and the new `DecisionLog` op. Proving test: `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::decide_routes_capability_designation`. | The served `Decide` answer for the new kind returns typed designations. A committed Agent Library write is visible to the next question without a rebuild. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.8 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Refuse with a typed reason and write nothing. `embedding_version_mismatch` and `dim_mismatch` name the expected and actual values. `empty_query_vector` and `malformed_query_vector` cover a bad vector. `too_many_required_capabilities` applies above 32, and `too_many_candidates` applies when k is above 64 (R065). `capability_schema_unavailable` applies when required capabilities exist and the GraphSchema closure or its digest is unavailable. The engine fails closed and never falls back to literal matching. `index_capacity_exceeded` applies on a bound overflow. `capability_outcome` refuses `outcome_value_missing` when it has neither success nor reward. It refuses `access_denied` for an entity outside the caller's tenant. When no visible candidate meets the filters, the engine abstains with `no_capable_candidate`. That reason names the first missing capability (R010). A k of zero returns an empty designation list. Proving test: `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::capability_designation_refusals`. | Each case returns its typed reason. No reward, index epoch or decision record changes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.9 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The decision record emits one premise per returned designation. The premise holds the entity id, cosine, reward, prior, blended score and eligibility verdict. It emits premises for each named default and its value. It emits premises for the index epoch, the embedding version, the GraphSchema digest and the candidate pool size. It emits one premise per subsumption path used. Capability facts from pack annotations or A2A cards are claims; the record states the weakest evidence class (R002). A `capability_outcome` trace records the prior and new reward, alpha, generation and source ids. Proving test: `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::premises_name_scores_and_defaults`. | The decision record lists every score term and default for every designation. The outcome trace links to its source ids. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.10 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The index meets measured budgets. Reference load: N = 100,000 records, dim = 1024, 8 capabilities per record, k = 5, on one build-host core. Filtered case: one required capability selects at most 5 percent of records. Its budget is 2 ms at p50 and 10 ms at p99 or less. Unfiltered case: the budget is 3 ms at p50 and 15 ms at p99 or less. Its recall@5 is at least 0.95 against an exact scan. Incremental upsert: the budget is 1 ms at p99 or less, without durable commit. Resident memory is at most `1.25 * N * dim` bytes for vectors plus 96 bytes per record for metadata and postings. At the reference load this is about 132 MiB. Query cost is sub-linear in N for the unfiltered and large-pool paths. Read throughput scales with reader threads, because no global lock is on the query path. Benchmark: `benches/capability_designation_bench.rs`. | The benchmark reports p50, p99, recall@5 and resident bytes at the reference load and at N = 10,000. Each value is within its budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.11 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method with a `CapabilityDesignation` question. The test `tests/decide/test_capability_designation_served.py::test_designation_end_to_end` writes agent, tool and skill components through the served Agent Library. It submits a question with required capabilities, a tenant and policy tags, and observes subsumption-aware, filtered, ranked designations with eligibility. It then records outcomes through `DecisionLog` and observes the re-ranked order. It restarts the engine and observes the same rewards. Acceptance mirrors the deleted AU tests: `tests/retrieval/test_capability_index.py`, `tests/retrieval/test_kg_2_44b_ontology_prior.py`, `tests/retrieval/test_reward_writeback.py`, `tests/unit/graph/test_capability_routing_x4.py` and `tests/unit/graph/test_capability_designation.py` on agent-utilities branch `fix/au300-queries`. The `.10` benchmark runs in the same lane. Proving test: `tests/decide/test_capability_designation_served.py::test_designation_end_to_end`. | The served test passes against a real engine, and the benchmark meets the `.10` budgets. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.12 Designation and selection read imported connector-pack relationships (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Designation and selection read imported connector-pack relationships (rollup).** Capability designation selects tools, skills and prompts from the surface triples of `EG-TYPED-PACKS-R102`. It also answers which domain method applies to a target class. Children `.12.1` to `.12.6` deliver it. | Rollup closes when every child `.12.1` to `.12.6` passes its proving test. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.12.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `applies_to: BTreeSet<ClassIri>` and `executes: BTreeSet<ClassIri>` to `CapabilityRecordV1` in `crates/eg-types/src/decision/capability_designation.rs`. Add `target_classes: BTreeSet<ClassIri>` to the designation question. The engine fills records from `cp:operatesOn`, `cp:appliesTo`, `cp:executes` and `cp:providesCapability` triples. Owner: epistemic-graph. | `crates/eg-types/src/decision/capability_designation.rs::tests::pack_surface_fields_round_trip`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.12.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** `capability_rule` must also match a record when one `applies_to` or `executes` class is a subclass of a target class. Subsumption reads `rdfs:subClassOf` over the composed schema within the shared step budget. A method question returns the method class and each tool that executes it. Owner: epistemic-graph. | `crates/eg-types/src/decision/capability_designation.rs::tests::target_class_subsumption_selects_tools`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.12.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The surface projection of `EG-TYPED-PACKS-R102.2` upserts records into the index of `crates/eg-compute/src/capability_index/` at projection commit. `capability_designation_outcome` is matched in `handle_decide` beside `tool_subset_outcome` (`src/server/handlers/decide/stat_decide.rs:137`). Owner: epistemic-graph. | `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::projection_commit_upserts_pack_records`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.12.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A target class with no matching record must abstain with `no_designated_component`, naming the class. A record from a stale pack revision must refuse with `stale_pack_revision`. An unknown target class must refuse with `unknown_target_class`. Owner: epistemic-graph. | `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::pack_target_refusals`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.12.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The engine must emit one premise per candidate. Each premise names the subclass path, the component IRI, the pack digest and the graph revision. Owner: epistemic-graph. | `src/server/handlers/decide/stat_tests/capability_designation_tests.rs::premises_name_subclass_path_and_pack`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.12.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` method with a `CapabilityDesignation` question. The test imports a connector pack through `ConnectorPack.Import` and asks for a target class. It must observe the executing tool and the subclass path. With the pack withdrawn, the question must abstain. Owner: epistemic-graph. | `tests/decide/test_capability_designation_pack_served.py::test_designation_reads_imported_pack`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R172.13 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The capability index applies the active capability-scope adapter of `EG-DECISION-ENGINE-R174.7` to the task embedding before `rank_capability_candidates`. Capability outcomes from `EG-DECISION-ENGINE-R172.5` feed that adapter's fit. A drift refresh of `EG-DECISION-ENGINE-R174.8` re-indexes a shard through the generation swap of `EG-DECISION-ENGINE-R172.6`. With no active adapter, ranking uses the base vector. Proving test: `crates/eg-compute/src/capability_index/tests.rs::capability_adapter_applies_before_rank`. | The adapted ranking differs from the base ranking only through the active adapter, and no adapter yields the base ranking. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R175 Implicit-reasoning recommendation over temporal semantic ids (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Implicit-reasoning recommendation over temporal semantic ids (rollup).** The engine must rank catalog items for a query and a history. It encodes items as temporal semantic ids and refines a latent target for a bounded number of pause steps. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R175.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `SemanticId{time_bucket: u16, codes: [u8; 4]}`, `RecommendRequestV1` and `RecommendAnswerV1` in `crates/eg-types/src/decision/recommend.rs`. The request holds a catalog reference, a query embedding, history item ids, `pause_steps` from 0 to 8, `top_k` from 1 to 100 and `as_of`. Add `QuestionKind::ItemRecommendation`. Proving test: `recommend.rs::tests::request_round_trips`. | A serde round trip keeps every field and rejects `pause_steps = 9`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R175.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add residual quantization and refinement in `crates/eg-numeric/src/recommend/`. Fitting uses seeded k-means per level with at most 4 levels of 256 codes. Each pause step moves the working vector toward the history and its nearest items. Ranking uses code-prefix buckets, then cosine. Encode cost is O(L·C·d) per item. Query cost is O(p·(h + m)·d) plus the candidate bucket size. | A seeded fixture returns the same ranking on two runs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R175.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:137`, beside `tool_subset_outcome`. Catalog vectors come from the graph's semantic store. The fitted encoder persists through `decision_jobs::encode_artifact` per catalog revision. A new item encodes with the frozen codebooks. | A dispatch test routes the new kind and reads the stored encoder. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R175.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** An empty catalog must abstain with `empty_catalog`. A dimension mismatch must return `INVALID_ARGUMENT`. An encoder older than the catalog revision must abstain with `encoder_stale`. | Each case returns its typed reason and no ranking. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R175.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The record must name encoder revision, catalog digest and pause steps. It must hold one premise per returned item with its score. The NDCG reproduction must persist as a `BenchmarkClaim` from `crates/eg-types/src/benchmark_claim.rs`. | A record readback lists the premises and the claim. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R175.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` method. The test `tests/decide/test_recommend_served.py::test_pause_steps_lift_ndcg` uses a seeded catalog of 4 clusters with 6 items each. NDCG@6 with 2 pause steps must be at least NDCG@6 with 0 pause steps. The benchmark `crates/eg-numeric/benches/semantic_id_rank.rs` must show p50 under 5 ms and p99 under 20 ms for 100,000 items. | The served test passes, and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R173 Cross-round edit concentration cap (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Cross-round edit concentration cap (rollup).** The engine must decide keep or revert for a candidate harness edit. It counts shipped edits per dimension over a round window against a received threshold. The default threshold is 3 shipped edits within 5 rounds. The same threshold must drive a shape the engine validates. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R173.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `ConcentrationPolicy{policy_iri, min_shipped, window_rounds, revision}`, `EditFact{edit_id, dimension_iri, round, status}` and `ConcentrationVerdict{dimension_iri, count, first_round, last_round, action}` in `crates/eg-types/src/decision/concentration.rs`. Closed `action` values are `keep` and `revert`. Add `QuestionKind::EditConcentration`. Proving test: `concentration.rs::tests::policy_round_trips`. | A serde round trip keeps every field and rejects `window_rounds = 0`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R173.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add `concentration_verdict(facts, candidate, policy)` in `concentration.rs`. It counts shipped edits on the candidate's dimension inside the window. It returns `revert` when the count with the candidate reaches `min_shipped`. Otherwise it returns `keep`. Each dimension keeps a ring buffer of rounds. A new edit costs O(1) amortized. | Unit tests cover the third edit in rounds 2 to 4 and two edits only. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R173.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The decision attaches in `handle_decide` at `src/server/handlers/decide/stat_decide.rs:137`. The policy node supplies the threshold. A concentration shape in `crates/eg-core/ontology/` reads the same policy node. `ShaclValidate` evaluates it through `eg-shacl`. | A test asserts the same verdict from `Decide` and from `ShaclValidate`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R173.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A missing policy must abstain with `no_concentration_policy`. Facts with mixed policy revisions must abstain with `mixed_policy_revision`. | Each case returns its typed reason and no verdict. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R173.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The record must list the counted edit ids, the window bounds, the threshold and the policy revision. | A record readback lists each field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R173.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` method. The test `tests/decide/test_concentration_served.py::test_third_same_dimension_edit_reverts` submits shipped edits in rounds 2 to 6 on one dimension. The third edit must return `revert`. Two edits must return `keep`. The benchmark `crates/eg-types/benches/concentration.rs` must show p99 under 2 ms for 10,000 edit facts. | The served test passes, and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.110 Native tool relevance index and task-to-tool assignment (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Native tool relevance index and task-to-tool assignment (rollup).** The engine must hold one tool relevance index for the fleet catalog. It must assign tools to a task and an agent role from that index. Every tool search surface must receive this one ranking. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.110.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `ToolEntry{tool_id, server_id, name_tokens, description_tokens, capability_iris, token_cost}` with interned `u32` ids. Add `ToolAssignmentRequestV1{task_text, task_embedding, agent_role_iri, top_k, context_budget_tokens}` with `top_k` from 1 to 50. Add `ToolAssignmentV1` in `crates/eg-types/src/decision/task_plan.rs`. Proving test: `task_plan.rs::tests::assignment_round_trips`. | A serde round trip keeps every field and rejects `top_k = 51`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.110.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add an inverted token index in `crates/eg-text/src/tool_relevance.rs` and an embedding arm in `eg-ann`. Lexical and embedding ranks fuse by reciprocal rank with `k = 60`. The role allowlist filters before ranking. The result feeds `rank_tools_by_relevance` from `EG-DECISION-ENGINE-R134.2`. A catalog change updates postings in O(t) tokens. | A fixture asserts the fused order and an incremental update. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.110.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The `ToolRelevance` arm from `EG-DECISION-ENGINE-R134.5` at `src/server/handlers/decide/stat_decide.rs:137` reads this index. Fleet catalog writes update the index through the `FleetCatalog` record path. | A served test changes the catalog and observes the new ranking. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.110.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** An empty catalog must abstain with `empty_catalog`. A budget below the cheapest tool must abstain with `budget_below_minimum`. An embedding dimension mismatch must return `INVALID_ARGUMENT`. | Each case returns its typed reason and no tools. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.110.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each returned tool must carry a premise with lexical score, embedding score, fused rank and index revision. | A record readback lists the premise fields. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.110.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` method with a `ToolRelevance` question. The test `tests/decide/test_tool_assignment_served.py::test_role_assignment_uses_one_ranking` loads a catalog of 123 tools on 66 servers. Two search surfaces must receive the same order. The benchmark `crates/eg-text/benches/tool_relevance.rs` must show p50 under 1 ms and p99 under 5 ms for 10,000 tools. | The served test passes, and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.102 Run retrieval outcomes and per-step credit (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Run retrieval outcomes and per-step credit (rollup).** The engine must record a delegated run's retrieval outcome and per-step credit. The harness sends the answer and the trace only. The engine joins cited rows to retrieved rows and credits each step. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.102.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `LearningWrite::RunOutcome(RunOutcomeV1)` at `crates/eg-types/src/decision/statistical/retrieval.rs:295`. `RunOutcomeV1` holds run id, decision ids, answer digest, cited row ids, success and at most 256 `StepRecord{step_idx, agent_iri, capability_iri, reward}`. Proving test: `retrieval.rs::tests::run_outcome_round_trips`. | A serde round trip keeps every field and rejects 257 steps. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.102.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Cited rows become positives. Retrieved rows that the answer does not cite become hard negatives under `EG-DECISION-ENGINE-R100`. Each step's advantage is reward minus a per-capability moving baseline. The default baseline weight is 0.1 and is a replaceable default. Cost is O(s + r) in steps and rows. | A unit test computes positives, negatives and advantages for a fixture. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.102.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The write enters `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398`. The decide handlers dispatch it to a new `src/server/handlers/decide/stat_run_credit.rs`. The capability baseline persists in the decision jobs store. | A dispatch test routes the write and reads the stored baseline. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.102.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** An unknown decision id must return `INVALID_ARGUMENT`. A repeated run id with a new digest must return `IDEMPOTENCY_CONFLICT`. A cited row absent from every referenced result must refuse with `CITATION_NOT_RETRIEVED`. The generated error contract must declare that code. | Each case returns its code and writes nothing. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.102.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The receipt must hold run id, decision ids, positive and negative counts, per-step advantages and baseline revisions. | A test reads the receipt after one run. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R100.102.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is a served `Discover` call followed by a served `DecisionLog` `Learn` call. The test `tests/decide/test_run_credit_served.py::test_cited_rows_and_step_credit_recorded` reads back the hard negatives and the moved baseline. The benchmark `benches/run_credit.rs` must show p99 under 5 ms for a 256-step run. | The served test passes, and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174 Engine-run embedding generation swap cycle (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Engine-run embedding generation swap cycle (rollup).** The engine must run the embedding generation cycle end to end. The cycle publishes a model, re-embeds into a shadow generation, receipts the comparison and activates the generation. Children `.1` to `.6` deliver it. Child rollups `.7` (scoped adapters), `.8` (drift-driven refresh) and `.9` (search-connector freshness) extend it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `GenerationCycleV1{logical_graph, model_ref, state, shadow_graph, receipt_digest}` in `crates/eg-types/src/decision/statistical/retrieval_generation.rs`. `model_ref` holds id, revision and dimension. Closed `state` values are `published`, `reembedding`, `evaluated`, `activated` and `rejected`. Proving test: `retrieval_generation.rs::tests::cycle_round_trips`. | A serde round trip keeps every field and rejects an unknown state. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** A cycle is idempotent per logical graph and model revision. A model that is already active is a no-op. Re-embedding runs in batches of 256 nodes and checkpoints each batch. Evaluation reuses `src/server/handlers/decide/stat_generation.rs`. Activation moves the pointer by compare-and-set against the active generation. | A unit test resumes a cycle from a checkpoint and activates once. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The cycle enters through `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398`. A new `stat_generation_cycle.rs` runs it as an `eg-jobs` analytics job. The job holds a background capacity lease from `AcquireCapacity`. The embedding call uses the engine's configured embedding endpoint. | A served test submits a cycle and observes the job and the lease. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A caller without `admin:decision-head` must receive `ACCESS_DENIED`. A dimension mismatch must return `INVALID_ARGUMENT`. A failing receipt must end in `rejected` with no pointer move. A concurrent pointer move must return `CONFLICT`. | Each case returns its code and leaves the active pointer unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The receipt must hold model revision, re-embedded node count, comparison metrics and the pointer before and after. | A test reads the receipt after one activation. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `DecisionLog` method. The test `tests/decide/test_generation_cycle_served.py::test_cycle_resumes_and_activates` re-embeds 10,000 nodes. It restarts the engine during re-embedding and observes resume from the checkpoint. A later served `Discover` must read the new generation. Engine overhead must stay under 1 ms per 256-node batch. | The served test passes, and the measured overhead meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R176 Job-scoped load set from the overlay of all connector packs (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Job-scoped load set from the overlay of all connector packs (rollup).** A client asks what a job needs. The engine answers with the tools, the skills and the local agents with their prompts. It reads the surface relationships of every imported connector pack (`EG-TYPED-PACKS-R102`). It reuses capability designation (`EG-DECISION-ENGINE-R172`). graph-os loads only the answered set (`ARBORA-FLEET-R037`). Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R176.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `LoadSetQuestion{job_text, job_embedding, required_capabilities, max_tools, max_agents}` and `LoadSetAnswer{tools, skills, agents, graph_revision, premises}` in `crates/eg-types/src/decision/load_set.rs`. An agent entry is `AgentStart{agent_iri, prompt_iri, model_profile}`. Add `QuestionKind::LoadSet` (`crates/eg-types/src/decision/statistical.rs:58`). The default `max_tools` is 32 with a hard limit of 128. The default `max_agents` is 4. Proving test: `crates/eg-types/src/decision/load_set.rs::tests::load_set_round_trips`. | A serde round trip keeps every field and rejects `max_tools` above 128. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R176.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The engine runs capability designation for each required and each job-derived capability. It unions the candidates and removes duplicate component ids. It keeps the top `max_tools` by designation score. Skills join with the tools they use. Agents and prompts come from the orchestration answers of `EG-CQ-ORCH-R002` and `EG-CQ-ORCH-R005`. The p95 answer time must stay under 50 ms for 5,000 tools across 100 packs. Proving test: `src/server/handlers/decide/stat_tests/load_set.rs::bounded_union_in_stable_order`. | A job over three packs returns a bounded, duplicate-free set in a stable order. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R176.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** `handle_decide` (`src/server/handlers/decide/statistical.rs:11`) matches `QuestionKind::LoadSet` beside capability designation. No production caller answers a load set today. Proving test: `src/server/handlers/decide/stat_tests/load_set.rs::served_decide_reaches_load_set`. | A served `Decide` with a load-set question reaches the new arm. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R176.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** An empty job text with no capabilities must refuse with `INVALID_ARGUMENT`. A capability without a candidate must abstain with `no_designated_component` and name the capability. A stale pack revision must refuse with `stale_pack_revision`. Proving test: `src/server/handlers/decide/stat_tests/load_set.rs::load_set_refusals`. | Each case returns its code, and no partial set hides an abstention. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R176.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The answer must carry one premise per chosen component. A premise names the capability, the score, the pack digest and the graph revision. The answer must state the count of excluded candidates. Proving test: `src/server/handlers/decide/stat_tests/load_set.rs::premises_per_component`. | Each chosen tool has one premise with its pack digest. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R176.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` method with a load-set question. The test imports three connector packs with 300 tools. It asks for one job. Proving test: `tests/decide/test_load_set_served.py::test_job_returns_bounded_tool_skill_agent_set`. | The answer holds 32 tools or fewer, their skills and one agent start, and meets the time budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R177 Connector usage guidance is a graph query (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Connector usage guidance is a graph query (rollup).** A client asks how and when to use connector X for job J. The engine answers from the graph. The answer holds the conditions, the ordered tool steps, the prompts and the cautions. A skill becomes this query. Static skill text is a secondary premise only. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R177.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `UsageGuidance{connector, job_class, conditions, steps, prompts, cautions, graph_revision}` and `UsageStep{tool, inputs_from, precedes}` in `crates/eg-types/src/decision/usage_guidance.rs`. Add `QuestionKind::UsageGuidance`. Proving test: `crates/eg-types/src/decision/usage_guidance.rs::tests::guidance_round_trips`. | A serde round trip keeps every field and rejects a step without a tool. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R177.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The engine derives conditions from capability and precondition triples. It derives steps from `eg:TaskStep` and `eg:precedes` (`EG-CQ-ORCH-R001`) joined to pack tools. When two step orders are legal, it orders them by recorded success rate. Static skill text enters as a premise labelled `declared`. Proving test: `src/server/handlers/decide/stat_tests/usage_guidance.rs::steps_ordered_by_outcome`. | A fixture connector returns ordered steps, and success rate breaks a tie. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R177.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** `handle_decide` (`src/server/handlers/decide/statistical.rs:11`) matches `QuestionKind::UsageGuidance`. Proving test: `src/server/handlers/decide/stat_tests/usage_guidance.rs::served_decide_reaches_guidance`. | A served `Decide` with a guidance question reaches the new arm. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R177.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** An unknown connector must refuse with `UNKNOWN_CONNECTOR`. A connector without steps must abstain with `no_usage_steps`. A cyclic step order must refuse with `CYCLIC_STEPS`. Proving test: `src/server/handlers/decide/stat_tests/usage_guidance.rs::guidance_refusals`. | Each case returns its code. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R177.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each step must cite the triples and the outcome counts it used. Proving test: `src/server/handlers/decide/stat_tests/usage_guidance.rs::steps_cite_triples`. | Each step lists its supporting triples. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R177.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` method with a guidance question. The test imports one connector pack and records outcomes for two step orders. Proving test: `tests/decide/test_usage_guidance_served.py::test_how_to_use_connector_answers_from_graph`. | The answer lists the steps in the order with the higher success rate, with citations. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.7 Scoped outcome-trained adapters on the frozen base embedding (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Scoped outcome-trained adapters on the frozen base embedding (rollup).** The engine must fit a small learned transform over the frozen base embedding. It trains from outcomes the engine already records. Each adapter is versioned per tenant, corpus or capability scope. It applies at query time, or at index time over stored vectors, without re-embedding the corpus. Keep or revert is decided by measured retrieval quality on held-out outcomes. Any failure serves the base embedding. Children `.7.1` to `.7.6` deliver it. It extends `EG-DECISION-ENGINE-R101`. | Rollup closes when every child `.7.1` to `.7.6` passes its proving test. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.7.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add closed `AdapterScope` values `graph`, `corpus{corpus_iri}` and `capability{capability_iri}` in `crates/eg-types/src/decision/statistical/retrieval_adapter.rs`. Add closed `AdapterSide` values `query` and `index`. Add closed `OutcomeSource` values `retrieval_outcome`, `run_outcome` and `capability_outcome`. Extend `AdapterFitRequest` with `scope`, `side` and `sources`. Extend `QueryAdapterBody` with `revision: u32` and `parent_digest: Option<String>`. Add `PointerRef::ScopedAdapter{graph, scope}` at `crates/eg-types/src/decision/statistical/retrieval.rs:263`. Proving test: `retrieval_adapter.rs::tests::scoped_fit_request_round_trips`. | A serde round trip keeps every field and rejects an unknown scope, side or source. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.7.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Extend the fit in `crates/eg-numeric/src/decision/adapter.rs`. The transform is `W = I + sum(g_i * u_i * u_i^T)` with rank 1 to 8 and orthonormal units. Rank 1 to 8 covers the low-rank layer; a diagonal projection is rank `d` and is out of scope. Cited rows are positives. Retrieved rows that are not cited are hard negatives (`EG-DECISION-ENGINE-R100`, `EG-DECISION-ENGINE-R100.102`). Capability outcomes (`EG-DECISION-ENGINE-R172.5`) weight task-to-entity pairs by reward. All arithmetic is Q30 fixed point with a seeded order, so a refit replays bit for bit. The held-out split hashes each decision id. Keep needs the existing Wilson lower bound above one half and adapted MRR at least base MRR. After activation, a monitor dual-scores new outcomes against the base. It rolls back when the Wilson upper bound falls below one half over at least 50 outcomes. Resolution order is capability, then corpus, then graph, then base. An `index` adapter transforms stored vectors at read, with no embedding endpoint call. Budgets: fit at most 30 s for 100,000 examples at `d = 1024` and rank 8 on one core. Fit memory is at most 64 MiB. A resident adapter is at most 40 KiB. A tenant holds at most 64 active adapters. | Unit tests cover deterministic refit, the keep and revert rules, scope resolution order and the memory cap. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.7.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The fit enters `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398` through `LearningWrite::FitAdapter` and `stat_adapter.rs`. Activation and rollback move the pointer through `stat_pointer.rs`. Serving resolves the scoped adapter in `src/server/handlers/decide/served_adapter.rs` and applies it at `src/server/handlers/graph_ops/semantic.rs:233` on `Discover` and `SemanticSearch`. The capability index applies it before `rank_capability_candidates` (`EG-DECISION-ENGINE-R172.13`). An `index` adapter materializes through the generation cycle of `EG-DECISION-ENGINE-R174` with no endpoint call. Fits run as `eg-jobs` analytics jobs on a background lease from `AcquireCapacity`. Non-urgent runs take downtime priority from the downtime scheduling of `EG-DURABLE-KERNEL-R101`. | A dispatch test routes a scoped fit, an activation and a served query through each named call site. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.7.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A caller without `admin:decision-head` must receive `ACCESS_DENIED`. An unknown scope IRI must refuse with `adapter_scope_unknown`. Fewer held-out outcomes than `min_eval_items` must refuse with `insufficient_outcomes`. A space digest that differs from the graph's space must refuse with `adapter_space_mismatch`. Rank times dimension above the resident cap must refuse with `adapter_memory_budget`. A 65th active adapter in a tenant must refuse with `too_many_adapters`. A failing receipt must move no pointer. An unreadable adapter state serves the base query and is not a refusal. | Each case returns its code, writes no pointer and leaves the served adapter unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.7.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The fit receipt must hold scope, side and each outcome source with its count. It must also hold the training digest, both MRR values, the Wilson bounds, the parent digest and the revision. A rollback receipt must hold the monitor window and its bounds. The `Discover` verdict names the applied adapter digest or `base` (`EG-FEDERATED-QUERY-R089.7`). | A test reads the fit receipt, a rollback receipt and the verdict field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.7.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `DecisionLog` method followed by served `Discover`. The test `tests/decide/test_scoped_adapter_served.py::test_outcome_adapter_lifts_and_reverts` records cited outcomes through `Learn`. It fits a capability-scope adapter, activates it and observes the re-ordered `Discover` rows with the adapter digest. It then feeds degrading outcomes and observes rollback to `base`. The benchmark `crates/eg-numeric/benches/scoped_adapter.rs` must show at most 50 µs p99 added query latency at `d = 1024` and rank 8. It must show the fit and memory budgets of `.7.2`. | The served test passes, and the benchmark receipt meets each budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.8 Drift-driven embedding refresh with atomic per-shard versions (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Drift-driven embedding refresh with atomic per-shard versions (rollup).** The engine must keep embeddings current as data and vocabulary drift. It detects distribution shift, out-of-vocabulary growth, retrieval-quality decay and staleness per shard. It re-embeds only the changed regions into a new generation and swaps each shard atomically. Readers never mix generations. Refresh runs in downtime windows unless a job needs it now. Children `.8.1` to `.8.6` deliver it. | Rollup closes when every child `.8.1` to `.8.6` passes its proving test. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.8.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `DriftSignalV1{scope, kind, value_q16, threshold_q16, window, reference_generation, observed_at}` in new `crates/eg-types/src/decision/statistical/retrieval_drift.rs`. Closed `kind` values are `distribution_shift`, `vocabulary_growth`, `quality_decay` and `staleness`. Add `RefreshPlanV1{logical_graph, regions, reason, priority, target_generation}` with at most 4,096 regions. Add `RegionRef{shard_id, node_type, revision_from, revision_to}`. Closed `priority` values are `downtime` and `on_demand`. Proving test: `retrieval_drift.rs::tests::refresh_plan_round_trips`. | A serde round trip keeps every field and rejects 4,097 regions. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.8.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Add the per-shard monitor in new `crates/eg-numeric/src/decision/drift.rs`. It keeps a running mean and diagonal variance of written vectors with Welford updates. Shift is the symmetric divergence of two diagonal Gaussians against the activation reference. Vocabulary growth compares written tokens with an 8 KiB Bloom filter built at generation activation. Quality decay compares the rolling MRR of cited outcomes with the activation baseline. Staleness reuses the `stale_index` test of `EG-FEDERATED-QUERY-R089.2`. Named defaults: shift 0.2, vocabulary growth 5 points, quality decay 10 percent. A signal must fire on two consecutive evaluations. A compressed bitmap per shard records nodes changed since the generation watermark. The plan selects only firing shards and their changed regions. Memory is at most 64 KiB per shard at `d = 1024`, excluding the bitmap. | Unit tests fire each signal kind, show hysteresis and select only changed regions. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.8.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The write commit path and `LearningWrite::RecordOutcome` update the monitor. Evaluation runs as an `eg-jobs` analytics job on a background lease from `AcquireCapacity`. A firing plan submits the generation cycle of `EG-DECISION-ENGINE-R174` through `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398`. Each refreshed shard swaps under the per-shard pin of `EG-DECISION-ENGINE-R172.6`. `discover` at `src/server/handlers/graph_ops/semantic.rs:88` pins one generation per shard at query start. Non-urgent runs take downtime priority from the downtime scheduling of `EG-DURABLE-KERNEL-R101`. A job that declares a freshness need runs the plan with `on_demand` priority. | A dispatch test observes a monitor update, one scheduled plan and one per-shard swap. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.8.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A logical graph without a drift policy must abstain with `drift_policy_missing`. A plan above 4,096 regions or the policy node budget must refuse with `refresh_region_budget`. A concurrent shard swap must return `CONFLICT` and leave the live generation. An `on_demand` plan without `admin:decision-head` must receive `ACCESS_DENIED`. | Each case returns its code and leaves every shard generation unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.8.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each signal must persist as a premise with kind, value, threshold, window and reference generation. The refresh receipt must list the regions, the re-embedded node count and each shard's generation before and after. | A test reads the signal premises and the refresh receipt. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.8.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served graph write path followed by served `Discover`. The test `tests/decide/test_drift_refresh_served.py::test_vocabulary_drift_refreshes_changed_shards` writes 4 shards. It adds new vocabulary to one shard and observes `vocabulary_growth`. It runs the scheduled downtime refresh and observes re-embedding of that shard only. Concurrent `Discover` readers must see one generation per shard in each response. The benchmark `crates/eg-numeric/benches/drift_monitor.rs` must show a monitor update under 2 µs p99 per write at `d = 1024`. It must show evaluation under 5 ms per shard. | The served test passes, and the benchmark receipt meets each budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.9 Fresh data through the search connector's virtual-graph source (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Fresh data through the search connector's virtual-graph source (rollup).** When drift, staleness or a job needs fresher data, the engine must schedule a refresh. The refresh runs through the `searxng` connector's virtual-graph source. It reads through the virtual-graph source and runs no extract-transform-load copy. Every result carries its source, retrieval time and query provenance. Refreshes deduplicate by URL and content digest. New and changed results feed the drift refresh of `EG-DECISION-ENGINE-R174.8`. Children `.9.1` to `.9.6` deliver it. | Rollup closes when every child `.9.1` to `.9.6` passes its proving test. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.9.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `FreshnessRefreshV1{logical_graph, queries, trigger, priority, acl_policy_ref, privacy_policy_ref, budget}` in new `crates/eg-types/src/decision/statistical/retrieval_refresh.rs`. `queries` holds 1 to 32 query texts. Closed `trigger` values are `drift_signal`, `staleness` and `job_demand`. `budget` holds `max_requests` and `max_cost_units`. Add `FreshResultV1{url, content_digest, source_connection_iri, retrieved_at, query_text, query_digest, refresh_id}`. Add `LearningWrite::RefreshFreshness` at `crates/eg-types/src/decision/statistical/retrieval.rs:295`. Proving test: `retrieval_refresh.rs::tests::refresh_round_trips`. | A serde round trip keeps every field and rejects 33 queries. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.9.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Canonicalize each URL by scheme and host case, default port and fragment removal. A result whose URL and content digest are already stored is a no-op. A stored URL with a new digest supersedes the earlier row. A new or superseding row marks its region changed in the drift bitmap of `.8.2`. A per-tenant token bucket enforces `max_requests` per window. Each request spends its declared cost units against `max_cost_units`. Cost is O(r) in results. | Unit tests cover canonical URLs, each dedupe outcome, the region mark and both budgets. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.9.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The refresh enters `DecisionLogOp::Learn` at `crates/eg-types/src/decision/statistical/log.rs:398`. A new `src/server/handlers/decide/stat_freshness.rs` runs it as an `eg-jobs` job. It reads the `searxng` `vg:VirtualMapping` of `EG-MEDIA-VOCAB-R015` through its registered `SourceConnection` (`EG-UNIFIED-DATA-PLANE-R037`). Hot results materialize under `EG-UNIFIED-DATA-PLANE-R038`. The web metasearch source category is `EG-UNIFIED-DATA-PLANE-R038.7`, listed in the source-category matrix `EG-UNIFIED-DATA-PLANE-R022.4`. Triggers come from `.8.3`, from `stale_index` of `EG-FEDERATED-QUERY-R089.2`, or from a job's freshness request. Non-urgent runs take downtime priority from the downtime scheduling of `EG-DURABLE-KERNEL-R101`. A `job_demand` refresh runs with `on_demand` priority on an interactive lease. | A dispatch test routes a refresh, observes one virtual-graph read and one region mark. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.9.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A refresh without an ACL policy must refuse with `refresh_acl_policy_missing`. A refresh without a privacy policy must refuse with `refresh_privacy_policy_missing`. A refresh above the request budget must refuse with `refresh_rate_budget_exceeded`. A refresh above the cost budget must refuse with `refresh_cost_budget_exceeded`. A graph with no registered search source must refuse with `search_source_unregistered`. The generated error contract must declare each code. | Each case returns its code and writes no row and no region mark. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.9.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each stored result must carry its source connection, retrieval time, query text and query digest. The refresh receipt must list new, unchanged and superseded counts, the budget spent and the marked regions. | A test reads the result provenance and the receipt. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.9.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `DecisionLog` method followed by served `Discover`. The test `tests/decide/test_freshness_refresh_served.py::test_search_refresh_dedupes_and_feeds_refresh` uses the recorded `searxng` fixture of `EG-MEDIA-VOCAB-R015.2`. A repeated refresh must report every result unchanged. A changed content digest must supersede its row and mark its region. The next drift refresh must re-embed that region. `Discover` must return the row with its provenance. Engine overhead must stay under 2 ms p99 per 100 results, excluding connector latency. | The served test passes, and the measured overhead meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R174.9.7 Held web Documents refresh by drift Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Held web Documents refresh by drift.** A staleness or drift signal of `EG-DECISION-ENGINE-R174.8` must schedule the URLs of the web Documents in its region as refresh candidates. The candidates pass the fetch selection of `EG-DECISION-ENGINE-R802`. An unchanged content digest is a no-op. A changed digest supersedes the Document through `EG-UNIFIED-DATA-PLANE-R651.7` and marks its region. Proving test: `tests/decide/test_freshness_refresh_served.py::test_stale_web_document_refetches_on_digest_change`. | A stale Document with an equal digest writes nothing; a changed digest supersedes it and marks its region. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R614 Capability cards, distilled proposals, topic classes and relation projection are engine enrichment (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Capability cards, distilled proposals, topic classes and relation projection are engine enrichment (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R614.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `crates/eg-enrich/src/semantic.rs` defines CapabilityCard, EnhancementCandidate, SpecDraft, TopicAssignment, ProjectionRule. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R614.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** A capability card summarizes a symbol, file or feature and is stored with the model and prompt that produced it. Research concepts rank into enhancement proposals and spec drafts by value. Documents classify into a fixed subject taxonomy with a confidence and link to topic nodes. A node's own properties project into the edges they encode through declared taxonomy and reference rules. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R614.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Scheduled by the expected-value rule of EG-DECISION-ENGINE-R031; model calls go through the engine's embedding and text heads, never a harness. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R614.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A card whose summary cites no stored fact id is refused. The stable code is `CARD_UNGROUNDED`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R614.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Per card: model, prompt digest, source fact ids. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R614.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** projection of 100k nodes under 1 s p99; classification of one document under 30 ms p99. The benchmark is `benches/r614_decision_engine.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R615 Write-back proposals queue for approval, then reach vendors only through the governed contract (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Write-back proposals queue for approval, then reach vendors only through the governed contract (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R615.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `crates/eg-decision/src/writeback.rs` defines WritebackProposal{risk_tier, as_of}, ProposalQueue, InventoryCreation, FindingTicket. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R615.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** High-stakes proposals are previewed and queued; approval releases them as one governed change set. Reconciled inventory becomes creation proposals for every enabled system of record and risk findings become ticket proposals, each stamped with the as-of instant they derive from and deduplicated by external id. Source-conflict preflight yields refuse, queue or proceed. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R615.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extends EG-DECISION-ENGINE-R043; vendor execution is the SDK sinks of SDK-SOURCE-INGEST-R600. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R615.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A queued proposal executed without an approval record is refused. The stable code is `PROPOSAL_UNAPPROVED`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R615.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Per proposal: tier, approver, change-set id, as-of. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R615.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** enqueue plus approve round trip p99 under 15 ms. The benchmark is `benches/r615_decision_engine.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R617 Conversation logs, project rules and memory pruning are engine-held memory (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Conversation logs, project rules and memory pruning are engine-held memory (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R617.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `crates/eg-memory/src/conversation.rs` defines ConversationRecord, ProjectRules, RetentionPolicy, ContextBudget. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R617.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Chat logs from several IDE formats parse into ordered, provenance-keyed messages stored as transcript threads (EG-INGEST-WORKER-R003.13). Project rule files load layered and attach as scoped facts. Retention prunes by policy with a legal-hold exception, and memory nodes are created, read and expired through one surface. The context budget optimizer chooses the smallest covering set (EG-DECISION-ENGINE-R045). | Unit tests cover each rule with positive and boundary cases. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R617.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** SourceIngest transcript path; the harness only requests a context under a budget. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R617.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Pruning a node under legal hold is refused and logged. The stable code is `RETENTION_LEGAL_HOLD`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R617.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Per prune: examined, removed, held. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R617.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** parse plus store of 10k messages p99 under 1.5 s. The benchmark is `benches/r617_decision_engine.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R043.600 Approval queue and as-of stamping for write-back proposals Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Approval queue and as-of stamping for write-back proposals.** High-stakes proposals queue until an approval record exists and carry the as-of instant they derive from, as `EG-DECISION-ENGINE-R615` defines. Enqueue plus approve p99 stays under 15 ms. | Test queues a high-stakes proposal, asserts refusal without approval and one change set after approval. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R750 Bounded multi-step reasoning search with explicit budgets (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Bounded multi-step reasoning search with explicit budgets (rollup).** Rust-native in `crates/eg-compute/src/reasoning`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R750.750 Model: Bounded multi-step reasoning search with explicit budgets Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model: Bounded multi-step reasoning search with explicit budgets.** A reasoning strategy is a closed enum over chain, tree, graph and planning-with-world-model search. Each strategy runs over an arena of thought nodes. The decision ladder gives it a deterministic budget for nodes, depth, branching and tokens. A stored `ReasoningPolicy` selects the strategy per task class. Types: `ReasoningStrategy` (Chain, Tree, Graph, Planning), `ReasoningState`, `BudgetLedger`, `ThoughtNode` in a bump arena indexed by `u32`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R750.751 Behavior: Bounded multi-step reasoning search with explicit budgets Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior: Bounded multi-step reasoning search with explicit budgets.** Expansion, scoring, pruning, aggregation and merge are pure functions of the state and the fixed-point scores. The same inputs replay to the same best path and digest. An exhausted budget returns a typed best-so-far result with a certified-gap flag. It never continues without a bound. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R750.752 Refusal: Bounded multi-step reasoning search with explicit budgets Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal: Bounded multi-step reasoning search with explicit budgets.** The engine refuses four inputs with typed errors. The first is a strategy name outside the closed set. The second is a budget field of zero or above its ceiling. The third is a cyclic merge in graph search. The fourth is a score that is not a fixed-point value. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R750.753 Hot-path proof: Bounded multi-step reasoning search with explicit budgets Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof: Bounded multi-step reasoning search with explicit budgets.** Criterion benchmark `reasoning_search` expands 100k nodes on one core. The p50 is under 40 ms and the p99 is under 90 ms. Peak memory stays under 64 MiB per search. The search makes zero allocations after arena reservation. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R751 Horizon curriculum, step reward decomposition and hierarchical task decomposition (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Horizon curriculum, step reward decomposition and hierarchical task decomposition (rollup).** Rust-native in `crates/eg-plan/src/horizon`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R751.750 Model: Horizon curriculum, step reward decomposition and hierarchical task decomposition Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model: Horizon curriculum, step reward decomposition and hierarchical task decomposition.** The engine stores curriculum stages with promotion thresholds. It decomposes a task into a bounded hierarchy of subgoals with checkpoints. It attributes a trajectory outcome to per-step rewards. These rewards sum to the trajectory reward within a fixed-point tolerance. Types: `CurriculumStage`, `PromotionPolicy`, `SubgoalCheckpoint`, `StepReward`, `TrajectoryReward`, `HtnNode` in a flat `Vec` with parent indices. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R751.751 Behavior: Horizon curriculum, step reward decomposition and hierarchical task decomposition Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior: Horizon curriculum, step reward decomposition and hierarchical task decomposition.** Promotion to a longer horizon happens only when measured success over the stage window clears the received threshold. Reward decomposition is deterministic and idempotent per trajectory id. Normalized-advantage, dynamic-sampling, difficulty-floor and cache-tier-aware reward terms are pure numeric kernels in `eg-numeric`. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R751.752 Refusal: Horizon curriculum, step reward decomposition and hierarchical task decomposition Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal: Horizon curriculum, step reward decomposition and hierarchical task decomposition.** The engine refuses four inputs. The first is a decomposition deeper than the received recursion limit. The second is a reward that does not sum to the trajectory reward. The third is a promotion without a full stage window. The fourth is a non-finite advantage. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R751.753 Hot-path proof: Horizon curriculum, step reward decomposition and hierarchical task decomposition Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof: Horizon curriculum, step reward decomposition and hierarchical task decomposition.** Criterion benchmark `reward_decompose` over 10k-step trajectories with p50 under 5 ms and p99 under 12 ms, memory under 8 MiB, linear time in steps. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R752 Population drift, diversity-aware fan-out width and safe-autonomy ramp (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Population drift, diversity-aware fan-out width and safe-autonomy ramp (rollup).** Rust-native in `crates/eg-numeric/src/drift`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R752.750 Model: Population drift, diversity-aware fan-out width and safe-autonomy ramp Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model: Population drift, diversity-aware fan-out width and safe-autonomy ramp.** The engine measures agent-population drift as a one-dimensional Wasserstein distance between a reference window and a current window. It selects a fan-out width from pairwise output diversity. It accrues trust per action class. It returns a corrigibility verdict, and that verdict requires confirmation for irreversible actions. Types: `DriftReading`, `Wasserstein1`, `PopulationSpread`, `TrustLedger`, `IrreversibilityClass`, `CorrigibilityVerdict`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R752.751 Behavior: Population drift, diversity-aware fan-out width and safe-autonomy ramp Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior: Population drift, diversity-aware fan-out width and safe-autonomy ramp.** Drift readings, diversity-based width and trust assessments are deterministic fixed-point computations. An autonomy ramp clears a class only after the received number of clean outcomes. A cost-aware cap never exceeds the replica ceiling. An assurance verifier checks an action against per-kind invariants before it returns a verdict. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R752.752 Refusal: Population drift, diversity-aware fan-out width and safe-autonomy ramp Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal: Population drift, diversity-aware fan-out width and safe-autonomy ramp.** Self-reported outcomes cannot raise trust. An irreversible action never passes without an explicit approval fact. An empty window returns abstention, not a zero drift. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R752.753 Hot-path proof: Population drift, diversity-aware fan-out width and safe-autonomy ramp Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof: Population drift, diversity-aware fan-out width and safe-autonomy ramp.** Criterion benchmark `population_drift` over 4k-sample windows. The p50 is under 1 ms and the p99 is under 3 ms. Memory stays under 2 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R753 Verification, adversarial and synthesis steps over parallel trajectories (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Verification, adversarial and synthesis steps over parallel trajectories (rollup).** Rust-native in `crates/eg-compute/src/verify`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R753.750 Model: Verification, adversarial and synthesis steps over parallel trajectories Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model: Verification, adversarial and synthesis steps over parallel trajectories.** The engine joins parallel trajectories and verifies a step. It recovers from a step error. It distills a set of trajectories into one. Each operation returns a typed verdict with proof bindings. An adversarial pass runs a bounded set of probes against a candidate before admission. Types: `StepVerdict`, `TrajectoryJoin`, `AdversarialProbe`, `DistilledTrajectory`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R753.751 Behavior: Verification, adversarial and synthesis steps over parallel trajectories Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior: Verification, adversarial and synthesis steps over parallel trajectories.** A join keeps the highest-evidence trajectory under a deterministic tie-break. A verifier binds its verdict to the trace digest. Distillation emits a derivation record that names every source trajectory. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R753.752 Refusal: Verification, adversarial and synthesis steps over parallel trajectories Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal: Verification, adversarial and synthesis steps over parallel trajectories.** The engine refuses a verdict without a trace binding. It refuses a join over an empty set. It refuses a probe set larger than its budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R753.753 Hot-path proof: Verification, adversarial and synthesis steps over parallel trajectories Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof: Verification, adversarial and synthesis steps over parallel trajectories.** Criterion benchmark `trajectory_join` over 256 trajectories. The p50 is under 2 ms and the p99 is under 6 ms. Memory stays under 4 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R035.750 Model and behavior: Routing strategies: fast-path, learned policy, team reuse, workflow-context shielding and fallback chain Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model and behavior: Routing strategies: fast-path, learned policy, team reuse, workflow-context shielding and fallback chain.** Rust-native in `crates/eg-decision/src/route`. Each strategy is a pure stage in an ordered pipeline, and the first decision wins. A fast path serves simple turns. A trace-learned, cost-aware policy ranks specialists. The engine reuses a proven team before planning. Workflow context stays shielded per boundary. The final fallback extracts a structured plan. | Unit tests assert the behaviour and replay determinism. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R035.751 Hot-path proof: Routing strategies: fast-path, learned policy, team reuse, workflow-context shielding and fallback chain Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof: Routing strategies: fast-path, learned policy, team reuse, workflow-context shielding and fallback chain.** Criterion benchmark `route_pipeline` with p50 under 300 microseconds and p99 under 1.2 ms over 500 specialists and under 4 MiB. | Benchmark runs in CI and fails on regression. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R046.750 Model and behavior: Elastic topology admission with sandbox resource limits and commit-time plan admission Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model and behavior: Elastic topology admission with sandbox resource limits and commit-time plan admission.** Rust-native in `crates/eg-compute/src/topology`. An elastic admission check tests a committed topology plan against sandbox resource limits and turns it into one enforcement record. The engine re-admits width and depth changes at run time. A plan never grants them to itself. | Unit tests assert the behaviour and replay determinism. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R046.751 Hot-path proof: Elastic topology admission with sandbox resource limits and commit-time plan admission Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof: Elastic topology admission with sandbox resource limits and commit-time plan admission.** Criterion benchmark `topology_admit`. The p50 is under 200 microseconds and the p99 is under 800 microseconds. | Benchmark runs in CI and fails on regression. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.750 Model and behavior: Tool resolution, adaptive provisioning and subagent pattern choice Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model and behavior: Tool resolution, adaptive provisioning and subagent pattern choice.** Rust-native in `crates/eg-decision/src/tools`. The engine resolves tools and provisions them on demand for an execution context. It also chooses among subagent patterns by task complexity. Both decisions run over the skill and tool library. | Unit tests assert the behaviour and replay determinism. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.751 Hot-path proof: Tool resolution, adaptive provisioning and subagent pattern choice Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof: Tool resolution, adaptive provisioning and subagent pattern choice.** Criterion benchmark `tool_resolve` over 20k tools. The p50 is under 2 ms and the p99 is under 6 ms. | Benchmark runs in CI and fails on regression. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R650 Capability descriptors and request-scoped designation (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Capability descriptors and request-scoped designation (rollup).** EG holds one versioned descriptor per capability. A descriptor carries typed inputs and outputs, side effects, data types, scopes, cost, latency, reliability, locality and approval class. EG projects the classified closure for a request. The harness receives the designation; it holds no descriptor index. The Rust home is `crates/eg-types/src/agent_component/capability_descriptor.rs`. Satisfied only when children `EG-DECISION-ENGINE-R650.1`-`EG-DECISION-ENGINE-R650.6` are satisfied. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R650.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `CapabilityDescriptor` (versioned), `CapabilityPowerDescriptor`, `DesignationRequest`, `Designation`, `ClosureProjection` in `crates/eg-types/src/agent_component/capability_descriptor.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R650.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Persist a descriptor as properties of the capability node. Derive reliability from the learned reward and do not store it. Generate the power descriptor from the registry and the capability ledger. Project the request-scoped closure from OWL classification in O(closure size). | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R650.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extends `AgentAssemble` (`EG-DECISION-ENGINE-R036`) and the pack publisher; served `CapabilityDesignate`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R650.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** EG refuses a descriptor that lacks a side-effect class or approval class at publication. A designation request outside the caller's tenant returns nothing. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R650.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Record descriptor version, ontology digest, closure members and the reward revision used. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R650.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Benchmark `capability_designate` (10k capabilities, closure of 200): p50 150 us, p99 900 us, peak memory 4 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-types capability_designate` against the stored baseline. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R651 Agent-native memory lifecycle and consolidation (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Agent-native memory lifecycle and consolidation (rollup).** EG owns the memory tiers and their lifecycle. The lifecycle covers summary nodes, episodic-to-procedural distillation, decay and semantic merge hygiene. It also covers context compression into mementos, per-session memento priming and trajectory pruning. It ends with embedding drift and stability checks, background learning, and the export of consolidated memory for weight training. The Rust home is `crates/eg-epistemic/src/memory.rs`. Satisfied only when children `EG-DECISION-ENGINE-R651.1`-`EG-DECISION-ENGINE-R651.8` are satisfied. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R651.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `MemoryTier{Working,Episodic,Procedural,Semantic}`, `MemoryEntry{timescale,salience,decay}`, `Memento`, `DriftReport`, `ConsolidationPlan`, `TrajectoryEntry` in `crates/eg-epistemic/src/memory.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R651.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Decay salience by timescale with a deterministic half-life. Merge near-duplicates above a similarity threshold in O(n log n) with an ANN index. Distil repeated episodes into procedures with support counts. Compress a context window into mementos under a token cap. Report drift between embedding snapshots with CKA and Fisher-weighted consolidation. Consolidation is a proposal until the owner verifies it. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R651.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Served `MemoryRemember`, `MemoryRecall`, `MemoryConsolidate` and `MemoryExport` methods; the harness reads recalled entries and sends observations only. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R651.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** EG refuses writes without tenant scope and entries over the size cap. It also refuses a consolidation that drops an entry with live references. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R651.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Record tier moves, merged IDs, support counts, drift metrics and the export manifest digest. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R651.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Benchmark `memory_consolidate_10k` (10k entries, 384-d vectors): p50 25 ms, p99 120 ms, peak memory 96 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-epistemic memory_consolidate_10k` against the stored baseline. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R652 Claim lifecycle, evidence channels and perspective arbitration (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Claim lifecycle, evidence channels and perspective arbitration (rollup).** EG records every research claim through a legal lifecycle. It gathers evidence from typed channels: outcome evaluation, optimization, health anomalies, process signals and mined insight. It arbitrates competing perspectives and grades feeds against fleet relevance. It compiles agent-native research artifacts. These artifacts carry claims, code specs, exploration graphs and a seal. The Rust home is `crates/eg-epistemic/src/claims.rs`. Satisfied only when children `EG-DECISION-ENGINE-R652.1`-`EG-DECISION-ENGINE-R652.6` are satisfied. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R652.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `ClaimState` (state machine), `LifecycleTransition`, `EvidenceChannel`, `Evidence{outcome,weight}`, `Cohort`, `PerspectiveMap`, `ResearchArtifact`, `ArtifactSeal` in `crates/eg-epistemic/src/claims.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R652.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Reject illegal transitions by table lookup in O(1). Combine evidence with log-odds addition and a per-channel prior. Compute contradiction maps between perspectives. Seal an artifact by content digest and check seal violations on read. Grade feeds with deterministic relevance scoring. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R652.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Claim lifecycle on the `eg-statechart` engine; served `ClaimPropose`, `ClaimAdvance`, `EvidenceRecord`, `ArtifactCompile`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R652.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** An illegal transition, evidence without a channel, or an unsealed artifact presented as sealed is refused with a stable code. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R652.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Record transition log, evidence inputs and weights, contradiction pairs and seal digest. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R652.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Benchmark `claim_advance_with_evidence` (50 evidence items per claim): p50 120 us, p99 700 us, peak memory 2 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-epistemic claim_advance_with_evidence` against the stored baseline. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R653 Loop engine state, gap market and improvement ledger (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Loop engine state, gap market and improvement ledger (rollup).** EG keeps the state of every long-running objective. That state holds loop status and priority, and gaps with severity and evidence. It holds the gap-to-work-offer market, saturation and stage beacons, and the improvement ledger and velocity. It also holds runtime reliability reconciliation, mined trace and placement patterns, and the capability ratchet verdict. The Rust home is `crates/eg-statechart/src/loops.rs`. Satisfied only when children `EG-DECISION-ENGINE-R653.1`-`EG-DECISION-ENGINE-R653.6` are satisfied. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R653.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `LoopInstance`, `LoopStatus`, `Gap{severity_ppm,evidence}`, `WorkOffer{rate}`, `StageBeacon`, `ImprovementLedger`, `RatchetVerdict`, `MinedPattern` in `crates/eg-statechart/src/loops.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R653.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Claim a loop with a fenced lease. Order loops by priority and age with a heap. Settle a gap exactly once. Derive offer rates deterministically. Mine failure sequences with a bounded frequent-pattern miner. Keep or revert a capability by comparing the ledger before and after. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R653.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Runs on `eg-statechart` and `eg-jobs` beside `src/loop_statechart.rs` and `src/work_item_statechart.rs`; the harness executes the loop step it is handed. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R653.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A stale lease, a double settle or a ratchet comparison with missing baseline is refused. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R653.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Record lease epochs, state transitions, offer inputs, mined support and the ratchet comparison. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R653.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Benchmark `loop_claim_and_settle` (10k open loops): p50 80 us, p99 500 us, peak memory 2 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-statechart loop_claim_and_settle` against the stored baseline. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R654 Skill evolution, promotion gate and spec proposals (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Skill evolution, promotion gate and spec proposals (rollup).** EG evaluates skill revisions by rollout and extracts failure patterns. It versions each revision by content and records transfer scores. It applies the promotion gate and auto-merge policy. It tracks spec proposals through review and development. The Rust home is `crates/eg-epistemic/src/evolution.rs`. Satisfied only when children `EG-DECISION-ENGINE-R654.1`-`EG-DECISION-ENGINE-R654.6` are satisfied. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R654.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `SkillRevision{version_hash}`, `Rollout`, `FailurePattern`, `TransferScore`, `PromotionVerdict`, `MergePolicy`, `SpecProposal` in `crates/eg-epistemic/src/evolution.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R654.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Hash revisions by content. Compare rollouts with paired bootstrap. Gate promotion on score, risk and policy. Advance a spec proposal only through legal review states. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R654.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Served `SkillRevisionPropose`, `PromotionEvaluate`, `SpecProposalAdvance`; the harness applies the merge it is told to apply. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R654.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A promotion without a baseline, an unreviewed spec advance or a policy-forbidden merge is refused. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R654.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Record rollout seeds, paired scores, gate inputs and verdicts. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R654.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Benchmark `promotion_gate_eval` (200 rollouts per arm): p50 200 us, p99 1.2 ms, peak memory 4 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-epistemic promotion_gate_eval` against the stored baseline. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R700 Belief revision recomputes confidence and explains every change (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Belief revision recomputes confidence and explains every change (rollup).** The engine recomputes the confidence of a claim from its supporting and opposing evidence. It records an explanation of each revision, detects opposing claims, and revalidates stale truth-maintenance materializations. Every result is a proposal. No claim is retracted without a separate explicit authorization (see R034). Implemented in eg-reason, eg-core. | Every child `.1` to `.7` is verified; the rollup is landed only when all are. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R700.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `BeliefRevision { claim, prior, posterior, support: Vec<EvidenceRef>, oppose: Vec<EvidenceRef>, reason }` and `FrictionFinding { left, right, similarity, opposes }` in `crates/eg-types`, keyed by claim id in a `BTreeMap` so a pass is deterministic. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R700.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** A revision pass walks claims whose evidence changed since the last pass. Its time is linear in changed claims plus their evidence edges. Opposition candidates come from an inverted token index (sub-linear per claim). A typed negation and antonym check confirms them. The pass revalidates stale materializations against the current assertion generation. It re-derives them only when their premises changed. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R700.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Handler `BeliefRevise` in `src/server/handlers`, wired to the outbox so only claims touched by a committed batch enter a pass. Per-graph passes run on the maintenance lane; passes on different graphs run in parallel, passes on one graph are serialized. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R700.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A revision that lowers a claim below the retraction threshold returns a `RetractionProposal` with evidence class `claim`. It never mutates the claim. A revision with a missing premise refuses with a typed reason. The reason names the premise. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R700.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each `BeliefRevision` stores its explanation and the evidence class of its weakest premise. The explanation reproduces the posterior from the recorded inputs. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R700.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_belief_revision_served.py::test_pass_proposes_and_never_retracts` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/belief_revision.rs` must show p50 under 5 ms and p99 under 40 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R701 Recurring failures cluster into patterns and file capability gaps (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Recurring failures cluster into patterns and file capability gaps (rollup).** The engine groups failed runs, anomalies and unresolved topics into recurring failure patterns. It files each pattern as a gap with a stable topic. It marks a topic addressed when it acquires a source that covers it. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R701.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `FailureRecord`, `FailurePattern { signature, members, first_seen, last_seen, count }` and `GapTopic { id, status: Open|Addressed{by} }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R701.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Records cluster by a canonical signature (normalized error class, tool, step kind) in one pass over a `HashMap<Signature, Vec<RecordId>>`. Time is O(n) and memory is O(distinct signatures). A trace is distilled to its minimal failing step sequence by a deterministic reduction. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R701.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Handler `FailureIngest` reads run-trace facts (R009 harness run-trace vocabulary) and anomaly facts from the health-anomaly derivation (UDP R036). Gap filing is idempotent on the topic id. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R701.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A record without a run-trace id is refused. A pattern below the configured minimum count files no gap. A topic is never marked addressed by a source that does not link to it. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R701.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Every gap links back to the member records that produced it. A reader can open the failing runs from the gap. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R701.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_failure_patterns_served.py::test_failures_cluster_and_gap_is_idempotent` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/failure_cluster.rs` must show p50 under 3 ms and p99 under 25 ms with peak memory under 48 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R702 Human corrections become rules, outcomes and evaluation cases (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Human corrections become rules, outcomes and evaluation cases (rollup).** A human correction of an answer is recorded once. It propagates into a candidate rule, an outcome record with an independent-evaluation tag, and an evaluation case. Experience alignment adapts behavior by retrieving the nearest prior corrected experiences. Implemented in eg-core, eg-decision. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R702.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `Correction { target, before, after, actor, at }` and `CorrectionEffect { rule_candidate, outcome, eval_case }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R702.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** A correction commits as one `MutationBatch` carrying all three effects so they are all present or all absent. Nearest corrected experiences are found with the engine vector index at k <= 16. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R702.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Handler `CorrectionRecord` on the decision lane, using the existing outcome aggregate (R059) and gated promotion (R060). A candidate rule is promoted only through R129. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R702.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A correction by an actor without the correcting role is refused. A candidate rule that contradicts a stored invariant is refused (R129). A self-reported outcome never enters calibration (R016). | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R702.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The correction, its three effects and its actor share one receipt id. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R702.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_correction_feedback_served.py::test_correction_commits_three_effects_atomically` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/correction_commit.rs` must show p50 under 4 ms and p99 under 20 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R703 Skill gaps, neologisms and merge candidates are detected as proposals (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Skill gaps, neologisms and merge candidates are detected as proposals (rollup).** The engine detects skills requested but absent. It detects terms used as skill names with no definition. It detects near-duplicate skills that should merge. It records each as a propose-only candidate. A skill is created, merged or retired only through the component-publish path. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R703.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `SkillGap`, `SkillNeologism` and `SkillMergeCandidate { a, b, overlap, evidence }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R703.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Merge candidates come from set overlap of declared capability annotations plus embedding similarity. A blocking index bounds pair comparison by block size, not by library size squared. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R703.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Handler `SkillEvolve` reads the Agent Library (typed-packs R100) and run-trace facts; publish uses the existing guarded promotion (R040). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R703.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A merge candidate whose members differ in capability class or tenant is refused. No candidate mutates the library. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R703.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each candidate cites the traces and library rows it was derived from. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R703.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_skill_evolution_served.py::test_candidates_are_proposals_only` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/skill_merge_blocking.rs` must show p50 under 8 ms and p99 under 60 ms with peak memory under 96 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R704 Fleet events and tickets route through remediation playbooks, evaluate-only (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Fleet events and tickets route through remediation playbooks, evaluate-only (rollup).** The engine correlates inbound fleet events and tickets. It matches each to a typed playbook (service down, service flapping, resource pressure, ticket classes). It answers with a proposed remediation and its evidence class. The engine takes no action on a connector's behalf. Implemented in eg-decision. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R704.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `Playbook { id, trigger, steps: Vec<ProposedStep>, evidence_class }` and `EventCorrelation { key, window, events }` in `crates/eg-types`; playbooks are graph content published as pack entries. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R704.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Correlation keys events into a sliding window per service with O(1) amortized insert. Playbook match is a hash lookup on trigger kind, then an ontology entailment check. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R704.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extends connector event triage (R041) and write-back routing (R043); steps that write are routed through `Decide` and then the governed Action path (UDP R700). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R704.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The engine refuses a playbook step that executes. The refusal carries a typed `EvaluateOnly` reason. An event with no matching playbook abstains naming the missing trigger. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R704.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Every proposal records the playbook id and revision. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R704.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_playbook_triage_served.py::test_flapping_service_proposes_without_acting` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/playbook_match.rs` must show p50 under 1 ms and p99 under 8 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R705 Research orchestration is budgeted by value of information (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Research orchestration is budgeted by value of information (rollup).** A research run decomposes a question into subtasks and walks citation links between sources. It spends a bounded budget in order of expected information value. It stops when the marginal value falls below cost. Implemented in eg-decision, eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R705.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `ResearchPlan { subtasks, budget }`, `VoiBudget { spent, limit, floor }` and `CitationWalk { frontier, depth_limit }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R705.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Frontier expansion uses a binary heap keyed by expected value. A node budget bounds the walk (as R011). The result count does not. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R705.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Consumes the sufficiency and stop rules (FQ R081, R082) and the cost ladder (R080). Language-model calls happen in the agent harness; the engine decides what to read next and when to stop. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R705.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A subtask without budget abstains with a typed reason. A walk past the depth limit refuses. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R705.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Every spent unit is recorded with the subtask that consumed it. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R705.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_research_voi_served.py::test_budget_stops_at_marginal_value` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/voi_frontier.rs` must show p50 under 2 ms and p99 under 15 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R706 Entity-resolution proposals use tenant-scoped embeddings and drift-monitored acceptance (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Entity-resolution proposals use tenant-scoped embeddings and drift-monitored acceptance (rollup).** The engine generates entity-resolution candidates from tenant-scoped embeddings. It scores them, reviews them through governance, and evaluates them per tier. It monitors the accept rate for drift. It composes a probabilistic completion only beside an exact answer, never in place of it. Implemented in eg-decision, eg-vector. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R706.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `TenantScopedEmbedding { tenant, node, model, content_hash, vector }`, `EntityResolutionProposal`, `ReviewOutcome`, `TierEvaluation` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R706.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Embeddings are content-hash keyed, so the engine never re-embeds an unchanged node. Candidates come from filtered k-NN (FQ R040) with the tenant predicate in the plan (FQ R078). | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R706.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extends the ResolveEntity path (R032.2); results pass the conformal guarantee there. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R706.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A proposal across tenants is refused. A proposal below the calibrated threshold abstains. The probabilistic result is marked `hypothesis` evidence. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R706.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each proposal records the model, content hash and tier. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R706.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_er_proposals_served.py::test_cross_tenant_candidates_never_returned` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/er_candidates.rs` must show p50 under 6 ms and p99 under 35 ms with peak memory under 128 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R707 Comparative-analysis ingest, matching, gap ledger and plan synthesis (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Comparative-analysis ingest, matching, gap ledger and plan synthesis (rollup).** The engine ingests studied external projects into the graph. It matches their features to local capabilities, deduplicates them and ranks them by synergy. It records them in a feature ledger with status. It turns them into plan proposals that close gaps. This is the engine side of R139. Implemented in eg-core, eg-decision. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R707.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `FeatureMatrixRow`, `Match { local, external, score }`, `LedgerEntry { feature, status, closed_by }` and `PlanProposal` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R707.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Matching is a blocked pairwise score (token, ontology label, embedding) bounded by block size. Dedup merges features by canonical id and entropy-aware name normalization. Ledger status changes are compare-and-set. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R707.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Extends R139 and R171 (planning admission needs a gap comparison); breadth discovery of projects is an ingest-worker job. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R707.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A close-out without a linked closing change is refused. A high-entropy token identity is never merged on name alone. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R707.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Ledger rows cite the matches and the plan that closed them. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R707.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/decision/test_comparative_ledger_served.py::test_closeout_requires_linked_change` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/feature_match.rs` must show p50 under 10 ms and p99 under 70 ms with peak memory under 128 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R800 Reflective optimization and benchmark scoring for recursive-run policies (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reflective optimization and benchmark scoring for recursive-run policies (rollup).** `crates/eg-program` keeps a Pareto-front store of candidate run policies (prompt, budget, tool set). It scores them on held-out evaluation sets and on long-context benchmark tasks. The engine then picks the next policy to try. It reports cost against accuracy per task family. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R800.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `PolicyCandidate{id, parent, genes_digest, scores:[f32;K], cost_micro_usd}` and `ParetoFront` in `crates/eg-program/src/optimize/front.rs`; scores are bounded and `K` is fixed per evaluation set. | Planned: `crates/eg-program/tests/optimize_front.rs::dominated_candidate_is_dropped`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R800.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** `front.insert` keeps only non-dominated candidates in O(F) per insert for front size F. `next_parent` samples by crowding distance with a seeded generator. `scoreboard` ranks by accuracy per cost. | Planned: `crates/eg-program/tests/optimize_front.rs::same_seed_reproduces_front_digest`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R800.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The served `Decide` ladder reads the front through the existing DecisionFit job. The optimizer never writes a promoted head without the DecisionEval publish receipt of R040. | Planned: `crates/eg-program/tests/optimize_front.rs::mismatched_score_length_is_refused`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R800.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Three inputs return a typed refusal with no state change. The first is an evaluation set under the declared minimum size. The second is a candidate whose score vector length differs from `K`. The third is a reward that uses a non-independent label. | Planned: `crates/eg-program/tests/optimize_front.rs::promotion_requires_publish_receipt`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R800.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Evidence is the stored front, the evaluation-set digest and the scoreboard rows for each benchmark family. A rerun with the same seed reproduces the same front digest. | Planned: `crates/eg-program/tests/optimize_front.rs::scoreboard_ranks_accuracy_per_cost`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R800.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Hot-path proof: a Criterion benchmark inserts 100000 candidates at F up to 256. It reports p50 and p99 insert latency. The p99 stays under 50 microseconds. Resident memory stays under 64 MiB. | Planned: `crates/eg-program/tests/optimize_front.rs::insert_bench_stays_within_budget`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R801 Usage ledger and versioned price catalog (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Usage ledger and versioned price catalog (rollup).** `crates/eg-core` owns a per-tenant usage ledger of model calls (tokens in and out, cached tokens, latency, outcome). It also owns a versioned price catalog with name normalization. Cost is a derived fact. Routing (R039), budgets and reports read it through one served method. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. Child `.7` covers the served tenant-scoped read. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R801.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `UsageRecord{tenant, principal, run_id, model_key, tokens_in, tokens_out, tokens_cached, latency_ms, outcome, content_digest}` and `PriceEntry{model_key, valid_from, in_per_mtok, out_per_mtok, cached_per_mtok}` in `crates/eg-types/src/usage.rs`; prompts and completions are stored only as digests. | Planned: `crates/eg-core/tests/usage_ledger.rs::record_round_trips_digest_only`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R801.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Append is a single `MutationBatch` per call batch. Cost is derived at read time from the price entry valid at the record time. One alias table normalizes `model_key`. Rollups by tenant, model and day come from `eg-tsdb` buckets in O(buckets). | Planned: `crates/eg-core/tests/usage_ledger.rs::cost_uses_price_valid_at_record_time`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R801.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The `Usage` served domain registers scopes `usage:read` (user) and a service-only write scope in `crates/eg-capabilities`. Readers see only their tenant. Callers outside the tenant see an empty result. | Planned: `crates/eg-core/tests/usage_ledger.rs::alias_table_normalizes_model_keys`. | requirement | EG-DECISION-ENGINE | VERIFIED | 52b574819aca cfe7d38376a4 crates/eg-capabilities/src/scopes/tests.rs:73 |
| EG-DECISION-ENGINE-R801.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Four inputs return a typed refusal and write nothing. The first is a record with an unknown tenant. The second is a negative count. The third is a price entry that overlaps an existing validity window. The fourth is a read across tenants. | Planned: `crates/eg-core/tests/usage_ledger.rs::cross_tenant_read_is_empty`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R801.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Evidence is the audit line per append and a golden report. A fixed record set and catalog yield byte-identical cost rollups. | Planned: `crates/eg-core/tests/usage_ledger.rs::overlapping_price_window_is_refused`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R801.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** Hot-path proof: a Criterion benchmark appends 1 million records in batches of 1000 and reads a 30-day rollup. The append p99 stays under 2 ms per batch. The rollup p99 stays under 20 ms. Bucket memory stays under 128 MiB. | Planned: `crates/eg-core/tests/usage_ledger.rs::append_and_rollup_bench_within_budget`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R801.7 Served tenant-scoped usage read Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Served tenant-scoped usage read.** It completes the read half of `EG-DECISION-ENGINE-R801.3`. A served `UsageRead` method returns usage records from the durable ledger of `EG-DECISION-ENGINE-R801.2`. The dispatcher takes the tenant from the verified request context, never from a request field. A caller outside the tenant receives an empty result. | Planned served test: `tests/usage/test_usage_read_served.py::test_usage_read_is_tenant_scoped` appends records for two tenants and reads as each tenant. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R801.8 Fenced committed-run usage and caller-context aggregation Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Fenced committed-run usage and caller-context aggregation.** A terminal WorkItem extension optionally carries bounded observed token counts bound to the native run owner, tenant, principal and conversation context. The native terminal CAS co-commits the immutable receipt; retry scheduling publishes no receipt. The opt-in outcome reader projects it only for the verified owner. Canonical aggregation counts each committed run once, refuses conflicting duplicates and foreign attribution, and reports missing/per-counter coverage without fabricated counts or prices. Existing tenant aggregate and default outcome shape remain unchanged. | Native terminal/restart read and denial tests; typed aggregation tests for duplicate retries, missing counts, overflow and foreign contexts. Budget: at most 10,000 run receipts per aggregation, O(n log n) time and O(n) memory; a 10,000-receipt test exercises the bound. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R802 Web fetch selection over search candidates (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Web fetch selection over search candidates (rollup).** The engine must choose the web candidates to fetch. It ranks candidates and removes duplicates by canonical URL and content digest. It skips a held Document that is still fresh. It reads only the RLS-visible Documents of the request graph and enforces a fetch budget. No model runs. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | VERIFIED | 1517690bd1d2 780ae2e14170 b3d7b62e5f61 cbda3e13e4c8 d715658809da crates/eg-numeric/src/decision/web_fetch_selection.rs:333 crates/eg-numeric/src/decision/web_fetch_selection.rs:437 crates/eg-numeric/src/decision/web_fetch_selection.rs:452 crates/eg-types/src/decision/web_fetch_selection.rs:169 tests/web_document_enrich_served.rs:222 |
| EG-DECISION-ENGINE-R802.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `crates/eg-types/src/decision/web_fetch_selection.rs` holds `SelectWebPagesRequest{query, candidates, max_fetches, freshness_window_s, now_ms}`, `WebCandidate{url, title, snippet, engine, rank, content_digest, published_at_ms}` and `SelectWebPagesAnswer{query_digest, selected, skipped, max_fetches, considered, now_ms}`. `max_fetches` ranges from 1 to 32. Closed skip reasons are `duplicate_url`, `duplicate_digest`, `held_fresh`, `invalid_url` and `over_budget`. Proving test: `web_fetch_selection.rs::tests::question_round_trips`. | A serde round trip keeps every field and rejects 33 fetches or an unknown skip reason. | requirement | EG-DECISION-ENGINE | VERIFIED | b3d7b62e5f61 crates/eg-types/src/decision/web_fetch_selection.rs:169 |
| EG-DECISION-ENGINE-R802.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** `crates/eg-numeric/src/decision/web_fetch_selection.rs` canonicalizes each URL. Rows with one canonical URL fuse by reciprocal rank fusion with k = 60. A digest that the graph holds, or that another row carries, is skipped as `duplicate_digest`. A held Document younger than `freshness_window_s` is skipped as `held_fresh`. The default window is 86,400 s. A stale held Document is selectable as a refresh. The score is `0.5 relevance + 0.3 rank + 0.2 freshness` in integer millionths. The budget keeps the top `max_fetches`. Cost is O(c log c) in candidates. Proving test: `crates/eg-numeric/src/decision/web_fetch_selection.rs::tests::ranks_dedupes_and_skips_fresh`. | Unit tests cover each skip reason, the ranking order and the budget. | requirement | EG-DECISION-ENGINE | VERIFIED | b3d7b62e5f61 crates/eg-numeric/src/decision/web_fetch_selection.rs:333 |
| EG-DECISION-ENGINE-R802.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The served `SelectWebPages` method reaches `src/server/dispatch/graph_pipeline/web_ingest.rs` after graph ACL. It reads the RLS-visible `Document` rows of the request graph as held pages. The production caller is the arbora operation `ARBORA-OPS-R067`. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | A served `SelectWebPages` call skips the held and duplicate pages. | requirement | EG-DECISION-ENGINE | VERIFIED | 1517690bd1d2 780ae2e14170 b3d7b62e5f61 tests/web_document_enrich_served.rs:223 |
| EG-DECISION-ENGINE-R802.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** An empty query must refuse with `WEB_SELECTION_QUERY_MISSING`. An empty candidate set must refuse with `WEB_SELECTION_NO_CANDIDATES`. More than 256 candidates must refuse with `WEB_SELECTION_TOO_MANY_CANDIDATES`. A budget outside 1 to 32 must refuse with `WEB_SELECTION_BUDGET_INVALID`. Proving test: `crates/eg-numeric/src/decision/web_fetch_selection.rs::tests::web_fetch_refusals`. | Each case returns its code and selects no candidate. | requirement | EG-DECISION-ENGINE | VERIFIED | b3d7b62e5f61 cbda3e13e4c8 d715658809da crates/eg-numeric/src/decision/web_fetch_selection.rs:437 |
| EG-DECISION-ENGINE-R802.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The answer must hold one entry per candidate, selected or skipped. A selected entry names the canonical URL, the engines, the score, its three components and its reasons. A skipped entry names its reason and a detail. Proving test: `crates/eg-numeric/src/decision/web_fetch_selection.rs::tests::premises_per_candidate`. | Each candidate has one entry, and the selected order follows the score. | requirement | EG-DECISION-ENGINE | VERIFIED | b3d7b62e5f61 crates/eg-numeric/src/decision/web_fetch_selection.rs:452 |
| EG-DECISION-ENGINE-R802.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `SelectWebPages` method. The benchmark selects from 50 candidates, ten of them held and fresh. The answer must hold `max_fetches` or fewer, no held fresh URL and no duplicate. The answer must stay under 3 ms p99 for 50 candidates. The benchmark is `crates/eg-numeric/benches/web_fetch_selection.rs`. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | The served test passes, and the benchmark meets the budget. | requirement | EG-DECISION-ENGINE | VERIFIED | 1517690bd1d2 b3d7b62e5f61 tests/web_document_enrich_served.rs:224 |
| EG-DECISION-ENGINE-R803 Contrastive harness composition decision (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Contrastive harness composition decision (rollup).** The engine composes the adopted harness for one task from the probed candidates. A caller presents two to eight candidate component versions, the identical probe conditions and the measured contrasts. The engine adopts a candidate only when its measured delta shows improvement. It abstains and keeps the current harness when no candidate improves. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child. | requirement | EG-DECISION-ENGINE | VERIFIED | 7cb7f367c849 f52d12235269 crates/eg-types/src/decision/harness_contrast.rs:578 crates/eg-types/src/decision/harness_contrast.rs:630 crates/eg-types/src/decision/harness_contrast.rs:723 crates/eg-types/src/decision/harness_contrast.rs:945 tests/decide/test_harness_contrast_served.py:257 |
| EG-DECISION-ENGINE-R803.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `HarnessContrastDecision{task_ref, task_class, candidate_version_refs, conditions_digest, probe_trace_ids, deltas, adopted_version_ref, abstain_reason}` in `crates/eg-types/src/decision/harness_contrast.rs`. `deltas` holds one `HarnessContrast` of EG-ORCH-VOCAB-R802.1 per candidate. `abstain_reason` is the closed set `no_improvement`, `trace_mismatch` or `insufficient_evidence`. Planned test: `crates/eg-types/src/decision/harness_contrast.rs::tests::decision_round_trips`. | The serde round trip keeps every field and rejects an open abstain reason. | requirement | EG-DECISION-ENGINE | VERIFIED | 7cb7f367c849 crates/eg-types/src/decision/harness_contrast.rs:578 |
| EG-DECISION-ENGINE-R803.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The caller drives the probes under an identical task, seed, model and budget; the candidate count k runs from 2 to 8. The engine reads the probe traces and the contrasts. It adopts a candidate when its `eval_score_delta` is positive and no other candidate beats it, with cost as the tie-break. It abstains with `no_improvement` when every delta is zero or negative. An abstention keeps the current harness and writes only the decision record. Planned test: `crates/eg-types/src/decision/harness_contrast.rs::tests::adoption_requires_positive_delta`. | Unit tests cover adoption, tie-break and abstention. | requirement | EG-DECISION-ENGINE | VERIFIED | 7cb7f367c849 crates/eg-types/src/decision/harness_contrast.rs:630 |
| EG-DECISION-ENGINE-R803.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The served `Decide` method accepts the `HARNESS_CONTRAST` question kind through `DecideText`. The answer stores as a `DecisionRecord` through `DecisionCommit` (EG-DECISION-ENGINE-R019, EG-DECISION-ENGINE-R047). The production caller is the harness cycle of AU-HARNESS-CYCLE-R001.5; it adopts the result through the arbora operation ARBORA-OPS-R068.4. Planned test: `tests/decide/test_harness_contrast_served.py::test_contrast_decide_stores_record`. | A served `Decide` call stores one decision record. | requirement | EG-DECISION-ENGINE | VERIFIED | 7cb7f367c849 f52d12235269 tests/decide/test_harness_contrast_served.py:257 tests/decide/test_harness_contrast_served.py:258 |
| EG-DECISION-ENGINE-R803.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Four inputs refuse with a typed code and write nothing. The first is a candidate set under two, with `HARNESS_CONTRAST_MIN_CANDIDATES`. The second is a probe trace whose conditions digest differs from the request, with `HARNESS_CONTRAST_TRACE_MISMATCH`. The third is a candidate version reference the graph does not hold, with `HARNESS_COMPONENT_VERSION_UNKNOWN`. The fourth is a candidate count over 8, with `HARNESS_CONTRAST_TOO_MANY_CANDIDATES`. Planned test: `crates/eg-types/src/decision/harness_contrast.rs::tests::contrast_refusals`. | Each case returns its code and stores no record. | requirement | EG-DECISION-ENGINE | VERIFIED | 7cb7f367c849 crates/eg-types/src/decision/harness_contrast.rs:723 |
| EG-DECISION-ENGINE-R803.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The record pins the request digest, each candidate version digest, the probe trace ids and the per-candidate deltas. A rerun with the same inputs produces the same record digest. The adopted record cites the superseded adoption of the same agent and task class through EG-ORCH-VOCAB-R802.4. Planned test: `crates/eg-types/src/decision/harness_contrast.rs::tests::record_pins_evidence_and_replays`. | The rerun digest matches, and the supersession citation resolves. | requirement | EG-DECISION-ENGINE | VERIFIED | 7cb7f367c849 crates/eg-types/src/decision/harness_contrast.rs:945 |
| EG-DECISION-ENGINE-R803.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` call. The test presents two candidates, one improving and one neutral, and checks the adoption and the abstention. The benchmark decides over 8 candidates with 200 stored contrasts. It stays under 5 ms p99. The benchmark is `crates/eg-numeric/benches/harness_contrast.rs`. Planned test: `tests/decide/test_harness_contrast_served.py::test_contrast_hot_path_served`. | The served test passes, and the benchmark meets the budget. | requirement | EG-DECISION-ENGINE | VERIFIED | 7cb7f367c849 f52d12235269 tests/decide/test_harness_contrast_served.py:379 tests/decide/test_harness_contrast_served.py:380 |
| EG-DECISION-ENGINE-R810 Program and prompt optimization job (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Program and prompt optimization job (rollup).** The engine must compile a stored program for one task signature. It must search prompts, demonstrations and rules with a named optimizer. The served job is `ProgramOptimize`. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R810.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `crates/eg-program/src/contracts.rs` holds `SignatureSpec`, `ProgramRevision`, `TrainingCorpus` and `TrainingExample{split, score, trace_ref, feedback_ref}`. `OptimizerKind` at `crates/eg-program/src/optimizer.rs:32` is a closed set of 13 kinds. | `crates/eg-program/tests/native_program.rs` round-trips each contract and lists the 13 kinds. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R810.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** `NativeCompiler::compile_cancellable` at `crates/eg-program/src/optimizer.rs:511` must run one optimizer over the train split. It must score candidates on the dev split only. A cancel must stop the run within one candidate. | `native_program.rs` tests compile each kind on a fixture corpus and cancel one run. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R810.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The served `AnalyticsJob` submit with `JobKind::ProgramOptimize` reaches `submit_job_program_optimize` at `src/server/handlers/jobs/submit.rs:362`. The claim path in `src/server/handlers/jobs/executor_claim.rs` runs `executor_program.rs`. arbora serves it through ARBORA-OPS-R860. | A served test submits the job and reads the finished `ProgramRevision`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R810.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A corpus without a held-out split must refuse with `PROGRAM_HELDOUT_MISSING`. An unknown optimizer must refuse with `PROGRAM_OPTIMIZER_UNKNOWN`. A budget over the job limit must refuse with `PROGRAM_BUDGET_EXCEEDED`. A refusal writes no revision. | A served test submits each invalid request and asserts the code. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R810.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each revision must record the optimizer kind, the corpus digest, the dev score and the parent revision. A rerun with one seed must give one revision digest. | A test reruns one job and compares the digests. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R810.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served job submit. The test compiles one program on a 200-example corpus. The run must stay under 30 s and 512 MiB. The benchmark is `crates/eg-program/benches/program_optimize.rs`. | `tests/test_program_optimize_served.py::test_program_optimize_job_end_to_end` passes, and the benchmark meets the budget. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R811 Policy evolution capture, training and held-out evaluation receipts (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Policy evolution capture, training and held-out evaluation receipts (rollup).** The engine must capture policy traces, run one training job and evaluate it on held-out cases. Each step must leave a receipt. The served method is `PolicyEvolution`. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R811.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** `PolicyEvolutionOp` at `crates/eg-types/src/policy_evolution.rs:174` names capture, training run and held-out evaluation. `records.rs` and `stored.rs` hold the receipts. | `crates/eg-types/src/policy_evolution/tests.rs` round-trips each op and receipt. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R811.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Capture must store a trace only when the capability allows capture. A training run must read captured traces only. An evaluation must read held-out cases only. | `policy_evolution/tests.rs` covers capture denial and split isolation. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R811.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The served `PolicyEvolution` method reaches `src/server/dispatch/policy_evolution/gate.rs`. The gate stores blobs through `blobs.rs` and receipts through `store.rs`. | A served test runs capture, training and evaluation in order. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R811.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Capture without the capability must refuse with `POLICY_CAPTURE_DISABLED`. An evaluation that shares a case with training must refuse with `POLICY_SPLIT_OVERLAP`. A refusal writes no receipt. | `src/server/dispatch/policy_evolution/gate/tests.rs` asserts each code. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R811.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each receipt must name the policy revision, the input digest, the score and the evaluator kind. | A test reads back each receipt and compares the fields. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R811.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `PolicyEvolution` method. The test runs the three steps on 100 traces. The run must stay under 10 s. | `tests/test_policy_evolution_served.py::test_capture_train_evaluate_served` passes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R812 Champion and challenger promotion with rollback (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Champion and challenger promotion with rollback (rollup).** The engine must hold one champion revision per program. A challenger must replace it only when it wins on held-out cases. A rollback must restore the parent champion. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R812.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** The champion is the active revision of `ProgramRevisionIdentity` at `crates/eg-program/src/commit.rs:295`. Its `parent_ref` names the prior champion. `PromotionPolicy` at `crates/eg-program/src/optimizer.rs:221` holds the margin and the minimum case count. | A unit test builds a champion, a challenger and a parent link. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R812.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** A challenger must win when its held-out score beats the champion by the policy margin. The default margin is 0.02. A rollback must re-promote `parent_ref` through the same compare-and-set. A model-judge-only score must never promote, per EG-DECISION-ENGINE-R016. | Unit tests cover win, loss, tie, rollback and the model-judge refusal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R812.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Promotion and rollback commit through `program_promotion_methods` at `src/server/mutation_batch/commit/program.rs:146`. arbora serves both through ARBORA-OPS-R860 behind approval. | A served test promotes one challenger and rolls it back. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R812.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A stale champion pointer must refuse with `PROGRAM_CHAMPION_STALE`. A rollback without a parent must refuse with `PROGRAM_NO_PARENT`. A score set under the minimum case count must refuse with `PROGRAM_EVAL_TOO_SMALL`. | A served test asserts each code and an unchanged champion. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R812.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each promotion and rollback must record the old and new revisions, both scores, the margin and the principal. | A test reads back the promotion record. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R812.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served mutation batch. The test promotes, then rolls back, then reads the champion. The compare-and-set must stay under 5 ms p99. | `tests/test_program_champion_served.py::test_promote_then_rollback` passes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R813 Trace-store scores become evaluation examples (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Trace-store scores become evaluation examples (rollup).** The engine must turn an imported trace score into one `TrainingExample`. The example must carry the grader kind as an evidence class. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R813.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `GraderKind{annotation, model_judge, api}` beside `TrainingExample` in `crates/eg-program/src/contracts.rs`. The example links the `:Score` node and its `:Trace` node. | A unit test round-trips one example per grader kind. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R813.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** A score with an annotation or API grader may train and evaluate. A model-judge score may train but must not decide a promotion. A score without a trace link is skipped and counted. | Unit tests cover each grader kind and the skip. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R813.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The trace-store connector ingests `:Trace` and `:Score` through `SourceIngest`, per CONN-LANGFUSE-AGENT-TRACE-INGEST-R001. A corpus build for EG-DECISION-ENGINE-R810 reads those nodes. | A served test ingests two scores and builds one corpus. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R813.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A score with an unknown grader kind must refuse with `SCORE_GRADER_UNKNOWN`. A score whose value is outside its declared range must refuse with `SCORE_OUT_OF_RANGE`. | A served test asserts each code. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R813.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each example must name the score id, the grader kind, the author and the source trace id. | A test reads back one example. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R813.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `SourceIngest` followed by the served job submit of R810.3. The test ingests 50 scores and compiles one program from them. | `tests/test_trace_scores_to_corpus_served.py::test_scores_build_corpus_and_compile` passes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R036.102 Bind graph participant prepare records to their recovery identity Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Bind graph participant prepare records to their recovery identity.** The existing cross-shard coordinator writes a versioned graph-owner prepare envelope. It binds transaction ID, participant group and a SHA-256 digest of the exact encoded graph slices. Recovery validates these bindings before applying any slice. Unknown versions, owner kinds or changed payloads refuse. Existing array-form graph prepares remain readable without acquiring new authority. This prerequisite does not implement profile grants or heterogeneous-owner admission. | The production encoder and decoder round-trip a graph participant. Tests refuse swapped transaction/group keys, changed payloads and unsupported formats. A legacy graph prepare still decodes. Existing byte, item, slice and method limits remain enforced. | requirement | EG-DECISION-ENGINE | VERIFIED | cfe7d38376a4 src/raft/cross_shard_txn/prepare_record.rs:112 src/raft/cross_shard_txn/prepare_record.rs:125 src/raft/cross_shard_txn/prepare_record.rs:133 src/raft/cross_shard_txn/prepare_record.rs:150 |
| EG-DECISION-ENGINE-R036.103 Durable RBAC read reservation Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Durable RBAC read reservation.** Reserve the complete authority image under its existing owner. Compare revision and all identity state in one admitted write. Ordinary authority writes refuse while reserved. Reopen retains pending reservations. Only the matching durable coordinator decision resolves them. Fence old writers through the owner manifest and explicit offline upgrade. This child grants no profile access and admits no task. | Real-file tests cover competing saves, reopen, missing decisions, terminal replay and session-state digest changes. Coordinator tests apply graph phase two before releasing the reservation. Offline upgrade tests preserve existing rows. Native execution remains pending. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R036.104 Agent Library durable admission participant Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Agent Library durable admission participant.** Reserve exact ModelProfile and routed component revision/head and visibility predicates in AgentLibraryOwner, with the proposed decision-record body/component write key. Persist sealed transaction-bound intent and fence all conflicting writers through recovery. Consume prepare atomically with decision rows and receipt; no timeout release or historical-record admission proof. No authority grant is conferred. | Planned native store tests prove reopen, current-head/withdrawal refusal, blocked conflicting writes, exact-intent retry, changed-intent refusal, commit/abort replay and atomic record visibility. Source-only tests do not qualify cross-owner admission. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R036.105 Persist a request-bound coordinator decision certificate Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Persist a request-bound coordinator decision certificate.** The native local coordinator stores an immutable certificate beside its terminal outcome in one owner transaction. It binds transaction, tenant, coordinator scope, complete request digest and authority deadline. The storage writer chooses decision time. A COMMIT at or after the deadline refuses without a terminal write. Recovery reads the retained certificate through its owner. Legacy terminal rows never become certified evidence. | Real-store tests cover exact replay, changed intent, expiry, cleanup, reopen and legacy refusal. Structural decode stays bounded. Cross-owner consumers must match every binding field; native qualification remains pending. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R036.106 Durable profile-use grant records Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Durable profile-use grant records.** The RBAC owner records, reads and revokes profile-use grants in a registered durable table. An inspected offline upgrade moves both earlier RBAC layouts to the current one. It preserves authority and reservation rows and creates an empty grant table. An ordinary open refuses a predecessor layout. | An upgrade test reopens a store from each predecessor layout with every row preserved. A changed source refuses. Each layout digest matches its frozen value. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R804 Evaluation sets and the program optimizer loop (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evaluation sets and the program optimizer loop (rollup).** The engine must hold versioned evaluation sets and optimize a program or harness component against them. This row binds the existing `crates/eg-program` code to its served job. It adds the grader-kind evidence class for trace-store scores. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R804.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Bind `SignatureSpec` at `crates/eg-program/src/contracts.rs:106`, `TrainingExample` at `:271` and `TrainingCorpus` at `:333` as the evaluation-set records. Add `grader_kind` to `TrainingExample` as a closed set: `independent`, `human`, `model_judge`, `trace_metric`. | `crates/eg-program/tests/native_program.rs::all_modalities_compile_and_require_evidence_before_promotion` passes with the new field. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R804.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** The 13 `OptimizerKind` values at `crates/eg-program/src/optimizer.rs:32` compile a candidate revision against the train split. `PromotionPolicy` at `:221` scores it on the validation and test splits. A seeded run is deterministic. | `crates/eg-program/tests/native_program.rs::random_search_is_deterministic` passes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R804.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** The served `AnalyticsJob` arm `JobKind::ProgramOptimize` at `src/server/handlers/jobs/submit.rs:419` dispatches to `src/server/handlers/jobs/executor_program.rs`. A trace-store score enters a corpus through the SDK source ingest as a `TrainingExample` with its `grader_kind`. | `tests/decide/test_program_optimize_served.py::test_optimize_job_returns_candidate` submits a job and reads the candidate revision. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R804.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Under EG-DECISION-ENGINE-R016, a corpus whose test split holds only `model_judge` scores must refuse promotion with `EVAL_SET_NOT_INDEPENDENT`. A corpus with an empty test split must refuse with `EVAL_SET_NO_TEST_SPLIT`. | `tests/decide/test_program_optimize_served.py::test_judge_only_corpus_refuses` asserts both codes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R804.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The job result records the corpus digest, the optimizer kind, the seed and the per-split scores. | `crates/eg-program/tests/native_program.rs::promotion_identity_and_model_trace_bind_to_one_revision` passes with the corpus digest. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R804.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `AnalyticsJob` submit. The test optimizes a 3-example signature with `random_search` and reads the result. It completes in under 10 s on one core. | `tests/decide/test_program_optimize_served.py::test_optimize_hot_path` measures the wall time. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R805 Harness promotion and rollback (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Harness promotion and rollback (rollup).** The engine must promote an adopted harness or program revision through one champion pointer. Rollback re-promotes the parent revision. A post-promotion regression on the evaluation set triggers an automatic rollback decision. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R805.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add `ChampionPointer{agent_ref, task_class, revision_ref, parent_ref, promoted_by_decision}` and `RollbackDecision{pointer, from_ref, to_ref, reason, evidence_refs}` in `crates/eg-types/src/decision/promotion.rs`. | `crates/eg-types/src/decision/promotion.rs::tests::records_round_trip` round-trips both records. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R805.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Promotion compares and swaps the pointer through `commit_program_promotion` at `src/server/mutation_batch/commit/program.rs:64`. Rollback swaps the pointer to `parent_ref` of `ProgramRevisionIdentity`. A regression above 2 points on the test split after 50 runs records a rollback decision. | `crates/eg-types/src/decision/promotion.rs::tests::regression_triggers_rollback` feeds 50 worse outcomes. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R805.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** EG-DECISION-ENGINE-R803 adoptions and R804 candidates both promote through this pointer. arbora serves `harness.promote` and `harness.rollback` through `ARBORA-OPS-R852`. The AU cycle of AU-HARNESS-CYCLE-R001.5 reads the champion. | `tests/decide/test_harness_promotion_served.py::test_promote_then_rollback` promotes, rolls back and reads the pointer. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R805.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** A stale expected revision must refuse with `PROMOTION_CAS_CONFLICT`. A promotion without a passing R804 evaluation must refuse with `PROMOTION_UNEVALUATED`. A rollback with no parent must refuse with `ROLLBACK_NO_PARENT`. | `tests/decide/test_harness_promotion_served.py::test_promotion_refusals` asserts each code. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R805.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Each pointer move records the deciding record, the evaluation digest and the operator approval when present. The pointer history replays to the same head. | `tests/decide/test_harness_promotion_served.py::test_pointer_history_replays` replays the history. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R805.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-numeric/benches/harness_promotion.rs` evaluates the regression rule over 10,000 outcomes. The p99 stays under 1 ms. | `cargo bench -p eg-numeric --bench harness_promotion` fails on a 10 percent regression. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R651.7 Episodic-to-semantic promotion Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Episodic-to-semantic promotion.** Consolidation must promote an episodic pattern to a semantic fact when its support count reaches a threshold. The default threshold is 3 episodes. The fact must link to each supporting episode. The served `Consolidate` route at `src/server/handlers/graph_ops/gateway_graph_routes.rs:274` must run the promotion. | `tests/memory/test_consolidate_served.py::test_episodes_promote_to_semantic_fact` sends three episodes and reads one linked semantic fact. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R651.8 Reinforce and decay share one salience update Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Reinforce and decay share one salience update.** Served `Reinforce` must raise salience by a bounded step. Served `DecayMemories` must apply the half-life of `.2`. Both methods must call one salience function in `crates/eg-epistemic/src/memory.rs`. An entry below the salience floor must become a pruning candidate and must not be deleted. | `tests/memory/test_consolidate_served.py::test_reinforce_and_decay_share_salience` reinforces and decays one entry and checks the salience values. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R700.7 Contradiction records are tracked Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Contradiction records are tracked.** Each detected contradiction must persist as a record with both claim ids, the detected time, the evidence and a status. The status must move through `open`, `proposed` and `resolved` in that order only. UQL `CONTRADICTS` at `crates/eg-plan/src/uql/grammar.rs:180` must read these records. A status move out of order must refuse with `CONTRADICTION_STATUS_ORDER`. | `tests/decision/test_contradiction_records.py::test_detected_contradiction_is_tracked` detects one contradiction, reads it through UQL and refuses an out-of-order move. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.111 Bounded explicit task graphs (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Bounded explicit task graphs (rollup).** The engine validates caller-proposed tasks and derives a canonical bounded DAG. It returns an evaluate-only decision. Children `.1` to `.6` own the model, behavior, wiring, refusal, evidence and performance qualification. Child `.7` owns the published schema. Children `.8` to `.13` own deterministic typed tool steps. They cover the model, static checks, refusals, digest, wiring and proof. The harness runs those steps (`AU-BOUNDARY-R043.6.1` to `AU-BOUNDARY-R043.6.7`). Arbora serves them (`ARBORA-RELEASE-R003.4.6` to `ARBORA-RELEASE-R003.4.10`). Natural-language proposals remain untrusted inputs; semantic skill search remains outside this slice. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.111.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add strict `TaskPlanProposal`, `TaskPlanTask` and `TaskPlan` types. A task names its id, prompt and direct dependencies. A proposal names one output task and positive step and concurrency limits. The result binds the input digest, canonical tasks, total tasks, effective limits and fixed policy revision. | `task_plan_round_trips` preserves every field and rejects unknown fields. | requirement | EG-DECISION-ENGINE | SPECIFIED | crates/eg-types/src/decision/task_plan/tests.rs:26 tests/test_task_plan_client.py:10 |
| EG-DECISION-ENGINE-R134.111.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** Compute an explicit dependency DAG under `bounded-explicit-dag-v1`. Allow at most 64 tasks, eight active tasks, 16 KiB per prompt and 64 KiB of prompt text in total. Select lexical task-id order among ready tasks and sort direct dependencies. Every task must contribute to the named output sink. Never infer dependencies from prompt text. | `plan_respects_dependencies` returns A and B, then C after B, then the final join. Reordered input produces the same canonical plan digest. | requirement | EG-DECISION-ENGINE | SPECIFIED | crates/eg-types/src/decision/task_plan/tests.rs:169 crates/eg-types/src/decision/task_plan/tests.rs:43 |
| EG-DECISION-ENGINE-R134.111.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Serve the bounded explicit path through `Method::Decide`, `QuestionKind::TaskPlan`, and one typed `task_plan` parameter. The declared candidate ids must equal the task ids. Return the typed plan on the sealed statistical record. This is evaluate-only. Arbora owns admission and AU owns execution. | `decide_routes_task_plan` enters the existing handler and returns a typed plan. `test_explicit_plan_end_to_end` calls the served wire method. | requirement | EG-DECISION-ENGINE | SPECIFIED | src/server/handlers/decide/stat_tests/task_plan_tests.rs:60 tests/decide/test_task_plan_served.py:228 tests/decide/test_task_plan_served.py:350 |
| EG-DECISION-ENGINE-R134.111.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Refuse empty plans, duplicate or invalid ids, and duplicate or missing dependencies. Refuse cycles, disconnected output, invalid limits and excessive text. Return no plan on refusal. Refuse nonordinary questions, model heads, belief slices or candidate facts on this path. | Type and handler tests cover every refusal. A foreign tenant fails the existing authority-bound tenant check. | requirement | EG-DECISION-ENGINE | VERIFIED | f9bfc0da8ae7 crates/eg-types/src/decision/task_plan/tests.rs:117 crates/eg-types/src/decision/task_plan/tests.rs:195 crates/eg-types/src/decision/task_plan/tests.rs:205 crates/eg-types/src/decision/task_plan/tests.rs:233 crates/eg-types/src/decision/task_plan/tests.rs:82 |
| EG-DECISION-ENGINE-R134.111.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** Bind prompts and dependencies as caller claims, with one premise per task. Record the named fixed policy and its digest as definitions. Bind the plan digest into the record digest. The shared client checks proposal, request, plan and expected raw caller-principal bindings without granting authority. A plan is neither an authorization grant nor a durable publish. Do not accept a plan-bearing statistical record through the unrelated score replay path. | Handler tests verify claim evidence, task and policy premises, digest changes and refusal to log a forged plan-bearing score record. | requirement | EG-DECISION-ENGINE | SPECIFIED | src/server/handlers/decide/stat_tests/task_plan_tests.rs:155 src/server/handlers/decide/stat_tests/task_plan_tests.rs:61 tests/decide/test_task_plan_served.py:229 |
| EG-DECISION-ENGINE-R134.111.6 Performance qualification Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Performance qualification.** Measure the pure `plan_explicit_tasks` path at 64 tasks, maximum acyclic edges and 64 KiB of prompt text. Target p99 below 5 ms and transient memory below 8 MiB. | A reproducible `bounded_task_plan` benchmark receipt must identify workload, build profile, hardware and latency/memory measurements. Qualification remains pending; bounded-input functional tests do not establish measured performance. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.111.7 Canonical task-plan feature schema Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Canonical task-plan feature schema.** The engine defines one `FeatureSchemaBody` for `task_plan` requests. `gen_contract` emits it into the Python facade as `epistemic_graph.decision_client.TASK_PLAN_FEATURE_SCHEMA`. The export carries the body, `schema_version`, the body's content digest, the component id and a publish key. A host publishes the body once per tenant under that key. A repeat publish replays the same component revision and `definition_digest`. The host pins that digest in each task-plan Decide. | A Python test confirms that the exported digest is the body's digest under the engine codec. A served test publishes the body twice under the key and gets the same digest. It then routes a task-plan Decide with that pin. | requirement | EG-DECISION-ENGINE | VERIFIED | 67dffe78b02d crates/eg-types/src/decision/task_plan/tests.rs:250 src/server/handlers/decide/stat_tests/task_plan_tests.rs:181 tests/test_decision_stat_client.py:80 |
| EG-DECISION-ENGINE-R134.111.8 Tool step model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Tool step model.** Add an optional `call: TaskPlanCall{server, tool, arguments}` to `TaskPlanTask` in `crates/eg-types/src/decision/task_plan.rs`. `server` and `tool` are non-empty identifiers. `arguments` is a JSON object. Each value is a literal or a binding. A binding is the single-key object `{"$ref": "steps.<task_id>.output.<json.path>"}`. The path is dot-separated object keys and array indexes. A task without `call` is a prompt step and keeps its current form. A task with `call` is a tool step. Its `prompt` stays as the step label. No model runs a tool step. The result plan carries every call and binding in canonical form. Unknown fields are rejected. | `task_plan_round_trips` keeps a tool step, its literals and its bindings. It accepts a mixed plan. It rejects an unknown call field and a `$ref` object with extra keys. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.111.9 Canonical form and static checks Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Canonical form and static checks.** `plan_explicit_tasks` canonicalizes each call. It sorts argument keys, drops whitespace and normalizes each reference to one string form. A reference must name a task in the same task's direct `depends_on`. The path follows the closed grammar. It has at most 16 segments and 256 bytes. Bounds under `bounded-explicit-dag-v1` are 64 tool steps, 32 bindings per call and 16 KiB of canonical arguments per call. Call text counts toward the 64 KiB plan total. A binding adds no dependency edge. The engine never infers `depends_on` from a reference. The engine cannot know a run-time output, so it never checks that a path exists. `AU-BOUNDARY-R043.6.2` checks that at run time. | `binding_canonicalization_is_order_independent` yields one plan digest for reordered argument keys. `binding_bounds` accepts each ceiling and refuses one value past it. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.111.10 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** The decision refuses with a stable typed reason and returns no plan. `binding_unknown_task`: the reference names a task that is not in the plan. `binding_not_dependency`: the task is not in this task's direct `depends_on`. `binding_bad_path`: the path breaks the grammar or its bounds. `binding_cycle`: a binding edge closes a cycle, including a reference to the task itself. `call_invalid`: `server` or `tool` is malformed, or `arguments` is not an object. `call_bounds`: a count or byte bound of R134.111.9 is exceeded. A plain `depends_on` cycle still refuses with `plan_cycle`. Each refusal names the task id and the argument pointer. | `refuses_each_binding_defect` returns the reason, task id and argument pointer for all six reasons. A binding to a non-dependency refuses with `binding_not_dependency` and returns no plan. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.111.11 Digest and evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Digest and evidence.** The plan digest covers every call. That means `server`, `tool`, each literal and each binding. A change to any of them changes the digest. Key order does not. The fixed policy revision of `bounded-explicit-dag-v1` changes with this extension. The record holds one caller-claim premise per tool step. It names `server`, `tool` and the binding references. It holds one premise per binding that names the source task. Arguments are caller claims, so the record grants no authority to invoke a tool. `verify_task_plan_receipt` checks calls and bindings against the proposal. | `digest_covers_calls_and_bindings` changes the digest for a changed tool, literal, reference or server. `premises_name_calls_and_bindings` lists the premises. The receipt check refuses a receipt whose call differs from the proposal. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.111.12 Wiring and schema Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring and schema.** Calls attach in `plan_explicit_tasks` (`crates/eg-types/src/decision/task_plan.rs:215`). `handle_decide` reaches it through `super::stat_task_plan::task_plan` (`src/server/handlers/decide/stat_decide.rs:114`) and `outcome` (`stat_decide.rs:140`). The `TASK_PLAN_FEATURE_SCHEMA` body of `EG-DECISION-ENGINE-R134.111.7` grows to describe a call and a binding. Its content digest changes. The consumer rows are `AU-BOUNDARY-R043.6.1` for the harness and `ARBORA-RELEASE-R003.4.6` for served acceptance. Arbora re-pins the digest through `ARBORA-RELEASE-R003.4.4`. | `decide_routes_task_plan_with_calls` enters `handle_decide` and returns the typed plan with calls. The Python test checks that the exported digest equals the new body's digest. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R134.111.13 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide` wire method with a `TaskPlan` question. The plan mixes a prompt step with a tool step that has a binding. The test publishes the schema and submits the proposal. It reads the plan back. Calls and bindings round trip, and the digest binds them. It then submits a reference to a non-dependency. It requires the typed refusal and no plan. | `tests/decide/test_task_plan_served.py::test_tool_step_bindings_end_to_end`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R814 Connector prompts are system-prompt candidates that agent assembly selects (rollup) Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Connector prompts are system-prompt candidates that agent assembly selects (rollup).** Each packaged prompt with role `system` (`SDK-CONNECTOR-CONTROL-R074.2`) becomes a `system_prompt` harness component of `EG-ORCH-VOCAB-R801`. It links to its connector, its capabilities and its ontology classes. `AgentAssemble` (`EG-DECISION-ENGINE-R036`) and capability coverage (`EG-DECISION-ENGINE-R126`) select one candidate per agent slot for the task. The job load set (`EG-DECISION-ENGINE-R176`, `EG-CQ-ORCH-R011.1`) returns the prompt with its premise. Children `.1` to `.7` deliver it. | See each child. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R814.1 Model Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Model.** Add the candidate relation `:systemPromptFor` from a `system_prompt` component to a task class or capability. Add `PromptCandidate{component_id, connector, role, serves, digest}` in `crates/eg-types/src/decision/`. Task and template prompts register as components of kind `tool_guidance`. They are not system-prompt candidates. | `crates/eg-types/tests/prompt_candidate.rs::candidate_round_trips_and_kind_follows_role`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R814.2 Behavior Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Behavior.** arbora onboarding (`ARBORA-FLEET-R041.15`) writes one `PromptCandidate` node per `system` prompt into the tenant graph. It is the one producer of candidate nodes. The node has `:systemPromptFor` edges to the class and capability IRIs the prompt declares, and a `cp:ofConnector` edge. `AgentAssemble` fills an agent slot's system prompt from the candidates that cover the slot's task. It scores them by capability match and the confidence of `EG-ORCH-VOCAB-R801`. It abstains and names the uncovered capability when no candidate covers the task. It never invents a prompt. | `crates/eg-core/tests/prompt_candidate.rs::assemble_selects_covering_candidate_and_abstains_without_one`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R814.3 Wiring Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Wiring.** Candidates arrive in the onboarding triple batch of `EG-TYPED-PACKS-R106.3`. EG has no candidate projection of its own. `handle_agent_assemble` (`src/server/handlers/decide/assemble.rs:22`) reads them with a graph query over `:systemPromptFor`. The query runs in the Agent Library scope that already feeds tool components. The coverage query beside it (`src/server/handlers/decide/coverage.rs`) counts them. A caller lists candidates with served UQL or SPARQL. No served candidate read method exists. | `tests/decision/test_prompt_candidates_served.py::test_assemble_reads_candidates_from_imported_pack`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R814.4 Refusal Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Refusal.** Import refuses a `system` prompt that names no class or capability with `PROMPT_UNBOUND`. A candidate whose connector failed ontology admission is invisible to `AgentAssemble`. The decision names the excluded candidates. | `crates/eg-core/tests/prompt_candidate.rs::unbound_prompt_refuses_and_rejected_connector_is_excluded`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R814.5 Evidence Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Evidence.** The `Solved` record names each chosen system prompt, its connector, its digest and the capability it covered. The load-set row for the prompt cites the same component id. | `tests/decision/test_prompt_candidates_served.py::test_record_names_prompt_connector_digest_and_capability`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R814.6 Hot-path proof Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Hot-path proof.** The entry point is the served triple write of two onboarding batches, then served `AgentAssemble`. Each batch catalogs a connector that ships a system prompt. It assembles an agent for a task of one connector. It reads that connector's prompt in the committed agent graph. | `tests/decision/test_prompt_candidates_served.py::test_dynamic_agent_gets_the_matching_connector_system_prompt`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-DECISION-ENGINE-R814.7 Competency query Definition — EG-DECISION-ENGINE / EG-DECISION-ENGINE — Decision engineCanonical requirement and verification source**Competency query.** "Which prompts can be the system prompt for task Y" is one graph query. It returns each `PromptCandidate` whose `:systemPromptFor` names task Y or a task that requires a capability task Y requires. Each row names the connector and the digest. It runs through served SPARQL and through its UQL equivalent. The query string is the test vector in the test specification. | `tests/decision/test_prompt_candidates_served.py::test_system_prompt_query_lists_candidates_for_a_task`. | requirement | EG-DECISION-ENGINE | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC EG-SDLC — Graph-driven development lifecycle | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R001 Lifecycle record vocabulary and derived edges (rollup) Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Lifecycle record vocabulary and derived edges (rollup).** The engine must hold the nine lifecycle record kinds and the closed edge set of plan.md. Named rules derive the edges from the changeset log and the code graph. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R001.1 Model Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Model.** Add `:Release`, `:Deployment` and `:Defect` and the edges `changes`, `citesRequirement`, `implements`, `verifiedBy`, `exercises`, `judges`, `producedBy`, `affects`, `introducedBy`, `fixedBy`, `contains`, `deploys`, `observedIn` and `raises` to `crates/eg-core/ontology/sdd-v1.ttl`. Add one SHACL shape per edge with its domain and range. | `crates/eg-core/tests/lifecycle_vocab.rs::edge_set_is_closed_and_shaped` loads the ontology and validates one fixture per edge. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R001.2 Behavior Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Behavior.** Add `derive_lifecycle_edges(changeset, code_graph) -> Vec<DerivedEdge>` in `crates/eg-core/src/lifecycle/derive.rs`. It applies the eight named rules of plan.md. Each `DerivedEdge` carries the rule name, the rule version and the input digests. The function is deterministic. | `crates/eg-core/tests/lifecycle_derive.rs::rules_emit_expected_edges` applies each rule to a fixture and compares the output. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R001.3 Wiring Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Wiring.** The EG-SCM-R006 re-index hook calls `derive_lifecycle_edges` after each accepted changeset. `IndexRepository` at `src/server/dispatch/router/source_ingest.rs:24` calls it for each ingested git commit. No other caller writes these edges. | `tests/test_sdlc_derive_served.py::test_accept_writes_derived_edges` submits a changeset and reads the derived edges back. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R001.4 Refusal Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Refusal.** A direct write of a derived edge kind must refuse with `LIFECYCLE_EDGE_DERIVED_ONLY`. A derived edge with an absent endpoint must refuse with `LIFECYCLE_ENDPOINT_UNKNOWN`. A refusal writes nothing. | `crates/eg-core/tests/lifecycle_derive.rs::manual_edge_write_is_refused` asserts both codes and an unchanged graph. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R001.5 Evidence Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Evidence.** A rebuild replays every rule over the changeset log. The rebuilt edge set must equal the incremental edge set byte for byte. | `crates/eg-core/tests/lifecycle_derive.rs::rebuild_equals_incremental` applies 200 changesets incrementally and compares a rebuild. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R001.6 Hot-path proof Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Hot-path proof.** The entry point is the served `SubmitChangeset`. The benchmark `benches/lifecycle_derive.rs` derives edges for a 50-path changeset over a 1M-symbol graph. The p99 stays under 5 ms. Peak memory stays under 64 MiB. | `cargo bench --bench lifecycle_derive` against the stored baseline fails on a 10 percent regression. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R002 Release and deployment records (rollup) Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Release and deployment records (rollup).** The engine must store releases and deployments. It links each deployment to a release by artifact digest. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R002.1 Model Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Model.** Add `Release{repo, version, git_ref, changeset_head, artifact_digests, published_at}` and `Deployment{environment, workload, image_digest, release_ref, started_at, finished_at, outcome}` in `crates/eg-types/src/lifecycle.rs`. `outcome` is a closed set: `succeeded`, `failed`, `rolled_back`, `unattributed`. | `crates/eg-types/tests/lifecycle_records.rs::records_round_trip` round-trips both records and refuses an unknown outcome. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R002.2 Behavior Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Behavior.** `RecordDeployment` resolves the release by image digest. A digest that no release names sets `outcome` to `unattributed` and `release_ref` to none. The `contains.release_range` rule links a release to the changesets after the previous release head. | `crates/eg-types/tests/lifecycle_records.rs::unknown_digest_stays_unattributed` records a deployment with an unknown digest. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R002.3 Wiring Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Wiring.** Add the served methods `RecordRelease` and `RecordDeployment` in `src/server/handlers/lifecycle.rs`. The release workflow of `PIPE-RELEASE-R009` calls `RecordRelease`. The deploy operations of `ARBORA-OPS-R853` call `RecordDeployment`. | `tests/test_sdlc_release_served.py::test_release_then_deployment_links` records both and reads the link back. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R002.4 Refusal Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Refusal.** A release whose changeset head is absent from the repository chain must refuse with `RELEASE_HEAD_UNKNOWN`. A second release with the same repository and version must refuse with `RELEASE_VERSION_TAKEN`. | `tests/test_sdlc_release_served.py::test_release_refusals` asserts both codes. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R002.5 Evidence Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Evidence.** Each release record is sealed under the EG-DURABLE-KERNEL-R057 create-only guard. A readback must equal the written bytes. | `tests/test_sdlc_release_served.py::test_release_is_sealed` attempts an overwrite and reads the original back. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R002.6 Hot-path proof Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Hot-path proof.** The entry point is the served `RecordDeployment`. The test records 1,000 deployments over 50 releases. Each record stays under 2 ms at p99. | `tests/test_sdlc_release_served.py::test_deployment_record_latency` measures the p99. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R003 Defect records and intake (rollup) Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Defect records and intake (rollup).** The engine must store defects and accept them from five intake paths. It removes duplicates by a signature digest. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R003.1 Model Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Model.** Add `Defect{id, repo, title, intake, signature_digest, severity, status, symptoms, created_at}` in `crates/eg-types/src/lifecycle.rs`. `intake` is a closed set: `gate_failure`, `run_failure`, `incident`, `connector_issue`, `direct`. `status` is a closed set: `new`, `triaged`, `fixing`, `fixed`, `verified`, `closed`, `rejected`. | `crates/eg-types/tests/lifecycle_records.rs::defect_round_trips` round-trips a defect and refuses an unknown status. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R003.2 Behavior Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Behavior.** `FileDefect` normalizes the symptom: it strips addresses, line numbers and temporary paths. It hashes the result to the signature digest. An open defect with the same signature absorbs the symptom. A closed defect with the same signature reopens. | `crates/eg-core/tests/defect_intake.rs::same_signature_reuses_open_defect` files two equal symptoms and observes one defect. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R003.3 Wiring Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Wiring.** `RecordGateVerdict` of EG-SCM-R008 calls `FileDefect` on a fail verdict. The run-trace writer of EG-ORCH-VOCAB-R009 calls it on a failed run outcome. `incident.correlate` of EG-UNIFIED-DATA-PLANE-R760 calls it when an incident names a code symbol. | `tests/test_sdlc_defect_served.py::test_failed_gate_opens_defect` records a fail verdict and reads the defect back. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R003.4 Refusal Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Refusal.** A status move that skips a state must refuse with `DEFECT_TRANSITION_ILLEGAL`. A move to `verified` must refuse with `DEFECT_UNVERIFIED` unless a bound test passes on the fix changeset. | `tests/test_sdlc_defect_served.py::test_illegal_transitions_refuse` asserts both codes. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R003.5 Evidence Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Evidence.** Each defect lists its symptoms with the intake path, the source record id and the time. A readback through a separate principal must equal the stored list. | `tests/test_sdlc_defect_served.py::test_symptom_evidence_reads_back` compares every field. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R003.6 Hot-path proof Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Hot-path proof.** The entry point is the served `RecordGateVerdict`. The benchmark `benches/defect_intake.rs` files 100,000 symptoms over 1,000 signatures. The p99 per symptom stays under 1 ms. | `cargo bench --bench defect_intake` against the stored baseline fails on a 10 percent regression. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R004 Defect triage decision (rollup) Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Defect triage decision (rollup).** The engine must decide the triage of a defect. The decision names severity, suspected symbols, an owner and a duplicate link. It abstains with a typed reason when evidence is insufficient. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R004.1 Model Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Model.** Add `TriageDecision{defect_id, severity, suspected_symbols, owner_principal, duplicate_of, abstain_reason, evidence_refs}` in `crates/eg-types/src/decision/defect_triage.rs`. `abstain_reason` is a closed set: `no_symbol_match`, `no_owner`, `insufficient_evidence`. | `crates/eg-types/src/decision/defect_triage.rs::tests::decision_round_trips` round-trips the record. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R004.2 Behavior Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Behavior.** The engine maps symptom frames to symbols through the code graph. It ranks suspects by blame recency and the EG-SCM-R009 culprit. It picks the owner from path ownership records, then recent authors. It sets the `affects` and `introducedBy` edges from the result. | `crates/eg-types/src/decision/defect_triage.rs::tests::culprit_outranks_blame` seeds a culprit and asserts the rank. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R004.3 Wiring Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Wiring.** The served `Decide` accepts the `DEFECT_TRIAGE` question kind. The answer stores as a `DecisionRecord` through `DecisionCommit` of EG-DECISION-ENGINE-R019. `TriageDefect` calls it. | `tests/decide/test_defect_triage_served.py::test_triage_records_decision` triages a seeded defect and reads the record back. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R004.4 Refusal Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Refusal.** A triage of an absent defect must refuse with `DEFECT_UNKNOWN`. A triage of a closed defect must refuse with `DEFECT_CLOSED`. Neither writes a decision. | `tests/decide/test_defect_triage_served.py::test_triage_refusals` asserts both codes. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R004.5 Evidence Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Evidence.** The decision pins the symptom digests, the blame inputs and the culprit id. A replay with equal inputs must produce an equal record digest. | `tests/decide/test_defect_triage_served.py::test_triage_replays` replays the record and compares digests. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R004.6 Hot-path proof Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Decide`. The benchmark `crates/eg-numeric/benches/defect_triage.rs` triages over a 1M-symbol graph with 20 frames. The p99 stays under 10 ms. | `cargo bench -p eg-numeric --bench defect_triage` fails on a 10 percent regression. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R005 Requirement state derived from the graph (rollup) Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Requirement state derived from the graph (rollup).** The engine must derive each requirement state from the changeset log and the bound tests. The answer must equal the shared status generator on the same revision. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R005.1 Model Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Model.** Add `SpecStatusAnswer{repo, rev, rows}` with `SpecRowState{id, state, landed_by, verified_by, withdrawn}` in `crates/eg-types/src/lifecycle.rs`. `state` is the closed set `SPECIFIED`, `LANDED`, `VERIFIED`. | `crates/eg-types/tests/lifecycle_records.rs::status_answer_round_trips` round-trips the answer. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R005.2 Behavior Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Behavior.** Add `derive_spec_status` in `crates/eg-core/src/lifecycle/status.rs`. It applies the state rules of plan.md. A rollup takes the lowest child state. A `Spec-Withdraw` trailer removes the binding evidence for its IDs. | `crates/eg-core/tests/spec_status_derive.rs::rules_match_the_standard` covers each state, a rollup and a withdrawal. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R005.3 Wiring Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Wiring.** Add the served method `SpecStatus` in `src/server/handlers/lifecycle.rs`. It reads `:Requirement` nodes of EG-ORCH-VOCAB-R012.9 and the derived edges of R001. `PIPE-CONNSPEC-R009` reads it. | `tests/test_sdlc_spec_status_served.py::test_served_status_reads_graph` reads the state of a fixture repository. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R005.4 Refusal Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Refusal.** A revision absent from the repository chain must refuse with `SPEC_STATUS_REV_UNKNOWN`. A repository with no ingested spec tree must refuse with `SPEC_TREE_ABSENT`. | `tests/test_sdlc_spec_status_served.py::test_status_refusals` asserts both codes. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R005.5 Evidence Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Evidence.** Each landed row names its changeset ids. Each verified row names its test ids. A differential test compares the served answer with the shared status generator output for the same revision. | `tests/test_sdlc_spec_status_served.py::test_matches_shared_generator` compares both outputs on this repository. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R005.6 Hot-path proof Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Hot-path proof.** The entry point is the served `SpecStatus`. The test derives the state of 2,000 rows. The p99 stays under 50 ms. | `tests/test_sdlc_spec_status_served.py::test_status_latency` measures the p99. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R006 Lifecycle competency queries (rollup) Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Lifecycle competency queries (rollup).** UQL must answer the lifecycle questions of plan.md over the derived edges. The served `LifecycleTrace` returns the records reachable from one anchor. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R006.1 Model Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Model.** Add `LifecycleTraceRequest{anchor, depth, kinds}` and `LifecycleTraceAnswer{records, edges, truncated}` in `crates/eg-types/src/lifecycle.rs`. `depth` ranges from 1 to 8. | `crates/eg-types/tests/lifecycle_records.rs::trace_request_bounds` refuses depth 9. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R006.2 Behavior Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Behavior.** The trace walks the edge set breadth first to the depth bound. It filters by record kind. It reports `truncated` when the node budget of 10,000 stops the walk. | `crates/eg-core/tests/lifecycle_trace.rs::trace_respects_depth_and_budget` asserts both bounds. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R006.3 Wiring Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Wiring.** Add the served method `LifecycleTrace` in `src/server/handlers/lifecycle.rs`. Publish four UQL competency fixtures in `tests/fixtures/lifecycle_cq/`. | `tests/test_sdlc_trace_served.py::test_competency_questions_answer` runs the four fixtures. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R006.4 Refusal Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Refusal.** An anchor outside the caller tenant must return an empty answer, not an error. An unknown record kind must refuse with `LIFECYCLE_KIND_UNKNOWN`. | `tests/test_sdlc_trace_served.py::test_trace_refusals` asserts both cases. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R006.5 Evidence Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Evidence.** Each returned edge names its derivation rule and version. | `tests/test_sdlc_trace_served.py::test_edges_name_rules` reads the rule names back. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-SDLC-R006.6 Hot-path proof Definition — EG-SDLC / EG-SDLC — Graph-driven development lifecycleCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/lifecycle_trace.rs` walks depth 4 from a requirement over 1M symbols and 100,000 changesets. The p99 stays under 20 ms. | `cargo bench --bench lifecycle_trace` fails on a 10 percent regression. | requirement | EG-SDLC | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL EG-DURABLE-KERNEL — Durable graph kernel | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R001 Outbox head-only attempt accounting and rewind Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Outbox head-only attempt accounting and rewind.** The outbox increments retry attempts only for the row currently at the head of a stream, so a failing head cannot exhaust the attempt budget of healthy successor rows. Consumers can declare an explicit reject that dead-letters the head immediately and reports the transition, and an administrator can list head status and dead letters and issue a rewind to replay from an earlier position. | Verified by outbox tests covering a failing head never dead-lettering a healthy successor, repeated head releases dead-lettering only the head, consumer reject dead-lettering immediately, and rewind replay. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1813f2b5190d a676823d2b54 afc33c3cde5c b43f33569dd4 crates/eg-transaction/src/tests/outbox.rs:1577 crates/eg-transaction/src/tests/outbox.rs:1721 crates/eg-transaction/src/tests/outbox.rs:1893 crates/eg-transaction/src/tests/outbox.rs:2034 |
| EG-DURABLE-KERNEL-R002 Outbox consumers get per-class topics and reject-driven rebuild Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Outbox consumers get per-class topics and reject-driven rebuild.** Outbox consumers publish to semantically distinct topics per message class. A reasoning-projection consumer that rejects a message triggers a rebuild rather than silently acknowledging a skipped projection. `MutationOutbox` exposes an administrative method for inspecting and managing consumer state. The outbox reports metrics on attempts, rejects, dead letters, and rebuilds. | Verified by outbox integration tests asserting per-class topic routing, reject-triggered rebuild of a reasoning projection, and exported outbox metrics. | requirement | EG-DURABLE-KERNEL | VERIFIED | 03670fc1f33c a1bb9fb9503e a676823d2b54 crates/eg-transaction/src/tests/outbox.rs:2309 |
| EG-DURABLE-KERNEL-R003 Owner-store layout lineage registry with typed upgrade refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Owner-store layout lineage registry with typed upgrade refusal.** The owner-store layout maintains a lineage registry that recognizes every supported on-disk format and refuses an unsupported layout with a named `{LAYOUT}_FORMAT_UPGRADE_REQUIRED` error rather than reinterpreting it silently. A generated document records the steps required to remove a retired layout from the registry. | Verified by a golden lineage test that loads each supported manifest format and checks the typed refusal for unsupported ones. | requirement | EG-DURABLE-KERNEL | VERIFIED | a1bb9fb9503e a676823d2b54 afc33c3cde5c crates/eg-storage/src/owner/lineage_fixture_tests.rs:46 |
| EG-DURABLE-KERNEL-R004 Outbox attempt accounting is scoped to the head row Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Outbox attempt accounting is scoped to the head row.** Re-leasing an outbox row increments the attempt count only for the row at the head of its stream. Healthy successor rows staged behind it never gain an attempt. A failing head cannot dead-letter its successors. This accounting is implemented in `crates/eg-transaction/src/outbox/claim.rs`. | One test asserts a failing head never dead-letters a healthy successor. Another test asserts sixteen re-leases of the head dead-letter only the head. | requirement | EG-DURABLE-KERNEL | VERIFIED | a676823d2b54 afc33c3cde5c b43f33569dd4 crates/eg-transaction/src/tests/outbox.rs:1578 crates/eg-transaction/src/tests/outbox.rs:1894 |
| EG-DURABLE-KERNEL-R005 Outbox delivery state remains local to the owning node Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Outbox delivery state remains local to the owning node.** The local store owner writes outbox delivery-side rows. The multi-group raft layer does not replicate them. Delivery progress stays node-local and outside the replicated log. | Confirmed by an integration test checking that outbox delivery rows are not present in replicated state on non-owning cluster members. | requirement | EG-DURABLE-KERNEL | VERIFIED | 03670fc1f33c 48abc77ce72e 87a17d4fa2a4 a676823d2b54 e2e2514203b7 crates/eg-transaction/src/outbox/rows.rs:325 |
| EG-DURABLE-KERNEL-R006 Engine startup does not block on one store's lazy open Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Engine startup does not block on one store's lazy open.** Engine startup must not refuse entirely when the agent-library store fails to open. That store opens lazily. A failure to open it affects only the operations that depend on it, not overall startup. | A startup test forces the agent-library store to fail its open. The test asserts that the engine still starts and serves unrelated operations. | requirement | EG-DURABLE-KERNEL | VERIFIED | 03670fc1f33c 8dbb5bd9de53 a676823d2b54 src/raft/harness/resource_acceptance_test.rs:2570 |
| EG-DURABLE-KERNEL-R007 Host binary exposes a storage inspect and upgrade command Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Host binary exposes a storage inspect and upgrade command.** The host binary provides administrative `storage inspect` and `storage upgrade` commands. They examine and migrate on-disk layout state outside normal server startup. | Verified by a CLI integration test exercising `storage inspect` and `storage upgrade` against a sample data directory. | requirement | EG-DURABLE-KERNEL | VERIFIED | 0ce0383a5599 a676823d2b54 tests/operator_command_store_upgrade_cli.rs:35 tests/operator_command_store_upgrade_cli.rs:60 tests/operator_command_store_upgrade_cli.rs:81 |
| EG-DURABLE-KERNEL-R008 Raft unit tests pass under cluster features and run in CI Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Raft unit tests pass under cluster features and run in CI.** All `raft::*` unit tests and `txn_reconcile_ack_lost_retry` pass when compiled with cluster features enabled, without recursion-depth failures, and a continuous-integration job compiles and runs the raft test suite on every change. | Verified by a green continuous-integration job that builds with cluster features and executes the raft test suite, including `txn_reconcile_ack_lost_retry`. | requirement | EG-DURABLE-KERNEL | VERIFIED | 624e1e3076e6 a1bb9fb9503e a676823d2b54 tests/test_raft_cluster_ci_gate.py:31 tests/test_raft_cluster_ci_gate.py:39 tests/test_raft_cluster_ci_gate.py:57 |
| EG-DURABLE-KERNEL-R009 Native raft commands are sealed as their bare method Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Native raft commands are sealed as their bare method.** Native consensus commands are sealed and opened as the bare method they represent in `src/raft/command/native/sealed.rs` (`SealedNativeMethod::seal_value`/`open_value`), so a native raft command payload is never rejected as invalid due to a mismatched envelope. | Verified by a follower catch-up test that replays a create-graph-then-write sequence and by unit tests on `SealedNativeMethod` sealing and opening. | requirement | EG-DURABLE-KERNEL | VERIFIED | a676823d2b54 b43f33569dd4 src/raft/command/native/tests.rs:180 |
| EG-DURABLE-KERNEL-R010 jscpd clone gate runs on every commit Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**jscpd clone gate runs on every commit.** The jscpd structural-clone gate runs in the per-commit check suite. The gate flags each new duplicate code pair that an extraction introduces. | The per-commit hook configuration invokes the jscpd gate. The gate catches a deliberately duplicated extraction. | requirement | EG-DURABLE-KERNEL | VERIFIED | 624e1e3076e6 a1bb9fb9503e a676823d2b54 tests/test_jscpd_per_commit_gate.py:30 tests/test_jscpd_per_commit_gate.py:40 |
| EG-DURABLE-KERNEL-R011 Clippy and targeted tests cover the full and all-features builds Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Clippy and targeted tests cover the full and all-features builds.** CI must run full-feature clippy without raft and all-feature clippy with Kafka dependencies. CI must execute the raft, backup, and persistence modules before accepting a change. `.github/workflows/release.yml` owns these gates. This parent rolls up R011.1 through R011.5. Declaration validation alone does not prove runtime acceptance. | Exact-head CI logs must prove both clippy profiles and all three runtime categories passed before merge. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 1c6b4c961a40 7c046280f19e 9794030f6459 a676823d2b54 tests/test_release_feature_matrix.py:217 |
| EG-DURABLE-KERNEL-R011.1 `RequiredTestModuleCategory`/`RequiredTestModule` are a typed category and a validated declaration, refusing an unrecognized category name or an unselectable declaration Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`RequiredTestModuleCategory`/`RequiredTestModule` are a typed category and a validated declaration, refusing an unrecognized category name or an unselectable declaration.** `crates/eg-types/src/pre_merge_test_module.rs` parses the `raft`/`backup`/`persistence` category names. It requires a non-empty crate name and `cargo test` filter. It refuses declarations that cannot select and run a module. | Unit tests cover all three categories and valid declarations. They refuse unknown categories, missing crate names, and missing test filters. | requirement | EG-DURABLE-KERNEL | VERIFIED | 9794030f6459 crates/eg-types/src/pre_merge_test_module.rs:164 crates/eg-types/src/pre_merge_test_module.rs:181 crates/eg-types/src/pre_merge_test_module.rs:190 crates/eg-types/src/pre_merge_test_module.rs:202 crates/eg-types/src/pre_merge_test_module.rs:217 |
| EG-DURABLE-KERNEL-R011.2 Concrete required-module manifest Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Concrete required-module manifest.** `crates/eg-types/src/pre_merge_test_module.rs` must declare real crate names and test filters for all three categories. The manifest selects `epistemic-graph` `raft::` with `cluster`, `eg-transaction` `tests::backup_replay::` with no features, and `epistemic-graph` `server::persistence::` with `full`. All commands disable default features and target library tests. Empty discovered selections are refused. Runtime execution belongs to R011.3. | Unit tests in `crates/eg-types/src/pre_merge_test_module.rs`: `required_manifest_covers_runtime_categories` and `required_manifest_rejects_empty_selection`. | requirement | EG-DURABLE-KERNEL | VERIFIED | 85ce2ac73a96 a430c82b18b2 crates/eg-types/src/pre_merge_test_module.rs:232 crates/eg-types/src/pre_merge_test_module.rs:279 crates/eg-types/src/pre_merge_test_module.rs:295 scripts/tests/test_public_spec_inventory.py:102 |
| EG-DURABLE-KERNEL-R011.3 Pre-merge runtime execution Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Pre-merge runtime execution.** `.github/workflows/ci.yml` must execute the R011.2 manifest on pull requests. The gate must fail on test failures or zero selected tests. | Planned tests in `tests/test_required_runtime_gate.py`: `test_pull_request_executes_required_categories` and `test_failed_or_empty_category_blocks_acceptance`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R011.4 Exact-head CI acceptance receipts Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Exact-head CI acceptance receipts.** `specs/durable-graph-kernel/test-spec.md` must record passing pre-merge runtime and clippy evidence at one published revision. `.github/workflows/release.yml` must retain both clippy profiles and Kafka dependencies. | CI receipts must name `published-full`, `workspace-all-features`, and every selected runtime test. R011.2 and R011.3 test names define the gate checks. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R011.5 Required Clippy profile declarations Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Required Clippy profile declarations.** `tests/test_release_feature_matrix.py` must check both required profile flags, their executable command, and Kafka build headers. This child covers configuration only. R011.3 and R011.4 retain runtime and exact-head receipt acceptance. | `test_required_clippy_profiles_and_command_are_declared` checks current configuration. `test_required_clippy_declaration_drift_is_refused` rejects missing profiles, changed flags, disabled commands, and missing headers. | requirement | EG-DURABLE-KERNEL | VERIFIED | 7c046280f19e c73eeb01d917 tests/test_release_feature_matrix.py:218 tests/test_release_feature_matrix.py:257 |
| EG-DURABLE-KERNEL-R012 Raft native command sealing and placement routing are correct Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Raft native command sealing and placement routing are correct.** Native consensus commands are sealed and opened consistently so they are never rejected as invalid, and placement administration correctly routes data movement across a multi-node raft cluster. | Verified by a follower catch-up replay test and a placement-admin test that moves data across a real three-node cluster. | requirement | EG-DURABLE-KERNEL | VERIFIED | 6067fad789bb a676823d2b54 b43f33569dd4 src/raft/harness/catchup_test.rs:57 src/raft/tests.rs:1017 |
| EG-DURABLE-KERNEL-R013 Raft cluster test failures capture a causal trace automatically Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Raft cluster test failures capture a causal trace automatically.** A failing multi-node raft test captures a bounded ring-buffer trace of raft and heartbeat events. The trace filters to the consensus targets. A panic hook dumps it. The code lives in `src/raft/harness/trace_capture.rs`. The causal chain of a failure is available without manual tracing. | Unit tests cover the ring buffer, including eviction of the oldest entry when over capacity. A test covers the panic-hook dump path. | requirement | EG-DURABLE-KERNEL | VERIFIED | 624e1e3076e6 a676823d2b54 b43f33569dd4 src/raft/harness/trace_capture.rs:482 src/raft/harness/trace_capture.rs:562 |
| EG-DURABLE-KERNEL-R014 Raft cluster tests pass reliably under load Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Raft cluster tests pass reliably under load.** The leader-rebalance and three-node placement-admin tests must reach their expected cluster states under CPU load. R015 transport timing or ordering gaps must not cause flaky failures. `src/raft/tests.rs` owns both tests. This parent rolls up R014.1 through R014.5. Retry-budget validation alone does not prove loaded execution. | Repeated loaded runs must pass without flaky failures. `src/raft/harness/trace_capture.rs` must capture each failure trace. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 3a14159c3768 a676823d2b54 |
| EG-DURABLE-KERNEL-R014.1 A typed flake-budget / retry-policy model bounds how a load-test run retries past a transient failure Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**A typed flake-budget / retry-policy model bounds how a load-test run retries past a transient failure.** `src/raft/flake_budget.rs`'s `FlakeBudget` names `max_retries`, `backoff_ms`, and `max_backoff_ms`, refusing a zero-retry, zero-backoff, or inverted-cap budget at construction, and refusing `backoff_for` on a retry attempt beyond `max_retries`, rather than looping forever or silently giving up. Code root: `src/raft`. No load-test harness is driven yet. | Verified by unit tests covering a well-formed budget, each malformed-budget refusal, a retry attempt beyond `max_retries` being refused, and exponential backoff growth capped at `max_backoff_ms`. | requirement | EG-DURABLE-KERNEL | VERIFIED | 3a14159c3768 src/raft/flake_budget.rs:105 src/raft/flake_budget.rs:112 src/raft/flake_budget.rs:120 src/raft/flake_budget.rs:128 src/raft/flake_budget.rs:85 |
| EG-DURABLE-KERNEL-R014.2 Bounded representative CPU load Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Bounded representative CPU load.** `scripts/validate-raft-cluster.sh` must provide CPU workers while cluster tests run. The generator must record worker count and elapsed duration. It must reject zero workers and stop every worker on exit. | Process tests in `tests/test_validate_raft_cluster.py`: `test_cpu_load_runs_during_cluster_test`, `test_zero_load_workers_refused`, and `test_load_workers_stop_on_failure`. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1cf93eec4282 85ce2ac73a96 86913890006d tests/test_check_registry_test_ownership_completeness.py:31 tests/test_validate_raft_cluster.py:15 |
| EG-DURABLE-KERNEL-R014.3 Repeated loaded-test harness Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Repeated loaded-test harness.** `scripts/validate-raft-cluster.sh` must repeat both named cluster tests under R014.2 load. It must preserve every attempt result and failure trace. `src/raft/flake_budget.rs` must bound any diagnostic retry. A retry success must not erase a flaky first failure. | Planned tests in `tests/test_validate_raft_cluster.py`: `test_repeats_both_cluster_tests`, `test_retry_budget_is_bounded`, and `test_retry_preserves_failure_and_trace`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R014.3.1 Repeated fail-closed loaded execution Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Repeated fail-closed loaded execution.** The existing shell entry point accepts a bounded repeat count and runs both exact named cluster tests under R014.2 load. Each invocation keeps its own output trace and result in a fresh run directory. Any failed or empty selection keeps the overall run failed even when later repetitions pass. No diagnostic retries are performed by this leaf. | Process tests in `tests/test_validate_raft_cluster.py`: `test_repeats_both_cluster_tests`, `test_repetition_preserves_failure_and_trace`, `test_empty_selection_refused`, and `test_invalid_repeat_count_refused`. | requirement | EG-DURABLE-KERNEL | VERIFIED | e0efe89bdedf tests/test_validate_raft_cluster.py:221 tests/test_validate_raft_cluster.py:242 tests/test_validate_raft_cluster.py:264 tests/test_validate_raft_cluster.py:276 tests/test_validate_raft_cluster.py:289 |
| EG-DURABLE-KERNEL-R014.3.2 Bounded diagnostic retry integration Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Bounded diagnostic retry integration.** Drive optional diagnostic retries through `src/raft/flake_budget.rs`, preserving failed attempts and refusing retries beyond its budget. R014.3 rolls up this child and R014.3.1. | Planned `test_retry_budget_is_bounded` and `test_retry_preserves_failure_and_trace`; Rust retry integration remains pending. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R014.4 Loaded leader-rebalance acceptance Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Loaded leader-rebalance acceptance.** `specs/durable-graph-kernel/test-spec.md` must record repeated loaded runs of `src/raft/tests.rs::multi_node_group_join_then_leader_rebalance`. The record must include revision, command, hardware, CPU-worker count, repeat count, results, and trace locations. | `src/raft/tests.rs::multi_node_group_join_then_leader_rebalance` must pass every recorded loaded repetition without flaky failures. The record must include at least two repetitions. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R014.5 Loaded three-node placement acceptance Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Loaded three-node placement acceptance.** `specs/durable-graph-kernel/test-spec.md` must record repeated loaded runs of the three-node placement-admin test in `src/raft/tests.rs`. The record must include revision, command, hardware, CPU-worker count, repeat count, results, and trace locations. | `src/raft/tests.rs::placement_admin_wire_rpc::placement_admin_wire_rpcs_move_data_across_a_real_three_node_cluster` must pass every recorded loaded repetition without flaky failures. The record must include at least two repetitions. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R015 Raft heartbeat flush and batch dispatch avoid head-of-line blocking Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Raft heartbeat flush and batch dispatch avoid head-of-line blocking.** Each peer flushes its heartbeats independently. Per-group batch dispatch runs concurrently and does not wait behind one in-flight write. One slow peer or group does not stall the others. | A benchmark measures the worst-case heartbeat processing time under load. A documented single-graph-per-group configuration bounds any remaining head-of-line risk. | requirement | EG-DURABLE-KERNEL | VERIFIED | a595f3a182c3 a676823d2b54 src/raft/tests.rs:2087 |
| EG-DURABLE-KERNEL-R016 Raft durability writes are batched to reduce commit latency Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Raft durability writes are batched to reduce commit latency.** Raft log append and commit batches multiple entries using durability batching and coalescing rather than issuing one redb write transaction per entry, reducing commit latency that otherwise runs on the order of a second per transaction regardless of cross-group contention. | Verified by a focused raft durability test and by commit-latency measurements comparing per-entry commits against batched commits. | requirement | EG-DURABLE-KERNEL | VERIFIED | 92943a9ed1bb a676823d2b54 src/server/persistence/redb_backend/raft_linger_tests.rs:12 |
| EG-DURABLE-KERNEL-R017 Correctness-gated benchmark compares EG against HelixDB Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Correctness-gated benchmark compares EG against HelixDB.** A pinned, correctness-gated benchmark suite measures point-get, multi-hop traversal, transactional batch, text/vector prefilter, and mixed graph/vector workloads against HelixDB, reporting latency, throughput, CPU, resident memory, and storage amplification for each. | Verified by a benchmark report that records exact configuration, hardware class, code revision, and measured results, with no superiority claim accepted without it. | requirement | EG-DURABLE-KERNEL | VERIFIED | 28295e96e0a3 a676823d2b54 d2a5aa6460df tests/test_bench_helix_compare.py:113 tests/test_bench_helix_compare.py:144 tests/test_bench_helix_compare.py:177 tests/test_bench_helix_compare.py:56 |
| EG-DURABLE-KERNEL-R018 UDF registry and response-dedup cache are tenant-scoped Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**UDF registry and response-dedup cache are tenant-scoped.** The UDF registry is keyed and scoped by tenant and actor through a single authorization chokepoint. A tenant cannot invoke or shadow another tenant's UDF. This follows the foreign-source scoping in EG-FEDERATED-QUERY-R013. The in-memory mutation response-dedup cache keys its entries by tenant and caller. It never replays one tenant's cached response to another. | Cross-tenant negative tests assert that UDF invoke and shadow attempts are denied. They also assert that the response-dedup cache never replays another tenant's cached response. | requirement | EG-DURABLE-KERNEL | VERIFIED | 745bf5943743 a1bb9fb9503e a676823d2b54 src/server/mutation/context.rs:567 src/server/udf_catalog.rs:126 |
| EG-DURABLE-KERNEL-R019 Graph lifecycle idempotency keys are tenant-scoped Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Graph lifecycle idempotency keys are tenant-scoped.** The lifecycle batch identifier used for `CreateGraph` and `DeleteGraph` idempotency includes tenant in addition to the verified agent identity and graph name, so two tenants using the same agent identity, idempotency key, and graph name never receive each other's replayed result or reveal cross-tenant graph existence. | Verified by a test creating the same idempotency key, agent identity, and graph name under two different tenants and asserting each gets its own independent outcome. | requirement | EG-DURABLE-KERNEL | VERIFIED | 745bf5943743 a1bb9fb9503e a676823d2b54 src/server/mutation_batch/lifecycle_tests.rs:411 |
| EG-DURABLE-KERNEL-R020 Bounded background scrub detects node corruption between restarts Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Bounded background scrub detects node corruption between restarts.** A background content scrub reads nodes using a read transaction with no write lock, resumes from a stored key cursor, runs at a bounded rate, and surfaces typed corruption findings on status and metrics, rather than relying on detection only at read time or the next restart. Unseal failures return a typed error instead of an untyped string. | Verified by a test that corrupts a persisted node, runs the scrub, and asserts a typed finding is reported and the cursor resumes correctly after restart. | requirement | EG-DURABLE-KERNEL | VERIFIED | 461f8c84eb44 745bf5943743 a676823d2b54 src/server/persistence/redb_backend/scrub_api_tests.rs:80 |
| EG-DURABLE-KERNEL-R021 Store-authority binding validates once per write transaction Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Store-authority binding validates once per write transaction.** `binding_for_write` in `crates/eg-storage/src/physical/binding.rs` validates owner-store authority and scope once per write transaction and caches the result for that transaction's duration, rather than repeating the full manifest and table check on every member access, while still failing closed at the transaction boundary. | Verified by a commit-latency benchmark showing per-commit validation overhead drop to a small constant cost instead of repeating per-member checks. | requirement | EG-DURABLE-KERNEL | VERIFIED | a1d6b2bd5e03 a5e7b2983a04 a676823d2b54 crates/eg-transaction/src/tests/write_authority.rs:19 |
| EG-DURABLE-KERNEL-R022 Just-in-time RBAC elevation requires two-person approval Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Just-in-time RBAC elevation requires two-person approval.** A dedicated `rbac.elevation` control lease is consulted by the access-check path to grant temporary elevated access, requires approval from two distinct principals, carries a hard expiry, is audited, and is never issued automatically by a learning or inference process. | Verified by tests asserting elevation is denied without two distinct approvers, denied after expiry, and always produces an audit record. | requirement | EG-DURABLE-KERNEL | VERIFIED | 2f37015096de a1d6b2bd5e03 a676823d2b54 crates/eg-core/src/isolation/elevation_tests.rs:158 crates/eg-core/src/isolation/elevation_tests.rs:192 crates/eg-core/src/isolation/elevation_tests.rs:85 |
| EG-DURABLE-KERNEL-R023 UQL enforces a read-only guarantee at compile time and by test Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**UQL enforces a read-only guarantee at compile time and by test.** `UnifiedQuery`, `UnifiedQueryText`, and `Uql` operations never perform a mutation or touch a durable domain, are idempotent, and execute against a `Snapshot`; a compile-time pin ensures operation dispatch takes the snapshot by shared reference so a mutable path cannot be introduced without a build failure. | Verified by an eg-capabilities invariant test asserting the read-only, idempotent, snapshot-based contract for all three query types. | requirement | EG-DURABLE-KERNEL | VERIFIED | a676823d2b54 e1ca1b8fd167 crates/eg-capabilities/tests/invariants.rs:504 |
| EG-DURABLE-KERNEL-R024 External graph and database backends become EG federation sources Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**External graph and database backends become EG federation sources.** The fan-out backend, PostgreSQL/AGE backend, Cypher transpiler, mirror target, outbox-based mirror, brain-guarded backend, Trino backend, and Spark job backends are implemented in this repository as ForeignSourceSpec federation sources and mirror targets rather than remaining external, undeleted components. One child per named backend (`.1` AGE, `.2` fan-out, `.3` Cypher transpiler, `.4` mirror target, `.5` outbox-based mirror, `.6` brain-guarded, `.7` Trino, `.8` Spark); each net-new child is further split producer-first by the typed-model/entry-point rule. Rollup: LANDED only once every child is. | Verified by integration tests that register each backend as a ForeignSourceSpec or MirrorTargetSpec and exercise a representative query or mirror operation through it. | requirement | EG-DURABLE-KERNEL | LANDED | 35f12e9cc56f 3a14159c3768 3ddc77c97ef8 42a0b101b111 4746fbcf1601 |
| EG-DURABLE-KERNEL-R024.1 PostgreSQL/AGE backend becomes a ForeignSourceSpec source Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**PostgreSQL/AGE backend becomes a ForeignSourceSpec source.** A `ForeignSourceSpec::Cypher { backend: Age, .. }` wire spec is bound, under an explicit registration, to a read-only PostgreSQL credential in `crates/eg-plan/src/federation_age.rs`; the binding is refused unless the credential's endpoint matches the declared endpoint, and every fetch reuses the existing guarded SQL federation transport (read-only transaction, timeout, cardinality bound), so AGE mutation clauses cannot commit. Code root: `crates/eg-plan`. | Verified by tests covering a successful bound registration and probe, a mismatched-binding refusal that also proves the unbound wire spec still errors, and a Cypher-text injection guard on the generated dollar-quote delimiter. | requirement | EG-DURABLE-KERNEL | VERIFIED | 42a0b101b111 7b7d4a0fb10f a1d6b2bd5e03 c2dd4c98fe60 crates/eg-plan/src/federation_age.rs:231 crates/eg-plan/src/federation_age.rs:261 crates/eg-plan/src/federation_age.rs:279 |
| EG-DURABLE-KERNEL-R024.2 The fan-out backend becomes a `MirrorTargetSpec` federation mirror target Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**The fan-out backend becomes a `MirrorTargetSpec` federation mirror target.** No fan-out-shaped mirror target existed on main (net-new); split producer-first: `.1` is the typed `FanOut` spec plus validation and registration refusal, `.2` is the dispatch entry point that drives a bound driver through it. | Verified per child; `.1` by unit tests on the spec's validation and unbound-refusal behavior. | requirement | EG-DURABLE-KERNEL | VERIFIED | 3ddc77c97ef8 42a0b101b111 7a8f87ca8484 9a7674d1bae5 crates/eg-plan/src/mirror_target.rs:138 crates/eg-plan/src/mirror_target.rs:148 crates/eg-plan/src/mirror_target.rs:159 crates/eg-plan/src/mirror_target.rs:169 crates/eg-plan/src/mirror_target.rs:180 |
| EG-DURABLE-KERNEL-R024.3 Cypher transpiler becomes a ForeignSourceSpec source Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Cypher transpiler becomes a ForeignSourceSpec source.** The existing external Cypher transpiler becomes a `ForeignSourceSpec` federation source in this repository. It extends the AGE binding from `EG-DURABLE-KERNEL-R024.1` to other Cypher backends. Code root: `crates/eg-plan`. | An integration test registers a non-AGE Cypher backend as a `ForeignSourceSpec` and runs a representative query. | requirement | EG-DURABLE-KERNEL | LANDED | 4746fbcf1601 47a33ca58bb6 48abc77ce72e 9d6110b74214 |
| EG-DURABLE-KERNEL-R024.4 Mirror target becomes a ForeignSourceSpec mirror target Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Mirror target becomes a ForeignSourceSpec mirror target.** The existing external mirror-target backend is implemented as a `ForeignSourceSpec` mirror target in this repository rather than remaining external. Code root: `crates/eg-plan`. | Verified by an integration test that registers the mirror target and exercises a representative mirror operation through it. | requirement | EG-DURABLE-KERNEL | LANDED | 4746fbcf1601 48abc77ce72e 9d6110b74214 b1310a7964f2 |
| EG-DURABLE-KERNEL-R024.5 Outbox-based mirror becomes a `MirrorTargetSpec` mirror target Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Outbox-based mirror becomes a `MirrorTargetSpec` mirror target.** `MirrorTargetSpec::Outbox { consumer }` names the outbox consumer this mirror reads committed rows as, reusing the outbox contract `EG-DURABLE-KERNEL-R001`/`R002`/`R052` already gives (committed-only delivery, a stable per-consumer cursor, idempotent replay after outage) instead of a separate ad hoc mirror loop; `crates/eg-plan/src/mirror_target.rs`'s `target_for` validates the spec (refusing an empty or padded consumer name) and returns the same unbound refusal as `FanOut`/`Named` until a driver that actually drains the consumer's cursor registers. Code root: `crates/eg-plan` (wire type in `crates/eg-types`). | Verified by unit tests: the spec round-trips over the wire, an empty or padded consumer name is refused before any binding is attempted, and a valid-but-unbound outbox target fails closed on `send` without reaching any target. | requirement | EG-DURABLE-KERNEL | VERIFIED | 3a14159c3768 42a0b101b111 crates/eg-plan/src/mirror_target.rs:264 crates/eg-plan/src/mirror_target.rs:274 crates/eg-plan/src/mirror_target.rs:285 crates/eg-plan/src/mirror_target.rs:295 |
| EG-DURABLE-KERNEL-R024.6 Brain-guarded backend becomes a ForeignSourceSpec source Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Brain-guarded backend becomes a ForeignSourceSpec source.** `ForeignSourceSpec::BrainGuarded { endpoint, guard_policy, query, id_field, score_field }` is PURE serde; `crates/eg-plan/src/federation_brain_guarded.rs` validates its shape then explicitly REFUSES with a named reason, since no bound guard-policy evaluation driver exists yet -- a well-formed spec is never run unguarded. Code root: `crates/eg-plan` (wire type in `crates/eg-types`). | Verified by unit tests: a well-formed spec is refused (not silently run unguarded), an empty guard policy is rejected before reaching that refusal, a score field matching the id field is rejected, and the wrong spec variant is rejected. | requirement | EG-DURABLE-KERNEL | VERIFIED | 3a14159c3768 42a0b101b111 crates/eg-plan/src/federation_brain_guarded.rs:103 crates/eg-plan/src/federation_brain_guarded.rs:115 crates/eg-plan/src/federation_brain_guarded.rs:132 crates/eg-plan/src/federation_brain_guarded.rs:95 |
| EG-DURABLE-KERNEL-R024.7 Trino backend becomes a ForeignSourceSpec source Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Trino backend becomes a ForeignSourceSpec source.** This repository implements the external Trino backend as a `ForeignSourceSpec` federation source. It reuses the guarded SQL federation transport that `EG-DURABLE-KERNEL-R024.1` binds for PostgreSQL/AGE. An unmerged prior attempt is a starting point: `crates/eg-plan/src/federation_trino.rs` in the ancestry of commit `bfa1cabd8494accef2ae87892bdd63d8358eec93`. Re-verify it against current main before landing. Code root: `crates/eg-plan`. | Verified by an integration test that registers the Trino backend as a `ForeignSourceSpec` and exercises a representative query through it. | requirement | EG-DURABLE-KERNEL | VERIFIED | 42a0b101b111 7b7d4a0fb10f c2dd4c98fe60 crates/eg-plan/src/federation_trino.rs:369 |
| EG-DURABLE-KERNEL-R024.8 Spark job backend becomes a ForeignSourceSpec source Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Spark job backend becomes a ForeignSourceSpec source.** `ForeignSourceSpec::SparkBatch` already names a sealed, registered batch artifact. `crates/eg-plan/src/federation_spark.rs` adds the explicit per-registration half. The counterpart `federation_age`/`federation_trino` modules give their own backend. The registration requires `artifact_ref` to carry the `artifact://` scheme that a registration surface issues, never a caller-provided path. It then refuses explicitly, because no bound artifact-store driver exists yet. `federation::source_for`'s generic dispatch already refuses an inline `SparkBatch` spec through `Oq2Unbound`. Code root: `crates/eg-plan`. | Verified by unit tests: a well-formed spec is refused (not silently accepted), a caller-provided path lacking the `artifact://` scheme is rejected, an empty artifact id after the scheme is rejected, a score field matching the id field is rejected, and the wrong spec variant is rejected. | requirement | EG-DURABLE-KERNEL | VERIFIED | 3a14159c3768 42a0b101b111 crates/eg-plan/src/federation_spark.rs:100 crates/eg-plan/src/federation_spark.rs:112 crates/eg-plan/src/federation_spark.rs:124 crates/eg-plan/src/federation_spark.rs:141 crates/eg-plan/src/federation_spark.rs:92 |
| EG-DURABLE-KERNEL-R024.2.1 `MirrorTargetSpec::FanOut` is a typed, validated spec with registration refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`MirrorTargetSpec::FanOut` is a typed, validated spec with registration refusal.** `crates/eg-types/src/wire_query_modalities.rs` adds `MirrorTargetSpec::FanOut { targets }`, refusing an empty or duplicate-target spec; `crates/eg-plan/src/mirror_target.rs` adds the `MirrorTarget` trait and a `target_for` builder that validates the spec and returns an unbound refusal (no driver bound yet), mirroring `federation::source_for`'s `Oq2Unbound` pattern for Trino/Cypher/SparkBatch before their dedicated backends existed. | Verified by unit tests: the spec round-trips over the wire, an empty or duplicate-target fan-out is refused before any binding is attempted, and a valid-but-unbound fan-out fails closed on `send` without reaching any target. | requirement | EG-DURABLE-KERNEL | VERIFIED | 3ddc77c97ef8 42a0b101b111 crates/eg-plan/src/mirror_target.rs:138 crates/eg-plan/src/mirror_target.rs:148 crates/eg-plan/src/mirror_target.rs:159 crates/eg-plan/src/mirror_target.rs:169 |
| EG-DURABLE-KERNEL-R024.2.2 `MirrorTargetRegistry` is the one entry point a mirror-sink driver registers under and the outbox fan-out path resolves a name through Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`MirrorTargetRegistry` is the one entry point a mirror-sink driver registers under and the outbox fan-out path resolves a name through.** `crates/eg-plan/src/mirror_target.rs` adds `MirrorTargetRegistry` (`register`/`send_to`), mirroring `federation::ForeignSourceRegistry::register_spec`/`resolve`: an invalid spec is refused at registration time, a registered name resolves through the real `target_for` validate-and-dispatch path, and an unregistered name is a distinct clean error. | Verified by unit tests: an invalid spec is refused at registration (nothing is stored), a registered fan-out's `send_to` reaches the real unbound-driver refusal through the registry, and an unknown name reports a distinct "not registered" error. | requirement | EG-DURABLE-KERNEL | VERIFIED | 7a8f87ca8484 9a7674d1bae5 crates/eg-plan/src/mirror_target.rs:180 crates/eg-plan/src/mirror_target.rs:189 crates/eg-plan/src/mirror_target.rs:207 |
| EG-DURABLE-KERNEL-R025 Raft admin follows the current leader and traces are leader-agnostic Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Raft admin follows the current leader and traces are leader-agnostic.** A member-add administrative request follows the current leader to completion instead of returning a forward-to-leader response, the causal trace ring captures events across all nodes rather than only the calling thread so an election on another node is still traceable, and raft cluster tests tolerate a legal leader election instead of assuming a fixed leader. | Verified by a member-add test against a cluster undergoing an election and by raft tests that pass regardless of which node holds leadership. | requirement | EG-DURABLE-KERNEL | VERIFIED | 05bf09d8eee4 a676823d2b54 src/raft/tests.rs:2794 |
| EG-DURABLE-KERNEL-R026 Auth modes share one principal and RBAC evaluation path Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Auth modes share one principal and RBAC evaluation path.** The none, local, and external authentication modes all resolve through a single principal and RBAC evaluation path. The local mode provides a native user store with registration, login, password management, an administrative UI, and backing SQL tables, while external mode supports OIDC, SAML, LDAP, Active Directory, and SCIM authorities. | Verified by the auth-modes test scenario asserting all three modes resolve to the same internal principal and RBAC evaluator, with mode-specific negative cases denied. | requirement | EG-DURABLE-KERNEL | VERIFIED | 48abc77ce72e a676823d2b54 crates/eg-types/src/identity/tests/auth.rs:255 |
| EG-DURABLE-KERNEL-R027 Schema repair uses a reserved two-person approval lease (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Schema repair uses a reserved two-person approval lease (rollup).** Split into EG-DURABLE-KERNEL-R027.1 (model types), EG-DURABLE-KERNEL-R027.2 (dispatch wiring) and EG-DURABLE-KERNEL-R027.3 (raft catalog registration); landed when all three are landed. | Verified by each child requirement's own verification. | requirement | EG-DURABLE-KERNEL | VERIFIED | 2a4982e949a3 3c618dd255ba 42a0b101b111 6e52c9bcfb57 a676823d2b54 crates/eg-types/src/control_lease/tests.rs:174 crates/eg-types/src/governed_change/tests.rs:110 crates/eg-types/src/governed_change/tests.rs:148 crates/eg-types/src/governed_change/tests.rs:54 crates/eg-types/src/governed_change/tests.rs:77 |
| EG-DURABLE-KERNEL-R027.1 Governed-change model types Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Governed-change model types.** `eg-types` defines the two-person governed-change ledger: `GovernedChange`, `GovernedLedger`, `GovernedActor` and the propose/approve/revoke/consume state machine. It reserves the `governed.` control-lease prefix against the generic lease path. | eg-types unit tests verify five refusals. Self-approval is denied and a delegated approver is refused. A generic control lease of a governed kind is refused. An altered digest is rejected. A consumed or revoked change cannot be reused. | requirement | EG-DURABLE-KERNEL | VERIFIED | 3c618dd255ba 42a0b101b111 6e52c9bcfb57 d768ee483940 crates/eg-types/src/control_lease/tests.rs:174 crates/eg-types/src/governed_change/tests.rs:110 crates/eg-types/src/governed_change/tests.rs:148 crates/eg-types/src/governed_change/tests.rs:54 crates/eg-types/src/governed_change/tests.rs:77 |
| EG-DURABLE-KERNEL-R027.2 Governed-change dispatch wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Governed-change dispatch wiring.** Depends on EG-DURABLE-KERNEL-R027.1. The wire protocol, capability policy and isolation layers serve propose/approve/revoke/get/list through the request boundary, with the acting identity server-stamped from the verified request context rather than trusted from the request body. | Verified by dispatch tests sent through the real request boundary, covering self-approval refusal, a delegated approver refusal, and a forged actor in the request body being overwritten. | requirement | EG-DURABLE-KERNEL | VERIFIED | 2a4982e949a3 3c618dd255ba 42a0b101b111 cd899a5c8c20 src/server/dispatch/governed/tests.rs:109 src/server/dispatch/governed/tests.rs:59 |
| EG-DURABLE-KERNEL-R027.3 Governed-change raft catalog registration Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Governed-change raft catalog registration.** Depends on EG-DURABLE-KERNEL-R027.2. The native raft method catalog records `GovernedChange` in the `Identity` domain, the same replication class as `RbacAdmin`/`RbacElevation`/`Identity`; without this record `NativeMutationCommand::from_public_method` refuses the method outright instead of sealing it into a native consensus command. | Verified by a round-trip test sealing a `GovernedChange` method into a native command and opening it back, asserting it resolves to the `Identity` domain. | requirement | EG-DURABLE-KERNEL | VERIFIED | 3c618dd255ba 42a0b101b111 cd899a5c8c20 src/raft/command/native/tests.rs:280 |
| EG-DURABLE-KERNEL-R028 WorkItem lifecycle test uses a consistent verified tenant Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**WorkItem lifecycle test uses a consistent verified tenant.** The work-item metadata CAS lifecycle test signs its request as the same tenant it names in the work-item body, and the tenant guard in ClaimWorkItem denies a request naming a foreign tenant rather than allowing a mismatched signer and body tenant to pass. | Verified by the focused work-item lifecycle test surviving a restart under the corrected tenant fixture and by a negative case proving a foreign-tenant claim is denied. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 15451958704f a676823d2b54 |
| EG-DURABLE-KERNEL-R029 Universal read-RLS gate checks the current TsScan dispatch path Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Universal read-RLS gate checks the current TsScan dispatch path.** scripts/check_universal_read_rls.py verifies tenant scoping on the series executor's actual dispatch path through exec/dispatch.rs into exec/tsscan.rs, confirming SeriesKey::new(tenant, graph, series) and range-scoped access, rather than checking a superseded code path. | Verified by running the universal read-RLS gate against the current executor layout and confirming it detects the scoped SeriesKey and range-scoped call. | requirement | EG-DURABLE-KERNEL | LANDED | 0447684dce7b a676823d2b54 |
| EG-DURABLE-KERNEL-R030 Reserved RBAC elevation lease kind cannot be issued generically Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Reserved RBAC elevation lease kind cannot be issued generically.** An unrestricted principal can issue any non-reserved control lease kind, but the rbac.elevation kind remains globally reserved for the dedicated two-person elevation flow and cannot be issued through the generic lease path by any principal, including an unrestricted one. | Verified by a per-principal kind-policy test asserting unrestricted principals can issue non-reserved kinds while an attempt to issue rbac.elevation generically is denied. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 3157bcbb4ac2 a676823d2b54 |
| EG-DURABLE-KERNEL-R031 Audit append supports tenant-scoped idempotent reservation Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Audit append supports tenant-scoped idempotent reservation.** AuditAppend provides a tenant-scoped, idempotent reservation in a pending state, followed by a linked terminal outcome and reconciliation if the outcome is interrupted. It rejects a request with a missing audit class or when the durable audit writer is unavailable, and binds to verified service-level claims of the caller. | Verified by tests covering duplicate reservation requests, writer-unavailable rejection, missing-class rejection, and reconciliation after a crash between reservation and outcome. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 2cc878fb8938 5c83a1967042 8628416b1736 8e288da667fc src/redb_store/operation_audit_tests.rs:278 src/server/dispatch/graph_pipeline/dispatch_helpers.rs:687 src/server/mutation_batch/tests.rs:1394 |
| EG-DURABLE-KERNEL-R031.1 The audit append accounts the serving write version Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**The audit append accounts the serving write version.** After an audit append, the serving write version equals the authoritative scope version. Each attempt commits one maintenance batch under a unique attempt id. The kernel advances the authoritative version by one per committed batch, maintenance included. The served append accounts that commit in the serving projection. A governed ingest stamps its graph version expectation from the serving version. That write commits after the append. It never meets the +1 skew the kernel refuses as `STALE_VERSION`. | One test exercises the served append. It performs one audit append, then the write stamped from the serving version. It asserts the serving and authoritative versions agree. It asserts the stamped write commits through the kernel version check. It asserts a replayed append advances the serving version by exactly one. After that, the two agree again. | requirement | EG-DURABLE-KERNEL | VERIFIED | 92f13033b00a src/server/dispatch/graph_pipeline/dispatch_helpers.rs:687 |
| EG-DURABLE-KERNEL-R031.2 Writes are stamped from the authoritative scope version Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Writes are stamped from the authoritative scope version.** A durable commit can advance a graph's mutation scope without the serving projection accounting it. The authoritative version read then raises the serving write version to the durable one, once, before anything stamps a version from it. SourceIngest stamps its batch from that read. A fresh single-writer ingest after such a commit therefore commits. It never meets the kernel's `STALE_VERSION` refusal. A serving version ahead of its authority is still refused. | Test `the_authoritative_version_accounts_a_durable_write_the_projection_missed` in `src/server/mutation_batch/tests.rs` puts the projection two versions behind the durable scope. The read returns the durable version and the projection equals it. A projection ahead of its authority refuses. | requirement | EG-DURABLE-KERNEL | VERIFIED | 5c83a1967042 aeb9c998476a src/server/mutation_batch/tests.rs:1394 |
| EG-DURABLE-KERNEL-R032 Native primary-key fast path bypasses the SQL planner Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Native primary-key fast path bypasses the SQL planner.** Primary-key point operations on the pgwire, MySQL and MSSQL listeners run through a native fast path. The fast path skips DataFusion query planning. It applies the same authorization and audit checks as the planned path. A hybrid storage provider unions a hot redb tier with a cold eg-lake tier under compaction. It relies on the write-latency reduction in EG-DURABLE-KERNEL-R016. The net-new rule splits this row, and `.1` is the typed model. The rollup is LANDED only when every child is. | A differential test compares fast-path and planned-path results for primary-key operations. A compaction test runs over the hot/cold union provider. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 49c43fca68d0 crates/eg-types/src/fast_path.rs:109 crates/eg-types/src/fast_path.rs:118 crates/eg-types/src/fast_path.rs:81 crates/eg-types/src/fast_path.rs:97 |
| EG-DURABLE-KERNEL-R032.1 PrimaryKeyOperation and FastPathDecision are typed, and routing refuses rather than silently bypassing checks Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**PrimaryKeyOperation and FastPathDecision are typed, and routing refuses rather than silently bypassing checks.** `crates/eg-types/src/fast_path.rs` defines a closed `PrimaryKeyOperation` enum and a `route` decision function whose `Ok` result always carries authorization-checked and audit-checked as true, and which refuses (not downgrades) an unauthorized operation. | Verified by unit tests: operation round-trips through its wire name, an authorized operation routes with both checks true, and an unauthorized operation is refused for every operation variant. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 49c43fca68d0 crates/eg-types/src/fast_path.rs:109 crates/eg-types/src/fast_path.rs:118 crates/eg-types/src/fast_path.rs:81 crates/eg-types/src/fast_path.rs:97 |
| EG-DURABLE-KERNEL-R033 Hot-store engine choice is evaluated against captured workloads Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-store engine choice is evaluated against captured workloads.** An evaluation compares redb, fjall and RocksDB behind the existing storage interface. It uses captured traffic from representative application workloads and a finance workload. An architecture decision record keeps the outcome. Split per the net-new rule (no engine-comparison type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A benchmark report compares the three engines on the same captured workloads. The architecture decision record is published. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 be3fad3f9840 crates/eg-types/src/hot_store_engine.rs:125 crates/eg-types/src/hot_store_engine.rs:140 crates/eg-types/src/hot_store_engine.rs:157 crates/eg-types/src/hot_store_engine.rs:168 crates/eg-types/src/hot_store_engine.rs:190 |
| EG-DURABLE-KERNEL-R033.1 HotStoreEngine, WorkloadProfile, and BenchmarkResult are typed. Winner selection refuses rather than silently defaulting Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**HotStoreEngine, WorkloadProfile, and BenchmarkResult are typed. Winner selection refuses rather than silently defaulting.** `crates/eg-types/src/hot_store_engine.rs` defines closed engine/workload enums and a validated `BenchmarkResult`. Its `select_winner` decision refuses when no captured result matches the requested workload. | Unit tests verify wire-name round trips and refusal of non-positive throughput. They verify highest-throughput selection for a workload and refusal when no result matches. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b be3fad3f9840 crates/eg-types/src/hot_store_engine.rs:125 crates/eg-types/src/hot_store_engine.rs:140 crates/eg-types/src/hot_store_engine.rs:157 crates/eg-types/src/hot_store_engine.rs:168 crates/eg-types/src/hot_store_engine.rs:190 |
| EG-DURABLE-KERNEL-R034 Cross-store atomicity is proven and scoped to mixed transactions Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Cross-store atomicity is proven and scoped to mixed transactions.** Cross-store atomicity has an architecture decision record and an implementation such that traffic confined to a single store never enters the cross-store commit path, and the mechanism survives a hard process kill without partial application. Split per the net-new rule (no transaction-scope type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by a crash-consistency test that kills the process mid-commit and a concurrency anomaly corpus exercising the cross-store path. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 5dc0a601b2cf crates/eg-types/src/cross_store_scope.rs:65 crates/eg-types/src/cross_store_scope.rs:79 crates/eg-types/src/cross_store_scope.rs:85 crates/eg-types/src/cross_store_scope.rs:94 |
| EG-DURABLE-KERNEL-R034.1 TransactionScope and CommitPath are typed, and a single-store scope structurally can never map to the cross-store commit path Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**TransactionScope and CommitPath are typed, and a single-store scope structurally can never map to the cross-store commit path.** `crates/eg-types/src/cross_store_scope.rs` defines a closed `TransactionScope` enum, a classifier that refuses an empty (zero-store) transaction, and a pure, total `commit_path_for` mapping where `SingleStore` always yields `Direct` and `CrossStore` always yields `CrossStoreCoordinated`. | Verified by unit tests: scope variants round-trip through their wire name, classifying zero stores is refused, one store classifies as single-store and more than one as cross-store, and the commit-path mapping is deterministic per scope. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 5dc0a601b2cf crates/eg-types/src/cross_store_scope.rs:65 crates/eg-types/src/cross_store_scope.rs:79 crates/eg-types/src/cross_store_scope.rs:85 crates/eg-types/src/cross_store_scope.rs:94 |
| EG-DURABLE-KERNEL-R035 PostgreSQL wire protocol reaches operational and dump/restore parity Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**PostgreSQL wire protocol reaches operational and dump/restore parity.** The PostgreSQL-compatible wire surface supports pg_dump and pg_restore, exposes a replication protocol, and provides operational parity including pg_stat views, pg_locks, EXPLAIN, query cancellation, and pooler transaction mode. Split per the net-new rule (no operational-surface tracking type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by a compatibility test suite running pg_dump and pg_restore round trips and exercising each operational surface against the PostgreSQL wire listener. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 1ef84395fa69 de5f096bc0fd |
| EG-DURABLE-KERNEL-R036 Mirror sinks reach fan-out parity and include Postgres table mirroring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Mirror sinks reach fan-out parity and include Postgres table mirroring.** EG mirror sinks reach parity with the existing fan-out mirror backend. They provide a durable per-mirror cursor, replay after outage, reconciliation and a non-empty-default guard. They also mirror SQL user tables to a real PostgreSQL target. Every mirror target registers in the attached-source registry. Split per the net-new rule, because main had no sink-side cursor type. `.1` is the typed model. This rollup is LANDED only once every child is. | Verified by outage/replay/reconcile tests against a mirror sink. A PostgreSQL-target mirroring test confirms registration in the attached-source registry. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 d833c1d987a6 crates/eg-types/src/mirror_sink.rs:111 crates/eg-types/src/mirror_sink.rs:121 crates/eg-types/src/mirror_sink.rs:130 crates/eg-types/src/mirror_sink.rs:138 crates/eg-types/src/mirror_sink.rs:147 |
| EG-DURABLE-KERNEL-R036.1 MirrorSinkKind and MirrorCursor are typed, and the cursor refuses an empty-string position Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**MirrorSinkKind and MirrorCursor are typed, and the cursor refuses an empty-string position.** `crates/eg-types/src/mirror_sink.rs` defines the closed fan-out/postgres sink kind and a cursor whose constructor and advance method both refuse an empty position, so a mirror cursor can never silently start or resume from the default/empty string. | Verified by unit tests: sink-kind variants round-trip through their wire name, cursor construction refuses an empty position for both kinds, advancing refuses an empty next-position, and a refused advance leaves the cursor's prior position unchanged. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b d833c1d987a6 crates/eg-types/src/mirror_sink.rs:111 crates/eg-types/src/mirror_sink.rs:121 crates/eg-types/src/mirror_sink.rs:130 crates/eg-types/src/mirror_sink.rs:138 crates/eg-types/src/mirror_sink.rs:147 |
| EG-DURABLE-KERNEL-R035.1 PgOperationalSurface and a fail-closed PgCompatibilityMatrix are typed Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**PgOperationalSurface and a fail-closed PgCompatibilityMatrix are typed.** `crates/eg-types/src/pg_operational_surface.rs` defines the closed set of required PostgreSQL operational surfaces (pg_dump, pg_restore, replication, pg_stat views, pg_locks, EXPLAIN, query cancellation, pooler transaction mode) and a matrix that starts fail-closed and refuses a parity check naming any surface not explicitly declared supported. | Verified by unit tests: every surface round-trips through its wire name, a fresh matrix reports every surface unsupported, a parity check is refused and names exactly the missing surfaces, and the check succeeds once every surface is declared. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b de5f096bc0fd crates/eg-types/src/pg_operational_surface.rs:105 crates/eg-types/src/pg_operational_surface.rs:131 crates/eg-types/src/pg_operational_surface.rs:140 crates/eg-types/src/pg_operational_surface.rs:153 |
| EG-DURABLE-KERNEL-R035.2 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define conditional-write intent through separate authorized MutationBatch graph endpoint. | Typed test shows conditional-write request/response structure and MutationBatch routing. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R035.3 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Link schema mapping and read compatibility with write authorization. | Served test maps external-app relational schema to graph edges and proves read consistency. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R035.4 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Route external-app mutations to authorized graph MutationBatch, never to projection tables. | Served test routing proves projections are never writable even with grants. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R035.5 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Deny projection writes and accept only graph MutationBatch paths. | Test shows write to projection table is refused even when caller has write grant. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R035.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** External app submits MutationBatch; authorized graph mutation is reflected immediately on projection read. | Integration test proves write-through: external app commits through MutationBatch, projection read shows the change, subsequent relational reads return consistent view. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R037 Workload classifier routes point operations around the SQL planner Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Workload classifier routes point operations around the SQL planner.** A workload classifier at every wire listener, including native, RESP, pgwire, MySQL, and MSSQL, routes point and data-structure operations to the native KvStore/GraphCore path without allocating a DataFusion session, while SQL statements route to the planner; the classification is cached per prepared statement. Split per the net-new rule (no classifier type existed on main): `.1` is the typed model. Rollup: LANDED only once every child is. | Verified by a route test confirming no DataFusion session is created for classified point/structure operations and a cache test confirming classification is reused for a repeated prepared statement. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 4ed831ced92f add3fe5b1d67 crates/eg-types/src/workload_class.rs:110 crates/eg-types/src/workload_class.rs:117 crates/eg-types/src/workload_class.rs:126 crates/eg-types/src/workload_class.rs:136 crates/eg-types/src/workload_class.rs:144 |
| EG-DURABLE-KERNEL-R038 KV namespaces declare an explicit, enforced durability class Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**KV namespaces declare an explicit, enforced durability class.** Each KV namespace or table declares a durability class of ephemeral, meaning in-memory with TTL and no durable log; async, meaning group commit with a measured loss window of at most 100 milliseconds; or sync, the default, meaning commit before acknowledgment. The declared class is visible and never silently downgraded, the measured loss window is exported, and authorization plus HMAC-protected keyspace isolation apply in every class. Split per the net-new rule (no `DurabilityClass` type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by kill-point tests per class and a measurement test confirming the exported async loss window stays within the declared bound. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 1ef84395fa69 2146c76bc6f8 |
| EG-DURABLE-KERNEL-R038.1 `DurabilityClass` is a typed enum with a declared loss-window bound and a refusal for an unrecognized name Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`DurabilityClass` is a typed enum with a declared loss-window bound and a refusal for an unrecognized name.** `crates/eg-types/src/durability_class.rs` defines `ephemeral`/`async`/`sync` as a closed enum (`sync` the default), exposes `Async`'s 100 ms loss-window ceiling, and parses a namespace's declared class name without ever silently downgrading an unrecognized one to a default. | Verified by unit tests: each class round-trips through its lowercase wire name, `sync` is the default, an unrecognized class name is refused (not downgraded), and a measured async loss window is accepted at/under 100 ms and refused over it. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 2146c76bc6f8 crates/eg-types/src/durability_class.rs:183 crates/eg-types/src/durability_class.rs:199 crates/eg-types/src/durability_class.rs:205 crates/eg-types/src/durability_class.rs:214 crates/eg-types/src/durability_class.rs:225 |
| EG-DURABLE-KERNEL-R038.2 The write path's durability selection: `write_plan`/`refuse_if_durable_log_write` are the one entry point a write admission calls Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**The write path's durability selection: `write_plan`/`refuse_if_durable_log_write` are the one entry point a write admission calls.** `DurabilityClass::write_plan` decides whether a write waits for its own durable commit and how wide a group-commit batch window it admits; `refuse_if_durable_log_write` refuses a durable (redb) log append on behalf of an `ephemeral` namespace, which declares none. The real storage-kernel write-admission call site threading these in is further work. | Verified by unit tests: `sync`'s plan waits with no batch window, `async`'s plan does not wait and batches within its declared loss window, `ephemeral`'s plan neither waits nor batches, an ephemeral durable-log append is refused, and sync/async durable-log appends are allowed. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1a1ef47cb448 crates/eg-types/src/durability_class.rs:251 crates/eg-types/src/durability_class.rs:259 crates/eg-types/src/durability_class.rs:267 crates/eg-types/src/durability_class.rs:275 crates/eg-types/src/durability_class.rs:284 |
| EG-DURABLE-KERNEL-R037.1 `WorkloadClass` is a typed classifier with a refusal for an unrecognized operation kind Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`WorkloadClass` is a typed classifier with a refusal for an unrecognized operation kind.** `crates/eg-types/src/workload_class.rs` defines `Point`/`Structure`/`Sql`, a `bypasses_sql_planner` predicate, and `classify` over a wire listener's declared operation-kind name, refusing any name no rule recognizes rather than defaulting it to either path. | Verified by unit tests: point and structure operation kinds classify and report they bypass the SQL planner, `sql` classifies and reports it does not, and an unrecognized operation-kind name is refused. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 4ed831ced92f crates/eg-types/src/workload_class.rs:110 crates/eg-types/src/workload_class.rs:117 crates/eg-types/src/workload_class.rs:97 |
| EG-DURABLE-KERNEL-R037.2 `route` is the one dispatch entry point a wire listener calls to decide whether to allocate a DataFusion session Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`route` is the one dispatch entry point a wire listener calls to decide whether to allocate a DataFusion session.** `route(operation_kind)` classifies the operation and returns a `DispatchRoute` whose `allocate_datafusion_session` field is the dispatcher's one gate — never re-derived per listener by comparing against `WorkloadClass::Sql` directly. Splicing this call into each of the five listeners' real dispatch loops is further work. | Verified by unit tests: point/structure operations route with no session allocation, `sql` routes with session allocation, and an unrecognized operation kind's classifier refusal propagates through `route`. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b add3fe5b1d67 crates/eg-types/src/workload_class.rs:126 crates/eg-types/src/workload_class.rs:136 crates/eg-types/src/workload_class.rs:144 |
| EG-DURABLE-KERNEL-R039 In-memory data structures rebuild from the redb durability log Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**In-memory data structures rebuild from the redb durability log.** Hash, sorted-set, list, and set structures are held in memory as working state for ephemeral and async namespaces, with redb as the sole durability log; native atomic primitives include INCRBY with expiry, SET NX EX, CAS-based leases, a token bucket, a bounded counter, and a work-claim operation. On recovery, the in-memory tier rebuilds entirely from the redb log, which remains the only durability authority. Split per the net-new rule (no structure/primitive durability-declaration type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by a concurrent linearizability test on the atomic primitives and a recovery test that rebuilds the in-memory tier from the redb log after restart. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 1ef84395fa69 a7372171174e |
| EG-DURABLE-KERNEL-R039.1 Every in-memory structure and atomic primitive is typed and structurally declares redb as its sole durability authority Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Every in-memory structure and atomic primitive is typed and structurally declares redb as its sole durability authority.** `crates/eg-types/src/atomic_primitive.rs` defines the closed data-structure and atomic-primitive kinds and a `DurabilityDeclaration` whose `redb_is_sole_authority` flag is always true by construction (not caller-settable), with `declare_all` enumerating every structure and primitive for a namespace. | Verified by unit tests: every kind round-trips through its wire name, a declaration always reports redb as sole authority regardless of subject or namespace, and `declare_all` covers every structure and primitive exactly once per namespace with no duplicates. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b a7372171174e crates/eg-types/src/atomic_primitive.rs:120 crates/eg-types/src/atomic_primitive.rs:161 crates/eg-types/src/atomic_primitive.rs:176 |
| EG-DURABLE-KERNEL-R039.2 Native control-lease consumption checks expiry inside its durable transaction Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Native control-lease consumption checks expiry inside its durable transaction.** Reuse the native record applier and its engine-owned mutation timestamp, sampled after the graph lock and preserved for replay. This does not claim a wall-clock check at physical commit. An active lease may become consumed only strictly before both expiry timestamps. At or after either deadline, return the existing conflict outcome without changing the row or revision. Revocation and explicit expiry remain legal after a deadline. The engine uses its mutation time and existing lease store. | The native-record dispatch test covers live consumption, exact and elapsed expiry, and unchanged rows on refusal. Row-applier tests cover single use and revocation after expiry. | requirement | EG-DURABLE-KERNEL | SPECIFIED | src/redb_store/work_item/control_lease/tests.rs:246 |
| EG-DURABLE-KERNEL-R039.3 Atomic pending-call envelope storage and consumption Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Atomic pending-call envelope storage and consumption.** A reserved control lease binds an immutable envelope to one claimed WorkItem. Registration checks native claim provenance, revision, live worker fence and metadata preimage. It writes a protected pending lease reference in the same transaction. Consumption checks native claim provenance, the exact envelope, the pending reference and the current WorkItem revision and metadata. It then consumes the lease and clears the reference atomically. The served pending kind also requires existing WorkItem-write authority; lease-write alone cannot mutate a WorkItem. A missing transition target refuses at the served precheck before dispatch, so concurrent registration cannot bypass kind authorization. Existing-row ordinary leases retain their behavior. Parent/child references are immutable caller provenance, not authenticated hierarchy. This storage primitive proves neither human approval nor permission to execute. | Native tests cover registration, single consumption, changed preimages, wrong tenant, stale fence, expiry and replay without partial row writes. Generated contracts expose the typed optional fields. | requirement | EG-DURABLE-KERNEL | SPECIFIED | crates/eg-types/src/control_lease/tests.rs:191 crates/eg-types/src/control_lease/tests.rs:225 src/redb_store/work_item/control_lease/tests.rs:424 src/redb_store/work_item/control_lease/tests.rs:452 src/redb_store/work_item/control_lease/tests.rs:477 |
| EG-DURABLE-KERNEL-R039.4 Atomic plan-bound pending consumption Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Atomic plan-bound pending consumption.** Registration may bind an exact plan lease preimage immutably to the pending envelope. The plan must be active, belong to the same tenant, and cover the pending lifetime. Its kind is deployment-configured. Consumption must present the identical registered pair; omission or substitution refuses. The native transaction checks plan revision, kind, grant and expiry before consuming both leases and clearing the WorkItem reference. Paired requests remain unavailable through the served handler until Arbora provides authority composition. This row owns storage only. Existing bounds limit each grant or metadata preimage to 64 KiB and each identifier or kind to 512 bytes. Pending lifetime cannot exceed 24 hours. Consumption changes exactly three rows in one transaction. The owner benchmark is `benches/redb_write_latency_bench.rs`; its paired-consumption scenario and measurements remain pending. Existing commit-path results do not prove paired-call performance. Unpaired records retain their storage behavior. No human approval or execution authority is implied. | Native tests cover three-row consumption, omitted or changed preimages, expiry, revocation and replay. Every refusal preserves all three rows. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 9cff8714dbf0 e4ca61b2ecc0 crates/eg-types/src/control_lease/tests.rs:237 src/redb_store/work_item/control_lease/tests/plan_consumption.rs:119 src/redb_store/work_item/control_lease/tests/plan_consumption.rs:154 src/redb_store/work_item/control_lease/tests/plan_consumption.rs:175 src/redb_store/work_item/control_lease/tests/plan_consumption.rs:229 |
| EG-DURABLE-KERNEL-R039.4.1 Functional plan-bound pending storage Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Functional plan-bound pending storage.** Implement the parent's immutable same-tenant plan preimage, bounded lifetime, exact registered-pair comparison and atomic three-row consumption. Preserve unchanged rows on omission, substitution, expiry, revocation or replay refusal. Preserve unpaired behavior. Paired served requests remain unavailable until Arbora authority composition exists. This child establishes no human approval, execution authority or performance result. | Native transaction tests and the served-entry refusal test pass. Generated contracts and codec artifacts match. Tests retain the parent's existing preimage and lifetime bounds. | requirement | EG-DURABLE-KERNEL | SPECIFIED | crates/eg-types/src/control_lease/tests.rs:237 src/redb_store/work_item/control_lease/tests/plan_consumption.rs:119 src/redb_store/work_item/control_lease/tests/plan_consumption.rs:154 src/redb_store/work_item/control_lease/tests/plan_consumption.rs:175 src/redb_store/work_item/control_lease/tests/plan_consumption.rs:229 |
| EG-DURABLE-KERNEL-R039.4.2 Paired-consumption performance qualification Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Paired-consumption performance qualification.** Extend `benches/redb_write_latency_bench.rs` with the parent's paired-consumption scenario. Measure the existing 64 KiB preimage, 512-byte identifier, 24-hour lifetime and three-row transaction bounds through the actual durable path. Report the benchmark configuration and measured commit-phase latency. This child remains pending; existing generic commit-path measurements do not establish paired-call performance. | The paired benchmark scenario and its reproducible measurement receipt exist. No latency threshold or measurement is asserted before that evidence. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R040 Pipelined requests commit as a single batch Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Pipelined requests commit as a single batch.** A RESP pipeline or a pgwire extended-protocol batch is admitted once and committed as a single group commit, returning the same number of ordered replies as requests in the batch. Split per the net-new rule (no batch-admission type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Verified by a test sending a pipelined batch and confirming one admission decision, one commit, and correctly ordered per-request replies. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 726ee0a3eadf crates/eg-types/src/pipeline_batch.rs:101 crates/eg-types/src/pipeline_batch.rs:112 crates/eg-types/src/pipeline_batch.rs:78 crates/eg-types/src/pipeline_batch.rs:92 |
| EG-DURABLE-KERNEL-R041 SQL plan cache keyed by statement digest and schema version Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**SQL plan cache keyed by statement digest and schema version.** The engine caches repeated parameterized SQL execution plans keyed by statement digest and schema version, and invalidates cached plans using the existing dependency clock rather than introducing a separate cache mechanism. Split per the net-new rule (no plan-cache type existed on main): `.1` is the typed model. Rollup: LANDED only once every child is. | Route and invalidation tests for the native plan cache (KG-14) confirm cache hits are deterministic to the digest and schema version and invalidate correctly when the dependency clock advances. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 88496b615981 aaf7113fe427 crates/eg-types/src/plan_cache_key.rs:142 crates/eg-types/src/plan_cache_key.rs:150 crates/eg-types/src/plan_cache_key.rs:157 crates/eg-types/src/plan_cache_key.rs:170 crates/eg-types/src/plan_cache_key.rs:178 |
| EG-DURABLE-KERNEL-R041.1 `PlanCacheKey`/`PlanCacheLookup` are a typed key and a pure lookup decision, refusing to reuse a plan whose schema version has gone stale Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`PlanCacheKey`/`PlanCacheLookup` are a typed key and a pure lookup decision, refusing to reuse a plan whose schema version has gone stale.** `crates/eg-types/src/plan_cache_key.rs` defines `PlanCacheKey { statement_digest: Digest256, schema_version: u64 }` and a `lookup` function returning `Hit`/`Miss`/`StaleSchema`, never silently reusing a candidate compiled for a different statement or an earlier schema version. | Verified by unit tests: a repeated statement under the same schema version hits, nothing cached misses, a schema-version advance reports `StaleSchema` with the cached version, a candidate for a different statement digest is treated as a miss, and the key is deterministic across separate digest computations of the same statement. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b aaf7113fe427 crates/eg-types/src/plan_cache_key.rs:142 crates/eg-types/src/plan_cache_key.rs:150 crates/eg-types/src/plan_cache_key.rs:157 crates/eg-types/src/plan_cache_key.rs:170 crates/eg-types/src/plan_cache_key.rs:178 |
| EG-DURABLE-KERNEL-R041.2 `PlanCache::prepare` is the one entry point a SQL statement handler calls at prepare time Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`PlanCache::prepare` is the one entry point a SQL statement handler calls at prepare time.** Generic over the compiled plan type, `prepare` reuses a cached plan on `Hit` without invoking the caller's compile closure, and compiles (then caches, replacing any stale entry) on `Miss`/`StaleSchema`. Splicing a call to it into the real pgwire/MySQL/MSSQL prepare handlers, and keying `schema_version` to the engine's existing dependency clock, is further work. | Verified by unit tests: a repeated `prepare` for the same digest and schema version does not invoke the compile closure a second time, and a schema-version advance invokes it again and replaces the stale cached plan rather than keeping both. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 88496b615981 crates/eg-types/src/plan_cache_key.rs:185 crates/eg-types/src/plan_cache_key.rs:207 |
| EG-DURABLE-KERNEL-R040.1 PipelineBatch and BatchCommitDecision are typed, proving one admission maps to exactly one commit with order-preserving replies Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**PipelineBatch and BatchCommitDecision are typed, proving one admission maps to exactly one commit with order-preserving replies.** `crates/eg-types/src/pipeline_batch.rs` defines a closed `PipelineProtocol` (RESP/pgwire-extended), a batch constructor that refuses an empty request list, and an `admit` function whose result always reports the exact request count and the replies in the exact original order. | Verified by unit tests: protocol variants round-trip through their wire name, constructing an empty batch is refused for both protocols, a non-empty batch constructs successfully, and admitting a multi-request batch reports the exact count with replies in the original order. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 726ee0a3eadf crates/eg-types/src/pipeline_batch.rs:101 crates/eg-types/src/pipeline_batch.rs:112 crates/eg-types/src/pipeline_batch.rs:78 crates/eg-types/src/pipeline_batch.rs:92 |
| EG-DURABLE-KERNEL-R042 Benchmark gate defines and proves performance superiority claims Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Benchmark gate defines and proves performance superiority claims.** A published benchmark suite must define each performance claim and publish its configuration. The suite covers the YCSB workloads A to F, TPC-C and LDBC SNB Interactive. It also covers one converged graph, vector, SQL and time-series workload. `.1` is the typed model. `.100` binds complete measured input-token throughput, per-query cost and startup exclusion to the benchmark claim. Children `.2` to `.6` define the cross-modal, KV-cache tiering, ingest and wire protocol benchmarks. Rollup: LANDED only once every child is. | The gate accepts a superiority claim only with its published configuration and a passing measured result. `.100` requires reproducible served arithmetic and refuses missing or incomparable measurements. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 1ef84395fa69 9eac21608e67 |
| EG-DURABLE-KERNEL-R042.1 `BenchmarkClaim` is a typed report record that is only accepted as a superiority claim when published with its configuration and a passing result Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`BenchmarkClaim` is a typed report record that is only accepted as a superiority claim when published with its configuration and a passing result.** `crates/eg-types/src/benchmark_claim.rs` names the five required comparisons, defines `BenchmarkClaim { comparison, configuration, measured_result, passed }`, and `accept_as_superiority_claim` refuses a missing configuration, a missing measured result, or a non-passing result — never accepting an incomplete or failing report as a claim. | Verified by unit tests: a published passing report is accepted; a missing configuration, a missing measured result, and a non-passing result are each refused with the specific reason. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 9eac21608e67 crates/eg-types/src/benchmark_claim.rs:101 crates/eg-types/src/benchmark_claim.rs:109 crates/eg-types/src/benchmark_claim.rs:118 crates/eg-types/src/benchmark_claim.rs:127 |
| EG-DURABLE-KERNEL-R043 MutationBatch is the sole persistent write envelope across stores Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**MutationBatch is the sole persistent write envelope across stores.** Every store member, including graph, table, KV and time series state, adopts MutationBatch as its persistent write envelope, using the owner manifest for a single admission decision and one idempotent terminal outcome instead of a store-specific write path. The read-only downstream graph change feed is specified by .100 and cannot introduce a second write path. | Restart/replay and mixed-member tests (KG-01) confirm every store member commits through the shared MutationBatch path with an idempotent terminal outcome. `.100` also proves feed events derive only from committed envelopes. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 1d83cf4b704f 1ef84395fa69 |
| EG-DURABLE-KERNEL-R044 Upload cursor identifiers are never reused after a restart Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Upload cursor identifiers are never reused after a restart.** Upload cursor identifiers in src/server/blob/mod.rs are never reused across a restart, because the blob store persists a high-water mark that recovery reads before issuing any new cursor. | A restart test in src/server/blob/store/tests.rs proves the upload cursor high-water mark survives a restart and cursor ids remain monotonic afterward. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 b43f33569dd4 src/server/blob/store/tests.rs:643 |
| EG-DURABLE-KERNEL-R045 A single owner-manifest lineage check governs format upgrades Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**A single owner-manifest lineage check governs format upgrades.** Format upgrades for durable storage layouts route through the one versioned owner-manifest lineage check and typed upgrade-refusal path; the SQL store no longer maintains its own separate offline upgrade routine outside that path. | Lineage golden fixtures and stale-binding negative tests (KG-03) confirm a format upgrade is accepted or refused only through the shared lineage check. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 94edcf341758 df476f0df010 crates/eg-storage/src/owner/sql_checkpoint_upgrade/tests.rs:192 |
| EG-DURABLE-KERNEL-R046 Polygon interior/touch predicates are correct for shared boundaries Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Polygon interior/touch predicates are correct for shared boundaries.** eg-geo's polys_interiors_meet in crates/eg-geo/src/predicates.rs correctly classifies touches, contains and within for identical polygons and polygons sharing only boundary edges, so boundary-only contact is never reported as interior overlap and identical polygons are reported as mutually containing rather than merely touching. | Unit tests in crates/eg-geo/src/predicates.rs cover identical polygons, coincident edges with a shared interior, and shared boundaries with interiors on opposite sides. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 b43f33569dd4 crates/eg-geo/src/predicates.rs:802 crates/eg-geo/src/predicates.rs:815 crates/eg-geo/src/predicates.rs:868 |
| EG-DURABLE-KERNEL-R047 Ring-buffer eviction test matches whole entry identifiers Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Ring-buffer eviction test matches whole entry identifiers.** The ring-buffer capacity test verifies that the oldest entry is evicted once the buffer exceeds capacity by matching each entry's full anchored identifier, including its trailing delimiter, instead of an unanchored substring that could also match unrelated surviving entries sharing a numeric prefix. | ring_buffer_evicts_oldest_when_over_capacity asserts on the anchored identifier and fails if a wrongly retained or wrongly evicted entry is present. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 a1bb9fb9503e src/raft/harness/trace_capture.rs:481 |
| EG-DURABLE-KERNEL-R048 Dispatch-ordering guard test reliably locates its target function Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Dispatch-ordering guard test reliably locates its target function.** The dispatch-ordering guard in tests/sql_catalog_sharing.rs locates dispatch_graph_op_inner regardless of its visibility modifier, and fails loudly with a distinct diagnostic when it finds zero matching definitions or more than one ambiguous match, instead of silently passing on an unmatched search. | check_graph_access_precedes_query_and_rdf_try_handle_in_dispatch exercises the zero-match and ambiguous-match failure paths and its real ordering assertion against the current dispatch pipeline. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 cfb0a1279595 tests/sql_catalog_sharing.rs:413 |
| EG-DURABLE-KERNEL-R049 Idempotent retry of CreateGraph and DeleteGraph succeeds Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Idempotent retry of CreateGraph and DeleteGraph succeeds.** A retried CreateGraph or DeleteGraph that was already committed is recognized as idempotent by replaying its stored receipt, rather than being refused as already-exists or not-found; deleting a graph purges receipts from any prior incarnation of that name so a later retry cannot replay a stale outcome. | Idempotent replay tests for CreateGraph and DeleteGraph (KG-01) confirm a repeated commit returns the original outcome instead of a conflicting error. `delete_purges_receipts_of_a_prior_incarnation` checks recreation and replay across restart. `control_maintenance_reused_label_admits_at_the_current_version` checks control claims against their in-transaction version. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1c6b4c961a40 1ef84395fa69 3c481565fe1c 94edcf341758 ceec54145720 src/server/mutation_batch/lifecycle_tests.rs:243 |
| EG-DURABLE-KERNEL-R050 Blob garbage collection enforces a grace period before deletion Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Blob garbage collection enforces a grace period before deletion.** Blob garbage collection in src/server/blob/store.rs deletes a committed, unreferenced blob only after it has aged past a configured grace period, rather than deleting it immediately once it becomes unreferenced. | Grace-period sweep tests in src/server/blob/store/tests.rs prove a blob is retained until the grace period elapses and deleted only afterward. | requirement | EG-DURABLE-KERNEL | VERIFIED | 19da6ec1bc9b 1ef84395fa69 b43f33569dd4 src/server/blob/store/tests.rs:370 |
| EG-DURABLE-KERNEL-R051 BlobRef and BlobUnref are holder-scoped and idempotent Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**BlobRef and BlobUnref are holder-scoped and idempotent.** BlobRef and BlobUnref in src/server/blob/store/holders.rs track reference counts per named holder and are idempotent, so repeating the same acquire or release operation for a holder does not change the count beyond its first effect. | A test proving a named holder's acquire and release are idempotent across distinct operations covers this behavior. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 b43f33569dd4 src/server/blob/store/tests.rs:677 |
| EG-DURABLE-KERNEL-R052 Outbox delivery is organized by semantic class topics Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Outbox delivery is organized by semantic class topics.** Outbox delivery publishes semantically distinct event classes on their own topics, consistent with the outbox's per-consumer cursor and attempt-accounting contract, so a consumer for one event class is not blocked or confused by unrelated classes sharing a stream. | Failing-head and successor replay tests (KG-05) confirm per-class topic separation does not change attempt accounting or replay correctness. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 94edcf341758 9871859d4e0c d2e4cff47c86 crates/eg-transaction/src/tests/outbox.rs:2308 |
| EG-DURABLE-KERNEL-R053 AVX2 kernel paths are exercised on AVX2-capable hardware Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**AVX2 kernel paths are exercised on AVX2-capable hardware.** The downsampling kernel's AVX2 code path is executed and its output compared against the scalar reference on hardware that actually supports AVX2 instructions, rather than relying solely on golden values captured on hardware without AVX2. | A correctness run on AVX2-capable hardware compares AVX2 kernel output against the scalar reference within tolerance. | requirement | EG-DURABLE-KERNEL | LANDED | 1ef84395fa69 a1bb9fb9503e |
| EG-DURABLE-KERNEL-R054 Placement and consensus routing tests pass after command sealing changes Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Placement and consensus routing tests pass after command sealing changes.** Raft placement-catalog state-machine routing binds plan identity and replay nonce correctly, and three-node cluster placement admin wire RPCs correctly move data across the cluster, unaffected by native command sealing changes elsewhere in dispatch. | placement_state_machine_binds_plan_identity_and_replay_nonce and placement_admin_wire_rpcs_move_data_across_a_real_three_node_cluster (KG-10) pass against a live multi-node cluster. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 b43f33569dd4 src/raft/placement_harness.rs:149 src/raft/tests.rs:1016 |
| EG-DURABLE-KERNEL-R055 Durable-store registry classifies every .redb literal in the codebase Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Durable-store registry classifies every .redb literal in the codebase.** server::persistence::durable_stores maintains an exhaustive classification of every .redb string literal in the workspace as either a real durable store or a non-persisting test fixture, so no on-disk store can go unregistered. | registry_covers_every_redb_store statically scans the workspace sources for .redb literals and fails if any literal is unclassified. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 c143146d7855 src/server/persistence/durable_stores.rs:627 |
| EG-DURABLE-KERNEL-R056 Mutation durability classification is correct under every feature build Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Mutation durability classification is correct under every feature build.** is_durable_mutation in src/mutation_apply.rs classifies which mutations are durable consistently whether the server is compiled with the full or slim feature profile, so a durability classifier never answers differently depending on which features are compiled in. | test-mutation-apply-full and test-mutation-apply-slim both exercise is_durable_mutation under each feature profile and must pass identically. | requirement | EG-DURABLE-KERNEL | VERIFIED | 00a38629d214 1ef84395fa69 5bf5b719de7e src/mutation_apply.rs:206 |
| EG-DURABLE-KERNEL-R057 Sealed record classes are protected by a create-only write guard Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Sealed record classes are protected by a create-only write guard.** Sealed, content-addressed record classes such as AnalysisSnapshot are protected by an engine-enforced write guard that permits creation but refuses any overwrite of an existing sealed record except through its owning operation, so a generic graph-node write cannot silently replace a sealed record. | A negative test proves a generic write is refused against an existing sealed record, and a positive test proves the owning operation can still update it. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 00a38629d214 1ef84395fa69 5c2ab50088c4 src/sealed_guard/tests.rs:56 tests/sealed_record_guard.rs:210 |
| EG-DURABLE-KERNEL-R057.1 Order-snapshot lifecycle with immutable-history and derivation-link acceptance Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Order-snapshot lifecycle with immutable-history and derivation-link acceptance.** Define order-snapshot lifecycle and promotion admission using existing sealed-record and transactional authorities. Add immutable-history tracking, derivation-link binding and veto/no-effects acceptance for promotion flow. Keep provider order submission in SDK governed writeback and host confirmation routed through GraphOS. | Verified by integration tests covering snapshot creation, atomic promotion, immutable history after promotion, derivation links and veto refusal. Test replay after restart. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R058 Source-batch publication waiter cancellation is deterministic Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Source-batch publication waiter cancellation is deterministic.** cancelling_publication_waiter_does_not_cancel_owned_commit in server::handlers::source_batch synchronizes explicitly rather than relying on sleeps or wall-clock deadlines, so its outcome does not depend on disk or scheduling latency. | The test passes repeatedly both in isolation and under heavy concurrent disk fsync contention. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 480766675bd1 src/server/handlers/source_batch/tests.rs:176 |
| EG-DURABLE-KERNEL-R059 Garbage collection preserves chunks shared with a direct reference Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Garbage collection preserves chunks shared with a direct reference.** Blob garbage collection's live-chunk set in src/server/blob/store/gc.rs includes chunks reachable through a direct reference, not only chunks named by a live upload manifest, so a chunk shared between a dead upload and a direct reference is never deleted. | Sweep tests in src/server/blob/store/tests.rs confirm a racing refcount sweep never deletes a live chunk and a chunk shared with a direct reference survives the manifest that named it. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1ef84395fa69 b43f33569dd4 src/server/blob/store/tests.rs:420 |
| EG-DURABLE-KERNEL-R060 Unsupported legacy graph-data layouts are not silently migrated Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Unsupported legacy graph-data layouts are not silently migrated.** An on-disk graph-data directory in a format version the engine no longer supports is not required to be read or migrated; the engine fails closed with a typed upgrade-required error instead of silently reinterpreting it, and recovery proceeds by starting a fresh store and re-ingesting source data. | A negative test feeds an unsupported on-disk layout and confirms the engine refuses with the named upgrade-required error rather than attempting an implicit migration. | requirement | EG-DURABLE-KERNEL | VERIFIED | 00a38629d214 1ef84395fa69 9bc78efe95b3 crates/eg-storage/src/owner/lineage_tests.rs:109 |
| EG-DURABLE-KERNEL-R061 Test threading avoids unbounded channels and dead-time joins Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Test threading avoids unbounded channels and dead-time joins.** source_batch's test helpers use bounded rendezvous channels and a bounded join with a deadline instead of an unbounded std::sync::mpsc::channel or an indefinite JoinHandle::join, consistent with this repository's disallowed-methods lint, and a condition that can only ever be true is checked as a compile-time constant assertion rather than a runtime assertion on constants. | clippy across the workspace with all features and targets enabled passes with zero violations of the disallowed-methods and assertions-on-constants lints in this module. | requirement | EG-DURABLE-KERNEL | LANDED | c143146d7855 |
| EG-DURABLE-KERNEL-R062 Abandoned uploads are reclaimed after an idle TTL Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Abandoned uploads are reclaimed after an idle TTL.** Blob garbage collection in src/server/blob/store/gc.rs reclaims uploads that have been idle past a configured default TTL defined in src/server/blob/store/policy.rs, rather than leaving abandoned uploads unreclaimed indefinitely. | The GC sweep test suite exercises the abandoned-upload TTL split and asserts the uploads-expired counter increments correctly. | requirement | EG-DURABLE-KERNEL | VERIFIED | 00a38629d214 b43f33569dd4 src/server/blob/store/tests.rs:549 |
| EG-DURABLE-KERNEL-R063 Version-2 control-state rows are lifted losslessly on read (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Version-2 control-state rows are lifted losslessly on read (rollup).** When an existing graph shard still stores version-2 control-state rows, the engine reads and lifts them to the current representation losslessly in place, rather than requiring an offline migration or dropping any of their fields. Split (2026-10-09): `.1` the schema-version plumbing that exists today, `.2` the missing lift-on-read behavior. | Lineage golden fixtures (KG-03) cover reading a version-2 control-state row and confirm the lifted representation is lossless against the original fields. | requirement | EG-DURABLE-KERNEL | SPECIFIED | f17f47ab300f |
| EG-DURABLE-KERNEL-R063.1 Schema-version fields exist and mismatches are refused, not lifted Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Schema-version fields exist and mismatches are refused, not lifted.** `eg-storage` carries `schema_version`/`store_schema_version` fields (e.g. `DIRECT_STATE_SCHEMA_VERSION` in `crates/eg-storage/src/direct_state/journal/mod.rs`, `STORAGE_KERNEL_SCHEMA_VERSION` checks in `crates/eg-storage/src/recovery/validate.rs`) that compare the stored version against the current one by strict equality and refuse a mismatch; there is no version-2-specific control-state row type and no lift-on-read code. The landed_in SHA previously recorded against this row (`f17f47ab300f`) is an unrelated schema-authority commit, not this feature. | Existing unit tests in `crates/eg-storage/src/direct_state/journal/mod.rs` and `crates/eg-storage/src/recovery/validate.rs` cover the strict-equality version check (refusal), not lifting. | requirement | EG-DURABLE-KERNEL | VERIFIED | ac32740601a8 crates/eg-storage/src/direct_state/tests/contract.rs:82 |
| EG-DURABLE-KERNEL-R063.2 Remaining scope: lossless lift-on-read for version-2 control-state rows Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Remaining scope: lossless lift-on-read for version-2 control-state rows.** Add a version-2 control-state row representation plus read-path code that, on encountering `schema_version == 2`, lifts the row to the current representation in place (preserving every original field) instead of refusing the mismatch as `recovery/validate.rs` does today — no offline migration step. | Lineage golden fixtures (KG-03) cover reading a version-2 control-state row and confirm the lifted representation is lossless against the original fields (the original R063 acceptance test, now bound to this child). | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R064 Compiled shape memoization is benchmarked against parsing per write Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Compiled shape memoization is benchmarked against parsing per write.** Memoizing the compiled validation-shapes union is evaluated against re-parsing shapes on every write, with a measured benchmark naming the workload and hardware, before the memoized path is adopted as a performance improvement. | A benchmark comparing memoized versus parse-per-write shape compilation reports a measured latency difference under the same methodology required for other performance claims. | requirement | EG-DURABLE-KERNEL | LANDED | bee3dd02e6ed |
| EG-DURABLE-KERNEL-R065 Signed dispatch commit recovers correctly after an ack-lost fault window Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Signed dispatch commit recovers correctly after an ack-lost fault window.** signed_dispatch_commit_fault_windows_recover_parent_once confirms that when an acknowledgment is lost during a fault window, transaction reconciliation recovers the parent operation exactly once rather than duplicating or dropping it. | The full facade test suite, including tests/txn_reconcile_ack_lost_retry.rs::signed_dispatch_commit_fault_windows_recover_parent_once, passes deterministically. | requirement | EG-DURABLE-KERNEL | VERIFIED | 57a12eb06632 c3daf5c4438c src/server/mutation_batch/commit/internal.rs:611 tests/txn_reconcile_ack_lost_retry.rs:573 |
| EG-DURABLE-KERNEL-R065.1 The transaction coordinator lane is disjoint from graph lanes Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**The transaction coordinator lane is disjoint from graph lanes.** A Commit serializes on its parent receipt id and then takes its graph lane. The engine keeps coordinator lanes in their own lock table, so the order is always coordinator, then graph. A parent id that hashes to its own graph's stripe can no longer re-enter one mutex and hang the Commit. | A unit test picks a parent id on the same stripe as `__commons__`. It acquires that coordinator lane while the `__commons__` graph lane is held. Repeated full-parallel facade runs of the server test suite finish with no hung test. | requirement | EG-DURABLE-KERNEL | VERIFIED | c3daf5c4438c src/server/mutation_batch/commit/internal.rs:611 |
| EG-DURABLE-KERNEL-R066 Published contract metadata matches BlobRef/BlobUnref idempotent behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Published contract metadata matches BlobRef/BlobUnref idempotent behavior.** The published method contract marks BlobRef and BlobUnref as idempotent, matching their actual holder-scoped idempotent implementation, so the contract metadata and runtime behavior do not disagree. | A contract-conformance check compares the declared idempotent metadata for BlobRef and BlobUnref against the holder-scoped idempotent behavior proven in their own tests. | requirement | EG-DURABLE-KERNEL | LANDED | b8814b4560d1 |
| EG-DURABLE-KERNEL-R067 Trace capture isolates each test's events from concurrent noise Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Trace capture isolates each test's events from concurrent noise.** Causal trace capture for Raft failure diagnosis is scoped per thread rather than kept in a single shared global ring buffer, so a failing cluster test's captured trace contains only its own events and is not evicted by unrelated concurrent tests' activity. | Raft trace-capture tests confirm a failing cluster's trigger event remains present in its own per-thread trace buffer under concurrent load. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1813f2b5190d 57a12eb06632 src/raft/harness/trace_capture.rs:601 |
| EG-DURABLE-KERNEL-R068 Channel-group leave returns its own result, not a replayed join result Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Channel-group leave returns its own result, not a replayed join result.** The admin saga handler in src/server/handlers/admin/saga.rs decodes a durable ResultPayload using its tagged representation rather than treating it as a plain JSON string, so a leave operation on a channel group returns its own outcome instead of incorrectly replaying a stored join result. | A join-then-leave-then-rejoin regression test for channel groups confirms each operation returns its own correct result. | requirement | EG-DURABLE-KERNEL | LANDED | cee22e5290b1 |
| EG-DURABLE-KERNEL-R069 Scrub cursor fixture reliably tests the no-key encryption state Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Scrub cursor fixture reliably tests the no-key encryption state.** The scrub-cursor-survives-reopen test saves and restores the shared encryption environment under its write lock and forces the no-key condition for its own fixture, so its expected sealed-without-key finding does not depend on whether an earlier test in the same run already provisioned the process-wide encryption key. | scrub_cursor_survives_reopen_and_the_walk_skips_nothing passes both in isolation and as part of the full combined test suite regardless of run order. | requirement | EG-DURABLE-KERNEL | VERIFIED | be291021dfdc src/server/persistence/redb_backend/scrub_api_tests.rs:81 |
| EG-DURABLE-KERNEL-R070 Operator command inspects and applies registered offline store upgrades Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Operator command inspects and applies registered offline store upgrades.** The server binary has one operator command with two verbs over a data directory. `inspect` reads the format of every store and writes nothing. Its exit status says one of four things. Nothing needs doing, or an upgrade is available. A store may be in a format this build neither opens nor upgrades. A store may also be unreadable. `apply` requires an explicit confirmation flag and refuses while an engine holds the directory. It runs each registered offline upgrade in place and keeps the existing rows. It stops at the first failure and leaves that store in its previous layout. It never writes a store it does not upgrade. A second run reports nothing to do. The upgrades come from one registry in the storage kernel, so a new upgrade is one entry. With automatic migration off (`EG-DURABLE-KERNEL-R070.1`), the engine refuses to start on a store that a registered upgrade applies to. The refusal carries the named format error of that store and the exact command to run. No other store state refuses startup this way. Any other failure of a lazily opened store stays local to that store. | Command tests run on disposable stores. Inspect on current stores reports nothing to do and writes nothing. Inspect on a registered predecessor reports an available upgrade. Apply upgrades graph-shard, Agent Library and SQL catalog predecessors and keeps the exact row bytes. A second apply is a no-op. Both verbs refuse while the engine lock of the directory is held. Apply without confirmation opens nothing. An undeclared or non-upgradable format is reported and stays byte-identical. A failed upgrade stops the run and leaves later stores untouched. Apply still upgrades a predecessor that an unclean shutdown left. The startup check and the ordinary store opens refuse a predecessor with the named error and the command. Storage-kernel tests prove that every registry entry is a declared predecessor. They also prove that each entry reaches the current layout exactly once. | requirement | EG-DURABLE-KERNEL | VERIFIED | 2d6a22cb9bb4 4dfe8b2f33e0 8dbb5bd9de53 c3827ffe4f44 d44e49b9d67c src/server/persistence/store_upgrade/auto_migrate_tests.rs:107 src/server/persistence/store_upgrade/auto_migrate_tests.rs:129 src/server/persistence/store_upgrade/auto_migrate_tests.rs:170 src/server/persistence/store_upgrade/auto_migrate_tests.rs:197 src/server/persistence/store_upgrade/auto_migrate_tests.rs:223 |
| EG-DURABLE-KERNEL-R070.1 The engine migrates an older supported store when it opens it Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**The engine migrates an older supported store when it opens it.** `src/server/persistence/store_upgrade/auto_migrate.rs` runs the registered upgrades of `EG-DURABLE-KERNEL-R070` through `apply_store`. `src/server_startup.rs:155` calls it right after the engine takes its exclusive directory lock, before any store opens. The function takes the held lock as a parameter. It writes a journal under `<data-dir>/.store-upgrade-staging` before the first upgrade and replaces it atomically after each one. Each upgrade is one atomic commit, so an interrupted run leaves every store in one layout. The next open finds the journal, classifies every store again and resumes. A second run on current stores writes nothing. Each step is logged and counted in `epistemic_graph_store_migration_steps_total{step,outcome}`. A declared predecessor with no upgrade is refused as `STORE_FORMAT_TOO_OLD`. A layout outside the lineage is refused as `STORE_FORMAT_TOO_NEW`. The engine writes neither of them. A graph shard in either state stops startup; another store keeps its own lazy-open refusal. `EPISTEMIC_GRAPH_STORE_AUTO_MIGRATE` is on by default. `false` turns migration off, and an unknown value is refused as `STORE_AUTO_MIGRATE_INVALID_SWITCH`. | `src/server/persistence/store_upgrade/auto_migrate_tests.rs` tests disposable predecessor stores. Migration under the held lock keeps the row bytes and clears the journal. A second run writes nothing. A run stopped after one store leaves the journal, and the next open resumes it. With the switch off, the old named refusal and command stay. A too-new shard and a too-old blob store are refused by code and stay byte-identical. The metric samples render. | requirement | EG-DURABLE-KERNEL | VERIFIED | 4dfe8b2f33e0 c3827ffe4f44 d44e49b9d67c src/server/persistence/store_upgrade/auto_migrate_tests.rs:107 src/server/persistence/store_upgrade/auto_migrate_tests.rs:129 src/server/persistence/store_upgrade/auto_migrate_tests.rs:170 src/server/persistence/store_upgrade/auto_migrate_tests.rs:197 src/server/persistence/store_upgrade/auto_migrate_tests.rs:223 |
| EG-DURABLE-KERNEL-R070.2 Hot-path proof: a previous-patch store migrates and serves at open Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof: a previous-patch store migrates and serves at open.** A previous-patch engine writes a store in place. This build opens it with no offline step and serves it. `ListGraphs` returns the commons and tenant graphs for the System identity. A second restart finds nothing to migrate. With the switch off, the engine exits with `GRAPH_SHARD_FORMAT_UPGRADE_REQUIRED` and the command, and `store-upgrade apply` still works. | `tests/test_store_auto_migrate.py` runs the served engine. The previous-patch leg runs when `EPISTEMIC_GRAPH_PREVIOUS_PATCH_BINARY` names that engine. | requirement | EG-DURABLE-KERNEL | VERIFIED | 2d6a22cb9bb4 c3827ffe4f44 d44e49b9d67c tests/test_store_auto_migrate.py:39 |
| EG-DURABLE-KERNEL-R071 Typed durable task-queue model (enqueue/claim/ack) with refusal tests Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Typed durable task-queue model (enqueue/claim/ack) with refusal tests.** `eg-types` defines `TaskEnqueue`, `TaskClaim` and `TaskAck` for the served durable task queue that replaces AU's Postgres and Kafka queue backends. A blank queue name, zero lease, ack of an unclaimed or expired lease, and a duplicate idempotency key each resolve to a typed refusal. Unblocks AU-SEMANTIC-R011.3 and AU-SEMANTIC-R011.4. | Unit tests wire-round-trip each type and assert each listed refusal. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R072 Served task-queue RPC over the durable outbox Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served task-queue RPC over the durable outbox.** One served RPC pair, `TaskQueueEnqueue`/`TaskQueueClaim`/`TaskQueueAck`, persists tasks in the durable outbox so an unacked claim redelivers after lease expiry and survives restart. Unblocks AU-SEMANTIC-R011.3 and AU-SEMANTIC-R011.4. | One integration test enqueues, claims, lets the lease lapse, reopens the store and re-claims the same task. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R073 Generated client method for the task queue Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Generated client method for the task queue.** The generated Python client exposes `task_queue_enqueue`, `task_queue_claim` and `task_queue_ack` from the Rust schema source. Unblocks AU-SEMANTIC-R011.3 and AU-SEMANTIC-R011.4. | A generated-client test calls each method against the served RPC and a generation check shows no hand-written drift. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R074 Served worker registry (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served worker registry (rollup).** Split into R074.1 (pure producer) and R074.2 (served integration); both are required. The engine serves a worker registry with register, heartbeat and expiry of typed `WorkerRecord`s. Unblocks AU-SEMANTIC-R011.5.1 (AU `worker_scheduler.py`). | One test registers a worker, lets the heartbeat lapse and asserts it is expired. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R074.1 Typed worker registry producer and pure lifecycle Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Typed worker registry producer and pure lifecycle.** `eg-types::worker_registry` owns capacity-bearing WorkerRegistration/WorkerRecord and deterministic register, heartbeat, live lookup and expiry transitions. Refuse invalid capacity, empty identity/lanes, zero or overflowing TTL, duplicate live registration, unknown/expired heartbeat and clock regression without mutation. No served surface claimed. | Native tests cover register/heartbeat/expiry at the exact deadline, serde capacity round trip, every refusal and re-registration after expiry. | requirement | EG-DURABLE-KERNEL | VERIFIED | e7b0f9f670c9 crates/eg-types/src/worker_registry.rs:191 crates/eg-types/src/worker_registry.rs:212 crates/eg-types/src/worker_registry.rs:257 crates/eg-types/src/worker_registry.rs:277 |
| EG-DURABLE-KERNEL-R074.2 Served worker registry integration Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served worker registry integration.** Depends on R074.1. Wire register, heartbeat and expiry through authenticated engine dispatch using the producer. Generate the wire/client contract and enforce tenant/principal ownership. | Served dispatch test registers capacity, heartbeats, advances the clock to expiry and verifies disappearance. Unknown, expired and cross-owner requests refuse. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R075 Reserved-worker admission decision Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Reserved-worker admission decision.** A served `AdmitWorkerTask` decision returns admit or a typed refusal, keeping reserved workers free for their lane. Unblocks AU-SEMANTIC-R011.5.1. | One test shows a non-reserved task refused when only reserved capacity remains. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R076 Scheduler config and lane floors (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Scheduler config and lane floors (rollup).** `SchedulerConfig` with per-lane minimum worker floors is a typed served setting; a floor sum above total workers is refused. Split producer-first per SPEC-SIZING into R076.1 (pure contract) and R076.2 (served integration); both must be delivered. Unblocks AU-SEMANTIC-R011.5.1 only after R076.2. | Pure-model tests plus served setting/admission tests; R076.1 alone does not satisfy this parent. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R076.1 Authoritative scheduler config model and refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Authoritative scheduler config model and refusal.** `eg_types::scheduler_config::SchedulerConfig` carries explicit `total_workers`, `max_queue_depth`, per-lane floors, `cores_per_mille` default 360 and `memory_per_worker_bytes` default 3 GiB (EG-PLACEMENT-R002.2). Validation refuses over-subscribed floors without integer overflow, blank lanes, CPU shares above 1000 and zero memory per worker. Zero workers, CPU share or queue depth explicitly disables that resource. | Native tests round-trip real serde defaults/overrides; cover exact/over-subscribed floors, overflow, bounds and malformed wire fields. | requirement | EG-DURABLE-KERNEL | VERIFIED | 57050996421e crates/eg-types/src/scheduler_config.rs:112 crates/eg-types/src/scheduler_config.rs:127 crates/eg-types/src/scheduler_config.rs:142 crates/eg-types/src/scheduler_config.rs:155 crates/eg-types/src/scheduler_config.rs:169 |
| EG-DURABLE-KERNEL-R076.2 Serve and consume validated scheduler settings Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Serve and consume validated scheduler settings.** Expose R076.1 through the authoritative engine setting path, validate configured lane membership against the engine lane registry, and use it for admission and queue limits without worker-local policy. Preserve scope and refusal behavior. Depends on R076.1 and the served registry/admission surfaces R074/R075. | Served read/update and claim tests prove rejected settings have no effect and accepted floors/limits govern admission; remains unimplemented by the pure model. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R077 Shard-writer width served by the scheduler surface Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Shard-writer width served by the scheduler surface.** The engine serves the current shard-writer width as a typed read that the scheduler uses to size write lanes. Unblocks AU-SEMANTIC-R011.5.1. | One test reads the width for a multi-shard tenant and asserts it matches the configured writers. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R078 Bitemporal stamping served method Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Bitemporal stamping served method.** A served method stamps valid-time and transaction-time on a written fact and refuses an inverted valid interval. Replaces AU `knowledge_graph/core/bitemporal.py`; unblocks AU-SEMANTIC-R011.8.1. | Unit test asserts both stamps and the inverted-interval refusal. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R079 Served as-of filtering Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served as-of filtering.** A served as-of read returns only facts valid and recorded at the requested instants. Unblocks AU-SEMANTIC-R011.8.2. | One test writes superseded versions and asserts as-of returns the right version at two instants. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R080 Served supersession Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served supersession.** A served supersede method closes the prior fact's interval and links the successor atomically; superseding an already-closed fact is refused. Split into `.1` (atomic refusal for missing successor endpoints) and `.2` (already-closed-fact refusal and served integration coverage). The parent remains open until both children are verified. Unblocks AU-SEMANTIC-R011.8.3. | One test supersedes twice and asserts the refusal and the closed interval. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R080.1 Supersession refuses a missing successor endpoint without closing the prior fact Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Supersession refuses a missing successor endpoint without closing the prior fact.** The existing served `SupersedeEdge` path validates both successor endpoints under its topology write guard before changing the prior validity or transaction interval. This is the atomic-refusal child of R080; already-closed-fact refusal and served end-to-end verification remain open. | A GraphCore regression exercises missing source and missing target, verifies byte-identical prior properties and no successor on refusal, then creates the missing endpoint and proves retry closes both prior intervals and inserts the successor. | requirement | EG-DURABLE-KERNEL | VERIFIED | 35cab6a7f65f crates/eg-core/tests/edge_supersession.rs:21 |
| EG-DURABLE-KERNEL-R080.2 Served supersession refuses an already-closed fact and proves the atomic history transition Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served supersession refuses an already-closed fact and proves the atomic history transition.** Complete the existing `SupersedeEdge` handler's prior-fact lifecycle guard and successor provenance contract, preserving the original intervals and refusing repeated supersession without inserting another successor. | A served-RPC integration test supersedes a fact, verifies both closed prior intervals and the linked successor, then supersedes the closed fact again and asserts refusal with unchanged history. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R081 Generated client methods for bitemporal operations Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Generated client methods for bitemporal operations.** The generated client exposes stamp, as-of and supersede methods. Unblocks AU-SEMANTIC-R011.8.4. | A generated-client test exercises each method end to end. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R082 Analytics worker parity: association-rule mining jobs run on the engine's own durable job plane Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Analytics worker parity: association-rule mining jobs run on the engine's own durable job plane.** Rollup over `EG-DURABLE-KERNEL-R082.1`+. Replaces agent-utilities `analytics_worker.py` (commit 92974bae8, AU-SEMANTIC-R011.10), the `graph-os-analytics-worker` console script. That worker claimed `MineAssociate` jobs from the existing `eg-jobs` plane, mined association rules in Python, staged a typed result and asked the engine to publish it. The engine already provides every part except the verification that its colocated executor matches the old worker's governed behaviour: `src/server/handlers/jobs/executor_loop.rs` runs a bounded in-process worker pool that claims `mining.association` jobs, and `crates/eg-jobs` and the generated `JobsClient` already carry claim, renew, checkpoint, stage, publish, fail and cancel. The generic task queue in `EG-DURABLE-KERNEL-R071` to `R077` is a separate surface and is not a prerequisite for this path. Ownership: the engine owns execution through its colocated pool, so no separate worker process is needed for mining; see the architecture section 'Analytics worker carry-over'. | Each child below has its own named test; the rollup is verified when all children are verified. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R082.1 A submitted `MineAssociate` job is claimed and published by the colocated executor with no external worker Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**A submitted `MineAssociate` job is claimed and published by the colocated executor with no external worker.** `src/server/handlers/jobs/executor_loop.rs` already starts `EG_ANALYTICS_WORKERS` slots (default 1, capped at 32) that claim `mining.association` and `pool:default`. This row adds the missing end-to-end proof: submit, run, observe `Succeeded`. Replaces the old worker's claim and publish loop. | One server integration test in `src/server/handlers/jobs/graph_tests.rs` submits a `MineAssociate` job with a small transaction set and asserts the job reaches `Succeeded` with a non-empty result and no external worker connected. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R082.2 `MineAssociate` submission refuses a payload outside the governed schema Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`MineAssociate` submission refuses a payload outside the governed schema.** The old worker failed a job with reason `invalid_payload` for: transactions not a list of lists of strings, `min_support` or `min_confidence` non-finite or outside 0 to 1, or an algorithm outside apriori, fpgrowth (also fp-growth, fp_growth) and eclat. Defaults were support 0.1, confidence 0.5, algorithm fpgrowth. `src/server/handlers/jobs/submit.rs` validates at submit; this row verifies parity and fixes any gap. | A table-driven test in `src/server/handlers/jobs/graph_tests.rs` submits one payload per refusal listed above and asserts a typed refusal each, plus one accepted payload using the defaults. | requirement | EG-DURABLE-KERNEL | VERIFIED | 839c2e0d1ee2 src/server/handlers/jobs/graph_tests.rs:145 src/server/handlers/jobs/graph_tests.rs:170 src/server/handlers/jobs/graph_tests.rs:245 |
| EG-DURABLE-KERNEL-R082.3 Distinct-item cap and opaque-reference rule are decided and enforced at submit Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Distinct-item cap and opaque-reference rule are decided and enforced at submit.** The old worker required every item to be an opaque reference starting with `eg:` and refused more than 31 distinct items, which bounded subset enumeration. It was not determinable from the source whether the engine kernel needs the same cap. This row records the decision in `src/server/handlers/jobs/submit.rs` as a named constant and enforces it. | A test submits a payload with a non-opaque item and a payload over the cap and asserts a typed refusal for each; a payload at the cap is accepted. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R082.4 Association-rule identity is byte-identical to the old worker's Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Association-rule identity is byte-identical to the old worker's.** The id is `eg:rule:` followed by the sha256 of the prefix `eg-jobs.association-rule.v1` and a zero byte, then for antecedent and consequent a little-endian u64 count and length-prefixed utf-8 items, then little-endian f64 support, confidence and lift. Row ids must not change across the carry-over, because published claims are keyed by them. Code root: `src/server/handlers/jobs/results_association.rs`. | A golden-vector test hashes one fixed rule and asserts the digest recorded in the test, taken from the deleted Python implementation. | requirement | EG-DURABLE-KERNEL | VERIFIED | 63d041e21850 src/server/handlers/jobs/results_association.rs:101 |
| EG-DURABLE-KERNEL-R082.5 The staged result has the 11-column knowledge-batch shape Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**The staged result has the 11-column knowledge-batch shape.** Columns: id, kind, confidence, evidence_refs, source_refs, proof_ids, contradiction_ids, antecedent, consequent, support, lift. Each row's evidence and source refs are the input dataset ref. The result dataset ref is `eg:knowledge_batch:` plus a sha256 over the schema and rows. Uncertainty is the mean of one minus confidence, calibration is the min and max of support times confidence, and the reproducibility block carries the input digest, snapshot version, algorithm ref, params digest, code and environment versions and policy fingerprint. Code root: `src/server/handlers/jobs/results_association.rs` and `native_validation.rs`. | A test runs one job and asserts the column list, the evidence refs, the digest recomputed from the rows, and each reproducibility field. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R082.6 Rules are ordered and thresholded exactly as before Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Rules are ordered and thresholded exactly as before.** Minimum count is ceil(min_support times transaction count), at least 1. A rule is kept when confidence is at least min_confidence within 1e-12. Lift is confidence over consequent support, 0 when that is 0. Rules sort by confidence, lift, support descending, then first-seen interned antecedent and consequent IDs ascending. Code root: `crates/eg-compute/src/mining`. | A fixture test mines a fixed 6-transaction set and asserts the ordered rule list equals the list recorded from the deleted implementation. | requirement | EG-DURABLE-KERNEL | VERIFIED | 157e0a8e97a3 a35b312dbd40 crates/eg-compute/src/mining/association/parity_tests.rs:4 crates/eg-compute/src/mining/association/parity_tests.rs:47 |
| EG-DURABLE-KERNEL-R082.7 A running mining job observes cancellation, deadline and CPU budget Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**A running mining job observes cancellation, deadline and CPU budget.** The old worker polled job status every min(5 s, lease over 3) and cancelled the kernel with reason `kernel_cancelled` (acknowledged as cancelled), `deadline_exceeded` or `cpu_budget_exceeded` (both failed), renewing the lease otherwise. Verify the native executor stops cooperatively for all three. Code root: `src/server/handlers/jobs/executor_claim.rs`. | Three tests with a long-running synthetic kernel: cancel request, past deadline and tiny cpu budget each end in the matching terminal state, and no lease renewal happens after the stop. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R082.8 Failure codes and retry follow the durable retry policy Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Failure codes and retry follow the durable retry policy.** The old worker reported only the bounded codes `invalid_payload` and `kernel_failure` (plus the stop reasons above) and never logged payloads, endpoints or identity; retry and backoff were the server's `RetryPolicy` (`max_attempts`, `backoff_ms`). Verify the native executor uses `worker_execution_failed`-style bounded codes only and that a failed attempt becomes eligible again only after its backoff. Code root: `src/server/handlers/jobs/executor_loop.rs`. | A test fails a kernel twice, asserts the attempt count, that the retry is not claimable before the backoff elapses, and that no failure record contains payload text. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R082.9 Colocated pool lease and poll interval are configurable Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Colocated pool lease and poll interval are configurable.** The old worker took slots 1 to 64, lease 5000 to 300000 ms (default 60000) and poll 0.05 to 30 s (default 0.25) from `EG_ANALYTICS_WORKER_SLOTS`, `EG_ANALYTICS_WORKER_LEASE_MS` and `EG_ANALYTICS_WORKER_POLL_SECONDS`. The native pool fixes the lease at 60000 ms and the poll at 250 ms and caps slots at 32. This row adds validated `EG_ANALYTICS_LEASE_MS` and `EG_ANALYTICS_POLL_MS` with the old ranges, refusing out-of-range values at startup. Depends on EG-DURABLE-KERNEL-R076 for the shared scheduler configuration shape. Code root: `src/server/handlers/jobs/executor_loop.rs`. | A config test accepts values at both range ends and refuses one below and one above each range. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R082.10 Remote workers remain supported through the existing coordinator operations Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Remote workers remain supported through the existing coordinator operations.** `EG_ANALYTICS_WORKERS=0` leaves execution to authenticated remote workers using claim, renew, checkpoint, stage, publish, fail and cancel, claimed by capability (the old default set was `mining.association` and `pool:default`, at most 64 capabilities of at most 128 characters, no control characters). Service principal requires scope `analytics:worker`, already listed in `crates/eg-capabilities/src/scopes.rs`. This row proves the path without the deleted worker using the generated `JobsClient`. | A test with the colocated pool at zero drives the full worker sequence through `JobsClient`, and a worker without scope `analytics:worker` is refused. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R082.11 Cross-repo: graph-os hosts any remote worker process; agent-utilities does not Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Cross-repo: graph-os hosts any remote worker process; agent-utilities does not.** Owner repository: graph-os. Only if a deployment needs mining capacity beyond the engine pods, graph-os deploys a thin entry point that loops `JobsClient.worker_claim` and executes a kernel it ships; it must not embed a second copy of the mining kernel unless R082.6 golden tests run against it too. agent-utilities keeps no worker, console script or kernel. This row is a dependency marker, not engine work, and has no engine deliverable. | Recorded as satisfied by the engine rows above; graph-os links this row by ID if it ever adds the entry point. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R083 Shared versioned KV-cache tier (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Shared versioned KV-cache tier (rollup).** The engine's `eg-kvcache` tier must serve model KV-cache blocks to parallel consumers under content-addressed, model-versioned keys. A capacity budget must evict by recency and graph importance. A model-version mismatch must refuse the block. Children `.5` to `.8` cover the tier ladder, graph-guided paging, long-context coherence and tier refusals. | Tests prove two consumers share one block, a version mismatch refuses, and an over-budget insert evicts the coldest block. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R083.1 `KvBlockKey` typed model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**`KvBlockKey` typed model.** `crates/eg-kvcache/src/version.rs` must define `KvBlockKey` from model id, model version and token-prefix hash. | Unit test shows equal prefixes give equal keys and a different model version gives a different key. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R083.2 Version-mismatch refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Version-mismatch refusal.** `crates/eg-kvcache/src/shared.rs` must refuse a read whose model version differs from the stored block version, returning a typed error. | Unit test stores under version 1 and refuses a version 2 read. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R083.3 Budgeted eviction by importance Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Budgeted eviction by importance.** `crates/eg-kvcache/src/tiered.rs` must evict the lowest recency-and-importance block when the byte budget is exceeded, using `graph_importance.rs`. | Unit test inserts three blocks over budget and asserts the coldest is evicted. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R083.4 Locate and wire the served KV operation Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Locate and wire the served KV operation.** The first step must locate the served cache operations and expose get and put for `KvBlockKey`. Inference-side injection is an agent-utilities handoff. | Served-op test puts a block from one client and gets it from another. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R084 Version-checked concurrent writes with a typed conflict (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Version-checked concurrent writes with a typed conflict (rollup).** EG must serialize concurrent writers to one graph state by a version check. A losing writer must receive a typed conflict or a configured merge. Last-write-wins must never happen silently. | Tests prove a stale writer is refused, a merge strategy resolves a declared conflict, and the loss is never silent. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R084.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** `crates/eg-types/src/write_conflict.rs` must define `WriteConflict{expected, actual, scope}` and the closed `MergeStrategy` set `Refuse`, `PreferNewer`, `FieldUnion`. The default must be `Refuse`. | Unit test round-trips both types and asserts the default. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R084.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** `resolve_conflict(conflict, strategy, base, incoming)` must return a merged value or the conflict. The strategy must come from scope configuration. | Unit test resolves one conflict under each strategy. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R084.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** The version check built at `crates/eg-jobs/src/store.rs:2537` must call `resolve_conflict` when the stored version differs. Its production caller is the served `ApplyMutation` wire method. | Test writes with a stale version and asserts the resolver ran. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R084.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** With `Refuse`, the write must return `WRITE_CONFLICT` carrying expected and actual versions. No state may change. | Test asserts the refusal code and an unchanged readback. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R084.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Every resolved or refused conflict must emit `conflict_scope`, `strategy` and `winner` in the mutation trace. | Test reads the trace after one refusal and one merge. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R084.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** The entry point is the served `ApplyMutation` wire method. Two clients write against the same version and exactly one commit must win. | Integration test `tests/write_conflict_two_writers.rs` asserts one commit, one typed conflict and no silent overwrite. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085 Versioned memory synchronization (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Versioned memory synchronization (rollup).** EG owns memory content, versions, conflict decisions and synchronization evidence. GraphOS owns hosted file materialization. AU consumes EG decisions. This contract supports versioned documents without assigning filesystem authority to EG. | All eight children require their planned evidence. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define bounded memory snapshot, list cursor, sync request and outcome types. Use the exact fields and validation rules in the R085 design. Reuse Digest256, verified Request context and MutationScopeIdentity. Use tagged outcomes: authorized head-bearing results and a redacted refusal without head fields. New wire names are proposals until generated and served. | Planned: tests/memory_sync_contract.rs::bounded_contract_round_trips_and_refuses_invalid_fields. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.2 Versioned reads and listing Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Versioned reads and listing.** Read one authorized revision or list a stable snapshot with bounded pagination. Bind cursors to tenant, graph incarnation, principal, policy and filters. Never reveal hidden identifiers, counts or hashes. Expired cursors require an explicit restart. | Planned: tests/memory_sync_served.rs::authorized_read_list_and_cursor_isolation. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.3 Sync decisions and compare-and-set Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Sync decisions and compare-and-set.** Evaluate observe_file, submit, resolve and acknowledge actions against the durable document head. Atomically accept one matching-base candidate. Preserve both versions for an authorized stale submission without changing the accepted head. Resolve only against the current head and retained conflict. Repeated request identities return the original outcome. | Planned: tests/memory_sync_served.rs::competing_saves_retain_both_and_resolve_once. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.4 Production wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Production wiring.** Add the proposed read/list methods to authenticated graph dispatch. Route sync mutations through the existing gateway and canonical MutationBatch compiler. Commit content references, head, conflict receipt and outbox evidence together. Regenerate public method, result and client contracts. No direct GraphCore write may bypass durable admission. | Planned: tests/memory_sync_served.rs::wire_methods_reach_durable_gateway. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.5 Authority and refusals Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Authority and refusals.** Derive tenant, principal, graph and policy from verified request context. Check authority before lookup, cursor use, materialization acknowledgment or retention changes. Reject cross-scope references, malformed versions, digest mismatch and unavailable storage before effects. Unauthorized calls leave all durable records and holders unchanged. Denied existing and absent documents have indistinguishable results, including creation attempts. Refused creation needs no head metadata. | Planned: tests/memory_sync_served.rs::denied_and_malformed_requests_have_no_effects. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.6 Provenance and synchronization evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Provenance and synchronization evidence.** Persist the verified actor, policy, request identity, parent revision, content digest and committed outcome. Separate accepted content from a host materialization acknowledgment. EG reports in_sync only after an authorized acknowledgment matches the current revision, digest and observation generation. Pending edits and unresolved conflicts prevent in_sync. Missing evidence yields unavailable. | Planned: tests/memory_sync_served.rs::provenance_and_materialization_ack_survive_restart. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.7 Retention Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Retention.** Retain accepted and submitted conflict contents with their digests and provenance across restart. Use existing named blob holders and garbage-collection rules. Unresolved conflicts cannot expire automatically. Refuse before effects when configured retention capacity is exhausted. Release resolved history only through authorized policy after its retention deadline. | Planned: tests/memory_sync_served.rs::conflicts_survive_gc_and_retention_refusal. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.8 Real served acceptance Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Real served acceptance.** Start a real authenticated engine with disposable durable storage and two independent clients. Prove read/list, competing saves, conflict retention, resolution and materialization acknowledgment. Restart and read the durable records independently. Include cross-tenant, wrong-graph, stale-cursor, denied-writer and replay negatives. Do not mock transport, dispatch, authorization or persistence. | Planned: tests/memory_sync_served.rs::complete_memory_sync_journey. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086 Safe eviction and durable read-through (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Safe eviction and durable read-through (rollup).** Define the existing node-residency contract without changing storage, APIs or dependency direction. Preserve R039 recovery acceptance. All nine children require evidence; a resident read or index reopen alone cannot close this rollup. | Planned: tests/safe_eviction_read_through.rs::served_safe_eviction_read_through_journey. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Describe resident properties, durable presence, genuine absence and unavailable durability through existing GraphCore, ReadThrough and PersistenceBackend contracts. Bind observations to graph and node identity. Distinguish backend `Result<Option<Vec<u8>>>` from adapter `Option<Vec<u8>>`; None alone does not prove durable absence. | Planned: tests/safe_eviction_read_through.rs::read_through_model_outcomes. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086.2 Behavior: memory-only eviction Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior: memory-only eviction.** At GraphCore::evict_resident_nodes, remove only selected resident projections. Preserve durable node bytes and logical records. The primitive does not prove durability; its production callers own that guard. Retaining unconfirmed nodes may leave residency above the requested cap. | Planned: tests/safe_eviction_read_through.rs::selected_residents_leave_durable_rows_unchanged. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086.3 Behavior: cache-miss read Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior: cache-miss read.** GraphCore::get_node_properties serves resident bytes first, then consults its installed read-through on a miss. Release the seam lock before storage access. Serve durable bytes without repopulating RAM. A Bloom negative may suppress storage access only after the durable identity set is complete. | Planned: tests/safe_eviction_read_through.rs::evicted_blob_reads_without_resident_growth. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086.4 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Reuse src/main.rs:1547 and crates/eg-core/src/registry.rs:553 to install the facade factory for recovered and future graphs. Follow src/server/persistence/read_through.rs:38 to the existing scoped redb read. Verify the production eviction callers listed in the plan; introduce no second persistence path or lower-layer dependency. | Planned: tests/safe_eviction_read_through.rs::startup_attaches_graph_scoped_read_through. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086.5 Scoped reads Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Scoped reads.** At src/server/handlers/graph_ops/nodes.rs:85, preserve graph authority and row visibility when the filtered projection falls back to the raw core. At src/redb_store/store_read.rs:336, read the graph-scoped NODES table. Equal node IDs in separate graphs must not cross scopes; hidden rows must not leak through the fallback. | Planned: tests/safe_eviction_read_through.rs::served_evicted_reads_preserve_scope. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086.6 Refusal: unsafe eviction Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal: unsafe eviction.** Existing eviction callers retain candidates when persistence is absent, a presence lookup errors, or its positional result has the wrong length. A false entry retains that candidate. Do not treat an unconfirmed node as durable or report a cap as reached when nodes remain. | Planned: tests/safe_eviction_read_through.rs::production_eviction_retains_unconfirmed_candidates. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086.7 Refusal: unavailable reads Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal: unavailable reads.** Record current adapter behavior: a backend error produces a warning and None, without fabricated bytes. Distinguish this from a successful backend absence lookup in evidence. This definition creates no typed public error and does not credit a logged miss as successful recovery. | Planned: tests/safe_eviction_read_through.rs::backend_failure_is_not_absence_evidence. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086.8 Restart Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Restart.** After acknowledged writes and actual eviction, restart the real engine on the same durable directory. Use normal startup wiring and request authority. Prove a fresh nonresident lookup and compare exact committed properties. Eager recovery into RAM alone cannot prove post-restart read-through. | Planned: tests/safe_eviction_read_through.rs::restarted_engine_reads_an_evicted_node. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R086.9 Evidence and hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence and hot-path proof.** Enter through authenticated EvictLRU and GetNodeProperties. Observe src/server/handlers/graph_ops/gateway_graph.rs:111 and src/server/handlers/graph_ops/nodes.rs:85, then the real durable lookup. Retain source and binary identity, scope, write acknowledgment, residency, backend outcome and restart observations. Mocks, source inspection and unrelated receipts cannot close this rollup. | Planned: tests/safe_eviction_read_through.rs::served_safe_eviction_read_through_journey. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R087 Semantic changeset review with evidence-backed findings Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Semantic changeset review with evidence-backed findings.** (rollup) Define semantic changeset review across injection, auth bypass, data exposure, cryptography and business logic. Specify five flaw classes, impact/filter policy, finding-to-code evidence, and exact route from probe scorer to GraphOS changeset-review endpoint. Name authenticated producer/consumer edge and positive/negative served acceptance. R138.3 plans ProbeVerdict through served Decide/handle_decide and AgentLibraryStore. This rollup separates that from probe-score selection. | Verified by split `.1` (model definition) and `.2` (served integration) children. Each covers its scope without conflating probe selection with changeset review. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R087.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** `crates/eg-types/src/changeset_review.rs` defines the five flaw classes, impact/filter policy and finding-to-code evidence types. A changeset request names graph mutation and reviewer scope. A finding binds flaw class, severity, evidence reference and location. | Unit tests round-trip types and assert each flaw class. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R087.2 Served integration Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served integration.** Route served `ChangesetReview` request through authenticated producer to EG review handler and back to GraphOS consumer endpoint. Regenerate public method and client contracts. Serve both accept and reject outcomes with typed evidence. | Served test exercises all five flaw classes, verifies positive/negative acceptance, and traces output to code locations. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R088 Behavioral rule correction lifecycle with versioned approval Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavioral rule correction lifecycle with versioned approval.** (rollup) Extend rule proposal/promotion authority with exact correction/output lineage, approved version and replacement/revocation binding. Reuse existing EG-DECISION-ENGINE-R129 promotion authority and AU-DECISIONS rule storage. Do not equate invariant compliance with approval. | Verified by split `.1` (model definition) and `.2` (served integration) children. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R088.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** `crates/eg-types/src/rule_correction.rs` defines correction with original output reference, approved version and replacement/revocation binding. A correction binds rule ID, input pattern and expected output. An approval names two distinct principals and carries an approval timestamp. | Unit tests assert two-principal requirement and replacement/revocation states. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R088.2 Served integration Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served integration.** Wire correction submission and approval through existing rule authority. Check both principals before applying replacement or revocation. Return typed refusal if one principal is repeated. Preserve original invariant checking separate from approval flow. | Served test covers two-principal approval, replacement application, revocation blocking and audit trail. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R089 Step verification verdict with proof binding Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Step verification verdict with proof binding.** (rollup) Define a step verification verdict with uncertainty/proof binding. Consumer must refuse failed dependent conclusions. Link EG evidence authority to AU execution. Establish verification contracts for every reasoning step. | Verified by split `.1` (typed verdict) and `.2` (consumer refusal) children. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R089.1 Typed verdict Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Typed verdict.** `crates/eg-types/src/step_verdict.rs` defines VerificationVerdict with success/failure state, uncertainty bound and proof reference. Bind step identity and reasoning output hash. | Unit tests cover both states, bounds validation and proof reference round-trip. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R089.2 Consumer refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Consumer refusal.** Serving AU execution path checks verdict state before accepting conclusion derived from that step. A failed step refuses all dependent forward-chained conclusions. Preserve existing AU harness integration with EG evidence. | Served test writes one failed step and verifies dependent conclusion refusal. Verify halt of forward chains at failure. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R090 Operator-selected schema import with digest provenance Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Operator-selected schema import with digest provenance.** (rollup) Link GraphOS deployment selection to approved EG schema import and served digest readback. Define duplicate/drift refusal. External triple-store projections remain read-only and trace to EG revision. | Verified by split `.1` (import selection), `.2` (digest binding) and `.3` (read-only projection) children. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R090.1 Import path Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Import path.** `crates/eg-typed-packs` schema registration accepts GraphOS deployment selection and routes through EG schema admission with typed refusal for unknown candidate. Bind selected schema to its revision and digest. | Unit tests assert refusal for unknown/invalid candidates and successful binding for approved ones. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R090.2 Digest readback Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Digest readback.** Served read of selected schema returns exact digest hash enabling client verification. Mismatch with deployment expectation is reported with typed refusal. | Served test verifies digest accuracy and readback consistency after restart. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R090.3 Read-only projection Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Read-only projection.** Any external triple-store projection defined through R090 remains read-only for queries. Mutations are refused with explicit error. External projections trace to EG revision and schema version. | Negative test proves write attempt refused. Trace test verifies lineage to EG source. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R091 Versioned reviewed normative source coexists with EG active policy Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Versioned reviewed normative source coexists with EG active policy.** Policy source revision and digest bind to activated EG policy node. No autonomous source overwrite occurs. Requested source changes route through approved SDK writeback. | Served tests prove rejected/stale review leaves both file and active policy unchanged. R091 child tests verify binding, no-overwrite and governance routing. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R091.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define policy source revision, digest and activation binding to EG policy node. | Unit test round-trips source identity, revision and digest; activation binding confirms match. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R091.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Accept reviewed source revision and activate matching EG policy. | Served test receives reviewed policy source and confirms EG policy reflects it. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R091.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Bind source revision to active policy through durable metadata. | Served metadata readback confirms source revision, digest and active policy match. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R091.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Refuse source overwrite and require SDK writeback for mutations. | Test proves autonomous source mutation is refused; SDK writeback path is accepted. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R091.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Activation event includes source revision and approval authority. | Trace confirms reviewer identity and source version in activation record. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R091.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** GraphOS approved engine policy port receives versioned repository source binding from SDK. | Integration test submits reviewed policy source, confirms EG activation, rejects stale review, restarts and verifies durability. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R092 Multi-step Markov state-probability forecast with calibration refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Multi-step Markov state-probability forecast with calibration refusal.** Regime HMM feeds transition/state horizon probabilities to sizing analysis. Low-confidence refusal prevents invalid positions. Shared forecast/sizing carrier remains specified. | Child tests cover transition matrix oracle, horizon sums, refusal and served sizing dependency. R092 preserves R002 original kernels. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R092.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define transition/state horizon probabilities and sizing consumer binding. | Unit test shows transition matrix, horizon sums and confidence bounds. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R092.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Compute multi-step probabilities from seeded transition matrix. | Test proves probability sequence matches seeded oracle across horizon. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R092.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Link HMM output to sizing analysis through shared carrier. | Served test feeds forecast to sizing and observes position recommendation. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R092.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Refuse low-confidence forecasts for position sizing. | Test shows position refused when confidence below configured threshold. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R092.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Sizing decision includes forecast confidence and refusal reason. | Trace records probability, confidence and refusal reason. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R092.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** Served sizing endpoint consumes HMM forecast with confidence refusal. | Integration test proves seeded transition matrix drives positioning, low-confidence refusal blocks sizing, original kernels remain unmodified. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R093 Probabilistic financial-series provider with sampling controls and batch semantics Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Probabilistic financial-series provider with sampling controls and batch semantics.** AU finance role invokes typed forecast-provider with temperature, nucleus top-p, sample count. Per-series results bind to input series. Model execution stays in dedicated service. | Child tests cover controls, batch identity, refusal and served invocation. AU owns invocation only; SDK transport explicit non-ownership. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R093.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define provider capability with ordered series IDs, temperature, top-p, sample count, model revision. | Unit test round-trips request; all controls validated. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R093.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Invoke dedicated provider with exact control values. | Served test submits request with controls and receives corresponding results. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R093.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** SDK transports request; provider returns per-series results. | Served test matches response series IDs to request order. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R093.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Reject unsupported controls, invalid bounds, missing series and stale identities. | Test proves refusal for out-of-range temperature, unavailable provider. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R093.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Store calibrated/uncalibrated evidence through EG; do not treat sampled output as deterministic math. | Trace marks forecast as probabilistic; readback preserves sample-evidence flag. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R093.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** AU invokes provider through SDK; seeded reproducibility matches declared tolerance. | Integration test submits forecast request with seed, confirms result reproducibility, stores evidence in EG, refuses deterministic-math interpretation. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R094 Hierarchical concept-ID syntax and cross-repository authority Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hierarchical concept-ID syntax and cross-repository authority.** Shared path identity and collision/contradictory-path contract enforced across repositories. | Child tests cover grammar, collision refusal and producer/EG admission authority. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R094.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define concept-ID grammar and path-consistency contract. | Unit test shows valid/invalid ID formats; path collision detected. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R094.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Accept hierarchical concept identifiers and validate path uniqueness. | Served test submits IDs; duplicate paths are refused. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R094.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** EG vocabulary validation owns the admission gate. | Served test routes submission through EG; invalid paths are rejected. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R094.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Refuse duplicate, contradictory or malformed identifiers. | Test proves refusal for conflicting paths and invalid grammar. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R094.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Accepted ID includes repository source and admission timestamp. | Readback confirms authoritative source and acceptance record. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R094.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** Repository producers submit IDs through EG validation; cross-repository path collision is refused. | Integration test submits concept IDs from two repositories, proves collision detection and authority isolation. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095 GraphOS inter-session inbox operation with sender/recipient authorization Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**GraphOS inter-session inbox operation with sender/recipient authorization.** Authenticated inbox operation binds and authenticates sender/recipient before durable enqueue. Read isolation and delivery authorization establish binding. | Child tests cover sender/recipient bindings, authorization refusal and durable delivery. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define inter-session inbox operation with sender/recipient identity binding. | Unit test shows operation round-trips and binds both identities. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Authenticate sender and recipient session. | Served test confirms both sessions are verified before enqueue. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Route inbox operation through session-authenticated gateway. | Served test receives operation through verified request context. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Refuse unknown/unauthorized target session before durable enqueue. | Test proves unknown session and unauthorized recipient are refused. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Durable append includes sender/recipient with delivery binding. | Readback confirms both identities in durable record. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** GraphOS session port sends inbox operation; authorization validates before enqueue; scoped inbox read succeeds. | Integration test proves authenticated sender sends to authenticated recipient, durable append occurs, recipient reads inbox without authorization bypass. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.1000 Model: served agent bus Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model: served agent bus.** `eg-durable` defines `BusParticipant{session_ref, tenant, host_ref, capabilities, last_seen_ms}` and `HubPeer{hub_ref, url_ref, scope}`. Topic messages reuse the inbox entry of this row. Arbora deleted its own bus tool and calls the served methods instead. | Planned: model round-trip tests in `crates/eg-durable/tests/agent_bus.rs` | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.1001 Behavior: served agent bus Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior: served agent bus.** Registration and heartbeat update one participant row in O(1). A roster read scans the tenant's participants in O(n). Dispatch hands one objective to the work queue. Federation forwards one message group to a peer hub. | Planned: behavior tests in `crates/eg-durable/tests/agent_bus.rs` | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.1002 Wiring: served agent bus Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring: served agent bus.** The served methods are `bus.register`, `bus.heartbeat`, `bus.roster`, `bus.send`, `bus.receive`, `bus.dispatch` and `bus.federate`. Each method takes the verified request context. Arbora reaches each one through its generated `eg.<domain>.<Method>` operation. | Planned: a contract test checks that the manifest lists every method. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.1003 Refusal: served agent bus Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal: served agent bus.** The engine refuses a call without the tenant scope. It refuses a message to a participant of another tenant. It refuses a federation peer whose scope is wider than the caller's scope. | Planned: refusal tests in `crates/eg-durable/tests/agent_bus.rs` | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.1004 Evidence: served agent bus Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence: served agent bus.** Tests assert one row per session and a stable message order per topic. A restart keeps every participant and message. | Planned: restart test in `crates/eg-durable/tests/agent_bus.rs` | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R095.1005 Hot-path proof: served agent bus Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof: served agent bus.** Criterion benchmark `bus_send` sends 10,000 messages over 64 concurrent topics. A send has a p50 under 150 microseconds and a p99 under 900 microseconds, under 32 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress by more than 10 percent. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R096 AU search-result persistence with authorized readback completion gate Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**AU search-result persistence with authorized readback completion gate.** EG durable write/read service owned by AU. Search-result receipt and AU readback success gate complete run. Failed/mismatched readback refuses completion. | Child tests cover write binding, readback receipt and completion refusal. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R096.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define search-result write/readback receipt and completion gate. | Unit test shows receipt structure and refusal conditions. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R096.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Accept search result and store durably. | Served test writes search result through EG durable path. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R096.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** EG stores result; AU triggers readback and verifies match. | Served test AU component writes, then reads back and confirms identity. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R096.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Refuse completion when readback fails or mismatches write. | Test proves mismatched readback leaves completion gate open. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R096.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Completion record includes write receipt and readback verification. | Trace confirms both operations and match. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R096.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** AU execution writes search result to EG; readback gate blocks until match verified. | Integration test submits search result, proves readback succeeds only on match, completion gate fires. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R028.1 Run checkpoint and memory binding. Owner decisions remain open Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Run checkpoint and memory binding. Owner decisions remain open.** The EG storage boundary is the existing versioned memory contract in `EG-DURABLE-KERNEL-R085`. A run checkpoint is an immutable `active_context` snapshot. Its canonical UTF-8 content binds `run_id`, `work_item_id`, lease epoch/fencing token, checkpoint revision and payload digest. It also binds separate short-term and long-term memory document references. Each reference carries document ID, revision and digest. The authenticated request establishes tenant and graph authority. Body scope cannot override it. A checkpoint update must be fenced against the live WorkItem lease epoch and fencing token. Current EG surfaces lack an atomic operation that updates an R085 snapshot and binds the WorkItem checkpoint pointer and fence. `CasWorkItemMetadata` is scheduling metadata, not a checkpoint transaction. The exact transaction/recovery contract remains held. No snapshot/pointer atomicity is claimed. A retry must use the same request identity and body. A stale expected revision, mismatched graph/tenant, or expired/superseded WorkItem fence refuses. Digest mismatch or unavailable durable storage also refuses without advancing the checkpoint head. Reads return the exact accepted snapshot revision and digest. `SyncMemorySnapshot`/`ReadMemorySnapshot` are the proposed attachment points. They reuse R085’s existing MutationBatch and R039’s sole redb durability authority. This child does not claim AU resume or host streaming implementation. Source objective: production runs checkpoint across processes, separate short-/long-term memory, isolate tenants, and stream output. Preserve `EG-DURABLE-KERNEL-R028`, `EG-IDENTITY-R006`, `ARBORA-A2A-R001`, `ARBORA-A2A-R001.1`, `ARBORA-OPS-R001`. Source SHA-256: `d89bb9c69e2fdef6a5c3fd428ede3f91868539056c2b949700867d8d8087d1e7`. **Definition hold:** owners have not chosen short-/long-term retention bounds or release authority. They have not defined the AU resume request’s atomic binding to the current WorkItem fence. The host stream ID/cursor authority and replay semantics remain undefined. Keep SPECIFIED until those contracts are reviewed. Do not infer cross-process resume from WorkItem lifecycle or R085 memory sync. | Planned owner acceptance: commit a checkpoint and both memory references through the R085 durable path, then restart. Read back identical revision/digests under the same verified tenant and graph. Refuse wrong tenant/graph, stale revision or stale WorkItem fence. Refuse wrong digest, changed-body replay identity or storage failure without advancing the head. Companion AU/GraphOS tests must resume the exact run and fence. They must continue the existing stream from its exact host-issued cursor without duplicate or skipped output. Those tests are blocked on the listed owner decisions. No runtime evidence or receipt is claimed. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.9 Versioned search state is retained as a complete R085 memory snapshot Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Versioned search state is retained as a complete R085 memory snapshot.** A search-state document is an `active_context` `MemorySnapshot` keyed by stable search-run document ID. Its exact UTF-8 JSON body requires a nonempty `search_run_id` and a positive integer `state_revision` equal to the snapshot revision. It also requires `transcript`, `evidence`, `constraints`, and `open_claims` arrays; each may be empty. EG validates the envelope and hashes the exact stored bytes; AU owns item schemas and source identity within those arrays. The document carries R085’s graph incarnation, snapshot revision, parent revision, content digest, provenance, and retention metadata. The outer verified request is authoritative for tenant, graph, principal, and policy. Write with the current expected head through `SyncMemorySnapshot`. Read the exact revision through `ReadMemorySnapshot` after context eviction. R085’s one-MiB content bound, digest verification, compare-and-set, conflict retention, authorization-before-lookup, and durable MutationBatch path apply. A stale revision preserves the accepted head and returns the R085 conflict outcome. Malformed/oversized content, unauthorized scope, digest mismatch, expired graph incarnation, or unavailable storage refuses without changing the head. EG stores state and returns it; AU owns serialization, compaction policy, and continuation. Preserve `AU-HARNESS-R013.13`, `AU-HARNESS-R020.1`, `EG-DURABLE-KERNEL-R085.1`, `EG-DURABLE-KERNEL-R085.4`, `EG-DURABLE-KERNEL-R085.7`. Source SHA-256: `8c76fa1637e0cc2082a1cce16b9d637f12b310ae96d1fe9a50ec9c64f8e23944`. **Definition hold:** AU has not specified per-entry schemas or source identity fields for the four arrays. AU also has not specified the continuation request/receipt field that binds a resumed search to this exact memory revision. Do not treat the listed required fields alone as an AU continuation contract. | Planned owner acceptance: persist all four required state fields. Evict context and restart or create an independent client. Read back byte-identical canonical content at the bound revision. Refuse oversize, malformed/missing required fields or stale expected revision. Refuse changed graph/tenant, digest mismatch or unavailable storage without changing the head. The AU continuation test must prove it passes the returned document ID/revision. It must restore all four fields before any compacted summary is used. Pending AU schema/receipt decision. No implementation or served receipt is claimed. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R085.10 Prior-session notes use the existing authorized memory authority. Capture and reuse remain AU-owned Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Prior-session notes use the existing authorized memory authority. Capture and reuse remain AU-owned.** EG persists a note only as a versioned R085 `MemorySnapshot`. It includes a stable note ID, source run/task references and captured source revision. It also includes canonical UTF-8 content and digest, provenance, graph incarnation, parent revision and current revision. It also records existing authorization/retention evidence. Reads and lists use `ReadMemorySnapshot`/`ListMemorySnapshots`. Writes use `SyncMemorySnapshot` through the canonical gateway and R039 sole redb authority. R085 controls stale-write conflicts. It retains an authorized candidate without replacing the accepted head. It never reports in-sync when host evidence is absent or stale. EG returns only currently authorized revisions and their explicit conflict/sync state. It does not auto-inject notes into a prompt or choose relevance. Preserve `AU-HARNESS-R022.3`, `EG-DURABLE-KERNEL-R085.2`, `EG-DURABLE-KERNEL-R085.5`, `EG-DURABLE-KERNEL-R085.7`. Source SHA-256: `2362fd76bf40223aeb813866392670b65eae13d02a725b1af9a2e6711542dd12`. **Definition hold:** AU has not defined session/research capture events or the note-kind mapping. Relevance score/threshold and staleness rule also remain undefined. AU has also not defined how conflicting notes are surfaced and selected. These are required before automatic capture and transparent reuse can be claimed. EG’s storage contract does not decide them. | Planned owner acceptance: authorized note write/read survives restart with source revision, digest and provenance intact. Cross-tenant and revoked-authority reads are redacted. Stale submissions return retained conflict without replacing the accepted head. Retention exhaustion refuses before effects. AU acceptance must demonstrate its decided capture trigger and relevance/staleness behavior. It must also show conflict presentation without implicit use of unresolved content. Acceptance remains blocked on the listed AU decisions. No runtime evidence or receipt is claimed. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R084.7 Definition hold: no cross-backend transaction contract is authorized Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Definition hold: no cross-backend transaction contract is authorized.** The defined write boundary remains one graph through served `ApplyMutation`, expected-version arbitration. R039 remains the single redb durability authority. `EG-DURABLE-KERNEL-R024.1` is read-only; R036 defines mirror replay/cursors, not a distributed transaction coordinator. Neither federation reads nor asynchronous mirror targets establish atomic multi-backend writes or tenant-wide ordering. Do not extend R084’s one-graph guarantee to external backends, and do not add writes to read-only sources. Preserve `EG-DURABLE-KERNEL-R084.1` through `.6` and R039 unchanged. Source SHA-256: `96c3079859b0e63ec3e1174e25e7a4ab107b23ef6863ae9b54ff0e921a88e4b0`. **Unresolved owner decisions:** which registered backend kinds, if any, are writable projections. Name the owner for the target registry and coordinator. Whether ordering is per graph or tenant. Whether the contract promises atomic commit or eventual mirror replay. How partial target failure, retry/idempotency, and authoritative receipts are represented. Until owners make those decisions, R084.7 remains an explicit hold and makes no cross-backend write promise. | Existing acceptance remains the two-client, one-graph `ApplyMutation` test with one commit and one typed stale-writer conflict. Cross-backend tests cannot be specified as positive behavior until the target set, ordering and failure semantics above are decided. After owners decide, tests must cover two tenants, two declared targets, concurrent writes and target failure/replay. They must prove R039 remains sole authority, with no silent partial authoritative commit. This row is not closed by the existing one-graph test. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R084.8 Deterministic tenant-scoped ordering across backends Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Deterministic tenant-scoped ordering across backends.** Define which registered backend kinds are writable projections or mirrors and name the owner responsible for the target registry and coordination. Establish whether ordering is enforced per graph or across tenant, and whether the contract provides atomic commit or eventual mirror replay. Define handling for partial target failure, with explicit idempotency, retry and receipt binding. Preserve R084.1-.6 and R039 sole durability authority. | Verified by integration tests covering two tenants, multiple declared targets, concurrent writes to different backends and failure/replay cases. Tests must prove R039 remains sole authority with no silent partial authoritative effect. Include refused uncoordinatable writes. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R038.100 Embedded and served deployment profiles preserve durability classes Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Embedded and served deployment profiles preserve durability classes.** Define an explicit deployment profile with `embedded` (in-process operation requiring no external service) and `served` (configured service endpoint) modes. Profile selection controls transport/startup only. It does not silently change the existing persistent-namespace durability default or sync/redb acknowledgment authority. Ephemeral in-memory namespaces require an explicit `ephemeral` declaration and retain no durable log. Persistent namespaces retain their declared `sync` or `async` class. Do not adopt the source request’s universal in-memory default. Preserve existing parent obligations: `EG-DURABLE-KERNEL-R038`. Source record `EG:60` SHA-256 `b36ed0f40742d2f455b4eae67f2fb64edfb7a6ea87b93cbb8ac0046970728458`. | Start a fresh embedded profile without an external service and read/write an explicitly ephemeral namespace. Verify no persistent namespace is silently downgraded. Start served mode against its configured endpoint and verify its declared sync/async class and acknowledgment boundary. Refuse an unknown profile and an ephemeral-to-durable class mismatch. Read back profile and namespace declarations. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R043.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Link existing vocabulary and mapping IDs for organizations, roles, data assets, permissions and time-series facts per category. | Served schema round-trip confirms vocabulary bindings for all five categories. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R043.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Define scoped query plan from approved source mappings through logical view to agent consumer. | Served tests execute queries under two distinct tenants with differing clearances without duplicating attached source data. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R043.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Accept source-context view configuration and bind it to the durable query planner. | Served test configures one logical view from two approved sources and executes a query. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R043.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Refuse unapproved source or out-of-scope category binding. | Test proves a binding to an unknown source or foreign category is refused before execution. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R043.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Served query response includes source provenance and category path. | Readback verifies provenance covers requested categories and follows the bound mapping. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R043.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** Served GetTenantContext returns scoped bindings; query planner executes through the view without duplication. | Integration test with two tenants and two clearance levels proves query completeness and scope isolation. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R043.7 Attested envelope text admits `@` and `\` and refuses only host identity Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Attested envelope text admits `@` and `\` and refuses only host identity.** `ChangeEnvelope::validate` in `crates/eg-types/src/change_envelope.rs` screens caller-attested material values with the attested rule. These values are graph operation properties, compare-and-set conditions and updates, outbox payloads, evidence loci and feature values. The attested rule is in `crates/eg-types/src/change_envelope/material.rs`. The rule SHALL admit ordinary document text that contains `@` or `\`. Examples are decorators, handles, version pins, LaTeX, escapes and Windows program paths. The rule SHALL refuse a host path that starts anywhere in the text. The host-path prefixes are the home, users, mnt and root prefixes in `HOST_PATH_PREFIXES`. The rule SHALL also refuse a local file URI, a Windows profile path (`<drive>:\Users\`) and an e-mail address. Property keys and envelope identifiers keep the strict character rule. Repository-snapshot material keeps its own rule. | Unit tests in `material.rs`: `attested_material_admits_ordinary_document_text` and `attested_material_still_refuses_host_identity`. The served test `server::tests::test_served_change_envelope_admits_document_text_and_codes_refusals` commits document text with `@` and `\`. It sends `ApplyChangeEnvelopeDraft`, which continues as `ApplyChangeEnvelope`. | requirement | EG-DURABLE-KERNEL | VERIFIED | 8040b672e582 crates/eg-types/src/change_envelope/material.rs:161 crates/eg-types/src/change_envelope/material.rs:181 src/server/mod.rs:2163 |
| EG-DURABLE-KERNEL-R043.8 Envelope admission refusals carry a declared code and a safe diagnostic Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Envelope admission refusals carry a declared code and a safe diagnostic.** Every refusal that `ChangeEnvelope::validate` returns SHALL carry a declared error code. Host-identity refusals and the strict identifier rule emit `INVALID_ARGUMENT`. The detail names the shape found (host path, file URI or e-mail address) and the material class. The detail SHALL NOT echo the refused value. `contract::classify_refusal` classifies any other free-text refusal as `INVALID_ARGUMENT`. The served path never reports it as `INTERNAL: unclassified engine refusal`. `Response::err` in `crates/eg-types/src/protocol/support_04.rs` SHALL log dropped text at debug level. | The unit test is `host_identity_refusals_are_coded_and_do_not_echo_the_value` in `material.rs`. The served test above asserts `error == INVALID_ARGUMENT` and a privacy detail that names the e-mail shape. It also asserts that the detail does not echo the address. | requirement | EG-DURABLE-KERNEL | VERIFIED | 690f4389a87e 8040b672e582 crates/eg-types/src/change_envelope/material.rs:198 src/server/mod.rs:2163 |
| EG-DURABLE-KERNEL-R043.100 Committed graph changes publish an ordered, revocable cursor feed Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Committed graph changes publish an ordered, revocable cursor feed.** Add public read operations `Method::OpenGraphSnapshot` (`OpenGraphSnapshotV1`) and `Method::ReadGraphChanges` (`ReadGraphChangesV1`) downstream of the existing `ApplyChangeEnvelope` commit path in `src/server/dispatch/change_envelope.rs`; `GetChangeEnvelope` remains a keyed read, not a feed. Snapshot and events bind graph incarnation, committed revision, snapshot digest, visibility revision and caller authority. Event identity is `(commit_id, event_ordinal)` and ordering is `(graph_incarnation, committed_revision, event_ordinal)`. Tombstones name deleted node/edge ids and deletion revision but are filtered under current authorization. The snapshot response returns the exact high-water cursor from the same consistent read. This cursor prevents gaps in subsequent pages. Cursors are opaque and bind tenant, graph, incarnation, authorization revision and last event. Event replay is at-least-once with stable ids for client deduplication. Page size is 1..256 and retention is 24 hours. An expired cursor returns `CURSOR_EXPIRED` plus a safe current snapshot watermark, never a silent skip. A permission change returns `AUTHORIZATION_CHANGED` after reauthorization and reveals no protected counts or edges. Every event carries `committed_at_ms`, `visible_at_ms`, `latency_profile_revision` and derived `commit_to_visible_ms`. The served p95 target is ≤1000 ms from durable commit acknowledgement to first authorized feed read. The feed is read-only and cannot create a second persistence/write envelope; R043's MutationBatch authority remains mandatory. The EG latency measurement ends at first authorized feed read only. GraphOS/WebUI must separately define a versioned browser commit-to-visible p95. They must also set numeric readable-layout limits, including visible-node/edge budget and interaction target/label bounds. Those values and served receipts are explicit companion prerequisites, not inferred from the EG feed metric. Consumer: `WEBUI-APPS-R030.8` GraphView. Source objective WEBUI:5: “Connected client views reflect graph changes immediately without page refresh. And the graph layout stays readable under concurrent edits from concurrent users.” Source record SHA-256 `0b416b47d85530fb35cf44bf5dc79e04e1b9746481027d0b0687b66579dc9844`. | Use two authenticated served GraphView clients. Take one snapshot. Commit concurrent node/edge edits through `ApplyChangeEnvelope`. Read events on the other client without refresh. Reconnect from the returned cursor. Prove ordered/deduplicable events and independent durable readback. Exercise deletion, expired cursor, stale graph incarnation, and revoked permission. Each returns its typed recovery/refusal without leaking denied graph data. Measure EG commit-to-visible p95 only through first authorized feed read. GraphOS/WebUI separately prove browser commit-to-visible p95 and their versioned numeric readable-layout/interaction limits under concurrent edits. Do not count the EG read bound as that end-to-end evidence. No runtime or owner receipt is claimed. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R042.100 Comparable full-input-token throughput and per-query cost measurements Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Comparable full-input-token throughput and per-query cost measurements.** Extend the existing `BenchmarkClaim.measured_result` with `BenchmarkMeasurementV1`. Bind benchmark case/configuration and dataset/query digests, plus release commit. Bind model, provider and tokenizer revisions. Bind hardware/profile/settings digest. Record request start/end and model-ready timestamps. Record full input-token count from the named tokenizer and inference elapsed milliseconds measured after readiness. Pin the price-table revision. Compute input-token throughput as `full_input_tokens * 1000 / inference_elapsed_ms`. Compute per-query cost using the bound token quantities, price-table currency and currency minor-unit exponent, with explicit rounding. Startup time is reported separately and excluded from both inference elapsed time and throughput. Claims are comparable only when the named benchmark/workload/profile fields match. Missing full input tokens, tokenizer or price revision refuses claim admission. Nonpositive elapsed time, zero denominator, invalid currency exponent or incomparable profile also refuses admission. Preserve existing superiority pass/fail and publication requirements. Producer/consumer: benchmark runner returns measurements; EG binds and validates them in the existing typed claim. No new benchmark executor is introduced. Source objective EG:63 SHA-256 `78016644588199c94f30e549cda44e35667f0447e1ae15a2524a4710bdf92e00`. | Served acceptance recomputes throughput and currency-rounded per-query cost from read-back measurements for multiple releases. It must prove startup is excluded and complete tokenizer input tokens are used. Refuse zero/negative inference elapsed time or missing tokenizer/input-token count/price table. Refuse invalid currency exponent, stale profile or mismatched benchmark inputs. Existing benchmark superiority acceptance remains required. No performance result is claimed by this definition. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R097 Temporal extracted-fact forward chaining and durable per-fact provenance Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Temporal extracted-fact forward chaining and durable per-fact provenance.** A forward-chaining reasoner produces and persists extracted facts with linked temporal rule semantics and durable sentence/axiom origin. Rollup: LANDED only once every child is landed. | Verified by each child requirement's own verification. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R097.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define temporal rule semantics with fact timeline and origin linkage. | Typed test round-trips temporal rule and origin bindings through wire. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R097.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Forward chaining produces facts in time-order and chains derivations. | Served test applies rules sequentially and confirms fact derivation order. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R097.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Fact admission and readback bind origin sentence and axiom references. | Served test retrieves fact with linked provenance from persistence. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R097.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Reject rules with missing temporal bounds or malformed axioms. | Test proves invalid temporal range and unknown axiom are refused. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R097.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Durable fact store preserves origin chain and temporal rule instance. | Durability test shows fact origin persists across restart. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R097.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** Fact production API returns origin chain; integration test traces derived fact to source axiom. | Served API call shows temporal rule fired and returned origin. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R098 Ordered n-ary prediction with unseen-entity behavior and hypothesis-only evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Ordered n-ary prediction with unseen-entity behavior and hypothesis-only evidence.** A public hyperedge predictor accepts ordered arguments, routes unseen entities through hypothesis paths, and admits hypothesis-only evidence classes to output. Rollup: LANDED only once every child is landed. | Verified by each child requirement's own verification. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R098.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Define ordered argument list and hypothesis-class evidence enum. | Typed test round-trips ordered arguments and hypothesis class through wire. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R098.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Unseen entities route through inductive hypothesis path and bind response. | Served test invokes predict with unknown entity and observes hypothesis response. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R098.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Hypothesis evidence class is accepted and binds to public hyperedge predictor. | Served test configures predictor with hypothesis class and invokes it. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R098.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Reject hypotheses with empty argument list and non-hypothesis evidence claims. | Test proves empty arguments and asserting evidence are refused. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R098.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Hypothesis output never claims assertion and carries prediction confidence. | Readback shows hypothesis response lacks assertion flag. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R098.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** Prediction endpoint accepts ordered arguments and routes unseen entity to hypothesis response. | Served test calls predict with (known, unknown) arguments and observes hypothesis reply. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R099 Cross-graph writes fan out across shard writers (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Cross-graph writes fan out across shard writers (rollup).** A multi-graph write must commit each graph's sub-batch on that graph's shard writer. Sub-batches on distinct shards must commit in parallel. The response must prove the fan-out. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R099.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Add `ShardFanoutReport{graph, shard_index, queued_us, commit_us, outcome}` in `crates/eg-types/src/mutation_batch/fanout.rs`. A request holds at most 256 sub-batches. Proving test: `fanout.rs::tests::report_round_trips`. | A serde round trip keeps every field. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R099.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** The engine groups sub-batches by `shard_index(graph, k)` from `src/server/persistence/redb_backend/shard_writer.rs:29`. Each group goes to its writer channel at once. Distinct shards commit in parallel. Graphs on one shard commit in request order. Routing cost is O(b) in sub-batch count. | A unit test with four graphs on four shards observes overlapping commit windows. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R099.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** `multi_graph_batch_update` at `src/server/dispatch/change_envelope/multi_graph.rs:19` is the attach point. Its caller is the served `MultiGraphBatchUpdate` arm at `src/server/dispatch/router/data_plane.rs:770`. It resolves writers through `shard_for` at `src/server/persistence/redb_backend/backend_shard_routes.rs:12`. The writer width comes from `EG-DURABLE-KERNEL-R077`. | A dispatch test asserts one report per sub-batch from the served arm. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R099.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** More than 256 sub-batches must return `INVALID_ARGUMENT` before any commit. A failed sub-batch must return its own typed code in its report. This row adds no cross-graph atomicity. `EG-DURABLE-KERNEL-R084.7` holds that decision. | Tests cover the size refusal and one failed sub-batch beside committed ones. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R099.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** The response must carry one `ShardFanoutReport` per sub-batch. The engine must export `eg_shard_writer_inflight{shard}` and `eg_shard_writer_commit_seconds{shard}`. | A test reads the reports and scrapes the two metrics. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R099.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** The entry point is the served `MultiGraphBatchUpdate` method. The test `tests/shard_write_fanout.rs::cross_graph_writes_fan_across_shard_writers` writes eight graphs that hash to eight shards with `k = 8`. It must observe eight distinct shard indexes with overlapping commit windows. Wall time must stay under 1.5 times the slowest single-graph commit. The benchmark `benches/multi_graph_fanout.rs` records p50 and p99. | The served test passes, and the benchmark receipt meets the budget. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R100 Native property-graph mirror sinks (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Native property-graph mirror sinks (rollup).** The engine must mirror committed graph changes to three external property-graph sink kinds. The kinds are a Bolt-protocol openCypher server, a RESP-protocol graph server and an embedded columnar graph file. Each sink reuses the `EG-DURABLE-KERNEL-R036` cursor and the `EG-DURABLE-KERNEL-R024.2.2` registry. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R100.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Extend `MirrorSinkKind` at `crates/eg-types/src/mirror_sink.rs:24` with `BoltCypher`, `RespGraph` and `ColumnarGraphFile`. Each variant carries a target locator, a database or graph name, a secret reference and a TLS profile reference. A spec must never carry an inline credential. Proving test: `mirror_sink.rs::tests::graph_sink_kinds_round_trip`. | A serde round trip keeps every field. An inline credential is rejected. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R100.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Add drivers in `crates/eg-plan/src/mirror_sinks/{bolt.rs,resp_graph.rs,columnar_file.rs}` that implement `MirrorTarget` from `crates/eg-plan/src/mirror_target.rs`. Each driver turns committed outbox rows into idempotent `MERGE` upserts in batches of 1,000. The Bolt and RESP clients are pure Rust. The file sink writes Parquet node and relationship tables through `eg-lake` plus a load manifest. The cursor advances only after the target acknowledges a batch. | Unit tests replay one batch twice and observe one target state. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R100.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** The drivers register through `MirrorTargetRegistry::register` in `crates/eg-plan/src/mirror_target.rs`. The outbox consumer path of `EG-DURABLE-KERNEL-R024.5` drives them. Registration enters through the served `MutationOutbox` administrative method. | A served test registers each kind and observes outbox delivery. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R100.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** A plaintext connection to a non-loopback target must refuse with `MIRROR_TRANSPORT_INSECURE`. A non-empty target without explicit adoption must refuse with `MIRROR_TARGET_NOT_EMPTY`. The generated error contract must declare both codes. A refusal must not move the cursor. | Tests cover both refusals and an unchanged cursor. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R100.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Each batch must emit a receipt with sink kind, target locator, cursor start and end, and row count. A reconcile pass must compare source and target digests before the sink reports caught up. | A test reads the receipts and one digest comparison. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R100.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** The entry point is the served `MutationOutbox` method plus a served `ApplyMutation` write. The test `tests/mirror_graph_sinks_served.rs::each_sink_replays_after_outage` runs a real target for each kind. It stops the target, writes 10,000 nodes, restarts the target and observes equal digests. The benchmark `benches/mirror_graph_sinks.rs` must show at least 20,000 rows per second per sink and p99 batch acknowledgement under 250 ms. | The served test passes against real targets, and the benchmark receipt meets the budget. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R028.2 Read the committed terminal event through the existing WorkItem outcome read Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Read the committed terminal event through the existing WorkItem outcome read.** `GetWorkItemOutcome` retains `work:read`, verified tenant and graph authorization. The fenced terminal CAS binds the engine-derived outbox batch and stored event byte digest to the WorkItem. One snapshot resolves that binding to the exact committed run-event row and exposes its scope, commit sequence, ordinal and safe result references. Legacy rows return explicit `legacy_unbound` unavailability; a missing or corrupt bound event refuses. No lease authority is projected. This point read excludes status/step history and lifecycle streaming. | Commit a real terminal extension, read its event, reopen storage and read the identical identity. Foreign tenants see nothing. Corrupt/missing bound events refuse. Legacy rows report unavailability. Generic writes cannot forge the native binding. | requirement | EG-DURABLE-KERNEL | VERIFIED | 6aa2533a8865 src/redb_store.rs:6294 src/redb_store/work_item/read/tests.rs:130 src/redb_store/work_item/read/tests.rs:182 src/redb_store/work_item/read/tests.rs:221 src/redb_store/work_item/read/tests.rs:246 |
| EG-DURABLE-KERNEL-R028.3 Fenced metadata CAS requires a live worker lease Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Fenced metadata CAS requires a live worker lease.** When the request includes `expected_lease`, compare stored lease expiry with the engine mutation timestamp inside the row transaction. Refuse at or after expiry, or when expiry is absent, without changing the row. Caller time cannot extend the fence. Preserve unfenced metadata CAS behavior. This does not implement checkpoint atomicity under R028.1. | Planned native row tests cover before, exact and after expiry, absent expiry, unchanged rows on refusal, caller clock independence and unfenced compatibility. Native validation remains pending. | requirement | EG-DURABLE-KERNEL | SPECIFIED | src/redb_store/work_item/lease/tests.rs:31 |
| EG-DURABLE-KERNEL-R101 Downtime work is an ontology that drives the engine scheduler (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Downtime work is an ontology that drives the engine scheduler (rollup).** The downtime ontology declares job types, priorities, budgets, windows and preconditions. The scheduler reads the ontology and runs eligible downtime jobs in each window. Foreground work preempts downtime work. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R101.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** Add `crates/eg-core/ontology/downtime_work-v1.ttl` and its shapes file under prefix `dw:`. It declares `dw:JobType`, `dw:Window`, `dw:Budget`, `dw:Precondition` and `dw:priority`. Add `DowntimeJobType{iri, priority, budget, preconditions, window}` and `DowntimeWindow{kind, start, end}` in `crates/eg-jobs/src/downtime.rs`. `budget` reuses `ResourceBudget` (`crates/eg-jobs/src/model.rs:57`). Closed window kinds are `idle` and `declared`. Proving test: `crates/eg-jobs/src/downtime.rs::tests::job_type_round_trips`. | A serde round trip keeps every field, and the shape refuses a job type without a budget. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R101.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** An idle window opens when the foreground queue is empty and requests stay under one per second for 60 s. A declared window opens at its start time. The named default `priority_then_budget_fit` orders eligible types by priority, then by oldest last run. It selects types while their budgets fit the window. The default window budget is 25% CPU and 2 GiB memory. A precondition is a SPARQL ASK; a false answer skips the type. Proving test: `crates/eg-jobs/src/downtime.rs::tests::priority_then_budget_fit`. | Three job types run in priority order, and one with a false precondition is skipped. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R101.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Selection runs on the scheduler tick of `SchedulerConfig` (`crates/eg-types/src/scheduler_config.rs:30`), served by `EG-DURABLE-KERNEL-R076`. Each selected type enqueues an `eg-jobs` job under a background capacity lease. The ontology loads as core schema source `core:downtime-work@1`. Proving test: `crates/eg-jobs/src/downtime.rs::tests::tick_enqueues_leased_jobs`. | A served tick enqueues the selected jobs under background leases. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R101.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** A job type without a budget must refuse with `DOWNTIME_BUDGET_REQUIRED`. A budget sum over the lane floors must refuse as `SchedulerConfig` over-subscription. A job over its budget must stop at its next checkpoint with `DOWNTIME_BUDGET_EXHAUSTED`. Downtime work must not run on reserved foreground lanes. Proving test: `crates/eg-jobs/src/downtime.rs::tests::downtime_refusals`. | Each case returns its code, and no foreground lane runs downtime work. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R101.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Each tick must record `DowntimeSelection{window, candidates, chosen, skipped}` with one reason per skipped type. Each job must record the budget it used. Proving test: `crates/eg-jobs/src/downtime.rs::tests::selection_recorded`. | A served read finds the selection and the budget use of each job. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R101.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** The entry point is the served engine with three declared job types. The test idles for 60 s and observes the run order. It then sends a foreground query. Running downtime jobs must pause within 250 ms. Proving test: `tests/scheduler/test_downtime_scheduler_served.py::test_idle_window_runs_priority_jobs_and_preempts`. | Jobs run in priority order, and the foreground query preempts them within 250 ms. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R102 The engine serves its key-value modality as the memory read and save methods (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**The engine serves its key-value modality as the memory read and save methods (rollup).** `KvGet`, `KvPut`, `KvDelete`, `KvScan` and `KvCas` are stable, wire-callable methods of the generated client contract. Each has request and result schemas and the `kv:read` or `kv:write` scope. GraphOS binds `memory.read` and `memory.write` (`ARBORA-OPS-R024.4`) to them. The served graph-memory methods cover the rest: `Consolidate`, `Reinforce`, `DecayMemories`, `SummariesAtLevel` and trajectories. `EG-DURABLE-KERNEL-R085` still owns versioned document sync with retained conflicts. This row adds no second memory model. Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DURABLE-KERNEL | VERIFIED | 34d9e78dbe3c 48284711e3db 5430f4d714ee 70d7b722668b 74f3436402b8 src/server/kv/dispatch_tests.rs:158 src/server/kv/dispatch_tests.rs:159 src/server/kv/dispatch_tests.rs:160 src/server/kv/dispatch_tests.rs:232 src/server/kv/dispatch_tests.rs:261 |
| EG-DURABLE-KERNEL-R102.1 Served contract Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served contract.** The five KV methods are `Stable` and carry the Python consumer profile. The generated contract therefore marks them `is_wire_callable: true`, and the Python client binds them. `KvGet` answers `Option<KvEntry{value, version}>`. `KvPut` answers `KvWriteReceipt{version}`. `KvDelete` answers whether the key existed. `KvScan` answers `KvScanPage{entries, next_cursor}`. `KvCas` answers `KvCasOutcome{swapped, version}`. | `src/server/kv/dispatch_tests.rs::kv_dispatch_put_get_scan_delete_cas` round-trips every method through the real dispatch. The generated contract lists all five as wire-callable. | requirement | EG-DURABLE-KERNEL | VERIFIED | 34d9e78dbe3c 5430f4d714ee 74f3436402b8 src/server/kv/dispatch_tests.rs:159 |
| EG-DURABLE-KERNEL-R102.2 Scope and authorization Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Scope and authorization.** A private key's store namespace is an opaque digest of tenant, principal, request graph and namespace. All four come from the verified request; no body field widens them. No Redis, S3 or KV-cache adapter namespace can alias a served one. Reads require `kv:read` or the coarse `kg:read`. Writes require `kv:write` or the coarse `kg:write`. The request boundary refuses a missing scope before any row is read. | `src/server/kv/dispatch_tests.rs::kv_keys_are_scoped_by_graph_and_writes_need_kv_write`: the same key in another graph is absent. A `kv:read`-only caller reads, and its write is refused with the row unchanged. | requirement | EG-DURABLE-KERNEL | VERIFIED | 34d9e78dbe3c 74f3436402b8 src/server/kv/dispatch_tests.rs:261 |
| EG-DURABLE-KERNEL-R102.3 Versioned compare-and-swap and bounded paginated scan Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Versioned compare-and-swap and bounded paginated scan.** Every served write stamps the namespace's mutation-kernel commit version. That version never repeats, even after a delete and re-create. `KvCas` swaps only when the stored version equals `expected_version`; `0` means absent. A refused `KvCas` reports the current version. `KvScan` returns at most 1000 rows (default 100) and 4 MiB per page, in key order. Its exclusive-start cursor must lie inside the prefix. | `src/server/kv/dispatch_tests.rs::kv_dispatch_put_get_scan_delete_cas` covers stale-version refusal, create-if-absent and no A-B-A after delete. `::kv_scan_pages_are_bounded_and_resume_from_the_cursor` reads 25 keys in three pages and refuses a foreign cursor. `src/server/kv/wire.rs::tests::versions_never_repeat_across_delete_and_recreate` covers the row codec. | requirement | EG-DURABLE-KERNEL | VERIFIED | 34d9e78dbe3c 5430f4d714ee src/server/kv/dispatch_tests.rs:160 src/server/kv/dispatch_tests.rs:232 src/server/kv/wire.rs:339 |
| EG-DURABLE-KERNEL-R102.4 Durable, audited, replayable mutations Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Durable, audited, replayable mutations.** `KvPut`, `KvDelete` and `KvCas` each commit as one native MutationBatch in `kv.redb`. Their durability domain is `KvRedb`, and they commit before they acknowledge. One transaction holds the row, ledger, fence, idempotency record and outbox. They are `audited`: a digest-only `KV_PUT`, `KV_DELETE` or `KV_CAS` line plus the durable batch ledger. They emit no graph CDC, because native outbox rows are the projection authority. `KvDelete` is idempotent; `KvPut` and `KvCas` are not. All three replay by `OperationIdentity`. A fresh nonce with the same operation key returns the stored verdict without a second write. | `src/server/kv/dispatch_tests.rs::kv_fresh_nonce_replays_stable_operation_without_duplicate_write`; `crates/eg-capabilities/tests/consistency` `audited_matches_audit_rs_exactly`. | requirement | EG-DURABLE-KERNEL | VERIFIED | 34d9e78dbe3c 5430f4d714ee src/server/kv/dispatch_tests.rs:314 |
| EG-DURABLE-KERNEL-R102.5 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** The entry point is the served, authenticated dispatch against a durable `kv.redb`. The test sends 400 sequential `KvPut`/`KvGet` pairs of 256-byte values. `KvGet` must finish within 5 ms at p50 and 20 ms at p99. `KvPut` must finish within 25 ms at p50 and 500 ms at p99. Both include envelope verification. `KvPut` also includes the durable commit. On R820 in a debug build, `KvGet` measured 1012 µs at p50 and 1731 µs at p99. There `KvPut` measured 3931 µs at p50 and 7006 µs at p99. On a hosted CI runner, `KvGet` measured 530 µs at p50 and 905 µs at p99. There `KvPut` measured 2151 µs at p50 and 110589 µs at p99. | `src/server/kv/dispatch_tests.rs::kv_served_hot_path_meets_latency_budgets` prints and asserts the measured p50 and p99. | requirement | EG-DURABLE-KERNEL | VERIFIED | 34d9e78dbe3c 48284711e3db src/server/kv/dispatch_tests.rs:371 |
| EG-DURABLE-KERNEL-R102.6 Opt-in shared namespace Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Opt-in shared namespace.** Every KV method takes `shared`, which defaults to `false`. A private key stays scoped to the verified tenant, principal, request graph and namespace. `shared: true` drops only the principal. Every principal of the verified tenant and request graph then sees one row. The tenant owns its kernel scope, so writers from different principals advance one version sequence. A shared `KvPut`, `KvDelete` or `KvCas` needs the separate `kv:shared:write` action or `kg:admin`. The coarse `kg:write` and `kv:write` grants are refused. A shared read needs `kv:read`. | `src/server/kv/dispatch_tests.rs::kv_shared_namespace_spans_principals_and_needs_kv_shared_write`: one principal's private key is absent for another. A second principal reads a shared write, which is not the writer's private row. A coarse-write principal is refused. | requirement | EG-DURABLE-KERNEL | VERIFIED | b714af935390 src/server/kv/dispatch_tests.rs:441 |
| EG-DURABLE-KERNEL-R609 Versioned mutations, bitemporal validity and epistemic result rows are engine primitives (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Versioned mutations, bitemporal validity and epistemic result rows are engine primitives (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R609.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** `crates/eg-types/src/versioning.rs` defines KgTransaction, KgCommit, KgDiff, BitemporalStamp, EpistemicRow, KnowledgeBatch. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R609.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** A transaction collects node and edge mutations and applies atomically with rollback; a diff compares two versions. Every write carries storage time, event time and a validity interval; later event time wins a contradiction and supersedes. Query results carry score, confidence, validity window, evidence and policy labels per row, and a bulk columnar stream returns them in batches. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R609.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Built on MutationBatch of EG-DURABLE-KERNEL-R043; the stamp is applied at the single write chokepoint. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R609.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** An interval whose end precedes its start is refused. The stable code is `VALIDITY_INVERTED`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R609.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Per commit: version, mutation count, diff size. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R609.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** commit of 10k mutations: p50 under 40 ms, p99 under 120 ms; as-of filter adds under 5 percent to scan time. The benchmark is `benches/r609_durable_graph_kernel.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R071.600 Lane-aware claim on the durable task queue Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Lane-aware claim on the durable task queue.** `claim` accepts a lane and queue class and rotates across lanes before priority buckets, as `EG-INGEST-WORKER-R604` defines; one queue serves every lane and no second queue backend exists. Claim p99 stays under 1 ms at 64 workers. | Integration test claims across three lanes and asserts rotation and per-lane depth. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R750 Durable agent dispatch queue, turn claims and cooperative cancellation (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Durable agent dispatch queue, turn claims and cooperative cancellation (rollup).** Rust-native in `crates/eg-durable/src/dispatch`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R750.750 Model: Durable agent dispatch queue, turn claims and cooperative cancellation Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model: Durable agent dispatch queue, turn claims and cooperative cancellation.** The engine enqueues agent turns on the durable task queue with a signed carrier. A worker claims a turn under a fenced session lock, so one worker owns a session turn at a time. The worker heartbeats the claim. Cancellation is cooperative, and the queue worker owns the lifetime. Types: `AgentTurnEnvelope`, `DispatchCarrier`, `SessionLock`, `ClaimGuard`, `CancelToken`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R750.751 Behavior: Durable agent dispatch queue, turn claims and cooperative cancellation Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior: Durable agent dispatch queue, turn claims and cooperative cancellation.** Enqueue is bounded and returns a typed full result under backpressure. Claim and ack are idempotent by execution key. Cancellation is requested by soft timeout and enforced by the worker. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R750.752 Refusal: Durable agent dispatch queue, turn claims and cooperative cancellation Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal: Durable agent dispatch queue, turn claims and cooperative cancellation.** The engine refuses a carrier whose secret is unavailable. It refuses a second claim of a held session. It refuses an enqueue beyond the bound. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R750.753 Hot-path proof: Durable agent dispatch queue, turn claims and cooperative cancellation Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof: Durable agent dispatch queue, turn claims and cooperative cancellation.** Criterion benchmark `dispatch_claim` at 50k claims per second per shard. The p50 is under 100 microseconds and the p99 is under 500 microseconds. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R751 Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions (rollup).** Rust-native in `crates/eg-durable/src/run_state`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R751.750 Model: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions.** Resumable execution persists a checkpoint per step. Sessions and chat history are durable records with bounded retention. Fenced shared resource leases admit distributed capacity. Engine change subscriptions drive reactions with a budget and an append-only ledger. Types: `ExecutionCheckpoint`, `SessionRecord`, `ChatRecord`, `ResourceLease`, `LeaseFence`, `ReactiveSubscription`, `ReactionLedger`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R751.751 Behavior: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions.** Resume replays from the last checkpoint with idempotent steps. A lease carries scope, epoch and fence and is granted or denied atomically. A reaction fires at most once per event id within its budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R751.752 Refusal: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions.** The engine refuses five cases with typed errors. They are a stale fence, an expired lease, a scope mismatch, an idempotency conflict and a reaction beyond its budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R751.753 Hot-path proof: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof: Durable execution state, session and chat persistence, shared resource leases and reactive subscriptions.** Criterion benchmark `lease_acquire` runs at 10k leases. The p50 is under 80 microseconds and the p99 is under 400 microseconds. Memory stays under 8 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R752 Repository work items and operation payloads (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Repository work items and operation payloads (rollup).** Rust-native in `crates/eg-durable/src/work_item`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R752.750 Model: Repository work items and operation payloads Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model: Repository work items and operation payloads.** Repository work items are durable records. Each record holds a bounded typed operation payload, never a command envelope. It also holds the execution context, artifact promotion candidates and outcomes. Its lifecycle uses fenced transitions. Types: `WorkItem`, `OperationPayload`, `WorkItemContext`, `ArtifactPromotion`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R752.751 Behavior: Repository work items and operation payloads Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior: Repository work items and operation payloads.** Transitions are compare-and-set on the item revision. A promotion is evaluated against stored evidence before it is committed. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R752.752 Refusal: Repository work items and operation payloads Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal: Repository work items and operation payloads.** A payload larger than its bound, an untyped operation and a transition from a stale revision are refused. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R752.753 Hot-path proof: Repository work items and operation payloads Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof: Repository work items and operation payloads.** Criterion benchmark `work_item_transition`. The p50 is under 120 microseconds and the p99 is under 600 microseconds. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R820 Uncertain effects and effect receipts on work items (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Uncertain effects and effect receipts on work items (rollup).** Extends `EG-DURABLE-KERNEL-R752`. A work item whose effect started and has no proven outcome stays open until an effect receipt resolves it. Rust-native in `src/redb_store/work_item/` and `crates/eg-types`. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R820.1 Model: Uncertain effects and effect receipts on work items Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model: Uncertain effects and effect receipts on work items.** A work item can record an effect that started and has no proven outcome. Add `EffectState{Unstarted, Started, Resolved}` to the work-item row in `src/redb_store/work_item/`. Add `EffectReceipt{job_id, request_ref, principal_ref, outcome, receipt_ref, committed_at}` in `crates/eg-types/src/work_item_read.rs`. Add `AdmittedRequest{request_ref, tenant, session_ref, payload_digest, bytes}` as an immutable content-addressed record. `request_ref` is the SHA-256 digest of the canonical request. One receipt exists for each job ID. | A serde round trip keeps every field. A golden vector fixes the `request_ref` digest of one canonical request. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R820.2 Behavior: Uncertain effects and effect receipts on work items Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior: Uncertain effects and effect receipts on work items.** `MarkWorkItemEffectStarted` sets `Started` under the live claim before the first effect. A lease expiry on a `Started` item returns the item to `ready` with its attempt count unchanged. Retry exhaustion never moves a `Started` item to `dead_letter`. The item stays open until a receipt resolves it. `RecordEffectReceipt` writes the receipt once per job ID in the same transaction as the terminal commit. A replay of the same receipt returns the stored receipt. `GetEffectReceipt` reads it by job ID. `GetAdmittedRequest` reads a request by reference within the caller tenant and session. Writes are compare-and-set on the item revision, O(1) per call. | Unit tests cover each transition, the unchanged attempt count, the blocked dead letter and the idempotent replay. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R820.3 Wiring: Uncertain effects and effect receipts on work items Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring: Uncertain effects and effect receipts on work items.** Serve `MarkWorkItemEffectStarted`, `RecordEffectReceipt`, `GetEffectReceipt`, `SubmitAdmittedRequest` and `GetAdmittedRequest` as coordination methods in the public contract. Use the existing `work:write` and `work:read` scopes. The claim path in `src/redb_store/work_item/claim.rs` reads `EffectState` before it retires an item. The commit path in `src/redb_store/work_item/commit.rs` writes the receipt in its terminal batch. arbora binds these methods as `eg.coordination.*` operations; its tool-task worker (ARBORA-A2A-R002.2.2) consumes them. | A served test reaches each method through the wire contract, not through a unit entry point. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R820.4 Refusal: Uncertain effects and effect receipts on work items Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal: Uncertain effects and effect receipts on work items.** A receipt whose job ID, request reference or principal differs from the work item refuses with `EFFECT_RECEIPT_MISMATCH`. A second, different receipt for one job ID refuses with `EFFECT_RECEIPT_CONFLICT`. A start mark without a live claim refuses with `WORK_ITEM_CLAIM_STALE`. A request read from another tenant or session returns not found. An admitted request whose bytes do not match its reference refuses with `ADMITTED_REQUEST_DIGEST_MISMATCH`. | Negative tests assert each code and that durable state is unchanged. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R820.5 Evidence: Uncertain effects and effect receipts on work items Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence: Uncertain effects and effect receipts on work items.** Each start mark, receipt and blocked retirement records the job ID, item revision, outcome and timing in the work-item audit. The audit holds no parameters or credentials. Export the counter `eg_work_item_uncertain_effects_total` and the gauge `eg_work_item_uncertain_open`. | A served read finds the audit entries, and the metrics change after one uncertain run. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R820.6 Hot-path proof: Uncertain effects and effect receipts on work items Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof: Uncertain effects and effect receipts on work items.** The served test `tests/durable/test_uncertain_effect_served.py::test_started_item_never_dead_letters` claims an item, marks its effect started, lets the lease expire past the attempt ceiling and observes the item open. It then records a receipt and observes a terminal item. Criterion benchmark `benches/work_item_effect_receipt.rs` runs at 10k items with 32 writers. The p50 is under 150 microseconds and the p99 is under 700 microseconds per receipt. Memory stays under 16 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R700 Retention cleanup removes aged documents and orphans (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Retention cleanup removes aged documents and orphans (rollup).** Retention policy removes documents past their age limit. It also removes nodes left without any edge or owner. It works in bounded batches. A batch never removes a node held by a live reference or a legal hold. Implemented in eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R700.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** `RetentionPolicy { age, batch, holds }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R700.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Candidates are scanned in id order with a cursor; each batch is one `MutationBatch`. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R700.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** Runs on the maintenance lane and respects blob grace periods (R050). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R700.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** The engine never removes a node with a live reference or hold. It refuses a policy without a hold check at registration. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R700.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Each batch records counts and the cursor. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R700.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/durable/test_retention_cleanup_served.py::test_held_and_referenced_nodes_survive` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/retention_scan.rs` must show p50 under 8 ms and p99 under 50 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R710 Backend-agnostic graph copy and persisted-index migration catalogue: model and behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Backend-agnostic graph copy and persisted-index migration catalogue: model and behavior.** Extends `EG-DURABLE-KERNEL-R070`. `crates/eg-core` copies a graph between stores by streaming typed batches. Each batch has a verified count and digest. The crate also keeps one catalogue of one-time persisted-index migrations. Each migration has a spec, a run function and an idempotency marker. Copy is O(nodes + edges) with bounded memory. The migration catalogue runs in declared order. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R711 Backend-agnostic graph copy and persisted-index migration catalogue: refusal, evidence and hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Backend-agnostic graph copy and persisted-index migration catalogue: refusal, evidence and hot-path proof.** Extends `EG-DURABLE-KERNEL-R070`. The engine refuses a copy whose destination digest differs. It leaves the destination empty. It refuses a migration without a marker. Test `tests/durable/test_graph_copy_served.py::test_digest_mismatch_leaves_destination_empty`. Benchmark `benches/graph_copy.rs` has p50 under 400 ms and p99 under 1500 ms per 100,000 elements. Memory stays under 128 MiB. Copies of different graphs run in parallel. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R100.700 Mirror target naming and a lossless per-mirror outbox: model and behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Mirror target naming and a lossless per-mirror outbox: model and behavior.** Mirror sinks accept only validated target graph names. They refuse an unconfigured or reserved target. They deliver through one durable outbox per mirror with head-only attempt accounting (R001). One slow mirror never blocks the authority or another mirror. The authority commits first. A mirror hand-off after an authority commit is a typed retry, never a rollback. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R100.701 Mirror target naming and a lossless per-mirror outbox: refusal, evidence and hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Mirror target naming and a lossless per-mirror outbox: refusal, evidence and hot-path proof.** A reserved target name is refused; an authority-committed hand-off failure is retried from the outbox. Test `tests/durable/test_mirror_outbox_served.py::test_slow_mirror_does_not_block_authority`; benchmark `benches/mirror_outbox.rs` p50 under 1 ms and p99 under 6 ms added to the authority commit, memory under 64 MiB for 1,000,000 queued entries. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R094.700 Unified identifier registry across stores: model and behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Unified identifier registry across stores: model and behavior.** Identifier generation yields one hierarchical concept identifier per entity. A registry owned by the engine resolves it identically in document, graph and vector stores. Allocation is collision-free under concurrent writers. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R094.701 Unified identifier registry across stores: refusal, evidence and hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Unified identifier registry across stores: refusal, evidence and hot-path proof.** An identifier outside the grammar is refused; a collision is refused with both owners. Test `tests/durable/test_identifier_registry_served.py::test_concurrent_allocation_is_collision_free`; benchmark `benches/identifier_alloc.rs` p50 under 0.05 ms and p99 under 0.5 ms, memory under 16 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R800 Cache tier admission, rebuild-cost eviction and answer-cache freshness (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Cache tier admission, rebuild-cost eviction and answer-cache freshness (rollup).** `crates/eg-kvcache` decides which prompt-prefix and answer entries are worth caching in each tier. It uses reuse rate and rebuild cost. It evicts by value density. It serves a semantic answer cache. Its entries expire by the volatility class of the facts they depend on. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R800.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** `CacheEntryMeta{key_digest, tier, bytes, hits, rebuild_cost_ms, deps:[GenerationRef]}` and `TierPolicy{max_bytes, min_worth}` in `crates/eg-kvcache/src/policy.rs`. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::low_worth_entry_is_not_admitted`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R800.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** `worth = hits * rebuild_cost_ms / bytes`. Admission needs worth at or above `min_worth`. Eviction removes the lowest worth first from a heap in O(log N). An answer entry is invalid once any dependency generation advances. It is also invalid once its volatility window passes. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::lowest_worth_is_evicted_first`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R800.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** The policy attaches inside the existing versioned KV tier of R083 through R086, and invalidation reuses the dependency generations of EG-FEDERATED-QUERY-R017 and R018. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::dependency_advance_invalidates_answer`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R800.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** Three inputs return a miss with no content. The first is an entry larger than the tier. The second is a dependency list that names an unknown generation. The third is a read for another tenant's key. The engine never returns a stale hit. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::oversize_entry_is_refused`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R800.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Evidence is a counter set (admitted, evicted, invalidated, hit ratio). The metrics method exposes it, together with a replayable trace of decisions. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::foreign_tenant_key_misses`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R800.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** Hot-path proof: a Criterion benchmark of 1 million admit and lookup operations reports lookup p50 under 5 microseconds. The lookup p99 stays under 50 microseconds. Admission overhead stays under 10 percent. | Planned: `crates/eg-kvcache/tests/tier_policy.rs::admit_lookup_bench_within_budget`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R850 Durable topic message log with cursor reads Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Durable topic message log with cursor reads.** The engine stores topic messages in an append-only log. Each topic has a total order. A reader reads the messages after its cursor and gets the next cursor. The engine redacts private fields before it stores a message. Rollup: LANDED only when every child is landed. | Each child requirement has its own verification. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R850.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** `eg-durable` defines `TopicEntry{topic, seq: u64, sender, body_ref, redaction_digest, appended_at}` and a `TopicCursor(u64)`. One ordered key-value table keys entries by `(topic, seq)`. Append is O(log n). A read of k entries is O(log n + k). | A unit test round-trips one entry and one cursor through the wire codec. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R850.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Append gives each entry the next `seq` of its topic. Concurrent appends to one topic serialize on one per-topic lock. Appends to different topics run in parallel. A read returns at most the requested count, in `seq` order, and the next cursor. | A test runs 8 concurrent writers on one topic and finds no gap and no repeated `seq`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R850.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** The served operations `topic.append` and `topic.read` take the verified request context. The engine checks the caller's topic scope before it touches the log. | A served test appends and reads through the verified request context. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R850.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** The engine refuses an append without topic scope with `TOPIC_SCOPE_REQUIRED`. It refuses a cursor past the topic head with `TOPIC_CURSOR_AHEAD`. It refuses a body over 1 MiB with `TOPIC_BODY_TOO_LARGE`. It stores nothing for a refused append. | A test proves each code and an unchanged log after each refusal. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R850.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Each entry keeps the sender and the redaction digest. A restart keeps every entry and its order. | A durability test restarts the engine and reads the same entries and digests. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R850.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** An append must finish within 1 ms at p50 and within 5 ms at p99. A read of 100 entries must finish within 3 ms at p99. The index must use no more than 256 bytes for each entry. The benchmark `crates/eg-durable/benches/topic_log.rs` appends 100 000 entries over 16 topics. Then it reads them back. | The benchmark reports the latency percentiles and the index memory within the budgets. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R851 Agent peer records Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Agent peer records.** The engine stores one record for each remote agent peer that the platform can call. A record holds the peer name, the endpoint, the agent card digest, the skill list and a credential reference. It never holds a credential value. Rollup: LANDED only when every child is landed. | Each child requirement has its own verification. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R851.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** `eg-types` defines `AgentPeer{name, endpoint, card_digest, skills: Vec<SkillRef>, credential_ref, refreshed_at}`. The engine keys peers by `name` in one table. Lookup is O(1) on average. | A unit test round-trips one peer through the wire codec. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R851.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Register replaces the record with the same name. Delete removes it. List returns peers in name order. A refresh that changes the card digest records a new revision. | A test registers, refreshes, lists and deletes a peer and reads each revision. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R851.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** The served operations `peer.register`, `peer.delete` and `peer.list` take the verified request context. The A2A routing decision (`EG-DECISION-ENGINE-R044`) reads the peer table. | A served test registers a peer and finds it in the routing registry. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R851.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** The engine refuses a record that holds a credential value with `PEER_CREDENTIAL_VALUE`. It refuses an endpoint without `https` outside loopback with `PEER_ENDPOINT_INSECURE`. | A test proves each code and no stored record. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R851.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Each revision keeps the caller, the card digest and the time. | A served read returns the revision history of one peer. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R851.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** With 10 000 peers, a peer lookup must finish within 200 µs at p99. The table uses at most 2 KiB per peer. Benchmark: `crates/eg-durable/benches/agent_peers.rs`. | The benchmark reports the lookup p99 and the memory within the budgets. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R852 Incident and health-anomaly records with correlation Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Incident and health-anomaly records with correlation.** The engine stores health anomalies and incidents. It groups anomalies that share a resource and a time window into one incident. An incident moves through `open`, `acknowledged`, `resolved` and `closed`. Rollup: LANDED only when every child is landed. | Each child requirement has its own verification. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R852.1 Model Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Model.** `eg-types` defines `HealthAnomaly{resource, signal, value, baseline, observed_at}` and `Incident{id, resources, anomalies: Vec<AnomalyRef>, status, opened_at, route}`. | A unit test round-trips both records through the wire codec. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R852.2 Behavior Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Behavior.** Ingest attaches a new anomaly to the open incident of its resource when the anomaly is inside the correlation window. Otherwise ingest opens a new incident. The default window is 15 minutes. The engine decision sets the window value. Status changes follow the state order only. | A test ingests three anomalies on one resource and one on another and finds two incidents. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R852.3 Wiring Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring.** The served operations `incident.ingest_anomaly`, `incident.set_status` and `incident.list` take the verified request context. Graph OS calls them from its health and alert intake. | A served test ingests an anomaly through the verified request context. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R852.4 Refusal Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Refusal.** The engine refuses a status change out of state order with `INCIDENT_STATUS_ORDER`. It refuses an anomaly without a resource with `ANOMALY_RESOURCE_REQUIRED`. | A test proves each code and an unchanged incident. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R852.5 Evidence Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Evidence.** Each incident keeps every anomaly reference and every status change with its caller. | A served read returns the anomaly list and the status history. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R852.6 Hot-path proof Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof.** With 1 000 open incidents, an anomaly ingest must finish within 2 ms at p99. Correlation is O(log n) in the open incidents of one resource. Benchmark: `crates/eg-durable/benches/incident_correlation.rs`. | The benchmark reports the ingest p99 within the budget. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R028.4 Bind run ownership during native admission Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Bind run ownership during native admission.** Optional single-run admission captures verified caller attribution in the new WorkItem transaction. Graph, tenant and run select a deterministic WorkItem ID; caller-selected IDs and batch run admission refuse. Existing bindings cannot be attached, replaced or forged through generic writes. Existing replay authority remains mandatory. | Native tests prove admission, duplicate refusal, caller attribution and generic-write refusal. Publication remains separate. | requirement | EG-DURABLE-KERNEL | SPECIFIED | src/redb_store/work_item/row_guard.rs:266 tests/adopt_workitem_authenticated_replay.rs:459 tests/test_work_item_retry_identity.py:128 tests/test_work_item_retry_identity.py:274 |
| EG-DURABLE-KERNEL-R028.4.1 Recover immutable run submission records Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Recover immutable run submission records.** `GetRunWorkItem` reads the WorkItem and original submission from one durable snapshot. Graph, tenant, run and verified owner select the record. Missing and foreign records return null. Missing or malformed historical evidence returns non-retryable `RUN_ADMISSION_UNAVAILABLE`. Completion, lease expiry and restart preserve the original submission. Generic writes cannot plant, replace or remove it. Reading grants no execution authority. | Storage tests cover restart, owner isolation, invalid evidence and immutable retry records. Served tests cover authenticated dispatch. Point lookup costs O(log N + B) time and O(B) memory for B bounded submission bytes. | requirement | EG-DURABLE-KERNEL | VERIFIED | 62374ef41f37 924601ce5495 fc65d45d509d src/redb_store/work_item/row_guard.rs:316 src/redb_store/work_item/run_owner/tests.rs:115 src/redb_store/work_item/run_owner/tests.rs:147 src/redb_store/work_item/run_owner/tests.rs:446 src/redb_store/work_item/run_owner/tests.rs:48 |
| EG-DURABLE-KERNEL-R028.4.2 Qualify recovery performance Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Qualify recovery performance.** Owner-bound recovery targets p99 below 10 ms for a bounded original submission. | A dedicated reproducible recovery benchmark must record workload, hardware, build profile and latency. Functional tests do not establish this acceptance. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R028.5 Native current-plan publication and readback Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Native current-plan publication and readback.** Apply the owner admission amendment's publication/read transaction: immutable verified owner, active exact live fence, initial empty revision zero, strictly increasing later revisions, unchanged expiry on replay, and one authoritative snapshot read. Reuse WorkItem MutationBatch receipts and scoped stable retry identity. | Native tests cover ordered publication, owner/fence/expiry/revision refusal and durable readback; authenticated replay tests prove no extra effect. Target p99 point publication/read under 10 ms for at most 1024 items and 1 MiB payload; benchmark `current_plan_publication_readback` remains required before performance acceptance. | requirement | EG-DURABLE-KERNEL | SPECIFIED | 88fc4a5577c7 f9bfc0da8ae7 crates/eg-storage/src/owner/agent_library_upgrade/tests.rs:293 crates/eg-types/src/current_plan/tests.rs:110 crates/eg-types/src/current_plan/tests.rs:3 src/redb_store/work_item/current_plan/tests.rs:135 src/redb_store/work_item/current_plan/tests.rs:66 |
| EG-DURABLE-KERNEL-R030.1 Issuer-bound host-start record Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Issuer-bound host-start record.** `IssueHostStartGrant` requires dedicated service scope `host:issue-start`; generic control-lease issuance rejects reserved kind `host.start`. Reuse the protected ControlLease row and MutationBatch. Engine time bounds expiry to the asserted session expiry and existing 24-hour limit. Persist immutable beneficiary, session, workspace, configuration, interface and policy assertions and storage-owned issuer provenance from the authenticated batch actor, outside grant JSON. Legacy rows lack provenance and do not qualify. Generic consumption refuses; CAS revoke/expire only remove availability. Arbora owns current session/issuer policy and actual connector execution, not this record. No cross-store atomic session admission or external-effect reservation is claimed. Maximum grant 64 KiB, reference 512 bytes, one inserted row. Benchmark: `redb_write_latency_bench`; host-start latency measurement remains pending. | Typed tests cover bounds and forged provenance; native storage tests cover issuer stamping, collisions, legacy absence, revocation and consumption refusal. Served scope tests reject lease-only callers. Generated contract and native qualification are required before release. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R083.5 Tier ladder from accelerator memory to durable storage Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Tier ladder from accelerator memory to durable storage.** The inference connector `epistemic_graph/kvcache/connector.py:221` must offload a block from accelerator memory to the engine. `crates/eg-kvcache/src/tiered.rs:319` must place the block in the hot host-memory tier. Byte pressure must demote the lowest-scored block one rung: hot, compressed warm, then durable cold. The durable cold tier must use the redb store of `crates/eg-kvcache/src/cold.rs`. A hit must promote the block to hot. A demotion must move the bytes and must not drop them. | `crates/eg-kvcache/tests/tier_ladder.rs::demote_then_promote_keeps_bytes` fills each tier past its budget and reads every block back byte-identical. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R083.6 Graph-guided paging policy Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Graph-guided paging policy.** `apply_importance_scores` at `crates/eg-kvcache/src/tiered.rs:289` must take block importance from the graph centrality of `crates/eg-kvcache/src/graph_importance.rs:35`. The demotion score must combine recency and importance with the weight of `tiered.rs:263`. A hit must prefetch the cold blocks whose graph neighbors the same request reads. | `crates/eg-kvcache/tests/graph_paging.rs::central_blocks_stay_hot_and_neighbors_prefetch` shows a central block outlives a peripheral block and a neighbor block pages in early. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R083.7 Long-context coherence across tiers Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Long-context coherence across tiers.** A context of 10 000 000 tokens must stay coherent across all tiers. Coherent means that each paged-in block digest equals its digest at first write. The tier must not serve a block under a different model version or token-prefix hash. | `crates/eg-kvcache/tests/long_context.rs::ten_million_token_context_pages_in_coherent` writes the context over a 25 percent host budget and finds zero digest mismatches. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R083.8 Tier refusals Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Tier refusals.** A failed durable cold write must keep the block in the warm tier and return `KV_COLD_WRITE_FAILED`. A page-in with a digest mismatch must refuse with `KV_BLOCK_DIGEST_MISMATCH` and must drop the block. | `crates/eg-kvcache/tests/tier_ladder.rs::cold_write_failure_and_digest_mismatch_refuse` asserts each code and an unchanged tier state. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R042.2 Cross-modal query latency benchmark Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Cross-modal query latency benchmark.** The harness `crates/eg-plan/benches/hybrid_queries.rs` must run the `EG-CQ-XSRC-R009` program on a fixed corpus. The corpus holds 1 000 000 claims, 10 000 000 edges and 1 000 000 vectors of 384 dimensions. The starting target is 150 ms at p50 and 500 ms at p99. A measurement on this platform replaces the starting target. | The harness writes a `BenchmarkClaim` receipt with the configuration, the corpus digest, p50 and p99. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R042.3 KV-cache tiering benchmark Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**KV-cache tiering benchmark.** The harness `crates/eg-kvcache/benches/tiering.rs` must replay a multi-turn trace with a host-memory budget of 25 percent of the working set. The starting hit-rate target is at least 0.90 over all tiers. The starting cold page-in target is 5 ms at p99 for a 2 MiB block. It must also run a 10 000 000-token context with zero digest mismatches. | The harness writes a `BenchmarkClaim` receipt with the hit rate per tier, the page-in p99 and the mismatch count. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R042.4 Ingest throughput benchmark Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Ingest throughput benchmark.** The harness `benches/ingest_throughput.rs` must run the native admission path for 10 minutes. Each batch must hold 1 000 records. The starting targets are 50 000 records per second sustained and a commit p99 of 50 ms or less. A restart after the run must find every acknowledged record. | The harness writes a `BenchmarkClaim` receipt with the sustained rate, the commit p99 and the post-restart record count. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R042.5 Wire protocol benchmark Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wire protocol benchmark.** The harness `benches/wire_protocols.rs` must drive each listener of `EG-DURABLE-KERNEL-R860` with a standard client of its protocol. Each listener must carry 64 concurrent sessions. The starting point-read targets at p99 are 2 ms for PostgreSQL wire, 3 ms for Bolt and 1 ms for RESP. The starting target for an S3-compatible GET of 1 MiB is 10 ms at p99. | The harness writes one `BenchmarkClaim` receipt per protocol with p50, p99 and the session count. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R042.6 Benchmark publication and regression gate Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Benchmark publication and regression gate.** Each harness of `.2` to `.5` must publish its result as a `BenchmarkClaim` of `.1`. The claim must carry the configuration and the hardware identity. CI must fail when a measured value regresses more than 10 percent from the last published receipt. | `tests/test_benchmark_receipts.py::test_regression_over_ten_percent_fails` feeds a regressed receipt and asserts the gate fails. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R860 Served wire protocol listeners (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Served wire protocol listeners (rollup).** The engine must serve four wire protocols over its one store. The protocols are PostgreSQL wire, Bolt, RESP and an S3-compatible object API. Each listener must use the authenticated admission path of the served methods. `EG-DURABLE-KERNEL-R035` owns PostgreSQL operational parity beyond `.1`. Children `.1` to `.6` deliver it. | Each child requirement has its own verification. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R860.1 PostgreSQL wire listener Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**PostgreSQL wire listener.** `src/main.rs:1154` must start the listener of `src/server/pgwire` when its address is set. Simple and extended query must run SQL on the engine planner. | `tests/pgwire_roundtrip.rs` runs a simple and an extended query through a standard client. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R860.2 Bolt listener Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Bolt listener.** `spawn_bolt_listener` at `src/main.rs:1367` must start the listener of `src/server/bolt_wire`. A `RUN` message must run its openCypher text on the engine graph query engine. | `tests/bolt_roundtrip.rs::run_returns_records` runs a match through a standard Bolt client and reads the records. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R860.3 RESP listener Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**RESP listener.** `src/main.rs:1391` must start the RESP listener of `src/server/redis_wire`. RESP key commands must map to the served KV methods of `EG-DURABLE-KERNEL-R102`. | `tests/resp_roundtrip.rs::set_get_maps_to_kv_methods` writes with `SET` and reads the value back through `KvGet`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R860.4 S3-compatible object API Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**S3-compatible object API.** `src/main.rs:1461` must start the object API of `src/server/s3` over the selected blob store. Object put, get, list and delete must map to content-addressed blobs. | `tests/s3_roundtrip.rs::put_get_list_delete` drives each operation through a standard S3-compatible client. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R860.5 Listener refusals Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Listener refusals.** Each listener must refuse an unauthenticated session with the error form of its protocol. A listener must not bind a non-loopback address without a configured credential. | `tests/wire_listeners_one_store.rs::unauthenticated_sessions_refuse` asserts the refusal on each protocol and no state change. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R860.6 Hot-path proof: one store behind four protocols Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof: one store behind four protocols.** The test must start the server binary with all four listeners. A standard client must write a record through one protocol. Standard clients of the other protocols must read the same record. | `tests/wire_listeners_one_store.rs::write_one_protocol_read_all` passes through the real listeners. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R028.5.1 Typed executable attachment Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Typed executable attachment.** `CurrentPlanSnapshot.task_plan` optionally contains the canonical `EG-DECISION-ENGINE-R134.111` TaskPlan. Explicit attachments require `PublishCurrentPlanRequest.task_plan_proposal`. EG recomputes the entire plan from that original proposal and requires exact equality. An unpaired proposal or plan refuses. Legacy requests omit both fields. | `current_plan_task_plan_validation_and_legacy_roundtrip` and `current_plan_task_plan_rejects_unpaired_or_changed_content` cover compatibility and malformed attachments. The existing 64-task, 64-KiB prompt and eight-worker bounds apply. Validation uses O(T(T + D) log T + P) time and O(T + D + P) memory. | requirement | EG-DURABLE-KERNEL | SPECIFIED | crates/eg-types/src/current_plan/tests.rs:20 crates/eg-types/src/current_plan/tests.rs:56 |
| EG-DURABLE-KERNEL-R028.5.2 Immutable fenced attachment Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Immutable fenced attachment.** `current_plan::publish` binds the first TaskPlan through the existing owner transaction. An initial empty revision zero may attach a plan. A later increasing revision may attach one if absent. Omitted attachments preserve the bound plan; different plans refuse. The effective payload digest includes retained attachments. | `current_plan_attachment_is_immutable_and_scaffold_updates_preserve_it` and `current_plan_attachment_refusals_preserve_rows` verify atomic storage and unchanged refused rows. Existing owner, native claim, fence, lifetime and revision checks remain mandatory. | requirement | EG-DURABLE-KERNEL | SPECIFIED | src/redb_store/work_item/current_plan/tests/attachment.rs:13 src/redb_store/work_item/current_plan/tests/attachment.rs:139 src/redb_store/work_item/current_plan/tests/attachment.rs:61 |
| EG-DURABLE-KERNEL-R028.5.3 Attachment replay and recovery Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Attachment replay and recovery.** Existing MutationBatch identity binds the request, not its transport attempt. Exact replay returns the original receipt without writes or refreshed availability. Changed-plan replay refuses. `GetCurrentPlan` returns the bound TaskPlan from the same authoritative owner and lease snapshot. | `current_plan_native_publish_read_and_receipt_replay` verifies authenticated attachment, conflict, receipt replay and restart readback. `publication_attachment_changes_content_not_retry_identity` checks identity separation. Functional acceptance does not establish the performance budget in `EG-DURABLE-KERNEL-R028.5.4`. | requirement | EG-DURABLE-KERNEL | SPECIFIED | src/server/mutation_batch/digest.rs:319 tests/adopt_workitem_authenticated_replay.rs:588 tests/decide/test_task_plan_served.py:230 tests/decide/test_task_plan_served.py:351 |
| EG-DURABLE-KERNEL-R028.5.4 Attachment performance qualification Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Attachment performance qualification.** Measure native publication and readback with 64 tasks under the parent 10-ms p99 budget and at most 8 MiB transient payload memory. | A reproducible `current_plan_publication_readback` benchmark receipt must include workload, build profile, hardware and latency/memory measurements. This performance qualification remains pending; functional tests are not a substitute. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R028.6 Commit ordinary run completion and observed usage atomically Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Commit ordinary run completion and observed usage atomically.** A terminal WorkItem commit may carry `RunCompletionInput` for its original admitted run. The native transaction checks the live worker fence and immutable owner binding. Ordinary completion uses the engine commit clock for expiry and its terminal timestamp, not caller time. It commits the terminal row, receipt and one digest-bound outbox event together. Counters contain only observed nonnegative exact integers; omitted usage stays unknown, not zero. Failed or cancelled runs cannot publish an answer reference. Owner-bound recovery reads the exact receipt from one snapshot. Terminal replay preserves the first receipt. Ordinary completion and delegated outcome extensions are exclusive. | Native tests cover success, failure and unknown usage, live-fence refusal, owner/scope mismatch, replay, corruption and reopen. Generic writes cannot forge or remove bindings. Generated contracts expose the typed input and receipt. New-head native and served validation remain required; historical receipts do not prove this revision. | requirement | EG-DURABLE-KERNEL | VERIFIED | 42376299456f 701e8e498e07 870424b46d0b 8b5cbc59e851 b286edc1b3bf src/redb_store/work_item/run_owner/tests.rs:200 src/redb_store/work_item/run_owner/tests.rs:225 src/redb_store/work_item/run_owner/tests.rs:249 src/redb_store/work_item/run_owner/tests.rs:325 src/redb_store/work_item/run_owner/tests.rs:446 |
| EG-DURABLE-KERNEL-R861 Graph lifecycle replay and graph listing survive a patch upgrade (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Graph lifecycle replay and graph listing survive a patch upgrade (rollup).** A store that the previous patch release wrote keeps working after an engine upgrade. Children `.1` and `.2` deliver it. | Each child requirement has its own verification. | requirement | EG-DURABLE-KERNEL | VERIFIED | 9d5b6a58de75 eec3e5ffbf2d f3b89fbc5e09 fcb8d033061e src/server/mutation_batch/lifecycle_tests.rs:480 tests/test_upgrade_store_listing.py:39 |
| EG-DURABLE-KERNEL-R861.1 Lifecycle replay compares the stored identity Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Lifecycle replay compares the stored identity.** The engine answers a `CreateGraph` or `DeleteGraph` retry from the stored lifecycle receipt. It compares the receipt's retained identity: graph, graph type, principal, tenant scope and idempotency key. It never recompiles the batch to compare digests. So a receipt that the previous patch release wrote replays instead of conflicting. A receipt with a different identity stays an idempotency conflict. The engine refuses an attempt that re-presents the nonce its receipt consumed as REPLAY_NONCE_CONSUMED, before any identity check. Only a fresh attempt under the same idempotency key replays. | A unit test shows that a stored receipt with the same identity and different bytes counts as committed. The same test shows that a different graph type, principal or key is a conflict. It also shows that the engine refuses the consumed nonce and replays a fresh one. The served test t05 confirms that the engine refuses an identical signed envelope as REPLAY_NONCE_CONSUMED. | requirement | EG-DURABLE-KERNEL | VERIFIED | 9d5b6a58de75 f3b89fbc5e09 fcb8d033061e src/server/mutation_batch/lifecycle_tests.rs:480 |
| EG-DURABLE-KERNEL-R861.2 Graph listing survives a restart and a patch upgrade Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Graph listing survives a restart and a patch upgrade.** `ListGraphs` decides each graph from its catalog record, which keeps the graph type and owner. So a graph that is still catalog-only after a restart gets the same access decision as a resident graph. The stored policy decides: the engine lists a graph only for a principal that the policy lets read it. When `ListGraphs` filters out a graph, the engine logs the refusal reason without secrets. After an upgrade, the engine still lists the commons and tenant graphs of a previous-patch store. | A served test reopens a store and checks that the engine lists both graphs for the System identity. It also checks that the engine lists neither graph for a registered identity with no grants or for an unregistered principal. This build writes the store, and the previous patch's published engine also writes one when the test gets that engine. | requirement | EG-DURABLE-KERNEL | VERIFIED | eec3e5ffbf2d tests/test_upgrade_store_listing.py:39 |
| EG-DURABLE-KERNEL-R862 A copied store or bundle restores onto new files (rollup) Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**A copied store or bundle restores onto new files (rollup).** Each store binds to the device and inode of its files. So a copied data directory refuses to open with `mutation store root incarnation mismatch`. Offline `restore` also refuses a copied bundle, because it opens bundle sources through `Shard::open`. Children `.1` to `.3` deliver an explicit, verified re-binding. The ordinary open keeps refusing a copied file. | Each child requirement has its own verification. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R862.1 Restore reads bundle sources by content, not by physical identity Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Restore reads bundle sources by content, not by physical identity.** `src/server/persistence/shard_migrate.rs::open_source_shards` opens each bundle file read-only. It checks the bundle manifest digests and the source owner manifest instead of the root incarnation. Restore then writes every destination store fresh, bound to its own new files. A digest mismatch refuses the restore and writes no destination file. | A unit test restores a bundle copied to new inodes and reads every row back. A test with one changed byte refuses the restore and leaves the destination empty. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R862.2 Wiring: an explicit command re-binds a copied data directory Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Wiring: an explicit command re-binds a copied data directory.** `epistemic-graph-server store-upgrade rebind <data-dir> --confirm` holds the engine lock. It verifies the content digests of each store. Then it binds the root incarnation of each store to its current files. Each store changes in one atomic commit. Without `--confirm` the command writes nothing. The ordinary open still refuses a copied store. | Command tests copy a store and show that the ordinary open refuses it. Then they run `rebind` and reopen the store with its rows kept. A second run reports nothing to do. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R862.3 Hot-path proof: a copied bundle restores and serves Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Hot-path proof: a copied bundle restores and serves.** A served test takes a backup bundle and copies it with `cp -a`. It restores the copy into a new data directory. Then it starts the engine on that directory. The engine lists the backed-up graphs and reads their nodes. | `tests/test_store_copy_restore.py` runs the served engine over a copied bundle and a re-bound copied data directory. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-DURABLE-KERNEL-R028.4.3 Reserve ordered conversation turns with native run admission Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Reserve ordered conversation turns with native run admission.** Optional version-one `ConversationTurnAdmission` binds a context ID, expected head revision and exact preceding run. The existing `SubmitWorkItem` transaction stores a protected head in the graph-incarnation-scoped NODES table with the new WorkItem and immutable original request. Revision zero creates a head. A later reservation checks the same tenant, verified owner, context and preceding run in that write snapshot. Only a successful preceding run may advance the head. Active, failed, cancelled, dead-letter, missing or unknown predecessors refuse. Stale revisions conflict; no branch or implicit queue is created. Generic writers cannot create, replace or remove a head. Existing contexts with a head refuse metadata-only admission. Ordinary requests omit the new field without changing their serialized form. | Source tests cover admission order, same-head contenders, refusal rollback, owner isolation, reopen, unknown state, legacy codec and generic-write guards. Actual MutationBatch replay, changed-body conflict, graph-incarnation isolation, generated contracts and native execution remain required. A successful WorkItem is not a completed-history receipt. The host must validate the exact completed checkpoint before execution. This child does not deliver transcript paging or served continuation. | requirement | EG-DURABLE-KERNEL | VERIFIED | 1c6664149612 2df788ead124 74bd0bcf3899 a1874ae34e29 src/redb_store/work_item/conversation/tests.rs:138 src/redb_store/work_item/conversation/tests.rs:159 src/redb_store/work_item/conversation/tests.rs:175 src/redb_store/work_item/conversation/tests.rs:215 src/redb_store/work_item/conversation/tests.rs:235 |
| EG-DURABLE-KERNEL-R028.4.4 Replay a repeated run admission from its retained owner receipt Definition — EG-DURABLE-KERNEL / EG-DURABLE-KERNEL — Durable graph kernelCanonical requirement and verification source**Replay a repeated run admission from its retained owner receipt.** A retry of a native run admission carries the same run, key and command. Its request context may carry fresh clocks or correlation values. The engine reads the native receipt of the original committed admission. It checks the actor, tenant, single operation, result and immutable WorkItem owner binding. It then rebuilds that exact retained operation and recompiles it through the normal ledger. The retry carries fresh outer authentication and a fresh nonce. The retry returns the original receipt and writes nothing. Canonical digest rules and historical receipts stay unchanged. Metadata alone is never admission evidence. A changed policy, input or command refuses. Missing or corrupt retained evidence refuses with non-retryable `RUN_ADMISSION_UNAVAILABLE`. | Authenticated replay tests send a refreshed context. They require the original receipt, outbox and version, also after a restart. They require refusal for a changed policy, input or command and for missing or corrupt retained evidence. An upgrade test opens a store written by the server before this change and replays an admission it recorded. | requirement | EG-DURABLE-KERNEL | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY EG-IDENTITY — Engine identity, mode and scope authority | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R001 Multi-issuer OIDC trust list with per-issuer kind limits Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Multi-issuer OIDC trust list with per-issuer kind limits.** EG's primary OIDC verifier (src/server/oidc.rs, src/server/auth.rs) maintains an explicit, ordered multi-issuer trust list of issuer, JWKS source, audience, and allowed-principal-kind entries, accepts an overlapping rotated key only during a declared window, and restricts principal kind per issuer so a Keycloak-backed issuer can authenticate service principals only. | A negative test asserts an unknown, ambiguous, or disallowed-kind issuer fails verification before method dispatch, and a positive test confirms a rotated key is accepted only within its declared overlap window. | requirement | EG-IDENTITY | VERIFIED | 8fed7c656140 bb5db1746a16 src/server/issuer_trust.rs:112 src/server/issuer_trust.rs:120 src/server/issuer_trust.rs:128 |
| EG-IDENTITY-R002 Identity and RBAC writes recompute roles and audit atomically Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Identity and RBAC writes recompute roles and audit atomically.** Every identity or RBAC mutation in EG (security.rs, identity_admin.rs) recomputes the complete effective role set within the same durable transaction as the write, and src/audit.rs records an allow or denial entry naming the actor, tenant, operation, target, and authorization digest change, including a bounded sample of denied attempts. | A restart/fault test confirms a failed persistence rolls back the role change and its audit entry together, and a tamper-detection check catches a reordered or altered identity audit record. | requirement | EG-IDENTITY | VERIFIED | 8fed7c656140 f9a69bfe8a9c crates/eg-core/src/isolation/identity_store_tests/tenant_and_audit.rs:139 crates/eg-core/src/isolation/identity_store_tests/tenant_and_audit.rs:190 |
| EG-IDENTITY-R003 Identity mode is a durable singleton with CAS transition Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Identity mode is a durable singleton with CAS transition.** EG stores identity mode (none, local, or external) as a durable singleton with a monotonic epoch, transitions it only via compare-and-set once a new identity_config component validates the documented preconditions for that transition, and invalidates every active authentication token and rotates issuer material after the commit while retaining accounts, links, grants, and data. | A fault-injection test confirms a stale epoch, missing surviving admin, or unmet precondition returns a typed refusal with no mode or data change, and an integration test confirms tokens are invalidated only after the transition commits. | requirement | EG-IDENTITY | SPECIFIED | 8fed7c656140 f9a69bfe8a9c crates/eg-types/src/identity/tests/modes.rs:111 crates/eg-types/src/identity/tests/modes.rs:182 |
| EG-IDENTITY-R003.1 Explicit isolated anonymous store authority (native TCP qualification) Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Explicit isolated anonymous store authority (native TCP qualification).** EG consumes Arbora's explicit local `none` admission through `--auth-mode none` / `GRAPH_SERVICE_AUTH_MODE=none`. This mode requires no secret and either private UDS or literal loopback native TCP. It rejects auxiliary listeners and cluster configuration. The durable store must be fresh or already anonymous-marked. Default authenticated startup remains unchanged and refuses anonymous stores. A distinct server-owned origin supplies anonymous authority. It fixes principal `anonymous`, tenant `local` and policy `no-auth`, without credentials or signed request envelopes. Caller claims cannot substitute identity. The engine refuses mismatched embedded authority with the existing typed `ACCESS_DENIED` code. Existing ACL and mutation machinery grants local-owner access within the isolated anonymous store. This mode neither changes authenticated stores nor grants external identities. This child does not implement mode conversion. | Real served tests cover create, write, read and restart. Negative tests cover missing default credentials, mixed credentials, remote listeners, alternate transports, store reuse and mode mismatch. This receipt qualifies native TCP only. R003.3 retains private UDS and exhaustive feature-matrix qualification. R003.2 retains performance measurement. The parent row retains mode conversion. | requirement | EG-IDENTITY | VERIFIED | 5918e6017779 844fec51e35a tests/test_native_no_auth_served.py:15 |
| EG-IDENTITY-R003.2 Measured anonymous admission budget (pending) Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Measured anonymous admission budget (pending).** Measure the bounded anonymous authority decoder separately from graph operations; target p99 <100 us and <8 KiB per authority allocation. | Pending a dedicated benchmark implementation and reproducible receipt. Functional tests for R003.1 do not verify this row. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R003.3 Additional isolated-mode runtime qualification (pending) Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Additional isolated-mode runtime qualification (pending).** Qualify the implemented private-UDS transport on a host that permits Unix sockets and the default feature matrix, including AST repository enrichment. The same origin/store/loopback boundaries must hold. | Pending real UDS and full-feature runtime receipts. Native TCP tests and static mode-aware background branches do not verify this row. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R004 Generated scope registry classifies every capability scope Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Generated scope registry classifies every capability scope.** EG publishes a single generated, versioned scope registry from crates/eg-capabilities capability declarations, classifying each scope as user, domain, service-only, approver, or admin, with the generated package catalog and server checks sharing the same digest. GraphOS owns `decide:commit` (service-only) and `policy:read`, `security:read`, `swarm:read`, `telemetry:read`, `usage:read` (user); registration grants no access and consumers retain exact-scope and verified-tenant enforcement. | A generation check confirms the published scope registry digest matches the server's own classification for every declared scope, and a negative test confirms an unclassified or wildcard scope fails generation. | requirement | EG-IDENTITY | VERIFIED | 15acf1a959e5 63488a50eefc 6c11520aebfc 8503b23fdddd a2cbfc473ba2 crates/eg-capabilities/src/scopes/tests.rs:140 crates/eg-capabilities/src/scopes/tests.rs:200 crates/eg-capabilities/src/scopes/tests.rs:38 crates/eg-capabilities/src/scopes/tests.rs:51 crates/eg-capabilities/src/scopes/tests.rs:65 |
| EG-IDENTITY-R005 Semantic workers use one identity across queue classes Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Semantic workers use one identity across queue classes.** A production semantic worker presents a single verified identity consistently across every queue class it processes, rather than switching principals per class, so authorization and audit records for its work remain attributable to one principal. | `dispatch_attributes_every_queue_class_to_the_one_verified_principal` verifies principal attribution. `semantic_owner_registry_is_scoped_to_persistence_root` checks root isolation and canonical alias reuse in `src/server/semantic_index.rs`. | requirement | EG-IDENTITY | VERIFIED | 1c6b4c961a40 62bec8a1ae94 6c11520aebfc src/server/semantic_index/dispatch_pipeline_tests.rs:600 |
| EG-IDENTITY-R006 Tenant roles read the shared commons graph Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Tenant roles read the shared commons graph.** `IsolationLayer::provision_tenant_graph_access` (crates/eg-core/src/isolation/policy_admin.rs) grants the `tenant:<slug>` role Read on the exact `__commons__` graph, beside its tenant-pattern Read and Write grants. | A unit test confirms a tenant member reads `__commons__`, cannot write it, and cannot read another tenant's graph. The idempotence test confirms three grants after repeated provisioning. | requirement | EG-IDENTITY | VERIFIED | 0374378eb9db 7622e4b24455 dfb2367561d1 crates/eg-core/src/isolation.rs:1756 |
| EG-IDENTITY-R007 Scopes `identity:admin`, `loops:read` and `loops:control` are registered in the engine contract Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Scopes `identity:admin`, `loops:read` and `loops:control` are registered in the engine contract.** `contract/scopes.json` (and its `epistemic_graph/contract` mirror) registers `identity:admin` (class admin), `loops:read` (user) and `loops:control` (domain), generated from `crates/eg-capabilities/src/scopes.rs`. Unblocks graph-os ARBORA-OPS-R014 identity operations and ARBORA-OPS-R022.2.1. | The R004 generation check passes with the three scopes present and a negative test shows an unregistered scope still fails generation. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R008 Run scope comes from a durable policy node, never from plan text (rollup) Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Run scope comes from a durable policy node, never from plan text (rollup).** The engine must bound a run's tool and data scope by a stored policy node. A model-written plan must never widen that bound. | Test: `crates/eg-core/tests/scope_bound.rs::plan_cannot_widen_policy_bound` | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R008.1 Locate and wire the attach point Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Locate and wire the attach point.** The implementer must find where a plan's tool set is admitted beside `crates/eg-core/src/isolation/policy_admin.rs` and record `file:line` in `plan.md`. | Test: `crates/eg-core/tests/scope_bound.rs::attach_point_is_reached` | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R008.2 Typed `ScopeBound` Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Typed `ScopeBound`.** Add `ScopeBound { policy_iri, allowed_tools, allowed_graphs }` to `crates/eg-core/src/isolation/scope_bound.rs`. The type must reject an empty `policy_iri`. | Test: `crates/eg-core/src/isolation/scope_bound.rs::tests::empty_policy_iri_is_refused` | requirement | EG-IDENTITY | VERIFIED | 3c61dc94a9ed 92de9f434e0b crates/eg-core/src/isolation/scope_bound.rs:107 crates/eg-core/src/isolation/scope_bound.rs:144 |
| EG-IDENTITY-R008.3 Pure subset check Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Pure subset check.** Add `scope_within_bound(plan_tools, bound)` to `scope_bound.rs`. It must return the first out-of-bound tool IRI, not a boolean. | Test: `crates/eg-core/src/isolation/scope_bound.rs::tests::first_excess_tool_is_named` | requirement | EG-IDENTITY | VERIFIED | 92de9f434e0b crates/eg-core/src/isolation/scope_bound.rs:123 crates/eg-core/src/isolation/scope_bound.rs:164 |
| EG-IDENTITY-R008.4 Bound is read from the stored policy node Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Bound is read from the stored policy node.** The loader must read `ScopeBound` from the principal's policy node in the graph. It must ignore any scope field carried in the plan body. | Test: `crates/eg-core/tests/scope_bound.rs::plan_scope_field_is_ignored` | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R008.5 Typed refusal `ScopeExceedsPolicy` Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Typed refusal `ScopeExceedsPolicy`.** The admission path must refuse an out-of-bound plan with `ScopeExceedsPolicy` naming the tool IRI and policy IRI. It must write an audit record. | Test: `crates/eg-core/tests/scope_bound.rs::excess_plan_is_refused_and_audited` | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R008.6 End-to-end proof over the wire Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**End-to-end proof over the wire.** A served test must submit a plan that names a tool outside the principal's policy and assert `ScopeExceedsPolicy`. A second plan inside the bound must pass. | Test: `tests/identity/test_scope_bound_served.py::test_plan_scope_is_bounded_by_policy` | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023 Principal-scoped knowledge segments with explicit sharing (rollup) Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Principal-scoped knowledge segments with explicit sharing (rollup).** The engine segments stored chats, code and memories per principal. Sharing needs an explicit scope. Retrieval returns only the current version of permitted units. Children `.1` through `.12` cover segmentation and typed principal metadata. | See each child. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.1 Model Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Model.** Add `KnowledgeUnit{id, owner, version, supersedes, access_labels, share_scope}` in `crates/eg-types/src/identity/segment.rs`. Closed `share_scope` values are `private`, `placement` and `tenant`. Proving test: `crates/eg-types/src/identity/segment.rs::tests::unit_round_trips`. | A serde round trip keeps every field and rejects an unknown scope. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.2 Behavior Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Behavior.** Add `visible_units(principal, units)` returning owned units and units a matching scope shares. It keeps only the highest version of each lineage. Each rule is a named replaceable default. Proving test: `crates/eg-types/src/identity/segment.rs::tests::superseded_and_foreign_units_hidden`. | A superseded unit and an unshared foreign unit are absent from the result. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.3 Wiring Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Wiring.** The behavior attaches in the served content-read handler, before the hits leave the retrieval function. It reuses the visibility pattern at `crates/eg-types/src/rbac_elevation/ledger.rs:268`. This row creates the call site in the served content-read handler that invokes `retrieve`. Proving test: `tests/identity/test_segment_retrieval_served.py::test_retrieve_filters_by_principal`. | A served read as principal B never returns principal A's private unit. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.4 Refusal Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Refusal.** A read naming a unit outside the principal's scope must return `OutOfScope` naming the unit id. It must not reveal the unit's content. Proving test: `crates/eg-types/src/identity/segment.rs::tests::out_of_scope_names_id_only`. | The refusal carries the id and no content field. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.5 Evidence Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Evidence.** Each read must append an audit entry. The entry lists the principal and the returned unit ids. It also counts units hidden by scope or version. Proving test: `crates/eg-types/src/identity/tests/segment_audit.rs::read_audit_counts_hidden`. | The audit entry shows returned ids and the hidden count. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.6 Hot-path proof Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served content-read wire method. The test `tests/identity/test_segment_retrieval_served.py::test_shared_unit_visible_only_in_scope` writes a private and a shared unit. It passes through the wired retrieval call and observes that only the permitted current version returns. | The served read returns the shared current unit and hides the private one. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.7 Model Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Model.** Define bounded Preference, ClientMetadata and InteractionNetwork variants in the proposed identity/segment.rs model. Resolve principal references through the canonical identity store. Graph metadata grants no authority. | Planned: tests/identity/test_typed_metadata_served.py::typed_metadata_variants_round_trip. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.8 Behavior Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Behavior.** Persist these variants as versioned graph nodes with typed links. Require the managed metadata schema before every write. File imports create validated graph records; files never become shadow authority. | Planned: tests/identity/test_typed_metadata_served.py::typed_metadata_persists_without_file_authority. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.9 Wiring Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Wiring.** Attach admission before mutation compilation at src/server/mutation_batch/compile.rs:126. Reuse gateway.rs:72, composed graph schema validation and authorized node reads. Cover structural, batch, query and RDF write routes. | Planned: tests/identity/test_typed_metadata_served.py::all_metadata_write_routes_reach_admission. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.10 Refusal Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Refusal.** Refuse untyped metadata, malformed identity references, invalid schema and unauthorized scope before durable mutation. Refusals reveal no hidden identity or graph metadata. A caller-supplied owner never replaces verified authority. | Planned: tests/identity/test_typed_metadata_served.py::invalid_metadata_has_no_durable_effect. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.11 Evidence Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Evidence.** Commit source digest, mapping version, verified actor, schema digest and parent revision with each accepted record. Preserve import provenance and idempotent replay. Refused imports leave graph and receipts unchanged. | Planned: tests/identity/test_typed_metadata_served.py::metadata_import_provenance_survives_restart. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.12 Hot-path proof Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Hot-path proof.** Use authenticated served graph writes and reads against real durable storage. Prove all variants survive restart within scope. Denied and malformed writes must leave independently read durable state unchanged. | Planned: tests/identity/test_typed_metadata_served.py::typed_metadata_served_journey. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.13 Served share grant and revoke persist across restart (rollup) Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Served share grant and revoke persist across restart (rollup).** The engine must own node sharing. An owner or a graph administrator grants or revokes a share scope through one served operation. The change must commit through durable storage. A revoke must hold after an engine restart. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.13.1 Model Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Model.** `crates/eg-types/src/acl.rs` must add `RbacAdminOp::ShareGrant{node_id, scope, grantees}` and `RbacAdminOp::ShareRevoke{node_id}`. Closed `scope` values are `private`, `org` and `commons`. `grantees` holds at most 64 interned principal ids. Proving test: `crates/eg-types/src/acl.rs::tests::share_ops_round_trip`. | A serde round trip keeps every field. It rejects an unknown scope and a 65-entry grantee list. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.13.2 Behavior Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Behavior.** Add the pure function `share_transition(current, op, actor)` in `crates/eg-core/src/isolation/share.rs`. It returns the next `_shared_scope` and `_grants` values. Only the owner or a `kg:admin` holder may change a scope. A revoke clears the grantee set and sets `private`. A commons promotion copies one node to the commons graph in the same commit. Cost is O(g) in grantee count, with no graph scan. Proving test: `share.rs::tests::revoke_clears_grants`. | Unit tests cover grant, revoke, commons promotion and a non-owner attempt. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.13.3 Wiring Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Wiring.** The `RbacAdmin` arm at `src/server/dispatch/router/identity_access.rs:47` must call `share_transition`. It commits through the mutation gateway that `ApplyMutation` uses. `row_visibility` at `crates/eg-core/src/isolation.rs:157` reads the committed keys. No second visibility store may exist. The commit holds only the graph's shard writer. Reads stay on the off-lock snapshot. | A dispatch test asserts the gateway commit and an unchanged read path. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.13.4 Refusal Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Refusal.** A caller without owner or `kg:admin` authority must receive `ACCESS_DENIED`. A node in another tenant must return `AUTH_TENANT_MISMATCH`. An absent node or an invalid scope must return `INVALID_ARGUMENT`. A refusal must change no state. | Each case returns its code. An independent readback shows unchanged properties. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.13.5 Evidence Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Evidence.** Each grant or revoke must append one audit event. The event holds actor, node id, prior scope, new scope, grantee digest and commit revision. `AuditReadEvent` must return the event. | A test reads the audit event after one grant and one revoke. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.13.6 Hot-path proof Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served `RbacAdmin` method. The test `tests/identity/test_share_restart_served.py::test_org_share_revocation_persists_across_restart` writes a node, shares it to the org and revokes the share. It stops the engine with SIGTERM and restarts it on the same data directory. A second principal must not see the node after restart. The benchmark `benches/share_transition.rs` must show p50 under 2 ms and p99 under 10 ms per operation on a 1,000,000-node graph. | The served test passes against a restarted engine, and the benchmark receipt meets the budget. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R610 Tenant sharing, parent chains, secured reads and ownership claims are enforced in the engine (rollup) Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Tenant sharing, parent chains, secured reads and ownership claims are enforced in the engine (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R610.1 Model Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Model.** `crates/eg-types/src/tenancy.rs` defines TenantParent, AccessibleGraphs, Marking, ReadAudit, OwnershipClaim, ClaimPreview. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R610.2 Behavior Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Behavior.** Each tenant sees its own graph, its ancestors' shared graphs in precedence order, and the commons. Sharing is private by default and explicit. Reads are filtered by marking and tenant before results leave, and every read is audited. An admin can preview then apply a claim over unowned nodes, which stamps owner and classification and is itself audited. Queries are scoped by injecting a tenant predicate on the first bound node variable; an unscopable query is refused. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R610.3 Wiring Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Wiring.** Extends EG-IDENTITY-R023 and R006; the scope predicate is applied in the UQL planner. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R610.4 Refusal Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Refusal.** A read query with no bindable node variable is refused rather than run unscoped. The stable code is `QUERY_UNSCOPABLE`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R610.5 Evidence Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Evidence.** Audit line per read and per claim with actor, tenant, count. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R610.6 Hot-path proof Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Hot-path proof.** scope injection plus marking filter: p50 under 80 us per query, p99 under 400 us. The benchmark is `benches/r610_engine_identity_and_scope.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R023.600 Hierarchical tenant chains and audited reads Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Hierarchical tenant chains and audited reads.** Segment visibility follows the parent chain in precedence order and every read emits an audit line, as `EG-IDENTITY-R610` defines. | Test builds a three-level chain and asserts visibility order and one audit line per read. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R700 Graph ownership is inferred from signals and applied as reversible grants (rollup) Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Graph ownership is inferred from signals and applied as reversible grants (rollup).** The engine recommends an owner and role grants for each graph from ownership signals (naming hints, creators, activity). It produces a grant plan. It applies the plan through RBAC admin with a rollback record. It refuses to widen access without approval. Implemented in eg-identity. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R700.1 Model Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Model.** `GraphOwnershipSignals`, `OwnershipDisposition`, `GrantPlanEntry` and `RollbackEntry` in `crates/eg-identity`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R700.2 Behavior Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Behavior.** Signals are read once per graph. The plan is deterministic. Apply is transactional per graph. Rollback restores exactly the prior role set. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R700.3 Wiring Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Wiring.** Apply uses `RbacAdmin`; because registering identity replaces the role set, the plan carries the full intended set. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R700.4 Refusal Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Refusal.** A plan that removes the last admin or widens a graph beyond its tenant is refused. Apply without a rollback record is refused. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R700.5 Evidence Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Evidence.** Every applied grant stores actor, plan digest and rollback entry. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-IDENTITY-R700.6 Hot-path proof Definition — EG-IDENTITY / EG-IDENTITY — Engine identity, mode and scope authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/identity/test_graph_ownership_served.py::test_apply_then_rollback_restores_prior_roles` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/ownership_plan.rs` must show p50 under 4 ms and p99 under 25 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-IDENTITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY EG-ENGINE-PARITY — Relational engine parity inside one library | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R001 Single committer with group commit and batched fsync (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Single committer with group commit and batched fsync (rollup).** The engine must keep one committer per store file. The committer must batch concurrent write requests into one transaction and one fsync. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R001.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `GroupCommitter{max_batch, max_wait_us}` in `crates/eg-storage/src/group_commit.rs`. Requests queue on a bounded channel. The committer drains up to `max_batch` requests or waits up to `max_wait_us`. One redb write transaction and one fsync cover the batch. Each request receives its own result. | `crates/eg-storage/tests/group_commit.rs::batch_shares_one_fsync` sends 64 requests and counts fsync calls. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R001.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** Every durable write path calls the committer, beside the existing durability batching of EG-DURABLE-KERNEL-R016 and R040. A failed request in a batch refuses alone with its typed error. The other requests commit. A full queue refuses with `COMMIT_QUEUE_FULL`. | `crates/eg-storage/tests/group_commit.rs::one_failure_does_not_fail_batch` mixes one invalid request into a batch. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R001.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-storage/benches/group_commit.rs` commits 64 concurrent single-row writes. Throughput reaches at least 20,000 commits per second on the soak host. The p99 stays under 5 ms. | `cargo bench -p eg-storage --bench group_commit` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R002 Optimistic concurrency with read and write sets (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Optimistic concurrency with read and write sets (rollup).** A transaction must read from an MVCC snapshot and record its read set and write set. The committer validates both at commit. A conflict refuses with a typed error. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R002.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `TxnFootprint{snapshot_seq, reads, writes}` in `crates/eg-transaction/src/occ.rs`. Keys are table and key ranges. Validation fails when a key in `reads` or `writes` changed after `snapshot_seq`. | `crates/eg-transaction/tests/occ.rs::write_skew_is_detected` runs two transactions over one invariant. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R002.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** SQL, UQL and native mutation paths build the footprint. The group committer of R001 validates it. A conflict refuses with `TXN_CONFLICT{keys}` and writes nothing. It extends the version-checked writes of EG-DURABLE-KERNEL-R084. | `crates/eg-transaction/tests/occ.rs::conflict_refuses_and_writes_nothing` asserts the code and an unchanged store. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R002.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-transaction/benches/occ.rs` validates footprints of 100 keys. The added p99 per commit stays under 50 microseconds. | `cargo bench -p eg-transaction --bench occ` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R003 Partitioned store files for parallel writers (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Partitioned store files for parallel writers (rollup).** The engine must place each tenant, or each declared partition, in its own store file with its own committer. Writers to different files commit in parallel. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R003.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `PartitionMap{key_rule, files}` in `crates/eg-storage/src/partition.rs`. The rule is `tenant` by default or a declared key prefix. One committer of R001 runs per file. | `crates/eg-storage/tests/partition.rs::two_partitions_commit_in_parallel` measures overlap of two writers. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R003.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** The store registry of EG-DURABLE-KERNEL-R055 lists every partition file. A batch over two partitions uses the cross-store path of EG-DURABLE-KERNEL-R034 or refuses with `CROSS_PARTITION_BATCH`. | `crates/eg-storage/tests/partition.rs::cross_partition_batch_refuses_or_coordinates` submits one mixed batch. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R003.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-storage/benches/partition.rs` runs 8 tenants with 8 writers each. Total throughput reaches at least 6 times the single-file throughput of R001. | `cargo bench -p eg-storage --bench partition` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R004 Lock-free acceptance for disjoint keys (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Lock-free acceptance for disjoint keys (rollup).** Concurrent transactions whose footprints do not overlap must all commit with no global lock. This generalizes the disjoint-path acceptance of EG-SCM-R003 to every key space. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R004.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `disjoint(a, b) -> bool` over `TxnFootprint` in `crates/eg-transaction/src/occ.rs`. Disjoint footprints validate without a wait. | `crates/eg-transaction/tests/occ.rs::disjoint_footprints_never_wait` runs 32 disjoint writers. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R004.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** EG-SCM-R003 calls the same function for path sets. A repeated conflict on the same keys refuses after 3 retries with `TXN_RETRY_EXHAUSTED`. | `crates/eg-transaction/tests/occ.rs::retry_bound_refuses` forces 4 conflicts. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R004.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-transaction/benches/disjoint.rs` runs 32 disjoint writers. No writer waits on another at p99. | `cargo bench -p eg-transaction --bench disjoint` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R005 Write throughput benchmark and targets (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Write throughput benchmark and targets (rollup).** The engine must hold one write benchmark suite with stated targets. A change that lowers a target fails the benchmark gate of EG-DURABLE-KERNEL-R042. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R005.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `benches/engine_writes.rs` with five workloads: single-row commit, 64 concurrent writers, 8 partitions, bulk load and conflict-heavy. plan.md states the target for each. | `benches/engine_writes.rs` prints one record per workload. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R005.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** The benchmark gate of EG-DURABLE-KERNEL-R042 reads the records. A missing workload fails the gate with `BENCH_WORKLOAD_MISSING`. | `tests/test_engine_bench_gate.py::test_missing_workload_fails` drops one workload. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R005.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** The suite runs on the soak host on each release candidate. Each result carries host, revision and data digest. | `cargo bench --bench engine_writes` against the stored baseline. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R006 PostgreSQL wire protocol front end (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**PostgreSQL wire protocol front end (rollup).** The engine must serve the PostgreSQL frontend and backend protocol for outside SQL tools. It covers startup, simple query, extended query, prepared statements, COPY in and out, cancellation and TLS. EG-DURABLE-KERNEL-R035 owns the operational surfaces. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R006.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Extend `src/server/pgwire/mod.rs`. The extended-query path binds typed parameters through EG-FEDERATED-QUERY-R025. COPY uses the existing `CopyState`. TLS uses the existing startup policy. | `tests/pgwire_roundtrip.rs::extended_query_prepared_and_copy` runs a standard PostgreSQL client through each message flow. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R006.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** Every statement passes the SQL classifier and the plan cache of EG-DURABLE-KERNEL-R041. An unsupported message refuses with SQLSTATE `0A000`. A non-loopback listener without TLS refuses to start. | `tests/pgwire_roundtrip.rs::unsupported_message_and_plaintext_refuse` asserts both refusals. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R006.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** A standard client runs 10,000 prepared point reads. The p99 stays under 1 ms on loopback. | `tests/pgwire_roundtrip.rs::prepared_point_read_latency` measures the p99. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R007 Wire authentication mapped to engine principals and row security (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wire authentication mapped to engine principals and row security (rollup).** A wire login must resolve to one engine principal. Every wire statement must pass the same tenant and row-level security as a native call. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R007.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** `src/server/pgwire/auth.rs` maps password, certificate and token logins to the principal resolution of `src/server/sql_wire_auth.rs`. Issued outside identities come from `ARBORA-OPS-R858`. | `tests/pgwire_roundtrip.rs::login_maps_to_principal` logs in three ways and reads the principal. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R007.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** Wire reads pass the R078 predicates of EG-FEDERATED-QUERY and the masking of EG-FEDERATED-QUERY-R706. An unknown login refuses with SQLSTATE `28000`. | `tests/pgwire_roundtrip.rs::wire_rls_equals_native_rls` reads one table as three principals through both paths. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R007.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** Login and principal resolution stay under 5 ms at p99. | `tests/pgwire_roundtrip.rs::login_latency` measures the p99. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R008 Catalog views for outside tools (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Catalog views for outside tools (rollup).** The engine must serve `pg_catalog` and `information_schema` views that outside tools read at connect. The views derive from the engine catalog through the columnar engine. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R008.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `crates/eg-query/src/sql/pg_catalog.rs`. It registers table providers for `pg_class`, `pg_namespace`, `pg_attribute`, `pg_type`, `pg_index`, `pg_constraint`, `pg_proc`, `pg_settings` and the `information_schema` tables, columns, views and constraints. | `crates/eg-query/tests/pg_catalog.rs::views_list_engine_tables` creates two tables and reads both views. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R008.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** The views filter by the caller principal. A tool introspection query that reads an absent view returns an empty set, never an error. | `tests/pgwire_roundtrip.rs::bi_tool_introspection_queries_pass` replays a fixture of 40 recorded introspection queries. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R008.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** The introspection fixture runs under 200 ms in total. | `tests/pgwire_roundtrip.rs::introspection_latency` measures the total. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R009 SQL dialect compatibility matrix (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**SQL dialect compatibility matrix (rollup).** The engine must publish one compatibility matrix for its PostgreSQL-dialect SQL. Each statement form and function is `supported`, `partial` or `refused`. A refused form returns a typed error. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R009.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `contract/sql_compat.json`. It lists statement forms, functions, operators and types with their state. `crates/eg-query/src/sql/compat.rs` loads it. | `crates/eg-query/tests/compat.rs::matrix_loads_and_is_closed` loads the matrix. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R009.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** The classifier refuses a `refused` form with SQLSTATE `0A000` and the matrix entry name. A matrix entry without a test fails the contract gate. | `crates/eg-query/tests/compat.rs::every_supported_entry_has_a_test` checks test coverage. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R009.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** A conformance run tests every `supported` entry against the engine. The pass rate is 100 percent. | `tests/test_sql_compat_conformance.py::test_supported_entries_pass` runs the matrix. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R010 Secondary, partial and expression indexes (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Secondary, partial and expression indexes (rollup).** User tables must support declared secondary indexes, partial indexes with a predicate and expression indexes. The planner uses them for point and range probes. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R010.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `IndexSpec{table, columns_or_exprs, unique, predicate}` in `crates/eg-query/src/tables/index.rs`. The index is a redb table maintained in the same write transaction as the row. | `crates/eg-query/tests/index.rs::partial_index_holds_only_matching_rows` inserts rows inside and outside the predicate. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R010.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** `CREATE INDEX` through SQL and the wire front end creates the spec. The planner chooses an index scan when the predicate implies the index predicate. An expression that is not deterministic refuses with `INDEX_EXPR_NONDETERMINISTIC`. | `crates/eg-query/tests/index.rs::planner_uses_partial_index` reads the plan. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R010.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-query/benches/index.rs` probes a non-key column over 10M rows. The p99 stays under 2 ms. Index upkeep adds under 20 percent to insert cost. | `cargo bench -p eg-query --bench index` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R011 Constraints: unique, foreign key, check and shapes (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Constraints: unique, foreign key, check and shapes (rollup).** User tables must enforce unique, foreign-key and check constraints at commit. Graph data keeps SHACL shapes. One refusal form covers both. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R011.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `ConstraintSpec` in `crates/eg-query/src/tables/constraint.rs` with kinds `unique`, `foreign_key`, `check` and `not_null`. Unique uses an R010 index. A foreign key may be deferred to commit. | `crates/eg-query/tests/constraint.rs::deferred_foreign_key_checks_at_commit` inserts a child before its parent in one transaction. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R011.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** The committer of R001 runs constraint checks inside the batch. A violation refuses with SQLSTATE `23505`, `23503` or `23514` and the constraint name. SHACL violations map to `23514` on the wire. | `tests/pgwire_roundtrip.rs::constraint_violations_return_sqlstate` violates each kind. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R011.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** Constraint checks add under 15 percent to the R005 single-row commit. | `cargo bench --bench engine_writes` compares runs with and without constraints. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R012 Triggers as reactive rules (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Triggers as reactive rules (rollup).** A table may declare row triggers before and after insert, update and delete. A trigger is a reactive rule on the statechart engine. It runs inside the same transaction. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R012.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `TriggerSpec{table, timing, events, rule_ref}` in `crates/eg-query/src/tables/trigger.rs`. The rule is a statechart transition of `crates/eg-statechart` with typed row inputs. | `crates/eg-query/tests/trigger.rs::before_insert_rewrites_row` sets a default through a trigger. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R012.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** The committer calls triggers in declared order. A trigger chain deeper than 16 refuses with `TRIGGER_DEPTH`. A trigger that fails refuses the whole statement. | `crates/eg-query/tests/trigger.rs::depth_bound_refuses` builds a recursive trigger. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R012.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** One after-insert trigger adds under 30 microseconds at p99 per row. | `cargo bench -p eg-query --bench trigger` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R013 Sequences (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Sequences (rollup).** The engine must serve named sequences with `nextval`, `currval` and `setval`. Values never repeat after a crash. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R013.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `Sequence{name, start, increment, cache}` in `crates/eg-query/src/tables/sequence.rs`. The committer reserves a block of `cache` values per durable write. | `crates/eg-query/tests/sequence.rs::values_never_repeat_after_crash` crashes after a reservation. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R013.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** Serial and identity columns use sequences. A `setval` below the reserved high mark refuses with `SEQUENCE_REWIND`. | `tests/pgwire_roundtrip.rs::serial_column_uses_sequence` inserts through the wire front end. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R013.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** `nextval` stays under 2 microseconds at p99 inside a cached block. | `cargo bench -p eg-query --bench sequence` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R014 Views and materialized views as derived series (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Views and materialized views as derived series (rollup).** The engine must serve SQL views and materialized views. A materialized view is a derived series of EG-REPO-INGEST-R004 with lineage to its inputs. It refreshes on demand or on change. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R014.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** `CREATE MATERIALIZED VIEW` stores the plan and a derived series under the existing `matview` feature. Lineage edges link the view to each input table. | `crates/eg-query/tests/matview.rs::refresh_on_change_tracks_lineage` changes an input and reads the view and its lineage. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R014.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** `REFRESH MATERIALIZED VIEW` recomputes in one transaction. The dependency tracker of EG-FEDERATED-QUERY-R017 marks a view stale. A view over a masked column keeps the mask of EG-FEDERATED-QUERY-R706. | `tests/pgwire_roundtrip.rs::view_and_matview_over_wire` reads both through the wire front end. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R014.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** A materialized view of 1M rows refreshes under 2 s. A read of it stays under 3 ms at p99. | `cargo bench -p eg-query --bench matview` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R015 Change data capture by logical decoding (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Change data capture by logical decoding (rollup).** The committed log of the engine must be the change stream. Subscribers read decoded row and graph changes from a durable cursor. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R015.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `ChangeRecord{commit_seq, table_or_graph, op, key, before, after}` in `crates/eg-types/src/change_record.rs`. A decoder in `crates/eg-storage/src/decode.rs` reads the committed log. | `crates/eg-storage/tests/decode.rs::decode_matches_commits` commits 1,000 changes and decodes them. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R015.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** Add the served method `ChangeSubscribe{from_seq, filter}`. The wire front end serves the same stream through the replication protocol of EG-DURABLE-KERNEL-R035. A cursor below the retained log refuses with `CHANGE_CURSOR_EXPIRED`. | `tests/test_change_subscribe_served.py::test_subscriber_resumes_from_cursor` stops and resumes a subscriber. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R015.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** Decoding keeps up with 20,000 commits per second with lag under 100 ms at p99. | `cargo bench -p eg-storage --bench decode` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R016 Point-in-time recovery from snapshots and the log (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Point-in-time recovery from snapshots and the log (rollup).** The engine must restore any store to a chosen commit sequence or time. Restore combines the nearest snapshot with a replay of the archived log. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R016.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `RecoveryTarget{seq_or_time}` and `ArchivePolicy{segment_bytes, retain_s}` in `crates/eg-storage/src/archive.rs`. Log segments archive to the object storage backend of EG-OBJECT-STORAGE-BACKEND. | `crates/eg-storage/tests/archive.rs::restore_reaches_target_seq` restores to a mid-run sequence and compares digests. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R016.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** The storage command of EG-DURABLE-KERNEL-R007 gains `archive` and `restore --to`. A target past the archived log refuses with `RECOVERY_TARGET_UNAVAILABLE`. | `tests/test_pitr_served.py::test_restore_to_time` restores and reads the expected rows. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R016.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** A restore drill of a 10 GiB store finishes under 15 minutes with zero lost committed sequences. | `tests/test_pitr_served.py::test_restore_drill_budget` measures the drill on the soak host. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R017 Read replicas that follow the log (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Read replicas that follow the log (rollup).** A read replica must apply the committed log and serve reads at a stated lag. It never accepts a write. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R017.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add replica mode in `crates/eg-storage/src/replica.rs`. It reads the R015 stream and applies it in commit order. It reports `applied_seq`. | `crates/eg-storage/tests/replica.rs::replica_equals_primary_digest` compares digests after 10,000 commits. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R017.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** A read with a consistency token waits for `applied_seq` up to 2,000 ms, then refuses with `REPLICA_BEHIND`. A write to a replica refuses with SQLSTATE `25006`. | `tests/test_replica_served.py::test_token_read_and_write_refusal` checks both behaviors. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R017.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** Replica lag stays under 200 ms at p99 under the R005 64-writer workload. | `tests/test_replica_served.py::test_replica_lag_budget` measures the lag. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R018 Columnar materialization of hot record classes (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Columnar materialization of hot record classes (rollup).** The engine must keep columnar copies of declared hot record classes as Arrow batches and Parquet files. A cache policy bounds memory and freshness. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R018.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `ColumnarPolicy{record_class, format, max_mib, max_staleness_s}` in `crates/eg-query/src/columnar_cache.rs`. The copy rebuilds from the committed log of R015, never from a second writer. | `crates/eg-query/tests/columnar_cache.rs::copy_tracks_log_within_staleness` writes and reads the copy. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R018.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** The planner reads the copy for scans when it is within `max_staleness_s`. Otherwise it reads the primary store. Eviction follows the cache tier of EG-DURABLE-KERNEL-R800. | `crates/eg-query/tests/columnar_cache.rs::stale_copy_falls_back` ages the copy past the bound. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R018.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** A 100M-row aggregate over the columnar copy runs at least 5 times faster than over the primary store. | `cargo bench -p eg-query --bench columnar_cache` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R019 Outside PostgreSQL databases are sources only (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Outside PostgreSQL databases are sources only (rollup).** An outside PostgreSQL database must reach the engine only as an attached source through EG-UNIFIED-DATA-PLANE-R013 and R007. The engine never writes its authoritative data into an outside database. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R019.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** The storage provider set is closed in `crates/eg-storage/src/provider.rs`: the embedded store and the object storage backend. An outside database appears only as a table provider. | `crates/eg-storage/tests/provider.rs::provider_set_is_closed` lists the providers. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R019.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** Write-back to an outside source follows EG-UNIFIED-DATA-PLANE-R012 only. A request to place an engine record class in an outside database refuses with `EXTERNAL_PLACEMENT_FORBIDDEN`. | `tests/test_external_source_boundary.py::test_engine_data_never_syncs_out` attaches a source and checks that no engine write reaches it. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R019.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** A federated join of 1M engine rows with a 10,000-row outside table stays under 400 ms at p99 with pushdown. | `cargo bench --bench external_source_join` fails on a 10 percent regression. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R020 Demand gate, capability report and parity benchmark suite (rollup) Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Demand gate, capability report and parity benchmark suite (rollup).** Each row of this spec must name a consumer before work starts. The engine must report its relational capabilities. One benchmark suite must cover the budgets of plan.md. Children `.1` to `.3` deliver it. | See each child. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R020.1 Model and behavior Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Model and behavior.** Add `EngineCapabilities{wire_features, index_kinds, constraint_kinds, compat_matrix_digest, replication, pitr}` in `crates/eg-types/src/engine_capabilities.rs`. tasks.md names the consumer of each row. | `crates/eg-types/tests/engine_capabilities.rs::report_round_trips` round-trips the report. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R020.2 Wiring and refusal Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Wiring and refusal.** Add the served method `EngineCapabilities`. The wire front end reports `server_version` and parameters from it. A row without a named consumer stays out of the work queue. | `tests/test_engine_capabilities_served.py::test_report_matches_features` compares the report with the compiled features. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-ENGINE-PARITY-R020.3 Hot-path proof Definition — EG-ENGINE-PARITY / EG-ENGINE-PARITY — Relational engine parity inside one libraryCanonical requirement and verification source**Hot-path proof.** `benches/engine_parity.rs` runs every workload of the plan.md budget table. | `cargo bench --bench engine_parity` against the stored baseline. | requirement | EG-ENGINE-PARITY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY EG-FEDERATED-QUERY — Federated query, search, and reasoning | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R001 Bounded derivation steps in EL+/RL and tableau reasoning Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Bounded derivation steps in EL+/RL and tableau reasoning.** The EL+/RL and tableau reasoners enforce a derivation-step budget while checking consistency and classifying the schema, and fail closed with a typed VALIDATION_BUDGET_EXCEEDED error instead of running without bound. Consistency checking reports no unsatisfiable classes on the shipped ontology corpus. | A unit test exercises budget exhaustion to confirm the typed refusal, and an integration test checks consistency across the full corpus. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 1ac87735b5a3 57a12eb06632 c3b87d31ac11 crates/eg-rdf/src/owl/budget.rs:141 crates/eg-rdf/src/owl/budget.rs:143 crates/eg-rdf/src/tableau/abox.rs:481 src/server/graph_schema/world_model_tests.rs:116 |
| EG-FEDERATED-QUERY-R002 Rejection reasons stay out of the core kernel row schema Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Rejection reasons stay out of the core kernel row schema.** When a query or validation is rejected, the engine reports the rejection reason through the caller's log, metric, or domain-specific error channel rather than adding it as a field on the core kernel row structure. The kernel row format remains format-neutral and unchanged by the content of any given rejection reason. | A contract test confirms the kernel row schema carries no rejection-reason field, and a negative test confirms the reason is still observable through logs or returned error metadata. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 2b3e2738b5ff crates/eg-types/src/wire_query_core.rs:882 crates/eg-types/src/wire_query_core.rs:914 |
| EG-FEDERATED-QUERY-R003 Derivation-step budget is enforced once, not duplicated per path Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Derivation-step budget is enforced once, not duplicated per path.** The derivation-step budget that bounds EL+/RL and tableau reasoning is implemented a single time and applies to every reasoning entry point, including the path that composes and classifies the schema. This specification defines no separate step-budget enforcement here; that guarantee is owned by the typed-packs-and-catalog specification's schema composition work. | Covered by the step-budget enforcement test defined under the typed-packs-and-catalog specification; this specification requires no additional test for this item. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 1ac87735b5a3 73069c650dcd 80c865971ea8 crates/eg-rdf/src/owl/budget.rs:142 |
| EG-FEDERATED-QUERY-R004 Reasoning projection rebuilds after any skipped event Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Reasoning projection rebuilds after any skipped event.** If the reasoning projection misses or skips an update event, the engine triggers a full rebuild of the projection before serving any further reads from it, rather than serving results derived from an incomplete projection state. | An integration test injects a skipped projection event and confirms the engine rebuilds before serving reads. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 49b749980bf2 80c865971ea8 src/server/reasoning_projection.rs:1786 |
| EG-FEDERATED-QUERY-R005 UQL VALIDATE SHAPE stage Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL VALIDATE SHAPE stage.** UQL includes a VALIDATE SHAPE stage that checks query results or graph data against a declared shape definition and reports conformance or the specific violations found, as part of standard UQL execution. | An integration test runs VALIDATE SHAPE over fixtures with conforming and violating data and checks the reported conformance result. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 0265d3a41baf 1ac87735b5a3 80c865971ea8 a1bb9fb9503e crates/eg-plan/src/uql/tests/shape.rs:44 src/server/handlers/rdf/validation.rs:376 |
| EG-FEDERATED-QUERY-R006 Proof-carrying results for SPARQL and rule-derived queries Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Proof-carrying results for SPARQL and rule-derived queries.** A caller can request a proof alongside SPARQL or rule-derivation query results, and the returned proof states the premises used and the schema or index generation they were checked against, remaining consistent across the Rust server and the generated Python client. | An integration test requests a proof-carrying query, verifies the proof's premises against the serving generation, and confirms the proof survives the client wire format. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 0265d3a41baf 8bbe95351da3 crates/eg-rdf/src/rules/tests.rs:348 crates/eg-rdf/src/rules/tests.rs:376 crates/eg-rdf/src/rules/tests.rs:386 |
| EG-FEDERATED-QUERY-R007 Semantic-index reconciliation tombstones only on a complete proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Semantic-index reconciliation tombstones only on a complete proof.** Semantic-index reconciliation marks a source's entries as tombstoned only after an authoritative complete-snapshot proof confirms the source is genuinely missing; an interrupted or partial scan leaves the prior live entries untouched. When reconciliation refuses to proceed, it distinguishes an absent source from one whose proof is unissued or expired so the failure names the actual condition. | A regression test interrupts a source scan before the complete-snapshot proof and confirms no tombstone is created, then replays a complete scan and confirms exactly the absent sources are tombstoned. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf be0f1acb05c6 crates/eg-core/src/compute/semantic_index_service/reconciliation_regression.rs:343 |
| EG-FEDERATED-QUERY-R008 Edge-native text and vector search with stable identity Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Edge-native text and vector search with stable identity.** The engine indexes and retrieves edges directly by text and vector similarity, without requiring edges to be reified into nodes, using a stable identity for parallel edges between the same pair of nodes. Searches apply tenant, purpose and row-level-security prefilters before candidate truncation, update and delete against the index are safe to replay, and the set of indexable targets is defined once and generated consistently into every client. | A correctness oracle compares filtered edge-search results against an unfiltered full scan, a replay test confirms idempotent update/delete behavior, and a generated-contract check confirms the target set matches across clients. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 196ded575c8b 1ac87735b5a3 80c865971ea8 834aca5df713 crates/eg-query/src/edge_index/tests.rs:180 crates/eg-query/src/edge_index/tests.rs:282 crates/eg-query/src/edge_index/tests.rs:431 |
| EG-FEDERATED-QUERY-R009 Durable user-managed graph-index lifecycle Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Durable user-managed graph-index lifecycle.** A caller can create, check the status of, and drop a graph index through one durable, user-managed lifecycle that extends the engine's existing index-manager authority. Backfill is fenced against concurrent writes, activation is atomic, a blocked or partial index state is diagnosable, and the index recovers correctly after a restart, with the query planner falling back safely when a needed generation is unavailable. | An integration test exercises create, backfill, activate and drop plus a restart during backfill, and confirms atomic activation, diagnosable blocked state, and correct planner fallback. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 196ded575c8b 20e0a4ec589a 80c865971ea8 e99a95cc842d crates/eg-query/src/edge_index/tests.rs:305 crates/eg-query/src/edge_index/tests.rs:365 crates/eg-query/src/edge_index/tests.rs:402 crates/eg-query/src/edge_index/tests/durability.rs:48 crates/eg-query/src/edge_index/tests/durability.rs:9 |
| EG-FEDERATED-QUERY-R010 Tableau reasoning stays bounded on the shipped core schema Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Tableau reasoning stays bounded on the shipped core schema.** Tableau consistency and classification reasoning over the shipped core schema completes within bounded time and memory. Schema-axiom internalization and backtracking cause no exponential blowup or stack overflow. Schema composition and restart replay that depend on this reasoning path complete successfully under normal resource limits. | A performance and fault test composes and classifies the full core schema under a restart-replay scenario and confirms it completes within declared time and memory budgets without overflow. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 196ded575c8b 20e0a4ec589a 57a12eb06632 80c865971ea8 src/server/graph_schema/world_model_tests.rs:117 |
| EG-FEDERATED-QUERY-R011 EL+/RL reasoning is sound against the shipped ontology corpus Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**EL+/RL reasoning is sound against the shipped ontology corpus.** The EL+/RL reasoner derives only sound subsumption and disjointness conclusions, so checking the shipped core ontology corpus reports it as consistent with no unsatisfiable classes, including owl:Nothing and its root class. The EL/RL and tableau reasoning paths agree on consistency and disjointness results over this corpus. | A full-corpus consistency regression test checks the shipped ontology for unsatisfiable classes and confirms the EL/RL and tableau results agree. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 196ded575c8b 20e0a4ec589a f17f47ab300f src/server/graph_schema/compose.rs:851 |
| EG-FEDERATED-QUERY-R012 Tableau honors AllDisjointClasses and core disjointness facts Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Tableau honors AllDisjointClasses and core disjointness facts.** Tableau-based reasoning expands owl:AllDisjointClasses declarations the same way the EL path does, so schema-entry full-ABox checking enforces the core disjointness between information-content entities, generically-dependent continuants, processes and temporal regions, and between persons, organizations, servers and events. The corresponding fact that a taxon is never an organism is present and enforced. | An integration test checks that tableau reasoning rejects instances violating these disjointness constraints, including the taxon/organism fact. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 20e0a4ec589a 42aeb6436568 c3b87d31ac11 crates/eg-rdf/src/tableau/abox.rs:537 src/server/graph_schema/world_model_tests.rs:219 |
| EG-FEDERATED-QUERY-R013 Foreign-source resolution is scoped to the owning principal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Foreign-source resolution is scoped to the owning principal.** Registered foreign sources are keyed by owning tenant and actor rather than by name alone, so a caller with general federated-query access cannot name another principal's registered source and have the engine use its stored credentials on their behalf. Resolving a foreign source outside the registering principal's scope is refused with a stable ACCESS_DENIED error, and foreign-source rows are documented as not row-level-security filtered. | A negative integration test registers a foreign source under one principal and confirms a different principal's query naming that source is refused with ACCESS_DENIED. | requirement | EG-FEDERATED-QUERY | LANDED | 0265d3a41baf 196ded575c8b a3e0c9984c67 |
| EG-FEDERATED-QUERY-R014 Explicit grant-based sharing of a registered foreign source Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Explicit grant-based sharing of a registered foreign source.** A principal who owns a registered foreign source can share query access to it with another principal through the engine's existing role-based access-control grant mechanism, rather than through an implicit name lookup. The registering principal retains ownership of the source, and access can be granted and later revoked. | An integration test grants another principal access to a foreign source, confirms it can query through the grant, then revokes the grant and confirms the query is refused. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf a1bb9fb9503e c3b87d31ac11 src/server/foreign_share.rs:178 |
| EG-FEDERATED-QUERY-R015 Read-only enforcement at the shared SQL execution path Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Read-only enforcement at the shared SQL execution path.** The shared graph-free SQL execution path classifies and refuses DDL, DML, COPY and CREATE EXTERNAL TABLE statements as not read-only, enforced once at that shared path rather than duplicated per caller. Every caller that reaches this path, including observability log search, is subject to the same refusal. | A test sends DDL, DML, COPY and CREATE EXTERNAL TABLE statements through each caller of the shared SQL path, including log search, and confirms each is refused. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 0dea49929b94 196ded575c8b a1bb9fb9503e crates/eg-query/src/sql/read_only.rs:52 crates/eg-query/src/sql/read_only.rs:84 src/server/obs/search.rs:362 |
| EG-FEDERATED-QUERY-R016 UQL AS OF uses Unix-second timestamps, not ISO dates Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL AS OF uses Unix-second timestamps, not ISO dates.** UQL's AS OF clause takes a Unix-second timestamp, and query stages chain using the published UQL stage-separator syntax rather than Cypher-shaped text or an ISO-8601 timestamp; text that does not match this grammar is rejected as invalid rather than silently accepted. A conformance test confirms that UQL text emitted by any client parses successfully against the current grammar. | A parser test feeds the correct stage-chained, Unix-second AS OF form and confirms it parses, and a negative test confirms Cypher-shaped or ISO-timestamp text is rejected. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf a3ad18c91bc5 crates/eg-plan/src/uql/tests/legacy.rs:297 |
| EG-FEDERATED-QUERY-R017 Dependency tracking covers edge-type and embedding generations Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Dependency tracking covers edge-type and embedding generations.** Query plans that perform graph traversal or embedding-based ranking register their dependency on the specific edge types and embedding generations they read, so a write that changes an unrelated edge type or generation does not invalidate the plan, while a write touching a real dependency correctly does. | A test performs disjoint writes against unrelated edge types and embedding generations and confirms an existing traversal/rank plan is not invalidated, while a dependent write does invalidate it. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 0dea49929b94 10177f908dd0 crates/eg-core/tests/dependency_scoped_edges.rs:132 crates/eg-core/tests/dependency_scoped_edges.rs:147 crates/eg-core/tests/dependency_scoped_edges.rs:221 |
| EG-FEDERATED-QUERY-R018 Class-level volatility drives invalidation and cache freshness Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Class-level volatility drives invalidation and cache freshness.** Classes and sources declare an eg:volatilityClass, and a per-class invalidation event fires when matching data changes. Foreign-source result caching only serves a cached result when the relevant source watermark is current, consistent with the volatility class declared for that data. | A test changes data in a declared volatility class, confirms the corresponding invalidation event fires, and confirms the foreign-source cache only serves fresh, watermark-current results. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 10177f908dd0 70235bb3b98f src/server/handlers/query/foreign_watermarks.rs:160 src/server/handlers/query/foreign_watermarks.rs:195 src/server/handlers/query/freshness_feed.rs:115 |
| EG-FEDERATED-QUERY-R019 Per-bar signal-state advancement with revisable trend records Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Per-bar signal-state advancement with revisable trend records.** On each bar finalization, the complex-event-processing layer advances signal state and records a TrendFlip event; a later correction can revise a previously recorded TrendFlip without losing the revision history. A scanner index exposes the latest signal state per series for efficient lookup. | A test finalizes a sequence of bars, confirms signal state advances and TrendFlip records are created, then issues a revision and confirms both the historical and latest-state views are correct. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 0dea49929b94 532418b7e55b crates/eg-compute/src/finance/market/record_tests.rs:154 crates/eg-compute/src/finance/market/record_tests.rs:50 |
| EG-FEDERATED-QUERY-R020 One query-text method surface, with the legacy method retired Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**One query-text method surface, with the legacy method retired.** The engine serves exactly one query-text method, Method::Uql; the legacy UnifiedQueryText method and its callers, including remote-engine federation and server tests, are migrated to it, and UnifiedQueryText is removed from the codebase with no compatibility alias or deprecation shim. | A contract test confirms UnifiedQueryText no longer exists in the method registry, and an integration test confirms remote-engine federation operates correctly over Method::Uql. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf bd27155934dc c3b87d31ac11 crates/eg-capabilities/tests/contract_registry.rs:226 |
| EG-FEDERATED-QUERY-R021 Full UQL predicate algebra with SQL-consistent evaluation Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Full UQL predicate algebra with SQL-consistent evaluation.** UQL's predicate algebra supports the comparison operations, AND/OR/NOT with parentheses, IN, BETWEEN, IS [NOT] NULL, typed literals, JSONPath access and spatial predicates. The per-row three-valued evaluator used by UQL agrees with the equivalent SQL evaluation on every supported predicate, including null handling. | A differential test evaluates the same predicate set through SQL and the UQL per-row evaluator across null and non-null fixtures and confirms identical results. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 07988fcb61e4 e93f988eae07 crates/eg-plan/src/pred_eval.rs:310 |
| EG-FEDERATED-QUERY-R022 UQL source clauses are first-class, with typed empty-result cases Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL source clauses are first-class, with typed empty-result cases.** UQL treats MATCH, SPARQL, TSSCAN, SENSOR FUSE/ALIGN, SPATIAL/TENSOR SCAN and FOREIGN SCAN/HTTP as first-class source clauses in its grammar and planner. A head-transform stage that would yield an empty result set emits the UQL_W_HEAD_TRANSFORM_YIELDS_EMPTY warning instead of silently reseeding from the runtime, and runtime empty-set reseeding is no longer part of the documented language. | A parser and planner test exercises each source clause and confirms a head-transform-to-empty case emits the warning rather than reseeding. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 629101277687 6fb1c534abec 8040b672e582 8451d7eecf02 crates/eg-plan/src/exec.rs:2661 src/server/mod.rs:2099 |
| EG-FEDERATED-QUERY-R022.1 A label Scan matches the engine's label set Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**A label Scan matches the engine's label set.** The plan executor's label source is `scan_label` in `crates/eg-plan/src/exec.rs`. It and the layer filters of the stream, time-series, spatial and tensor sources SHALL select a node by its label. The label can be under `type`, `node_type` or `label`, or in the `labels` array. This is the same set that the engine's label index files (`eg_core::graph::node_carries_label`). That function shares `NODE_LABEL_KEYS` with `labels_of`. Writers store `node_type`, so a Scan that read only `type` returned no rows for them. | The unit test is `scan_matches_every_label_field_writers_store` in `crates/eg-plan/src/exec.rs`. The served test `server::tests::test_served_scan_reads_node_type_labels` returns `node_type` nodes. It uses both `Method::Uql` (`MATCH (:Paper)`) and `Method::UnifiedQuery` (`Op::Scan`). | requirement | EG-FEDERATED-QUERY | VERIFIED | 629101277687 6fb1c534abec 8040b672e582 crates/eg-plan/src/exec.rs:2661 src/server/mod.rs:2099 |
| EG-FEDERATED-QUERY-R023 Every query modality has a published UQL spelling Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Every query modality has a published UQL spelling.** UQL provides a syntax for every supported query modality: SPARQL/VAR, user-defined functions, FOREIGN SCAN/HTTP with any credential-bearing inline source specification refused, spatial functions including BUFFER, INTERSECTION and DIFFERENCE plus REPROJECT, tensor SLICE/REDUCE/ADD and related tensor functions, complex-event patterns such as SEQ/WITHIN/ABSENCE over SLIDING/TUMBLING windows, SENSOR ALIGN, probabilistic PROB, FUSE K, REASON ONTOLOGY, bounded WINDOW, and VALIDATE SHAPE. | A grammar-exhaustiveness test parses a program covering every listed construct and confirms each round-trips through the canonical printer, and a negative test confirms a credential-bearing FOREIGN SCAN/HTTP specification is refused. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 8451d7eecf02 crates/eg-plan/src/uql/tests/contract.rs:58 |
| EG-FEDERATED-QUERY-R024 Traversal syntax compiles to one canonical Expand encoding Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Traversal syntax compiles to one canonical Expand encoding.** UQL's directional traversal arrows, the wildcard hop syntax and edge predicate filters all compile to the budget-checked, shortest-hop Op::Expand plan node. The common case of an unfiltered, unbounded, outbound single-relationship expansion is always encoded the same way, spelled Traverse, so the planner has one canonical representation rather than multiple equivalent encodings. | A planner test compiles equivalent traversal syntaxes and confirms they produce the identical Op::Expand/Traverse plan node. | requirement | EG-FEDERATED-QUERY | LANDED | 0265d3a41baf e93f988eae07 |
| EG-FEDERATED-QUERY-R025 Typed parameter binding end-to-end through the Python client Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Typed parameter binding end-to-end through the Python client.** UQL's typed $param placeholders bind only in parser-recognized value positions and are type-checked, with unbound, mistyped or unused parameters failing as typed errors. The engine serves this through Method::Uql with text and params fields, and the generated Python client exposes a matching uql(text, params) call; values never pass through text interpolation. | A test sends injection-shaped parameter values through the Python client and confirms they bind as typed values rather than altering the executed query, plus negative tests for unbound, mistyped and unused parameters. | requirement | EG-FEDERATED-QUERY | LANDED | 0265d3a41baf 4e0570f079f5 |
| EG-FEDERATED-QUERY-R026 UQL documentation is test-verified with an embedded grammar Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL documentation is test-verified with an embedded grammar.** docs/uql.md documents the current UQL language with every example in a uql code block actually parsing under a dedicated test, and embeds the generated grammar rather than a hand-maintained copy. docs/analytics_in_uql.md clearly separates which analytics run through SQL from which run through UQL stages. | A documentation test parses every uql-tagged code block in docs/uql.md and fails the build if any example does not parse. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 7b9ba5708638 c3b87d31ac11 crates/eg-plan/src/uql/tests/contract.rs:106 crates/eg-plan/src/uql/tests/contract.rs:131 |
| EG-FEDERATED-QUERY-R027 EXPLAIN, PROFILE and RETURN support multi-stage UQL programs Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**EXPLAIN, PROFILE and RETURN support multi-stage UQL programs.** A UQL program that composes named LET/JOIN subplans into a dependency graph supports EXPLAIN and PROFILE output and RETURN channels the same as a single-stage query, rather than refusing with UQL_UNSUPPORTED. | An integration test runs EXPLAIN and PROFILE over a multi-stage LET/JOIN program and confirms per-stage plan and runtime information is returned instead of a refusal. | requirement | EG-FEDERATED-QUERY | LANDED | 0265d3a41baf 681de5cb1968 |
| EG-FEDERATED-QUERY-R028 KnowledgeSet is reachable from UQL Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**KnowledgeSet is reachable from UQL.** A UQL query can read a KnowledgeSet, combining epistemic status, FUSE and AS OF semantics within a single query, and produces results equivalent to issuing the corresponding operations through the structured query surface or the previously separate surfaces. | An oracle test runs equivalent epistemic, fuse and as-of queries through UQL, the structured surface and the prior separate surfaces and confirms the results agree. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 0265d3a41baf 681de5cb1968 |
| EG-FEDERATED-QUERY-R029 UQL text from graph-exploration clients matches the grammar Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL text from graph-exploration clients matches the grammar.** Any UQL text generated by a graph-exploration client, including a temporal scrubber control, uses the stage-chained syntax and a Unix-second AS OF timestamp defined by the published UQL grammar, not Cypher-shaped text or an ISO-8601 timestamp. Text that does not conform to this grammar is rejected with a typed parse error rather than silently misinterpreted. | A conformance test parses the exact text emitted by the temporal-scrubber control's query template and confirms it succeeds under the current grammar. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf cb0a4dfcf4a5 crates/eg-plan/src/uql/tests/scrubber.rs:16 crates/eg-plan/src/uql/tests/scrubber.rs:38 crates/eg-plan/src/uql/tests/scrubber.rs:53 |
| EG-FEDERATED-QUERY-R030 TSSCAN preserves per-series row identity and full precision Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**TSSCAN preserves per-series row identity and full precision.** The TSSCAN source identifies each time-series row by series@ts and carries its values as f64 channels named v0..vk, so rows from different series at the same timestamp never collide and no value is truncated to f32. This row identity is the basis for series analytics expressed in UQL. | A fixture test scans overlapping multi-series data through TSSCAN and confirms no row collisions, no truncation and correct per-series, per-timestamp identity. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 79fb60a33ee0 crates/eg-plan/src/rowset.rs:219 crates/eg-plan/src/rowset.rs:243 crates/eg-plan/src/tsdb_scan_tests.rs:693 |
| EG-FEDERATED-QUERY-R031 Contribution attribution kernels exposed through UQL ATTRIBUTE Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Contribution attribution kernels exposed through UQL ATTRIBUTE.** The engine computes contribution attribution using linear split, exact Shapley for small coalitions, seeded sampled Shapley with a confidence interval, Owen values over a hierarchy, and multi-factor OLS regression with heteroskedasticity-and-autocorrelation-consistent standard errors. UQL exposes these through an ATTRIBUTE channel VALUE agg SHAPLEY [SAMPLES n SEED s] stage, and a decision-evaluation report can attribute an assembly slate's outcome across its logged sub-slates. | Exact Shapley results are checked against a brute-force oracle, sampled Shapley against seeded-repeatability and confidence-interval-coverage tests, and the ATTRIBUTE UQL stage against an integration test. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 7940beedc463 crates/eg-numeric/src/attribution/tests.rs:133 crates/eg-numeric/src/attribution/tests.rs:83 crates/eg-numeric/src/attribution/tests.rs:93 |
| EG-FEDERATED-QUERY-R032 Probabilistic impact propagation with cone-scoped recomputation Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Probabilistic impact propagation with cone-scoped recomputation.** The engine propagates probabilistic impact across the graph using an exact Noisy-OR model on acyclic structure with a bounded unroll on cycles, and an Independent-Cascade model using seeded Monte Carlo simulation with a confidence interval, following ontology-declared edge transmission. Results report the top-k contributing paths with per-seed attribution, are exposed in UQL as PROPAGATE model edge-pattern HOPS n, and a standing query seeded from Incident, ConformanceViolation or CVE facts recomputes only the affected cone and records ImpactAssessment facts. | A test compares the Noisy-OR result against an exact enumeration on small acyclic graphs and the Independent-Cascade result against seeded-repeatability and confidence-interval checks, plus an integration test for the PROPAGATE stage and standing-query cone recomputation. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 0265d3a41baf c06e903d0def src/server/impact_watch/tests.rs:112 src/server/impact_watch/tests.rs:135 src/server/impact_watch/tests.rs:157 |
| EG-FEDERATED-QUERY-R033 Barrier-hit and time-to-exhaustion derivations, one shared CDF Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Barrier-hit and time-to-exhaustion derivations, one shared CDF.** The engine computes first-passage probability for a barrier using the arithmetic-Brownian-motion inverse-Gaussian form and the geometric-Brownian-motion log-barrier form, each checked against a terminal-distribution calculation, with maximum-likelihood drift and volatility estimation and a bootstrap confidence interval. These are exposed as DERIVE barrier_hit(...) and DERIVE tte(...), and all normal-tail calculations use one public stats::norm_cdf implementation rather than a separate private copy. | Results are checked against a Monte Carlo simulation and against the analytic limit as volatility approaches zero, which must match the deterministic linear-prediction case. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf a0fbd9c05adf c98e58397fcc crates/eg-compute/src/graph_algos/impact/tests.rs:101 crates/eg-compute/src/graph_algos/impact/tests.rs:117 crates/eg-compute/src/graph_algos/impact/tests.rs:87 |
| EG-FEDERATED-QUERY-R034 Motif and discord search over time series, batch and streaming Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Motif and discord search over time series, batch and streaming.** The engine finds motifs and discords in time series using an FFT-accelerated MASS distance computation and a matrix profile, computed anytime for batch data and incrementally for streaming data. UQL exposes MOTIF LIKE $shape LENGTH m TOP k and DISCORD LENGTH m TOP k under the standard query budgets, anomaly mining supports a matrix-profile discord algorithm, and a series shape predicate can emit a stream event consumed by the existing complex-event-processing matcher. | A test compares matrix-profile motif and discord results against a brute-force distance computation on a reference series and confirms the streaming and batch computations agree. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 1625e507f6fc fa64a5de6cda crates/eg-numeric/src/series/motif_tests.rs:152 crates/eg-numeric/src/series/motif_tests.rs:84 |
| EG-FEDERATED-QUERY-R035 Filtered text search evaluates within the filtered candidate set Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Filtered text search evaluates within the filtered candidate set.** A text search combined with a filter evaluates its relevance ranking only within the set of rows that satisfy the filter, using a filtered index scan or equivalent pre-filtering, so a filtered query returns up to k relevant results drawn from the full matching set rather than filtering after an unfiltered top-k ranking has already discarded relevant rows. | A correctness oracle compares filtered BM25 search results against an unfiltered full scan intersected with the filter and confirms they agree. | requirement | EG-FEDERATED-QUERY | VERIFIED | 0265d3a41baf 4dfe7beb589b fa64a5de6cda crates/eg-plan/src/text_tests.rs:309 |
| EG-FEDERATED-QUERY-R036 Bounded, observable graph reopen after a restart Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Bounded, observable graph reopen after a restart.** After a restart, the engine serves reads from stored data immediately and rebuilds or restores its index state either from persisted index state or incrementally in the background, rather than blocking all reads on a full linear index rebuild. While materialization is incomplete, reads are refused with a typed PARTIAL_MATERIALIZATION state, and a readiness signal indicates when the graph is fully queryable. | A restart test measures reopen time and reads against graphs of increasing document counts and confirms the PARTIAL_MATERIALIZATION state and readiness signal behave correctly, with reopen time bounded well under a full rebuild. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 bcbbe09c7e76 |
| EG-FEDERATED-QUERY-R037 Rolling window statistics are both O(1) and numerically exact Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Rolling window statistics are both O(1) and numerically exact.** Streaming rolling-window statistics, such as standard deviation and z-score, update in constant time per step and report exactly zero for a window containing constant values, with no floating-point residue accumulating from incremental add/remove updates over long-running windows. | A property test compares the streaming O(1) update against an exact from-scratch recomputation across constant, alternating and large windows and confirms they agree, including an exact zero on constant windows. | requirement | EG-FEDERATED-QUERY | VERIFIED | 1ee2319ee506 62c450561948 crates/eg-numeric/src/series/streaming_tests.rs:63 crates/eg-numeric/src/series/streaming_tests.rs:76 crates/eg-numeric/src/series/streaming_tests.rs:87 |
| EG-FEDERATED-QUERY-R038 Federation optimizer: cost-aware pushdown, freshness-aware cache (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Federation optimizer: cost-aware pushdown, freshness-aware cache (rollup).** The query planner models each foreign source's capability, including SQL/OBDA, SPARQL endpoints, HTTP/REST connectors, lake formats and other registered engine kinds, and pushes down projection, filters, LIMIT/ORDER, aggregates, same-source joins and batched key lookups only when that capability proves the work sound. It applies cardinality and cost estimates under a per-query network budget, serves freshness-aware cached results gated by source watermarks, bounds remote parallelism, and EXPLAIN output shows exactly which fragments ran remotely. The child requirements below define the required behavior and acceptance. | A differential test compares optimized execution plans and results against a full-fetch oracle across each supported source capability and confirms correctness, declared pushdown, and accurate EXPLAIN reporting. | requirement | EG-FEDERATED-QUERY | LANDED | 212c65869e32 62c450561948 |
| EG-FEDERATED-QUERY-R038.1 Typed foreign-source capability + cost model proves which pushdown kinds are sound Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Typed foreign-source capability + cost model proves which pushdown kinds are sound.** A `ForeignSourceCapability`/cost-model typed struct declares, per source, a cardinality estimate, a network-budget cost, and which pushdown kinds (projection, filter, limit/order, aggregate, same-source join, batched key lookup) that source's declared capability proves sound. The optimizer consults this model before pushing any fragment down and refuses a pushdown kind the capability does not prove sound. | A unit/property test suite validates the typed model's construction and asserts a representative refusal case per pushdown kind: a source whose declared capability does not prove a kind sound is never offered that pushdown. | requirement | EG-FEDERATED-QUERY | LANDED | 212c65869e32 |
| EG-FEDERATED-QUERY-R039 Mixed traversal and vector queries return k or a typed shortfall Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Mixed traversal and vector queries return k or a typed shortfall.** A query combining multi-hop graph traversal with vector similarity search continues generating candidates until k results survive the traversal filter, or returns a typed shortfall result naming how many matches were found, rather than silently returning fewer than k results without explanation. | A correctness oracle runs mixed traversal-plus-vector queries against a reference corpus and confirms either exactly k permitted results or an explicit typed shortfall, never a silent undercount. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 5c2ab50088c4 62c450561948 |
| EG-FEDERATED-QUERY-R040 Filter-aware index scans for filtered vector and text search Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Filter-aware index scans for filtered vector and text search.** Filtered approximate-nearest-neighbor and BM25 text search plan as filter-aware index scans over pre-filtered candidate sets or bitmap filters, rather than scanning the full unfiltered index and discarding non-matching rows afterward, while preserving the filtered-search correctness guarantee. | A benchmark compares filtered vector and text search latency before and after the filter-aware scan change on a fixed corpus, alongside the correctness oracle confirming results remain correct. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 08b2c9d4b567 62c450561948 |
| EG-FEDERATED-QUERY-R041 Federation optimizer core drives pushdown decisions for every query Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Federation optimizer core drives pushdown decisions for every query.** The federation optimizer in eg-plan/src/federation_opt/ models each foreign source's capabilities, builds a RemoteRequest per source, tracks a per-query budget meter, trace and LIMIT hints, maintains learned SourceStats with provenance, and executes bind joins with an adaptive batch sizer and typed refusals; it is bound into the ForeignScan/Foreign plan arms so every served plan uses it. | Federation optimizer unit and integration tests exercise capability-gated pushdown, budget enforcement, bind-join batching and typed refusal paths against the served query path. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 d656b605ef0a |
| EG-FEDERATED-QUERY-R042 OBDA pushes per-predicate scans and semi-join reduction to SQL sources Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**OBDA pushes per-predicate scans and semi-join reduction to SQL sources.** OBDA execution groups scans per predicate, pushes constant-subject key lookups and constant-object equality checks to the external SQL source, and reduces semi-joins to an IN clause rendered as ObdaCompare::In by that source. | OBDA pushdown tests (FQR-06) confirm per-predicate scan grouping, constant lookup/equality pushdown and semi-join IN reduction produce results matching the full-fetch oracle. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 d656b605ef0a |
| EG-FEDERATED-QUERY-R043 SQL foreign-source connections share the one outbound SSRF guard Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**SQL foreign-source connections share the one outbound SSRF guard.** SQL DSN connections for Sql foreign-source specs and OBDA external sources are validated at a single chokepoint against the same outbound allowlist and sensitive-address-range checks used for HTTP foreign sources. | Security negative tests confirm a disallowed SQL DSN target is refused with the same stable typed error as a disallowed HTTP target. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 d656b605ef0a |
| EG-FEDERATED-QUERY-R044 UQL EXPLAIN and PROFILE surface federation trace and budget hints Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL EXPLAIN and PROFILE surface federation trace and budget hints.** UQL's PROFILE and EXPLAIN output include a federation trace describing remote fragments, residual local work and budget usage, and callers can supply budget hints that the planner honors when routing a query through the remote UQL method. | EXPLAIN/PROFILE tests for federated UQL queries confirm the trace reports the remote/residual breakdown and that caller-supplied budget hints are respected. | requirement | EG-FEDERATED-QUERY | LANDED | 33c1fd51757d 62c450561948 c98e58397fcc |
| EG-FEDERATED-QUERY-R045 Foreign rows carry typed columns for filter and projection pushdown Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Foreign rows carry typed columns for filter and projection pushdown.** A foreign source returns ForeignRows with stable column names, types, null semantics and row provenance, and apply_filter/apply_projection classify each operation as Exact, Inexact or Unsupported; only an Exact result removes the local residual, an Inexact result may narrow transfer only to a superset of authorized matching rows, and an Unsupported result fetches the needed columns and evaluates locally without ever dropping a column required by a residual, ORDER BY, authorization or proof channel. | A recording mock verifies every pushed ForeignRows request narrows data transfer without changing answers, and a schema/version mismatch or ambiguous column identity is refused rather than silently bound. | requirement | EG-FEDERATED-QUERY | VERIFIED | 62c450561948 6ffff56cecff crates/eg-plan/src/federation_opt/columns.rs:285 crates/eg-plan/src/federation_opt/columns.rs:311 crates/eg-plan/src/federation_opt/columns.rs:334 |
| EG-FEDERATED-QUERY-R046 OBDA pushes SPARQL LIMIT, ORDER, aggregates and same-source joins Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**OBDA pushes SPARQL LIMIT, ORDER, aggregates and same-source joins.** OBDA translates SPARQL LIMIT, ORDER BY, aggregate and same-source join clauses into the rendered SQL sent to the external source and evaluates the pushed solutions directly, without materializing a transient in-memory graph. | OBDA pushdown tests confirm pushed LIMIT/ORDER/aggregate/join results match the full-fetch oracle and that no transient graph is constructed for the pushed portion. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 c98e58397fcc |
| EG-FEDERATED-QUERY-R047 Federation enforces per-source parallelism caps and rate limits Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Federation enforces per-source parallelism caps and rate limits.** Each foreign source is bounded by a global semaphore keyed to its fingerprint that caps concurrent requests and enforces a rate limit, while bind-join batches to different sources still execute in parallel within those caps. | Concurrency tests confirm request counts to a single source never exceed its configured cap while independent sources execute concurrently. | requirement | EG-FEDERATED-QUERY | LANDED | 321aa24de7c0 62c450561948 |
| EG-FEDERATED-QUERY-R048 Join ordering across foreign sources uses learned, provenanced statistics Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Join ordering across foreign sources uses learned, provenanced statistics.** The planner orders joins across multiple foreign sources using learned cardinality statistics persisted as graph facts with their provenance, seeded by registration-time probes such as PostgreSQL table-size statistics, engine-reported statistics and VoID descriptions. (Rollup: delivered incrementally by its `.1`, `.2`, ... children, one per code root — typed model, persistence, per-source-kind probes, planner join-ordering use.) | Join-ordering tests compare planner choices against known cardinalities and confirm learned statistics carry sample count and provenance per FQR-05. | requirement | EG-FEDERATED-QUERY | VERIFIED | 62c450561948 6c11520aebfc f708d6e7728f crates/eg-plan/src/federation_stats.rs:166 crates/eg-plan/src/federation_stats.rs:174 crates/eg-plan/src/federation_stats.rs:185 crates/eg-plan/src/federation_stats.rs:209 |
| EG-FEDERATED-QUERY-R048.1 Typed join-cardinality-statistic model with provenance Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Typed join-cardinality-statistic model with provenance.** `crates/eg-plan/src/federation_stats.rs` defines `JoinCardinalityStatistic` (estimated cardinality, sample count, a source generation marker) and `StatisticsProvenance` (PostgreSQL table-size stats, engine-reported stats, or a VoID description), constructed only through a fallible constructor that refuses a statistic carrying no provenance. This is the typed-model code root of R048; persistence as graph facts, per-source-kind probes and planner join-ordering use are later `.2`+ children. | A unit test constructs a statistic with each provenance kind and confirms it round-trips its sample count and provenance, and a second test confirms the constructor refuses a statistic given no provenance. | requirement | EG-FEDERATED-QUERY | VERIFIED | 6c11520aebfc f708d6e7728f crates/eg-plan/src/federation_stats.rs:166 crates/eg-plan/src/federation_stats.rs:174 crates/eg-plan/src/federation_stats.rs:185 crates/eg-plan/src/federation_stats.rs:209 |
| EG-FEDERATED-QUERY-R049 Foreign query fragment cache is freshness-aware and owner-salted Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Foreign query fragment cache is freshness-aware and owner-salted.** Cached results for a foreign query fragment are keyed by source identity, an owner-specific salt, the canonical request and the source's current freshness watermark; a missing or stale watermark disables the cache hit rather than serving stale data. | Cache tests confirm a hit requires a matching fresh watermark and that a stale or absent watermark forces a live fetch. | requirement | EG-FEDERATED-QUERY | VERIFIED | 33c1fd51757d 62c450561948 b0124203865d crates/eg-plan/src/federation_opt/cache.rs:162 crates/eg-plan/src/federation_opt/run.rs:502 |
| EG-FEDERATED-QUERY-R050 SPARQL SERVICE uses bind joins and pushes FILTER/LIMIT Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**SPARQL SERVICE uses bind joins and pushes FILTER/LIMIT.** SPARQL SERVICE clauses execute as VALUES-based bind joins against the remote endpoint and push FILTER and LIMIT into the SERVICE request where sound, validated through the same single outbound SSRF guard used by other foreign sources. | SERVICE bind-join tests confirm multivalued RDF answers are preserved and that a disallowed SERVICE endpoint is refused by the shared SSRF guard. | requirement | EG-FEDERATED-QUERY | LANDED | 3d00361f3191 62c450561948 |
| EG-FEDERATED-QUERY-R051 Iceberg scans prune manifests using the final pushed predicates Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Iceberg scans prune manifests using the final pushed predicates.** The Iceberg table scan is assembled only after the query engine has supplied its filters, projection and limit, so manifest pruning reflects the actual pushed predicates instead of an earlier, less-informed scan; documentation describing pruning behavior is corrected to match this. | A partitioned Iceberg fixture test confirms manifest files are pruned according to the final pushed filters, projection and limit. | requirement | EG-FEDERATED-QUERY | VERIFIED | 56d3663f4bf8 5dd3f1b33fad 62c450561948 8676a7f3af87 crates/eg-query/tests/iceberg_federation_scan.rs:384 |
| EG-FEDERATED-QUERY-R052 RemoteEngine sources receive pushed key filters and bounded LIMIT Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**RemoteEngine sources receive pushed key filters and bounded LIMIT.** For registered RemoteEngine sources, the planner appends authorized key filters and a bounded LIMIT to the canonical read-only UQL request, preserving ORDER BY, residual filtering, pagination and outer-query limit semantics; a remote lacking the feature or exact push capability falls back to the safe bounded route with local residuals instead of fetching an unbounded result. | A recording mock proves pushed RemoteEngine requests narrow transfer without changing answers, and a capability-lacking remote is verified to fall back safely. | requirement | EG-FEDERATED-QUERY | VERIFIED | 62c450561948 70c5421663b9 8676a7f3af87 a854dd78481d crates/eg-plan/src/federation_opt/engine_peer_tests.rs:277 |
| EG-FEDERATED-QUERY-R053 Trino, Cypher and Spark sources are typed ForeignSourceSpec kinds Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Trino, Cypher and Spark sources are typed ForeignSourceSpec kinds.** Trino, Cypher-speaking stores and Spark are each registered as a distinct ForeignSourceSpec kind with its own declared capability set. Spark is restricted to batch access with no interactive pushdown capability. | Per-kind capability tests confirm each ForeignSourceSpec only advertises and exercises the pushdown operations its declared capability set allows. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 09385617b3ae 62c450561948 ec4d3c4ee5a3 |
| EG-FEDERATED-QUERY-R054 SPARQL SERVICE and peer federation share the one outbound SSRF guard Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**SPARQL SERVICE and peer federation share the one outbound SSRF guard.** Outbound requests from SPARQL SERVICE handling and peer federation fan-out both validate their target through the single shared federation guard; no separate, weaker outbound validation remains in either call path. | Security tests confirm a target disallowed by the shared guard is refused identically from both the SPARQL SERVICE and peer fan-out call paths. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 70c5421663b9 |
| EG-FEDERATED-QUERY-R055 SPARQL evaluation binds every value of a multi-valued property Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**SPARQL evaluation binds every value of a multi-valued property.** The SPARQL evaluator iterates and binds every value of a repeated predicate on a subject, rather than binding only the first value and silently dropping the remaining matching answers. | A regression test on a graph with two values for the same predicate confirms both values bind, including per-binding FILTER evaluation, per FQR-01's correct-read acceptance. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 d656b605ef0a |
| EG-FEDERATED-QUERY-R056 Causal-impact p-values reuse the shared numeric tail functions Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Causal-impact p-values reuse the shared numeric tail functions.** eg-compute/src/mining/causal_impact.rs computes its p-value using eg-numeric's shared normal survival and cumulative distribution functions instead of a local error-function approximation, avoiding the catastrophic cancellation that approximation produced in the tail. | A tail-probability test against literal reference values at tight relative tolerance confirms the computed p-value matches the exact reference in the tail, per FQR-09. | requirement | EG-FEDERATED-QUERY | VERIFIED | 1b55c58d05d5 62c450561948 b6e49c439128 crates/eg-compute/src/mining/causal_impact.rs:179 |
| EG-FEDERATED-QUERY-R057 SQL provider module stays within the repository's file-size limit Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**SQL provider module stays within the repository's file-size limit.** crates/eg-query/src/sql/providers.rs is kept at or under the repository's 900-line file-size limit through semantic extraction that preserves existing provider behavior exactly. | A line-count check confirms the file is at or under 900 lines, and the existing SQL provider test suite passes unchanged after extraction. | requirement | EG-FEDERATED-QUERY | LANDED | 3241ec8af9d4 62c450561948 |
| EG-FEDERATED-QUERY-R058 Natural language runs only as disclosed, read-only typed UQL Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Natural language runs only as disclosed, read-only typed UQL.** A natural-language request is never query authority itself: the configured planner translates it to UQL text, the engine parses that text with the same grammar as any caller-written query and runs it through the same read-only pipeline under the caller's verified authority, row visibility and budgets. Every natural-language result carries the exact UQL that was executed, a plan-only mode returns that typed UQL candidate without executing it so a caller can review first, results are never cached on the natural-language text, and natural language cannot reach any mutating or side-effecting operation. Rollup over `EG-FEDERATED-QUERY-R058.1` (typed disclosure model, built), `.2` (wire the dispatch entry point and result contract to it), `.3` (no-cache-on-NL-text + no-mutation-reachable guards). | Tests confirm the executed UQL is returned with the result, plan-only mode returns a candidate without reading data, planner output that fails to parse or exceeds a budget is refused with a typed error, row visibility matches the equivalent direct UQL query, and no mutation is reachable. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 3da71fa8e9b7 62c450561948 |
| EG-FEDERATED-QUERY-R058.1 Typed NL→UQL disclosure model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Typed NL→UQL disclosure model.** `eg-plan` exposes an `NlQueryResult` that always carries the exact UQL text alongside any data — `Some(rows)` when executed, `None` (plan-only mode) when not — plus a typed `NlQueryError` with dedicated variants for planner output that fails to parse and output that exceeds a configured `NlQueryBudget`, refused before parsing or execution. `plan_only` produces the candidate without taking any view/`PlanCtx`, so plan-only mode cannot read data even by construction. | Unit tests confirm: an executed result carries the exact UQL that ran; `plan_only` returns a candidate with `rows: None` and reads no data; malformed planner output is refused with `NlQueryError::ParseFailed` (not executed); and over-budget planner output is refused with `NlQueryError::BudgetExceeded` before parse/execute, in both plan-only and executing modes. | requirement | EG-FEDERATED-QUERY | LANDED | 3da71fa8e9b7 |
| EG-FEDERATED-QUERY-R058.2 Dispatch handler and result contract disclose the typed NL→UQL model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Dispatch handler and result contract disclose the typed NL→UQL model.** Child slice of `EG-FEDERATED-QUERY-R058` (see tasks.md). Rollup over `EG-FEDERATED-QUERY-R058.2.1` (dispatch-path budget enforcement against the typed model, built) and `EG-FEDERATED-QUERY-R058.2.2` (serve the executed UQL in the result contract and expose a plan-only entry point to callers). | Tests confirm the executed UQL is returned with the result, plan-only mode returns a candidate without reading data, planner output that fails to parse or exceeds a budget is refused with a typed error, row visibility matches the equivalent direct UQL query, and no mutation is reachable | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.2.1 Dispatch handler enforces the typed NL budget before parsing Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Dispatch handler enforces the typed NL budget before parsing.** `Method::NlQuery`'s dispatch handler (`handle_nl_query_plan`) applies the SAME character-count `NlQueryBudget` the typed disclosure model (`EG-FEDERATED-QUERY-R058.1`) defines to the planner's produced UQL text BEFORE it reaches `eg_plan::uql::parse`, refusing an over-budget answer with the typed `UQL_BUDGET_EXCEEDED` code rather than running unbounded planner text into the parser. | A unit test confirms `NlQueryBudget::check` refuses over-budget text with a typed `BudgetExceeded` error and accepts in-budget text, independent of whether that text later parses. | requirement | EG-FEDERATED-QUERY | VERIFIED | 8710a3709c47 crates/eg-plan/src/nl.rs:846 |
| EG-FEDERATED-QUERY-R058.2.2 Served NL result carries the executed UQL; plan-only is reachable Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Served NL result carries the executed UQL; plan-only is reachable.** This row holds the remaining scope of `EG-FEDERATED-QUERY-R058.2`. A served method returns the executed UQL text with the rows. A caller can also reach the typed model's `plan_only`. Other clients depend on the `Method::NlQuery` result, so it stays unchanged. A sibling method carries the disclosure. Rollup over `EG-FEDERATED-QUERY-R058.2.2.1` (served `NlQueryExplain`, built) and `EG-FEDERATED-QUERY-R058.2.2.2` (plan-only entry point). | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.2.2.1 Served `NlQueryExplain` returns the executed UQL with the rows Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Served `NlQueryExplain` returns the executed UQL with the rows.** `Method::NlQueryExplain { text, graph }` takes the same request as `Method::NlQuery`. It routes the same way and has the same `query:nl` read policy. An empty `graph` falls back to the request envelope's graph. Both handlers share one run, `run_nl_query` in `src/server/handlers/query/nl.rs`. There, `handle_nl_query_plan` returns the planner's exact UQL text with the parsed plan. The same legs, row-level-security snapshot and off-lock run then produce the rows. The engine answers with `eg_types::nl_query::NlQueryExplainResult`: `{"uql": <UQL text>, "rows": [[node_id, score or null], ...]}`. The engine never caches this result. The `NlQuery` result stays byte-identical. The Python client exposes `QueryClient.nl_query_explain(text, graph=None)`. | Served tests confirm that `uql` equals the planner's output. They confirm that `rows` equal the `NlQuery` rows for the same text. A parse failure (`INVALID_ARGUMENT`) refuses with the same code and detail as `NlQuery`. An over-budget answer (`UQL_BUDGET_EXCEEDED`) does too. A wire test confirms the Python call shape. | requirement | EG-FEDERATED-QUERY | VERIFIED | 569b1ab507d6 f9d6d793d946 crates/eg-types/src/nl_query.rs:26 src/server/tests/nl_explain.rs:54 src/server/tests/nl_explain.rs:81 tests/test_pb_clients.py:88 |
| EG-FEDERATED-QUERY-R058.2.2.2 Plan-only NL entry point Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Plan-only NL entry point.** Expose the typed model's `plan_only` as a served read that returns the candidate UQL without reading data. | A test confirms a plan-only call returns the candidate and reads no data. Not yet delivered. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.3 No-cache-on-NL-text and no-mutation-reachable guarantees Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**No-cache-on-NL-text and no-mutation-reachable guarantees.** Child slice of `EG-FEDERATED-QUERY-R058` (see tasks.md). Rollup over `EG-FEDERATED-QUERY-R058.3.1` (no-cache-on-NL-text guard, built) and `EG-FEDERATED-QUERY-R058.3.2` (no-mutation-reachable confirmation). | Tests confirm the executed UQL is returned with the result, plan-only mode returns a candidate without reading data, planner output that fails to parse or exceeds a budget is refused with a typed error, row visibility matches the equivalent direct UQL query, and no mutation is reachable | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.3.1 NL results are never cached on the NL text Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**NL results are never cached on the NL text.** `Method::NlQuery`'s handler answers through the uncached `result_response` path and never references the engine's `ResultCache`, so a non-deterministic planner answer can never be served stale from a prior, differently-planned request; a regression guard pins this structural guarantee. | A test confirms the handler source never references `ResultCache` or the cache-aware `served_response` helper. | requirement | EG-FEDERATED-QUERY | VERIFIED | 8710a3709c47 d2cb221aa148 src/server/handlers/query/nl.rs:205 src/server/handlers/query/nl.rs:211 src/server/handlers/query/nl.rs:234 |
| EG-FEDERATED-QUERY-R058.3.2 No mutating operation is reachable from the NL surface Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**No mutating operation is reachable from the NL surface.** Remaining scope of `EG-FEDERATED-QUERY-R058.3`: confirm no NL-planned UQL text can reach a mutating or side-effecting operation. | A negative test confirms an NL-planned mutating statement is refused. Not yet delivered. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R059 Semantic index lifecycle is fenced, durable and restart-safe Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Semantic index lifecycle is fenced, durable and restart-safe.** Semantic and vector index creation, backfill, activation and drop are fenced, durable operations, and an unavailable index generation falls back correctly rather than serving incorrect or partial results after restart. | Restart and fenced-lifecycle tests (FQR-07) confirm index generations activate, drop and recover correctly across a restart. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 8fa63622a11f |
| EG-FEDERATED-QUERY-R060 Leiden community detection supports a Constant Potts Model quality function Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Leiden community detection supports a Constant Potts Model quality function.** LeidenConfig exposes a Constant Potts Model quality function as an alternative to modularity, applying its own delta-quality term inside the existing local-moving and refinement loop, so community detection is not limited to modularity's resolution limit. | Leiden kernel tests and the corresponding query-surface objective-function parameter confirm the Constant Potts Model produces correct communities distinct from the modularity result on the same graph. | requirement | EG-FEDERATED-QUERY | LANDED | 2a0d6eae0918 62c450561948 |
| EG-FEDERATED-QUERY-R061 One grammar table drives UQL docs, prompts and error messages Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**One grammar table drives UQL docs, prompts and error messages.** The UQL grammar table is the single source for the generated EBNF documentation block, the natural-language planner's prompt, and the expected-token lists in parser error messages; the dispatch table is checked against the grammar in both directions, and a feature unsupported in the current build fails with one dedicated feature-not-available error. | A generated-docs snapshot test and a dispatch-table-versus-grammar consistency check (FQR-01) both pass, and a feature excluded from compilation is confirmed to fail with the dedicated error. | requirement | EG-FEDERATED-QUERY | VERIFIED | 62c450561948 8451d7eecf02 crates/eg-plan/src/uql/tests/contract.rs:46 crates/eg-plan/src/uql/tests/contract.rs:58 |
| EG-FEDERATED-QUERY-R062 Streaming memory test measures only its own allocations Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Streaming memory test measures only its own allocations.** The million-row streaming-scan memory test measures memory allocated by the stream under test using a scoped counting allocator, rather than process-wide memory, so the test cannot fail due to unrelated concurrent work in the same process or host. | The test passes measuring peak allocation for the streamed scan below its declared bound when run both in isolation and alongside concurrent unrelated tests. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 645f55e5f0db |
| EG-FEDERATED-QUERY-R063 Leiden provides stable community naming and a connectivity check Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Leiden provides stable community naming and a connectivity check.** Community detection runs a sweep across multiple resolution values and keeps communities that persist across them, names each stable community by its highest-centrality member rather than by an index that can shuffle between runs, and performs a connectivity post-check on every detected community. | Tests cover the resolution sweep's stability selection, confirm community names stay stable across reruns on the same input, and confirm the connectivity post-check detects any disconnected community. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 b5fe3c140c21 |
| EG-FEDERATED-QUERY-R064 UQL lexer supports its full token set and structured diagnostics Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL lexer supports its full token set and structured diagnostics.** The UQL lexer tokenizes comments, scientific notation, Unicode and quoted identifiers, UTF-8 strings, parameter placeholders and JSONPath tokens, enforces bounded nesting, and reports structured diagnostics with an error code, source span, expected-token set, fix hint and a line/column caret. | Lexer tests cover each token class and confirm diagnostic output includes the code, span, expected set and caret position for malformed input. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 8451d7eecf02 |
| EG-FEDERATED-QUERY-R065 Named UQL sub-plans compile to an ordered plan DAG Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Named UQL sub-plans compile to an ordered plan DAG.** Named sub-plans referenced by FROM or JOIN compile into a plan DAG ordered by first-reference depth-first traversal, a FUSE operation inlines named sub-plans, and the DAG printer's output can be re-parsed back to an equivalent plan. EXPLAIN and PROFILE are served for a DAG-shaped program, node by node and truthfully: the program is reported as written with one stage per node and its estimate, PROFILE records each node's rows and time, and the result states that such a program is not cost-reordered and not incrementally maintained. | Tests confirm depth-first compile ordering, FUSE inlining correctness via re-parse, and that EXPLAIN and PROFILE on a DAG program return one stage per node with the not-reordered, not-incremental note. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 8451d7eecf02 |
| EG-FEDERATED-QUERY-R066 SPARQL evaluator is split into modules within the file-size limit Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**SPARQL evaluator is split into modules within the file-size limit.** crates/eg-rdf/src/sparql.rs is split into cohesive modules so that no resulting file exceeds the repository's 900-line limit, using pure code moves that preserve every existing function and behavior unchanged. | The full eg-rdf all-features test suite passes identically before and after the split, and a function-by-function comparison confirms every original function is preserved. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 fbb3b6f0ff6c |
| EG-FEDERATED-QUERY-R067 UQL RETURN exposes multiple named score channels per row Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL RETURN exposes multiple named score channels per row.** Each scoring stage, such as similarity, belief or window scoring, records its score under its own fixed channel in a side table, so a query can return several distinct named scores for the same row and served results carry every requested channel. | A test returning two or more named score channels in the same query confirms each row carries the correct value for every requested channel. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 8451d7eecf02 |
| EG-FEDERATED-QUERY-R068 UQL supports WITH PROOF for proof-carrying results Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL supports WITH PROOF for proof-carrying results.** UQL gains a WITH PROOF clause that returns proof-carrying results consistent with EG-FEDERATED-QUERY-R006's proof contract, binding each returned proof to its premises and source generation. | A test issuing a UQL query WITH PROOF confirms the returned proof matches EG-FEDERATED-QUERY-R006's premise-binding and source/generation requirements. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 857e20c63775 |
| EG-FEDERATED-QUERY-R069 SQL pushdown batches key lookups and shares rendering with OBDA Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**SQL pushdown batches key lookups and shares rendering with OBDA.** SQL foreign-source pushdown batches key lookups into a single IN-list subquery and pushes LIMIT into the statement's parsed syntax tree while respecting any existing ORDER BY or LIMIT and skipping FETCH or non-literal limits; both SQL pushdown and OBDA render literals and identifiers through the same shared rendering function. | Pushdown tests confirm batched IN-list queries and pushed LIMIT match the full-fetch oracle, and OBDA's rendered SQL uses the identical shared rendering function. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 d656b605ef0a |
| EG-FEDERATED-QUERY-R070 UQL execution budgets are enforced and reported in EXPLAIN/PROFILE Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL execution budgets are enforced and reported in EXPLAIN/PROFILE.** A query's execution is bounded by a budget on maximum result rows and maximum traversal visits, failing with a dedicated budget-exceeded error when exceeded; EXPLAIN reports the canonical and optimized plan with per-stage estimated rows and an incremental-maintainability reason, and PROFILE reports per-stage observed rows and elapsed time. | Tests confirm a query exceeding its budget fails with the dedicated budget-exceeded error, and EXPLAIN/PROFILE output includes the documented per-stage fields. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 62c450561948 e93f988eae07 crates/eg-plan/src/budget.rs:73 |
| EG-FEDERATED-QUERY-R071 HTTP foreign sources support templated pagination and key placeholders Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**HTTP foreign sources support templated pagination and key placeholders.** An HTTP foreign source's URL query part may declare placeholders for keys, limit, offset and page, which the planner fills with percent-encoded values and paginates up to the source's declared page/limit budget; a source requiring keys refuses a full scan that supplies none. | Tests confirm correct percent-encoded substitution for each placeholder, pagination stopping at the declared budget, and a keys-required source refusing a keyless full-scan request. | requirement | EG-FEDERATED-QUERY | LANDED | 62c450561948 d656b605ef0a |
| EG-FEDERATED-QUERY-R072 The ontology selects the sources for a cross-source question Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**The ontology selects the sources for a cross-source question.** A caller sends the ontology classes of a question. EG links those classes through object properties within a hop budget. EG entails subclass relations during that search. For each class on the path, EG names the approved virtual mapping that serves it, or the class itself as uncovered. Every selection carries its premises: label, relation and mapping facts with their source generation. The answer is read-only and plans no execution. Rollup: split into `.1` (below) per SPEC-SIZING §5; further children land the live-ontology/mapping-catalog search. | A fixture with two sources proves the path, the selected mappings, a subclass mapping serving its superclass, an uncovered class and a disconnected pair. | requirement | EG-FEDERATED-QUERY | VERIFIED | 62c450561948 6c11520aebfc f948211fb8c7 crates/eg-rdf/src/source_selection.rs:321 crates/eg-rdf/src/source_selection.rs:343 crates/eg-rdf/src/source_selection.rs:369 crates/eg-rdf/src/source_selection.rs:378 crates/eg-rdf/src/source_selection.rs:388 |
| EG-FEDERATED-QUERY-R072.1 Typed model for cross-source coverage, proved against a fixture Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Typed model for cross-source coverage, proved against a fixture.** `eg-rdf::source_selection` defines `CoverageResult` (`Covered`/`Uncovered`/`Disconnected`), `SourceSelectionHop`, and `Premise` (label/relation/subclass/mapping/source-generation facts), and a fixture-driven `select_sources` that links classes through object properties within a hop budget, entails asserted `subClassOf` facts, and reports read-only coverage with no execution plan attached. | Unit tests over a two-source fixture prove a direct mapping, a subclass mapping serving its superclass, an uncovered reachable class, and a disconnected class. | requirement | EG-FEDERATED-QUERY | VERIFIED | 6c11520aebfc f948211fb8c7 crates/eg-rdf/src/source_selection.rs:321 crates/eg-rdf/src/source_selection.rs:343 crates/eg-rdf/src/source_selection.rs:369 crates/eg-rdf/src/source_selection.rs:378 crates/eg-rdf/src/source_selection.rs:388 |
| EG-FEDERATED-QUERY-R073 Operation-bound virtual mappings federate API, MCP, A2A and GraphQL sources Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Operation-bound virtual mappings federate API, MCP, A2A and GraphQL sources.** These sources register as typed `ForeignSourceSpec` kinds with declared capabilities. A mapped entity reads through its discovered operation. A key filter is pushed only when the source declares that capability. EG always keeps the exact local residual filter. Every request passes the shared outbound guard and the per-query budgets of FQR-04. Rollup: split into `.1` (below) per SPEC-SIZING §5; further children bind the discovered operation and prove the recording-mock equal-rows case. | A recording mock proves pushed and unpushed key filters return equal rows. Budget, outbound-guard and ungranted-source cases refuse with typed errors. | requirement | EG-FEDERATED-QUERY | SPECIFIED | 62c450561948 bfd84b2ccbcb f948211fb8c7 |
| EG-FEDERATED-QUERY-R073.1 Typed model for operation-bound foreign sources, with refusal tests Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Typed model for operation-bound foreign sources, with refusal tests.** `eg-types::wire` adds four `ForeignSourceSpec` variants — `Api`, `Mcp`, `A2a`, `GraphQl` — each carrying its operation reference plus a declared `ForeignOperationCapabilities` (including `key_filter_pushdown`). An unbound spec of any of these kinds resolves to a typed refusal (no verified registration) rather than a silent empty result or a panic. | Unit tests wire-round-trip each new variant and confirm an unbound/ungranted spec and a budget-exceeded fixture both refuse with typed errors; the recording-mock equal-rows proof is deferred to a later child. | requirement | EG-FEDERATED-QUERY | VERIFIED | 6c11520aebfc bfd84b2ccbcb crates/eg-plan/src/federation.rs:229 crates/eg-plan/src/federation.rs:249 crates/eg-plan/src/federation_opt/budget.rs:156 crates/eg-plan/src/federation_opt/budget.rs:173 |
| EG-FEDERATED-QUERY-R073.2 Connection-protocol pushdown matrix Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Connection-protocol pushdown matrix.** The planner must hold one matrix row per connection protocol. Each row names the paging or streaming form and the usable pushdown capabilities. It also names the contract term in the connector pack. The matrix is the table in `plan.md`. The planner must not push a capability that the row does not list. A stream protocol must push a time range only. The SDK transport per protocol is `SDK-CONNECTOR-CONTROL-R069`. | A unit test fails when a declared protocol lacks a row. It refuses a pushdown kind outside the row. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R074 Served `select_topology` reasoning-policy op Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Served `select_topology` reasoning-policy op.** A served `SelectTopology` operation returns a typed topology choice for a task description under the reasoning policy, refusing an empty task. Unblocks AU-SEMANTIC-R008.2.2. | One test asserts the chosen topology for two task shapes and the empty-task refusal. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R075 Generated client method for `select_topology` Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Generated client method for `select_topology`.** The generated client exposes `select_topology` from the Rust schema source. Unblocks AU-SEMANTIC-R008.2.2. | A generated-client test calls it against the served op. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R076 Canonical ontology hash for a Turtle payload Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Canonical ontology hash for a Turtle payload.** A served method returns a canonical hash of a Turtle payload that is stable under prefix, statement-order and blank-node relabelling. Invalid Turtle is refused. Unblocks AU-SEMANTIC-R006.5.1. | Test asserts equal hashes for two reordered serializations and a refusal for invalid Turtle. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077 Vectorized SQL text columns (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Vectorized SQL text columns (rollup).** EG must bind a text column of a SQL table to an embedding index, so vector search covers that column. Each column must opt in to the binding. A column without a binding stores no vectors. | Tests prove a bound column answers a nearest-neighbour query, an unbound column refuses, and an update re-embeds the changed row. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.1 `ColumnVectorBinding` typed model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**`ColumnVectorBinding` typed model.** `crates/eg-query/src/sql/ann.rs` must define `ColumnVectorBinding` with table, column, embedder reference, dimension and an `bound` flag. | Unit test round-trips a binding and rejects a zero dimension. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.2 Bind and unbind surface Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Bind and unbind surface.** A served SQL operation must bind or unbind a column. Binding a non-text column must be refused with a typed error. | Test binds a text column and refuses an integer column. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.3 Row-write re-embedding hook Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Row-write re-embedding hook.** The SQL write path must queue a re-embed for each changed row of a bound column. Unbound columns must queue nothing. | Test writes one row and asserts exactly one queued embed for a bound column and none for an unbound one. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.4 Vectorization recommendation Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Vectorization recommendation.** A pure function must rank text columns by average length and distinct ratio and return recommendations. It must never create a binding itself. | Unit test ranks three columns and asserts no binding changes. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.5 End-to-end column vector search Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**End-to-end column vector search.** A SQL nearest-neighbour query over a bound column must return the expected rows, with EXPLAIN naming the binding. Agent-webui table explorer consumption is a handoff. | Fixture table with five rows returns the expected nearest row and EXPLAIN names the binding. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R078 Tenant and clearance predicates are part of the query plan (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Tenant and clearance predicates are part of the query plan (rollup).** EG must apply the caller's tenant and access-policy predicates inside the plan, before any retrieval. A query must never read a node, edge or vector hit outside the caller's clearance. | Tests prove an out-of-tenant node, edge and vector hit never appear, and an unverified caller is refused. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R078.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** `crates/eg-query/src/plan_scope.rs` must define `PlanScope` with tenant, clearance labels and a `verified` flag. It must expose `predicate()` as a closed predicate set. | Unit test round-trips a `PlanScope` and rejects an empty tenant. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R078.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** `inject_scope(plan, scope)` must add the tenant predicate to every graph, edge and vector scan node. The default rule `scan_all_leaves` should be replaceable by a named rule. | Unit test plans a three-leaf query and asserts each scan carries the predicate. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R078.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** `handle_uql` at `src/server/handlers/query/uql_statement.rs:17` must call `inject_scope` after planning and before execution. Its production caller is `dispatch_query_family` at `src/server/handlers/query/dispatch.rs:66`. | Test asserts a planned statement reaches execution only with the predicate attached. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R078.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A caller without a verified tenant must receive the typed refusal `PLAN_SCOPE_UNVERIFIED`. The handler must not post-filter results instead. | Test sends a statement with no verified tenant and asserts the refusal and zero reads. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R078.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Each executed plan must record `plan_scope_tenant` and `plan_scope_predicates` in its trace. The explain output must show them. | Test reads the trace and the explain output for one scoped query. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R078.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served UQL statement operation, called through `dispatch_query_family`. It must show that a vector hit in another tenant never returns. | Integration test `tests/plan_scope_tenant.rs` seeds two tenants, queries as one, and asserts only its own rows return. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R079 Iceberg v2 catalog interoperability (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Iceberg v2 catalog interoperability (rollup).** EG must publish an Iceberg REST catalog with add, drop, rename and reorder schema evolution. It must support retained snapshot time travel and read and write Iceberg v2 manifests. Manifest writing means engine-owned publication from committed graph state; external clients receive read-only projections under R080. Children `.1` through `.6` define the complete contract. | Satisfied only when every child is verified through served acceptance; source inspection alone proves no runtime delivery. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R079.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Extend `crates/eg-types/src/lake_catalog.rs::SchemaChangeKind` with `ReorderColumn` and define `ManifestPublication` with tenant, table, committed graph version, source LSN, snapshot ID and schema ID. It also carries format version 2, manifest and manifest-list locations, and artifact digests. Keep field IDs stable across rename and reorder. Classify reorder as compatible and drop as destructive. | Round-trip every field; classify every column change; refuse absent version binding or unsupported format version. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R079.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Extend `LakeTable::evolve_add_column` to add, drop, rename and reorder committed graph schema changes. Reuse `LakeTable::iceberg_manifests` and `build_iceberg_manifests` to write Iceberg v2 Avro manifests and manifest lists, with file paths, counts and sizes. Partition/schema IDs and snapshot/sequence metadata must match the published snapshot. Publish metadata only after referenced artifacts are durable; preserve retained snapshots and their schemas. Support append, compaction and copy-on-write deletion without exposing abandoned artifacts as a committed snapshot. | Decode emitted artifacts, verify referenced files and metadata, and compare old/new snapshot rows and schemas after every supported mutation. Inject publication failure and prove the previous snapshot remains readable. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R079.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The engine publication path is `LakeManager::drain_series` -> `materialize_batch` in `src/server/lake/mod.rs:537` -> `prepare_materialization` and `publish_artifacts` in `src/server/lake/catalog_ops.rs` -> `LakeTable::iceberg_manifests` -> `crates/eg-lake/src/iceberg_avro.rs::build_iceberg_manifests`. Bind committed graph version and schema evolution to this path and expose committed metadata through `src/server/lake/rest/catalog.rs::load_table` and `LakeManager::load_table_as_of`. The writer exists today; the graph-version binding and complete schema-evolution acceptance remain delivery work. REST CommitTable must pass R080 refusal before any mutation; it is not an alternate schema-write authority. | A served authoritative graph mutation reaches the production publisher and an authenticated catalog read resolves the resulting manifest list. A projection CommitTable request never invokes mutation or publication. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R079.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Unapproved destructive authoritative schema changes return `SCHEMA_CHANGE_NOT_APPROVED`; unknown columns return `SCHEMA_COLUMN_UNKNOWN`. A missing graph-version binding or unsupported manifest/schema/partition feature returns `MANIFEST_PUBLICATION_INVALID` with a reason. No new snapshot becomes visible. Projection metadata and data updates return R080's `PROJECTION_READ_ONLY`; a format-compatibility request never grants write authority. | Exercise every refusal with unchanged visible graph/catalog versions; readers must not receive a partially published or falsely compatible snapshot. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R079.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Use the lake operation evidence path. Record tenant, table, committed graph version, source LSN, schema version, change kind and compatibility. Include snapshot ID, format version, manifest/list locations and digests, publication outcome and refusal reason. A time-travel read records its resolved snapshot. Capture external reader name/version and supported feature matrix in acceptance evidence without exporting credentials or raw data logs. | Correlate graph commit, publication and catalog load records; failed publication has no successful snapshot evidence. Every advertised format feature has a reader acceptance result. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R079.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** `tests/lake_catalog_schema_evolution.rs` and `tests/lake_manifest_interoperability.rs` must drive the real served graph mutation entry point and authenticated Iceberg REST listener. A pinned independent Iceberg reader must load emitted v2 manifests and query Parquet data. Cover add/drop/rename/reorder, append, compaction and copy-on-write deletion. Also cover retained snapshot time travel, publication failure and projected write refusal. The test must name the actual graph handler and publisher call chain. Directly invoking the Avro builder or mocking catalog responses is insufficient. | The external reader sees committed rows and stable field IDs at retained and current snapshots. No separate copy job runs. Negative cases leave prior snapshots readable and cannot mutate graph or source systems. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R080 The graph is the only write boundary; table outputs are read-only projections (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**The graph is the only write boundary; table outputs are read-only projections (rollup).** Iceberg and Parquet outputs must serve external engines without a copy pipeline. The engine must refuse any write that arrives through a projection. Split into `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R080.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** `crates/eg-types/src/lake_catalog.rs` must define `ProjectionAccess` with the closed values `ReadOnly` and `Authoritative`. Every catalog table entry (`TableEntry`, `crates/eg-lake/src/catalog.rs:27`) must carry `ReadOnly`. | Unit test round-trips the type and asserts every entry is `ReadOnly`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R080.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** `refuse_projection_write(op, entry)` in `crates/eg-lake/src/catalog.rs` must classify create, data or metadata commit, schema update, rename and drop as writes. It must pass list and load. Unknown mutating operations must fail closed. Internal publication of committed graph snapshots under R079 does not authorize client writes. | Unit test classifies each operation. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R080.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** `refuse_projection_write` must run in the route dispatch in `src/server/lake/rest/mod.rs` before `commit_table` (`src/server/lake/rest/catalog.rs:318`) and `drop_table` (line 349). The caller is the Iceberg listener. The shared SQL path `validate_federated_sql` (`crates/eg-plan/src/federation.rs:933`) already refuses writes to foreign sources. No production caller refuses a projection write today. | Route test sends every write route and asserts the refusal. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R080.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Any data or metadata write through a projection must return `PROJECTION_READ_ONLY` with HTTP 405 and name the table. The graph state must not change. | Test attempts a data commit and asserts the code, status and an unchanged graph version. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R080.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Each refusal must record `table`, `operation` and `principal` in the operation record. Each projection read must record the graph `version` it was materialized at, using `ProjectionCatalog` (`crates/eg-core/src/projection_catalog.rs:75`). | Test reads the record after one refusal and one read. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R080.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the Iceberg REST listener. A graph write must appear in the next projection read. A write through the projection must be refused. An external reader must see the graph write without a copy job. | Integration test `tests/lake_projection_read_only.rs` writes through the graph, reads the projection, then attempts a projected write. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081 Retrieval sufficiency verdict with repair step, fallback policy and round limit (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Retrieval sufficiency verdict with repair step, fallback policy and round limit (rollup).** EG judges whether retrieved evidence suffices to answer, and chooses the repair step and the fallback policy. The harness applies the verdict and runs the next round. Children `.1` to `.6` deliver the base verdict. Rollups `.7` through `.9` extend selection, feedback and hierarchy. Mapped extensions `.100` through `.103` add distinct joint-selection, compression, distillation and viewport-binning contracts. | See each original child and mapped extension. Preserve the base verdict, fallback and tenant/result bounds. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `SufficiencyVerdict{verdict, evidence_count, reason, repair, fallback, round, round_limit}` in `crates/eg-types/src/retrieval_verdict.rs`. The `verdict` set is closed: `sufficient`, `insufficient`. `repair` is `BoostK{k}`, `SwitchMode{mode}` or `Stop`. `fallback` is `Lenient` or `Strict`. No type of this shape exists today. Proving test: `crates/eg-types/src/retrieval_verdict.rs::tests::verdict_round_trips_and_rejects_unknown`. | A serde round trip keeps every field and rejects an unknown verdict value. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Add `judge_sufficiency(rows, rule, call) -> SufficiencyVerdict`. The default `rule` is `min_evidence_count`, a named replaceable value with default 3. The default repair order is `BoostK` (k doubles, capped at 64), then `SwitchMode`, then `Stop`. The call carries `round` and `round_limit`. At `round_limit` the repair must be `Stop`. Proving test: `crates/eg-plan/src/retrieval_verdict.rs::tests::repair_order_ends_at_round_limit`. | Three insufficient rounds yield BoostK, SwitchMode, Stop. A replaced rule changes the count. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** `judge_sufficiency` attaches at the end of `execute` in `crates/eg-plan/src/exec.rs:536`, after `fuse_rrf` at `crates/eg-plan/src/exec.rs:848` returns its `RowSet`. A plan that carries a `SufficiencyRule` gets the verdict beside its rows. The production caller is the served query path: `eg_plan::execute` is called from `crates/eg-graphql/src/crossmodal.rs:429`. This row creates the call site in `execute`. No production caller of a sufficiency check exists today. Proving test: `crates/eg-plan/src/exec.rs::tests::execute_returns_verdict_for_rule_plan`. | A plan with a rule returns rows and a verdict. A plan without a rule returns rows only. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A verdict call without `round_limit` must refuse with `RETRIEVAL_ROUND_LIMIT_REQUIRED`. A `Strict` fallback with an `insufficient` verdict must return `abstain` and no extractive answer. The refusal names the missing field or the fallback. Proving test: `crates/eg-plan/src/retrieval_verdict.rs::tests::strict_insufficient_abstains`. | A missing limit returns the typed code. A strict call never carries an extractive hint. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Each verdict must be recorded as a premise on the retrieval `DecisionRecord` of `EG-DECISION-ENGINE-R100`. The premise lists `verdict`, `evidence_count`, `reason`, `repair`, `fallback` and `round`. Proving test: `crates/eg-plan/src/retrieval_verdict.rs::tests::verdict_premise_lists_all_fields`. | The decision record shows the verdict premise with all six fields. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served cross-modal query operation. The test sends a query that returns two rows against a rule of three. The call passes through `execute` at `crates/eg-plan/src/exec.rs:536`. It observes an `insufficient` verdict, repair `BoostK`, and the premise on the decision record. Proving test: `tests/retrieval/test_sufficiency_served.py::test_insufficient_returns_boost_k`. | The served response carries the verdict and the premise exists. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.7 Adaptive dual-score chunk selection (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Adaptive dual-score chunk selection (rollup).** Extend R081 with children `.1` through `.6`. EG owns retrieval decisions and evidence; applications consume or execute its bounded decisions. | All six children require served positive and negative acceptance. Definition publication claims no runtime delivery. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.7.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Define `ChunkScorePair`, `SelectionPolicy` and `SelectionReceipt` in `crates/eg-types/src/retrieval_verdict.rs`. Bind chunk IDs, corpus revision, embedding and cross-encoder scores, model revisions, normalization, thresholds, fusion weights and maximum count. Carry an activation benchmark digest. | Round-trip every field. Reject non-finite scores, missing model provenance, duplicate chunk IDs and invalid bounds. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.7.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Use already computed embedding and cross-encoder scores to classify four score regions. Retain dual-high candidates; reject dual-low candidates. Rescue low-embedding/high-relevance candidates, including vocabulary-mismatch results. Apply the declared fusion threshold to the remaining region. Compute query-dependent count, capped by `max_chunks`, with stable ID tie-breaking. Selection itself performs no model inference. | Golden score pairs prove rescue, dual-low rejection, variable count and deterministic ties. Empty accepted sets never backfill rejected chunks. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.7.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Add the selection operator to `crates/eg-plan/src/exec.rs:536` after candidate cross-encoder scoring and before final truncation. Retain per-chunk score pairs through `fuse_rrf` at line 848; rank-fusion output alone is insufficient. Its production caller is `crates/eg-graphql/src/crossmodal.rs:429`. Cross-encoder binding and this selector remain missing production work. | The real served cross-modal query reaches the selector with both scores. A disconnected helper or client-side selector cannot close this row. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.7.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Return `RETRIEVAL_SCORE_PAIR_REQUIRED` for missing or stale scores and `RETRIEVAL_NORMALIZATION_INVALID` for undefined normalization. Explicitly define empty and constant-score normalization in the policy. Return `RETRIEVAL_POLICY_UNVERIFIED` when activation lacks the matching benchmark receipt. Reject dual-low chunks even when fewer than the requested count remain. | Invalid inputs and unapproved activation fail before answer assembly. Dual-low-only input returns an empty evidence set and R081 insufficiency. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.7.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record input scores, normalization, region, fused score, selected IDs, exclusions, count and policy digest. Count embedding, reranker and selection inference calls separately. Benchmark against a declared fixed-count baseline using identical candidates, models, corpus and tenant predicates. Activation requires zero extra selection inference and declared quality/cost acceptance. | The benchmark receipt pins data, labels, configuration, acceptance thresholds and measured results. Paper results never substitute for EG measurements. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.7.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: the authenticated served cross-modal query. `tests/retrieval/test_adaptive_selection_served.py` uses a deterministic corpus and pinned production embedding/reranker artifacts. Compare adaptive and fixed-count results through the actual execution path. | Prove low-embedding rescue, dual-low refusal, varying counts and zero additional selection inference. Independently read the trace and verify tenant isolation. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.8 Bounded retrieval feedback and critique (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Bounded retrieval feedback and critique (rollup).** Extend R081 with children `.1` through `.6`. EG owns retrieval decisions and evidence; applications consume or execute its bounded decisions. | All six children require served positive and negative acceptance. Definition publication claims no runtime delivery. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.8.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Extend `crates/eg-types/src/retrieval_verdict.rs` with `RetrievalFeedback`, `PerspectiveQuery`, `TermFeedback` and `RetrievalCritique`. Bind original query, round, corpus/model revisions, document IDs, measured relevance, term weights and critique provenance. Feedback tiers are `Reinforce`, `Missing`, `Suppress`. Carry round, query, term, token and inference budgets. Use R082 `StopContext` and `StopVerdict` for termination; do not add a second stop authority. | Round-trip all tiers, limits and termination fields. Missing evidence IDs, unbounded requests and inconsistent revisions refuse. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.8.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Generate bounded diverse semantic-perspective expansions from the original query. Assess returned documents against that original query, then reinforce useful terms, record missing aspects and suppress misleading terms. Use the latest accepted expansion and revision-bound feedback for the next round. Critique may propose a reformulation but never replace measured relevance. | Fixtures prove useful terms persist, misleading terms lose weight and distinct perspectives remain distinct. Adversarial critique cannot promote rejected evidence. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.8.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Add the feedback operator beside R081 sufficiency evaluation in `crates/eg-plan/src/exec.rs:536`. The caller remains `crates/eg-graphql/src/crossmodal.rs:429`. EG validates continuation evidence and budgets, then applies R082 precedence before dispatching any next query. The harness only executes an authorized bounded continuation. This row creates the missing feedback call site. | Served successive requests carry a validated EG continuation. Terminal verdicts dispatch no retrieval or inference. No independent reformulation or stopping authority appears. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.8.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Return `RETRIEVAL_FEEDBACK_INVALID` for forged documents, incompatible revisions or evidence outside tenant scope. R082 checks round and other budget limits before progress or confidence stops. Exhaustion returns `RETRIEVAL_BUDGET_EXCEEDED` with its terminal verdict and dimension. Valid completed-round evidence can stop with `no_new_evidence` or `quality_saturated` even without calibration. Preserve `ROUND_NOT_CALIBRATED` and never promote such termination to calibrated sufficiency. Reject critiques that alter scope, scores, limits or activation policy. | Invalid feedback and terminal continuations perform no further retrieval or inference. An uncalibrated exhausted or saturated continuation returns the typed terminal reason plus the calibration refusal. A progressing uncalibrated continuation remains bounded. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.8.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record expansion text, semantic perspective, term reinforcement/suppression, document tiers, critique text and applied or rejected proposal. Bind each item to measured relevance, original query, round, policy and corpus revision. Record R082 reason, calibration refusal, exhausted dimension, progress evidence and inference/token costs. Treat critique text as untrusted data. | Independent trace readback connects each next query to its feedback. Terminal trace records retain missing calibration without inventing a margin or claiming enough evidence. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.8.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: the authenticated served cross-modal query with successive EG continuations. `tests/retrieval/test_feedback_served.py` reads a deterministic corpus through production operators and pinned inference artifacts. Its uncalibrated continuation matrix exercises R082 precedence and observes production dispatch counters. | Assert feedback tiers and term changes. Cover missing calibration with new evidence, no new evidence, saturation and every exhausted budget. Read the trace independently and assert no dispatch after terminal outcomes. Reject stale feedback and hostile critique. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9 Bounded typed hierarchy retrieval (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Bounded typed hierarchy retrieval (rollup).** Children `.1` through `.6` retain community-to-entity retrieval. Child `.7` adds distinct document-section retrieval. EG owns retrieval decisions and evidence; applications consume or execute its bounded decisions. | Both hierarchy kinds require served positive and negative acceptance. Definition publication claims no runtime delivery. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `HierarchyRetrievalPolicy` and `HierarchyStageReceipt` to `crates/eg-types/src/retrieval_verdict.rs`. Carry hierarchy revision, community/summary/entity IDs, parent links, stage, score provenance, beam width and depth. Bound visited communities, entity candidates, reranker calls, tokens and total cost. | Reject absent hierarchy revisions, invalid parent links and zero or missing required limits. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Read community summaries, refine selected communities, then descend to entity evidence. Rerank at each declared stage and prune with the declared beam and stable ID tie-breaks. Deduplicate entities and retain their community paths. Apply tenant predicates before every stage and candidate truncation. | A small hierarchy has exact expected stage order, selected paths and final entity IDs. A wider beam consumes an explicitly measured additional budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Attach the hierarchy operator before terminal fusion in `crates/eg-plan/src/exec.rs:536`. Bind graph community summaries and entity reads through `PlanCtx`; the served caller is `crates/eg-graphql/src/crossmodal.rs:429`. Reuse `fuse_rrf` only for its existing rank-combination role. Revision-aware descent and stage reranking remain missing production calls. | A served query must invoke all three stages before returning entities. Flat entity retrieval alone cannot claim hierarchical acceptance. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Return `RETRIEVAL_HIERARCHY_INVALID` for cycles, stale summaries or dangling parents/entities. Exhausted breadth, depth, scoring or cost bounds return `RETRIEVAL_BUDGET_EXCEEDED` with completed-stage evidence. Never silently replace failed descent with unbounded global retrieval. | Negative fixtures prove typed refusals and no reads beyond scope or budget. Partial evidence is explicitly marked incomplete. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record each visited community, pruning decision, entity path, stage score, reranker invocation and cumulative cost. Bind summary generation and graph/corpus revisions to the receipt. Compare quality and measured work against a declared flat-retrieval baseline. | Trace readback accounts for every stage and rejected candidate. Fixture expectations do not stand in for measured production costs. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: the authenticated served cross-modal query. `tests/retrieval/test_hierarchy_served.py` loads two tenant hierarchies with deterministic summaries and entity evidence. It uses production graph reads and scoring. | Prove summary-to-community-to-entity descent and exact cost counters. Refuse stale hierarchy, dangling entity and exhausted beam/cost budgets; another tenant remains unread. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R082 Iterative retrieval stop rule with calibrated confidence and bounded termination (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Iterative retrieval stop rule with calibrated confidence and bounded termination (rollup).** EG applies one precedence rule for invalid feedback, exhausted limits, measured retrieval progress and calibrated confidence. Only the confidence branch can claim `answer_repeated_margin_met`. No component is learned. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R082.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `CalibrationTable`, `RoundCalibration`, `StopContext` and `StopVerdict` in `crates/eg-types/src/retrieval_stop.rs`. Calibration rows hold round, baseline confidence and margin threshold. Context carries validated limits, completed-round progress and policy revision. Verdict carries stop, reason, round, optional margin/threshold, optional calibration refusal and exhausted dimension. Closed reasons: `round_limit`, `budget_exhausted`, `no_new_evidence`, `quality_saturated`, `answer_repeated_margin_met`, `continue_uncalibrated`, `continue_answer_changed`, `continue_margin_low`. Missing calibration retains `ROUND_NOT_CALIBRATED` and absent margin/threshold. | `crates/eg-types/src/retrieval_stop.rs::tests::table_and_verdict_round_trip` preserves all reasons and the simultaneous terminal reason/calibration refusal. Unknown reasons refuse. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R082.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Add `decide_stop(table, history, context) -> StopVerdict`. After feedback validation, precedence is round limit, other exhausted budget, no new evidence, declared quality saturation, then calibrated confidence. A confidence stop requires repeated answers and `confidence - baseline_confidence > margin_threshold`. Missing calibration selects `continue_uncalibrated` only if no earlier terminal condition applies. Other continuations use answer-changed or low-margin reasons. Stop alone does not assert R081 sufficiency. | `crates/eg-plan/src/retrieval_stop.rs::tests::repeat_and_margin_stops` covers each branch and simultaneous conditions. Equality at the margin threshold continues. Terminal progress requires completed-round evidence, not caller or critique assertions. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R082.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** `decide_stop` attaches beside `judge_sufficiency` at `crates/eg-plan/src/exec.rs:536`, reached through `crates/eg-graphql/src/crossmodal.rs:429`. Apply continuation validation and limit checks before dispatch; evaluate completed-round progress before issuing another continuation. EG derives context from validated evidence and counters. This row creates the call site. The harness cannot bypass a terminal verdict. | `crates/eg-plan/src/exec.rs::tests::execute_returns_stop_verdict_with_history` covers both hooks. A feedback continuation checks limits even without prior answer history. An ordinary query outside that path without history has no confidence verdict. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R082.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A missing calibration row prohibits a confidence-based early stop and records `ROUND_NOT_CALIBRATED` with the round. It never overrides an exhausted limit, no new evidence or declared saturation. Such terminal outcomes retain the calibration refusal; only a valid progressing round with remaining budgets may continue. Exhausted limits return `RETRIEVAL_BUDGET_EXCEEDED` with the terminal verdict. Invalid feedback refuses before continuation. | `crates/eg-plan/src/retrieval_stop.rs::tests::uncalibrated_round_refuses` asserts the missing calibration marker for both terminal and continuing cases. No fallback calibration, synthetic margin or budget reset is allowed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R082.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record each `StopVerdict` as a retrieval `DecisionRecord` premise. Include round, reason, optional margin/threshold, calibration refusal, policy revision, completed-round progress and exhausted dimension. Return the same typed outcome to the caller. Retain R081 insufficiency where present. | `crates/eg-plan/src/retrieval_stop.rs::tests::stop_premise_lists_margin_and_reason` proves missing calibration remains visible on a terminal verdict and never becomes a successful confidence claim. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R082.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: the served cross-modal query through `execute` at `crates/eg-plan/src/exec.rs:536`. `tests/retrieval/test_stop_rule_served.py::test_repeat_with_margin_stops` proves the calibrated branch. `tests/retrieval/test_feedback_served.py::test_uncalibrated_continuation_precedence` sends real successive continuations through production retrieval and inference operators with pinned artifacts. | A deterministic corpus proves progressing, saturated and exhausted uncalibrated outcomes. Assert exact reasons, calibration refusals, optional margins and independently read trace/counters. Terminal responses cause zero subsequent retrieval or inference calls; forged saturation cannot bypass validation. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R083 Arbitration between model prior and evidence (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Arbitration between model prior and evidence (rollup).** EG arbitrates between the answer a model gives without retrieval and the answer from retrieved evidence. Below the confidence margin EG abstains and returns both candidates. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R083.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `Candidate{answer, confidence, evidence_class}` and `ArbitrationVerdict{choice, margin, prior, retrieved}` in `crates/eg-types/src/retrieval_arbitration.rs`. `evidence_class` is closed: `parametric`, `retrieved`. `choice` is `Prior`, `Retrieved` or `Abstain`. Both candidates ride on every verdict. Search found no such type. Proving test: `crates/eg-types/src/retrieval_arbitration.rs::tests::verdict_carries_both_candidates`. | A verdict round trip keeps both candidates and their classes. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R083.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Add `arbitrate(prior, retrieved, margin) -> ArbitrationVerdict` and preserve the named replaceable default confidence margin 0.10. Before comparing confidence, classify support using citations bound to the same query digest and graph snapshot. `Supported` requires a valid source span for every material claim. Missing or invalid support is `unsupported` or `unknown`, never supported. A supported candidate beats an unsupported/unknown candidate in either case of confidence delta. If both candidates are supported, choose one only when its confidence exceeds the other's by more than `margin`. Otherwise abstain. If neither is supported, abstain. Both candidates, support states, citation ids, confidence values and margin remain in every verdict. The policy is deterministic and has no learned part. Proving test: `crates/eg-plan/src/retrieval_arbitration.rs::tests::support_precedence_precedes_confidence_margin`. | A supported 0.70 candidate beats an unsupported 0.95 candidate. Both-supported candidates still use the 0.10 margin. Both unsupported/unknown abstain. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R083.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** `arbitrate` attaches at the end of `execute` in `crates/eg-plan/src/exec.rs:536`. The harness runs the prior probe, the answer without retrieval, and sends it as a `Candidate` in the query call. EG scores the evidence side from the same call. The production caller of `execute` is `crates/eg-graphql/src/crossmodal.rs:429`. This row creates the call site. No production caller of an arbitration exists today. Proving test: `crates/eg-plan/src/exec.rs::tests::execute_returns_arbitration_for_prior_candidate`. | A call with a prior candidate returns a verdict. A call without one returns none. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R083.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A verdict that abstains must return the typed code `ARBITRATION_ABSTAIN` with both candidates and no chosen answer. A call whose prior candidate lacks `evidence_class` must refuse with `CANDIDATE_CLASS_REQUIRED`. The typed abstention follows the pattern at `crates/eg-compute/src/assemble/conclude.rs:69`. Proving test: `crates/eg-plan/src/retrieval_arbitration.rs::tests::abstain_returns_both_candidates`. | The abstain response holds two candidates and no answer. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R083.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Each verdict must be recorded as a premise on the retrieval `DecisionRecord`. The premise lists both candidates, their `evidence_class`, the margin and the choice. Proving test: `crates/eg-plan/src/retrieval_arbitration.rs::tests::arbitration_premise_lists_both_classes`. | The decision record shows parametric and retrieved classes. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R083.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served cross-modal query operation. The test sends a prior candidate and an evidence set whose confidence gap is below the margin. The call passes through `execute` at `crates/eg-plan/src/exec.rs:536`. It observes `ARBITRATION_ABSTAIN` with both candidates. Proving test: `tests/retrieval/test_arbitration_served.py::test_small_gap_abstains_with_both`. | The served response is the abstain code with two candidates. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.1 Shared multimodal space and missing-embedding shortfall (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Shared multimodal space and missing-embedding shortfall (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.1.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** The engine must extend EmbeddingSpaceRef in `crates/eg-types/src/embedding.rs:47` with a modality contract. It must declare text, image, audio and video bindings within one pinned coordinate space. | Planned: `tests/retrieval/test_multimodal_served.py`. Round-trip all four modality bindings and reject absent space identity. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.1.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The planner must rank each query modality against every target modality using the same compatible space. The named compatible_space_only policy must preserve R039 candidate replenishment and R040 exclusions. | Planned: `tests/retrieval/test_multimodal_served.py`. Compare all sixteen modality pairs against an independent permitted-candidate oracle. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.1.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The server must extend run_unified_bind_embedder at `src/server/handlers/query/planning.rs:611`, called by run_unified_with at `src/server/handlers/query/planning.rs:424`. It must bind approved multimodal encoders before rank_top at `crates/eg-plan/src/exec/vector_rank.rs:65`. No production caller today supplies this complete multimodal contract. | Planned: `tests/retrieval/test_multimodal_served.py`. The served UnifiedQuery must reach actual model bindings and the maintained index. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.1.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** The planner must return missing_embedding shortfall when eligible target items lack embeddings. It must report requested, returned and authorized missing counts without padding. Incompatible spaces and unavailable query encoders must refuse before ranking. | Planned: `tests/retrieval/test_multimodal_served.py`. Distinguish missing embeddings, too few eligible items and exhausted budgets without leaking hidden counts. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.1.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The retrieval receipt must record modality direction, space identity, model revisions, index generation and authorized shortfall counts. It must identify every actual encoding call. | Planned: `tests/retrieval/test_multimodal_served.py`. Independent receipt readback must match model calls and permitted results. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.1.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: authenticated UnifiedQuery. `tests/retrieval/test_multimodal_served.py` must use production encoders and persistent indexes for all sixteen pairs. | Planned: `tests/retrieval/test_multimodal_served.py`. Prove expected cross-modal matches; reject incompatible spaces and missing query bindings; expose target shortfall and preserve tenant isolation. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.1 Hard entity and relationship constraints (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hard entity and relationship constraints (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.1.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** The engine must add RetrievalConstraints beside Pred at `crates/eg-types/src/wire_query_core.rs:27`. It must bind typed entity predicates, directed relationship predicates, quantifiers and graph revision. | Planned: `tests/retrieval/test_constraints_served.py`. Round-trip required and forbidden relationships, typed values and conjunctions; reject unknown operators. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.1.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The constraint compiler must apply every declared constraint before ranking or truncation. The named require_all policy must intersect authorized entity and relationship matches. Contradictory constraints must yield an empty eligible set. | Planned: `tests/retrieval/test_constraints_served.py`. An independent graph oracle must exclude the highest-scoring candidate when one declared constraint fails. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.1.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The planner must attach constraint compilation at `crates/eg-plan/src/exec.rs:536` before rank_limit at `crates/eg-plan/src/exec/vector_rank.rs:56`. Its caller is execute_rows at `src/server/handlers/query/planning.rs:411`. Generic filters exist; no production caller today compiles this declared constraint contract. | Planned: `tests/retrieval/test_constraints_served.py`. Optimized and unoptimized served plans must feed identical constrained sets into vector and text ranking. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.1.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** The planner must refuse invalid predicates, stale graph revisions and unevaluable required constraints. It must never replace hard exclusion with a score penalty. An unsatisfiable valid conjunction must return R039 typed shortfall. | Planned: `tests/retrieval/test_constraints_served.py`. Malformed and unsupported predicates must perform no ranking; contradictory valid predicates must return zero eligible results. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.1.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The trace must record constraint digest, graph revision, authorized exclusion counts and per-predicate outcomes. It must retain the same constraint binding across replenishment and fusion. | Planned: `tests/retrieval/test_constraints_served.py`. Receipt readback must prove excluded candidates never reappear in any ranking branch. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.1.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: authenticated UnifiedQuery. `tests/retrieval/test_constraints_served.py` must traverse real entity relationships before production vector and text ranking. | Planned: `tests/retrieval/test_constraints_served.py`. Prove required and forbidden edge predicates, contradictory constraints, exact top-k replenishment, stale revisions and cross-tenant negatives. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.7 Vector-free document-section traversal (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Vector-free document-section traversal (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.7.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** The engine must extend HierarchyRetrievalPolicy in `crates/eg-types/src/retrieval_verdict.rs` with distinct community and document_section kinds. Section nodes must carry document revision, parent, ordered children, granularity, summary and source span. | Planned: `tests/retrieval/test_section_tree_served.py`. Validate one root, acyclic single-parent links and nested source spans; preserve all community fields. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.7.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The planner must traverse document sections through bounded reasoning over authorized summaries and section contents. The named section_beam policy must declare breadth, depth, visits, tokens, inference calls and cost limits. It must require no vector storage. | Planned: `tests/retrieval/test_section_tree_served.py`. Compare selected leaf spans and every visited path with a deterministic section-tree oracle. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.7.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The planner must add section traversal before fusion at `crates/eg-plan/src/exec.rs:536` through PlanCtx. run_unified_with at `src/server/handlers/query/planning.rs:424` must bind section reads and approved reasoning. No production caller today supplies this vector-free path. | Planned: `tests/retrieval/test_section_tree_served.py`. The served query must reach document reads and reasoning with no vector index or embedding calls. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.7.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** The planner must reject cycles, dangling parents, stale summaries, invalid spans and unavailable reasoning. It must stop before exceeding any traversal limit. Partial paths must carry incomplete evidence. | Planned: `tests/retrieval/test_section_tree_served.py`. Refuse malformed trees and exhausted limits without unbounded search or conversion into community retrieval. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.7.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** HierarchyStageReceipt must retain ordered visits, full root-to-section paths, selected spans, pruned branches and bounded decision premises. It must bind document, summary, model and policy revisions with measured work. | Planned: `tests/retrieval/test_section_tree_served.py`. An independent reader must reconstruct all visited paths, including rejected branches, without hidden section contents. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.7.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: authenticated UnifiedQuery. `tests/retrieval/test_section_tree_served.py` must read real section records and invoke production reasoning without vector storage. | Planned: `tests/retrieval/test_section_tree_served.py`. Prove multilevel descent and full paths; reject cycles, stale spans and exhausted budgets; retain community acceptance and tenant isolation. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.2 Independent document-chunk encoding and aggregation (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Independent document-chunk encoding and aggregation (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.2.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** The engine must define DocumentEncodingPolicy in `crates/eg-types/src/embedding.rs` beside EmbeddingSpaceRef. It must pin tokenizer, chunk size, overlap, position mode, aggregation and model revision. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Round-trip local_reset and absolute_offset modes; reject zero size, overlap at least size and unsupported policy revisions. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.2.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The encoder must split token IDs into ordered windows without losing token identities. Each window must reset positions locally or preserve absolute document offsets according to policy. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Golden boundaries must cover empty, short, exact-size, overlapping and partial-final windows. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.2.3 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The encoder must process every chunk independently with the pinned model and no state from another chunk. It must leave query encoding unchanged. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Production invocation records must show exactly one independent encode per declared chunk. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.2.4 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The named mean_chunks policy must average chunk vectors in ordinal order before one final declared normalization. Aggregation must be query-independent and produce exactly one document vector. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. An independent numerical oracle must reproduce the aggregate within declared floating-point tolerance. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.2.5 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The engine must validate chunk receipts at `src/server/handlers/semantic_index/worker.rs:175`, called by `src/server/handlers/semantic_index/dispatch.rs:14`. The governed ingestion worker must execute the approved encoding recipe before completing that generation. No production caller today validates this complete composition contract. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Served ingestion and query must share the same approved encoding policy and vector generation. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.2.6 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** The encoder must refuse unsupported position modes, incompatible vector dimensions, non-finite outputs and exhausted encoding budgets. Failed chunks must prevent aggregate publication. Empty input and zero-norm aggregates must return typed no_embedding outcomes. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Negative fixtures must leave the prior complete index generation intact and expose the specific refusal. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.2.7 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The encoding receipt must retain document digest, token ranges, position mode, per-chunk model revision and aggregate digest. It must bind policy, index generation and measured encoding cost. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Independent receipt readback must account for every chunk and the single stored vector. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.2.8 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: authenticated UnifiedQuery after governed ingestion. `tests/retrieval/test_chunk_encoding_served.py` must use actual model bindings and maintained indexes. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Compare local-reset and absolute-offset encodes, exact aggregation and one-vector retrieval; refuse invalid overlap, failed chunks and incompatible revisions. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.6 Workload-aware column vectorization advice (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Workload-aware column vectorization advice (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.6.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** The engine must add ColumnVectorAdvice beside EmbeddingBinding at `crates/eg-query/src/tables/embedding_binding.rs:398`. It must include table, column, schema revision, observed workload window, sample count, embedding eligibility and reason. | Planned: `tests/retrieval/test_column_advice_served.py`. Round-trip ranked advice and unsupported_type refusal without creating a binding. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.6.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The named workload_first policy must rank eligible text columns using observed text-search demand, average length and distinct ratio. It must use type admission before scoring and stable column identifiers for ties. Missing workload must produce insufficient_observations. | Planned: `tests/retrieval/test_column_advice_served.py`. Actual column-specific text-search traffic must change advice while unchanged data statistics remain equal. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.6.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The SQL handler must record resolved column usage at `src/server/handlers/query/sql_read.rs:379`, called by handle_sql_read at `src/server/handlers/query/sql_read.rs:100`. It must expose a bounded read-only advice relation through the existing authorized catalog. No production caller today supplies this advice contract. | Planned: `tests/retrieval/test_column_advice_served.py`. Served SQL advice must consume production query observations and authorized schema records. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.6.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** The advisor must refuse recommending any unembeddable type before scoring. It must reject stale schemas and unavailable model capability. Advice must never create a binding or queue embeddings. | Planned: `tests/retrieval/test_column_advice_served.py`. Integer, boolean, timestamp and unsupported binary columns must return unsupported_type with zero embedding side effects. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.6.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The advice receipt must record per-column workload counts, observation window, schema revision, policy revision and ranking contributions. It must omit raw query text and hidden columns. | Planned: `tests/retrieval/test_column_advice_served.py`. Independent readback must match authorized production observations and confirm unchanged binding state. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R077.6.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: authenticated Sql. `tests/retrieval/test_column_advice_served.py` must issue real table queries followed by the planned advice relation. | Planned: `tests/retrieval/test_column_advice_served.py`. Prove workload-dependent ordering, unembeddable-type refusal, absent observations, stale schema, tenant isolation and zero automatic bindings. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.2 Topic and dense ranking fusion (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Topic and dense ranking fusion (rollup).** The engine must satisfy the following typed, served retrieval children. | The child acceptance criteria apply. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.2.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** The engine must add TopicBackend and TopicRankingPolicy beside PlanCtx in `crates/eg-plan/src/exec.rs:84`. Backend results must carry topic weights, centroid vectors, corpus revision and the retriever EmbeddingSpaceRef. | Planned: `tests/retrieval/test_topic_fusion_served.py`. Two interchangeable backend implementations must satisfy one typed result contract. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.2.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The named weighted_topic_dense policy must combine normalized dense similarity and responsibility-weighted centroid similarity. It must use a bounded explicit weight and stable candidate identifiers for ties. Hard constraints must precede topic scoring. | Planned: `tests/retrieval/test_topic_fusion_served.py`. An independent score oracle must reproduce ordering for both backends and weights zero, one and an intermediate value. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.2.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The planner must attach topic scoring before final truncation at `crates/eg-plan/src/exec.rs:536`. run_unified_with at `src/server/handlers/query/planning.rs:424` must bind the selected backend. Existing fuse_rrf at `crates/eg-plan/src/exec.rs:848` combines ranks; no production caller today supplies topic fusion. | Planned: `tests/retrieval/test_topic_fusion_served.py`. The served query must exercise both dense ranking and the selected production topic backend. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.2.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** The planner must reject centroid dimensions, model revisions or coordinate spaces differing from the retriever. It must refuse non-finite weights, stale corpus revisions and unavailable backends. Equal dimensions alone must never establish compatibility. | Planned: `tests/retrieval/test_topic_fusion_served.py`. Negative fixtures must refuse before fusion without silently dropping the requested topic contribution. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.2.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The receipt must record backend identity, centroid generation, space tuple, topic responsibilities, component scores and fusion policy. Empirical centroids must record their authorized source-vector generation. | Planned: `tests/retrieval/test_topic_fusion_served.py`. Independent readback must reproduce the final score and prove constraints remain effective. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.2.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Entry point: authenticated UnifiedQuery. `tests/retrieval/test_topic_fusion_served.py` must swap two actual topic backends over the same authorized corpus. | Planned: `tests/retrieval/test_topic_fusion_served.py`. Prove backend interchange and score effects; reject incompatible centroids, stale generations, missing backends and cross-tenant topics. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.3 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The planner must replenish only candidates satisfying R040.1 constraints. Constraint exhaustion must produce typed shortfall without relaxing any entity or relationship predicate. | Planned: `tests/retrieval/test_constraints_served.py`. Positive and negative served generation checks. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The filtered index must consume only complete R039.2 aggregates through rank_top at `crates/eg-plan/src/exec/vector_rank.rs:65`. Its caller is execute at `crates/eg-plan/src/exec.rs:536`. It must reject stale encoding-policy generations before ranking. | Planned: `tests/retrieval/test_chunk_encoding_served.py`. Positive and negative served generation checks. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R039.4 Residual behavior: mixed multi-hop traversal and vector top-k Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Residual behavior: mixed multi-hop traversal and vector top-k.** A query must combine multi-hop graph traversal and vector similarity. It must replenish candidates until k results survive the traversal filter. Otherwise, it must return a typed shortfall naming the number of permitted matches. It must never return a silent undercount. | A correctness oracle must run mixed traversal-plus-vector queries against a reference corpus. It must confirm exactly k permitted results or an explicit typed shortfall, never a silent undercount. Retain S-01 with two-hop traversal, parallel edges and stable edge identity. Include ten permitted matches below unfiltered top-k. Planned: `tests/retrieval/test_mixed_traversal_topk_served.py`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.4 Residual behavior: filter-aware ANN and BM25 scans Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Residual behavior: filter-aware ANN and BM25 scans.** Filtered approximate-nearest-neighbor and BM25 text search must plan filter-aware index scans. These scans must consume pre-filtered candidate sets or bitmap filters. They must not scan the full unfiltered index and discard non-matching rows afterward. They must preserve the filtered-search correctness guarantee. | A benchmark must compare filtered vector and text search latency before and after the filter-aware scan change. Use a fixed corpus. A physical filtered-scan correctness oracle must confirm that results remain correct. Planned: `tests/retrieval/test_filtered_scan_benchmark_served.py`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R084 Served ShEx validation (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Served ShEx validation (rollup).** Define the existing ShexValidate surface and bounded eg-shex behavior. Preserve all existing reasoning and query obligations. Every child requires its planned evidence; parser availability and unit reports do not establish served conformance. | Planned: tests/shex_served.rs::served_shex_contract_journey. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R084.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Reuse Method::ShexValidate and ShexValidationReport. The request carries ShExJ schema text, optional Turtle data and ordered node-IRI/shape-label pairs. Preserve result order, node lexical form, shape, conforms and optional reason. An empty map produces zero results and a true aggregate, not a whole-graph validation claim. | Planned: tests/shex_served.rs::wire_report_preserves_shape_map. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R084.2 Behavior: data selection Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior: data selection.** The handler parses ShExJ. Nonblank data_graph supplies an inline Turtle graph. Empty or whitespace-only data_graph exports the authority-projected request graph. The operation reads these inputs without importing the inline graph or persisting a schema. Do not infer a broader durable snapshot from this exported core view. | Planned: tests/shex_served.rs::inline_and_live_data_selection. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R084.3 Behavior: supported constraints Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior: supported constraints.** Record existing node-kind, datatype, value-set, string-facet and numeric-facet checks. Triple constraints count matching outgoing arcs against min/max bounds. EachOf consumes matches sequentially. Closed shapes and extra predicates use the current matcher. Focused fixtures must show both conformance and a specific nonconforming result. | Planned: tests/shex_served.rs::bounded_constraints_report_results. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R084.4 Behavior: semantic limits Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior: semantic limits.** Record actual matcher limits without expanding them. OneOf chooses the first matching branch on a trial consumed set. Shared-predicate matching is greedy. The matcher ignores the parsed inverse flag and assumes success beyond depth 40. Neither limit establishes full ShEx conformance or satisfies existing reasoner-budget obligations. | Planned: tests/shex_served.rs::semantic_limits_remain_visible. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R084.5 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Trace authenticated ShexValidate through src/server/handlers/rdf/dispatch.rs:13, :281 and :357 to src/server/handlers/rdf/validation.rs:176. The handler calls Schema::from_shexj, ShapeMap::from_iri_pairs, validate and shex_report_wire. The shex feature supplies the handler; the method remains classified Internal. No new parser, planner path or wire method is introduced. | Planned: tests/shex_served.rs::real_dispatch_reaches_shex_validator. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R084.6 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Preserve the existing bad-schema, bad-data and live-export error paths. An unknown shape label produces a nonconforming result with a reason, not a transport parse error. Missing handler support must not fabricate a validation report. Do not claim that every unsupported schema field is rejected. | Planned: tests/shex_served.rs::parse_and_dispatch_failures_are_distinct. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R084.7 Scoped reads Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Scoped reads.** Retain universal served-read authority and GraphReadAuthority::project_core before live graph export. Hidden rows and another graph must not influence the caller-visible live report. Inline Turtle is caller-supplied data, not a read of hidden stored rows. Validation must leave graph rows and stored schema unchanged. | Planned: tests/shex_served.rs::live_validation_obeys_read_authority. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R084.8 Evidence and hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence and hot-path proof.** Enter through a real authenticated ShexValidate request. Observe the production handler, eg-shex validator and typed report projection. Prove inline and live cases, ordered mixed outcomes, parse failures, unknown labels and denied scope. Retain source, binary, feature and request identities. Record semantic discrepancies instead of claiming complete language support. | Planned: tests/shex_served.rs::served_shex_contract_journey. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R085 EG approves immutable source queries for bounded connector execution (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**EG approves immutable source queries for bounded connector execution (rollup).** EG owns the read-only query meaning and authorization. SDK-SOURCE-INGEST-R004.1–.6 executes the approved query through its registered adapter. Children `.1`–`.8` define the producer and its served evidence. Existing R015, R043 and R069 remain unchanged. | Each child must pass; these definitions do not establish runtime delivery. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R085.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `SourceQueryRequest`, `ApprovedSourceQuery`, `SourceQueryApprovalCheck`, `SourceQueryApprovalValidity` and `SourceQueryLimits` in planned `crates/eg-types/src/source_query.rs`. The exact fields and methods are specified in the plan. Bind typed parameters, dialect, source/schema/snapshot identities, read-only operations, authority, expiry and finite limits. Reject unknown fields and unrepresentable parameter values. Proving test: `crates/eg-types/src/source_query.rs::tests::approval_records_round_trip` (planned). | Round trips preserve every binding. Invalid references, parameter types, nonfinite values, absent snapshot identity and zero/unbounded limits refuse. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R085.2 Behavior: issue approval Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior: issue approval.** `ApproveSourceQuery` validates the registered source and query under the verified carrier before issuing `ApprovedSourceQuery`. Reuse the immutable control-lease grant and native authoritative commit path in `src/redb_store/work_item/control_lease.rs:58`. Reserve kind `source.query.approval` against generic `IssueControlLease`, following `crates/eg-types/src/control_lease.rs:244`. Only the validated producer may issue this kind. Grant digests bind every approved field; the server controls issue time and clamps expiry to existing lease limits. Proving test: `src/server/handlers/federation/source_query_tests.rs::approval_requires_authority_and_native_commit` (planned). | A successful response follows durable issuance. Generic lease writes cannot forge approval. Issuance uses existing storage and credentials; no external SQL executes during approval. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R085.3 Behavior: verify approval Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior: verify approval.** Add `VerifySourceQueryApproval`, taking the complete approved descriptor and observed source/schema/snapshot identities. Recompute its digest and read the authoritative control lease. Require active status, current server time before both expiries, matching caller/delegation and current source permissions. Recheck bound policy, identity and source revisions. Reuse `read_control_lease` at `src/redb_store/work_item/control_lease.rs:130`; a supplied lease view is not proof. Proving test: `src/server/handlers/federation/source_query_tests.rs::changed_or_revoked_approval_refuses` (planned). | Changing any binding, authority, source or revision refuses. Revoked, expired, consumed, unavailable or missing leases refuse. Verification grants no SQL effect and creates no bearer credential. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R085.4 Behavior: read-only SQL Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior: read-only SQL.** Reuse R015 classification, R043 destination checks and R069 SQL rendering within existing query machinery. `crates/eg-plan/src/federation.rs:933` validates one read statement; `federation_opt/columns.rs:215` and `sql_text.rs:48` own rendering helpers. Keep typed parameter binding separate from SQL text. Reject DDL, DML, COPY, external-table creation, multiple statements, locking reads and unknown effects. Require database-enforced read-only execution; read syntax alone cannot authorize side-effecting functions. Proving test: `crates/eg-plan/src/federation_tests.rs::approved_source_query_has_no_write_effects` (planned). | Native parameter binding preserves values and query meaning. Supported projections, predicates, ordering and limits match the query oracle. Unknown dialects, functions or effects refuse without issuing approval. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R085.5 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Register both planned methods in `crates/eg-capabilities/src/domains/query.rs` with generated request/result contracts and explicit authorization and durability metadata. Attach through `src/server/dispatch/graph_pipeline/pipeline.rs:333` to `handlers/federation.rs:21`, beside `QueryForeignColumns`. Extend the existing native control-lease commit route for issuance; verification remains an authoritative read. SDK receives the generated `ApprovedSourceQuery` type under SDK-SOURCE-INGEST-R004.1–.3. Proving test: `tests/source_query_approval_served.rs::real_dispatch_issues_and_verifies_approval` (planned). | Real authenticated dispatch reaches source validation, native issuance and fresh verification. No parallel planner, store or client-side approval authority appears. Current source has neither method. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R085.6 Behavior: bounded execution contract Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior: bounded execution contract.** The approved limits constrain total rows/bytes, chunk rows/bytes, queue depth/bytes, deadline and resident-memory budget. All are positive and finite. SDK-SOURCE-INGEST-R004.2 applies backpressure and retains no complete result. It verifies approval before opening the driver, before publishing each chunk and before terminal success. Each chunk binds query digest, source/schema/snapshot, sequence and cumulative totals. Proving test: `tests/source_query_approval_served.rs::bounded_stream_preserves_approval` (planned). | Oversized rows, exceeded budgets or failed revalidation stop execution and close the driver. Exactly one explicit completion or typed failure stops an execution. Missing terminal completion never means success. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R085.7 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Planned `source_query.rs` defines closed errors: `unsupported_dialect`, `invalid_query`, `unauthorized`, `approval_expired`, `approval_revoked`, `stale_source`, `query_failed`, `limit_exceeded`, `cancelled`, `verification_unavailable`. Errors carry query identity, stage and last completed chunk, without SQL literals, parameter values or credentials. SDK-SOURCE-INGEST-R004.4 retains these semantics after partial output. Proving test: `tests/source_query_approval_served.rs::failure_after_three_chunks_is_terminal` (planned). | Failure after three chunks stays failure with an incomplete execution identity. No successful terminal event or failed-chunk checkpoint follows. Earlier accepted pages retain their actual durable receipts. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R085.8 Evidence and hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence and hot-path proof.** `tests/source_query_approval_served.rs::approval_to_connector_query_journey` enters both real EG methods and links SDK-SOURCE-INGEST-R004.6's actual connector/driver receipt. Prove correct rows, typed binding, immutable provenance, authorization refusal and zero unauthorized database effects. Measure EG and connector peak resident memory in fresh processes across increasing result cardinalities. Proving test: `tests/source_query_approval_served.rs::approval_to_connector_query_journey` (planned). | Keep row widths, driver settings and all limits fixed while increasing cardinality by two orders of magnitude. Declare the baseline, memory envelope and tolerance before runs. Every peak must fit that fixed envelope; whole-result buffering fails. Record exact revisions, features, commands, rows/bytes, queue high-water marks, terminal outcomes and checkpoint agreement. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R070.1 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Definition hold — governed raw-corpus producer is not defined.** R070.1 requires exact lexical search, file reads, context verification, per-query cost and abstention before budget overrun. While R070 only bounds indexed UQL rows/visits and GraphOS retrieval returns a top-K boundary. Do not route this requirement through the indexed retriever or claim that its budget is a raw-source cost. The missing owner contract must identify the authorized raw-source provider and immutable source/snapshot identity. Exact search/read/verification operations and byte/line coordinate system. Finite scan/read/verification cost units and ceilings. The typed over-budget refusal. And the producer-to-EG request/response fields consumed by GovernedRetriever/AU. Until those decisions exist, this row defines no callable producer and remains held. Source objective: An agent may search a raw corpus directly with exact lexical, file-read and context-verification operations without an index. Each query reports its cost, and over-budget scans abstain. Source record `AU:71` SHA-256 `0f1b775fd66c41586bdcdf0047a9ccbc52e38aa1bc21a4e8234e9c641e45c68e`. Preserve existing obligations: `EG-FEDERATED-QUERY-R070; ARBORA-OPS-R053.2, ARBORA-OPS-R053.3, ARBORA-OPS-R053.5`. | Definition acceptance is blocked until the owner publishes the producer fields above. Serve an authorized query over an unindexed corpus. Return exact lexical hits, bounded file spans, verification result, source revision and measured cost. An over-ceiling query must return typed abstention before reading beyond the ceiling. Repeat against an indexed-only fixture and prove it is not accepted as this contract. Do not claim a served test or implementation now. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R006.1 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Definition hold — temporal derivation producer and semantics are absent.** R006 continues to require proof-carrying results for rule-derived queries. The source asks for temporal forward chaining from extracted facts. It requires provenance from every derived fact to its originating sentence or axiom. But the owner review found only answer-level proofs and no persistent fact-production API/origin chain. Before specifying a producer, the owner must decide rule language/version, temporal interval vocabulary, join/overlap semantics and conflict handling. The owner must also define derived-fact identity/update/retraction behavior and the persistent origin-record schema. The owner must also name the authoritative admission/readback operation. Do not treat query proof premises as a durable fact producer. No derivation or write is authorized by this row. Source objective: The engine derives facts from extracted facts using temporal forward-chaining rules. It records each derived fact's provenance to its originating sentence or axiom. Source record `EG:11` SHA-256 `2c2ffcf18d947730bc60a935fed942e1f82e9e8547f4509fe2941a34672fb8f3`. Preserve existing obligations: `EG-FEDERATED-QUERY-R001, EG-FEDERATED-QUERY-R011, EG-DECISION-ENGINE-R003, EG-FEDERATED-QUERY-R006`. | After owner decisions are recorded, acceptance uses two source facts with sentence and axiom origins. It exercises matching and nonmatching temporal intervals. Read back the derived fact with rule digest, graph generation and complete origin refs. Missing/stale origins, unsupported rule versions, conflicting validity windows and unauthorized writes must refuse without changing graph revision. Until then no producer test is specified as executable. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.5 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Definition hold — no parameter-free memory admission/encoding owner exists.** Existing lifecycle and filter-aware query operators do not specify persistent memory admission. They also do not define knowledge retention or cross-document relations. The source leaves the memory owner, admitted record/source identity, relation vocabulary, update/retention policy, and selectivity-versus-corpus benchmark target undecided. Those fields and an authorized producer/consumer operation are prerequisites. R040.4 filtered scans remain separate coverage; they cannot stand in for memory admission. Do not claim model weights change or that a no-forgetting property follows from ordinary graph writes. Source objective: The platform absorbs new knowledge into a retrievable memory module without changing model parameters or discarding earlier knowledge. Retrieval cost scales with query selectivity rather than corpus size, and cross-document relations are encoded. Source record `EG:20` SHA-256 `07df52b453f0f1b7be7aec7bf790f087c3fc5e13500915011382a9fcd8d9d41a`. Preserve existing obligations: `EG-FEDERATED-QUERY-R007, EG-FEDERATED-QUERY-R040, EG-FEDERATED-QUERY-R040.4, EG-FEDERATED-QUERY-R008`. | Blocked until the owner binds admission, relation, retention and benchmark semantics. The benchmark compares fixed query-selectivity workloads at multiple corpus sizes. It reports rows/bytes/visits and demonstrates the declared cost bound. Read back new knowledge; prove prior records and model revision remain unchanged. Missing admission authority, relation target or bound refuses. No runnable acceptance is asserted before the missing policy is supplied. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.6 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Definition hold — episode/layer producer and consumer policy are absent.** Existing SourceIngest validates/projects transcript records and UnifiedQuery supports filtered search. Neither defines semantic/procedural/episodic layer identity or builds graph episodes across sessions. The owner must define session and episode identity/boundaries, participant ordering and turn ordering. The owner must define utterance assignment to semantic, procedural or episodic memory. The owner must define cross-session merge/duplicate rules and temporal validation/conflict behavior. Name the AU operation that consumes/retrieves episodes. Keep the existing transcript and search contracts intact. Do not infer episode construction from transcript projection or introduce an unapproved AU consumer. Source objective: Agents keep semantic, procedural and episodic memory layers. These layers use graph-structured episodes built from multi-session dialogue. Retrieval spans sessions using hybrid vector and keyword search with temporal validation. Source record `EG:21` SHA-256 `c321db3aa79c29d891456f2bee98f545611b8d1be7c93d299b939c3d73a40279`. Preserve existing obligations: `EG-INGEST-WORKER-R003.13, EG-INGEST-WORKER-R003.14, EG-INGEST-WORKER-R003.17, EG-FEDERATED-QUERY-R040, EG-INGEST-WORKER-R003.18, EG-INGEST-WORKER-R003.16, EG-FEDERATED-QUERY-R016`. | After the owner fixes those decisions, acceptance ingests two ordered sessions. It builds and independently reads back an episode with transcript/revision/span provenance. It searches for the episode using hybrid vector+keyword search. Validate event time against storage time. Refuse or report partial for duplicate/conflicting chronology, stale transcript revision or unauthorized cross-session reference. Apply the owner-approved rule. No executable test exists until taxonomy and consumer are fixed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R083.7 Support-aware arbitration prevents unsupported confidence wins Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Support-aware arbitration prevents unsupported confidence wins.** Extend the existing `Candidate`/`ArbitrationVerdict` in R083.1 with `query_digest`, `graph_snapshot_revision`, `support_state` (`supported`, `unsupported`, `unknown`) and ordered `supporting_span_ids`. Preserve both candidates, the confidence margin, typed abstention and R083.2's existing >0.10 confidence rule for candidates with equal support state. Support is valid only when every material claim resolves to a source span. The span must share the query digest and graph snapshot. The decision order is fixed: exactly one supported candidate wins before confidence comparison. Both supported use the R083.2 margin. Both unsupported/unknown abstain with `ARBITRATION_ABSTAIN`. Missing citation, mismatched snapshot/query or unverifiable claim cannot raise support state and is treated as unknown. Wire validation and arbitration at existing `crates/eg-plan/src/exec.rs::execute` and `crates/eg-graphql/src/crossmodal.rs`. No separate arbitration endpoint. Proving tests: `crates/eg-types/src/retrieval_arbitration.rs::tests::support_state_round_trips_with_query_binding`, `crates/eg-plan/src/retrieval_arbitration.rs::tests::unsupported_high_confidence_loses_to_supported_candidate`, and `tests/retrieval/test_arbitration_served.py::test_supported_lower_confidence_beats_unsupported_prior`. AU prior probe dependency remains `AU-RETRIEVAL-R006`; R083.3/.6 define the EG execution path but do not prove that producer. Preserve existing coverage `EG-FEDERATED-QUERY-R083.1`, `EG-FEDERATED-QUERY-R083.2`, `EG-FEDERATED-QUERY-R083.3`, `EG-FEDERATED-QUERY-R083.4`, `EG-FEDERATED-QUERY-R083.6`. Source record EG:22 SHA-256 `544b7b0054e8c7cd9a76aedd0d665589d555a0bcf20d1f00679442574936af36`. This remains SPECIFIED pending producer/consumer implementation and served receipts. | Serve two candidates with a common query/snapshot: supported 0.70 versus unsupported 0.95 must select supported. Verify supported 0.95 versus supported 0.70 follows the 0.10 margin. Both unsupported abstain. Missing, stale or cross-snapshot citation evidence must not select a candidate. Read back both candidates and all support refs. Retain the existing R083.2 margin test. AU producer and runtime receipts remain unclaimed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.10 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Definition hold — clock precedence and fallback trigger are unspecified.** R081.8.1-.6 already own follow-up query expansion and remain credited. This child covers confusion among storage time, event time and narrative time. It also covers a bounded second pass when first-pass context is insufficient. Existing transcript ingestion supplies event/storage fields but no narrative-time interpretation. The owner must define three typed clock fields and their source/provenance. The owner must set precedence when values disagree. Define the sufficiency threshold that triggers fallback. Specify fallback query construction and maximum fanout. Report the selected clock basis. Until policy values are approved, do not choose narrative, event or storage time by heuristic. Do not duplicate R081.8 follow-up behavior. Source objective: Retrieval detects confusion among storage date, event date and narrative time using explicit rules. If first-pass context is insufficient, it runs a second pass with fallback queries. Source record `EG:25` SHA-256 `fb8d54d8554b8158da64f7c9e8bf02ea846e5b411768a0381c2682b2e6302dac`. Preserve existing obligations: `EG-FEDERATED-QUERY-R081.1, EG-FEDERATED-QUERY-R081.2, EG-FEDERATED-QUERY-R081.3, EG-FEDERATED-QUERY-R081.4, EG-FEDERATED-QUERY-R081.8.1, EG-FEDERATED-QUERY-R081.8.2, EG-FEDERATED-QUERY-R081.8.3, EG-FEDERATED-QUERY-R081.8.4, EG-FEDERATED-QUERY-R081.8.5, EG-FEDERATED-QUERY-R081.8.6`. | Once defined, serve a fixture where all three clocks disagree and another where one clock is absent. Assert the selected basis and its provenance, and trigger exactly the configured bounded fallback only below the declared sufficiency threshold. enough first-pass context must issue no second pass. Stale or conflicting clock provenance and exhausted query budget must return a typed partial/refusal with no unbounded retry. No executable acceptance is currently authorized. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R028.1 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Typed KnowledgeSet row contract.** Reuse the existing `KnowledgeSet`/`KnowledgeRow` producer in `crates/eg-plan/src/knowledge.rs`, the `UqlKnowledge` wire carrier in `crates/eg-types/src/wire_query_core.rs`. And the existing `WITH KNOWLEDGE` attachment in `crates/eg-plan/src/uql/serve/annotate.rs`. Do not substitute `ForeignRows`. Each row carries its own provenance-frame state and policy-frame state alongside the existing row id, `source_refs`, `evidence_refs` and `policy_labels`. `Resolved` means row provenance and policy were resolved from one pinned graph snapshot. Missing or unresolved frames do not count as empty success. The KnowledgeSet remains a superset of a plain row set: id/score and requested projection preserve existing values. Structured and UQL surfaces must serialize the same carrier. If either per-row frame is absent, malformed, or from a different snapshot, return typed `KNOWLEDGE_FRAME_MISSING`/`KNOWLEDGE_FRAME_STALE` and no partially annotated result. This is a contract clarification only. The source explicitly withholds UQL implementation authorization. Source objective: Typed KnowledgeSet rows carry provenance and policy frame per row. The query surface returns them as a superset of plain row sets and refuses rows lacking either. Source record `EG:29` SHA-256 `2eb8aadb1b6ccc2d5de77a4d1964fc04a4e944bccf9bcc1793e262f146af7583`. Preserve existing obligations: `EG-FEDERATED-QUERY-R028, EG-FEDERATED-QUERY-R045`. | Create one plain row and one row with resolved evidence/policy frames. Compare both with the same structured KnowledgeSet producer. Verify row id/score/projection are unchanged and both frame states are row-local. Independently omit provenance, policy and snapshot binding. Each case must return the typed refusal without a partial row. Keep R045 foreign-row pushdown behavior unchanged. Tests are acceptance targets only. No UQL implementation or served receipt is claimed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R005.1 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Typed consistency-violation matrix on the existing validation result.** Extend the existing R005 VALIDATE SHAPE / reasoning-validation result with a closed `ViolationKindV1`: `temporal_conflict`, `cardinality`, `self_loop`, `asymmetry`, `ontology_defect`. Each `ViolationV1` binds `kind`, focus entity, relation/property ids, graph/ontology revisions, expected/observed values and source axiom/evidence refs. Kind-specific fields are required: conflicting validity intervals for temporal conflict. Declared min/max and observed count for cardinality. One entity and its forbidden self-edge for self-loop. A declared asymmetric relation with an observed reverse pair. Include the property/axiom id, the subject and object, both forward and reverse edge ids, their evidence refs. And the pinned graph/ontology revisions. An absent reverse edge is not a violation. Violated axiom id and affected terms for ontology defect. The validator is read-only: it reports each independent violation and never chooses a winner or retracts facts. Any later retraction requires a distinct explicit authorized mutation. Do not add a UQL implementation under this row. Source objective: The platform detects temporal conflicts, cardinality, self-loop and asymmetry violations, plus ontology defects. Conflict rules report each with a typed reason, never silently choosing. Source record `EG:31` SHA-256 `973de1c3b38646a438d057299d8070070f0ef7a2056bb30acff6d1a3814df513`. Preserve existing obligations: `EG-DECISION-ENGINE-R034, EG-FEDERATED-QUERY-R001, EG-FEDERATED-QUERY-R005, EG-FEDERATED-QUERY-R011, EG-FEDERATED-QUERY-R012`. | Serve a violating fixture and repaired control for each of the five kinds. Assert exactly the typed diagnostic with pinned graph/ontology revision and evidence refs. For asymmetry, the control contains only `(a,p,b)` and has no asymmetry diagnostic. Adding `(b,p,a)` as the sole change creates the violation, which cites both observed edge ids and the declared asymmetric axiom. A missing reverse edge is not a violation. Combine two independent defects and require both diagnostics. Missing kind-specific fields, unknown kinds and stale ontology revision refuse validation. Querying graph state afterward proves no mutation. Retraction remains denied absent explicit authorization. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R078.7 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Governed company-context logical view.** The authenticated query uses the existing `PlanScope` and `inject_scope` path (R078.1-.6) over one pinned graph snapshot. It composes stored organization/role vocabulary (`crates/eg-core/ontology/core-foundation-v1.ttl` and `company-v1.ttl`), registered data-source mappings and native time-series facts. It returns references/projections from those sources as one logical view. It does not copy or merge source records. Every result is scoped by verified tenant and clearance before retrieval, and every source row retains its source identity/revision. **Definition hold:** Owner review found no exact canonical ontology/mapping ids for organizations, roles, data assets, permissions or time-series facts. The time-series source/revision join key is also unknown. Before complete acceptance, map each category to its existing class/property or registered mapping. Name the time-series key. Do not invent or duplicate terms. Source objective: Company context combines organizations, roles, data assets, permissions and time-series facts in one graph. Agents query it under caller tenant and clearance. Source record `EG:59` SHA-256 `fd5990a7c9f30e1e1aa0eed9aa08efef4e2ebc8f5f34387598f1c9e577c458dc`. Preserve existing obligations: `EG-DURABLE-KERNEL-R043, EG-FEDERATED-QUERY-R078, EG-UNIFIED-DATA-PLANE-R001, EG-UNIFIED-DATA-PLANE-R003, EG-FEDERATED-QUERY-R078.1, EG-FEDERATED-QUERY-R078.2, EG-FEDERATED-QUERY-R078.3, EG-FEDERATED-QUERY-R078.4, EG-FEDERATED-QUERY-R078.5, EG-FEDERATED-QUERY-R078.6`. | With category mappings supplied, serve identical company-context queries as two tenants with differing clearances. Verify the authorized tenant receives each mapped category as source-bound references. Exclude denied rows before any source read and copy no source record. Join native time-series values only by the declared series/time key and snapshot. Missing/ambiguous mapping, unverified tenant, stale source revision or cross-tenant join refuses. Current scope-planning acceptance remains covered by R078.1-.6. This new composed view stays held until mappings are exact. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.7.7 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Vector-free hierarchy mode with zero external model calls.** Add a read-only mode to the existing `HierarchyRetrievalPolicy`/authenticated `UnifiedQuery` section traversal. It accepts requested granularity (`document`, `section`, or `source_span`) and uses only the stored authorized section summaries and source spans already bound by R081.9.7.1-.6. It returns the selected stored summary or exact source span plus the ordered root-to-leaf path. It does not generate or rewrite summaries. In this mode external inference-call budget is exactly zero, vector index and embedding calls are forbidden. And the traversal limits from the existing section-beam policy remain enforced. Wire only at the existing `PlanCtx` section traversal before fusion in `crates/eg-plan/src/exec.rs`, reached through `run_unified_with`. Do not create a second retriever. Refuse requests for generated answer text, missing/stale summaries or spans, invalid trees, or external inference dispatch. Source objective: Retrieval builds hierarchical document trees. It answers at multiple granularities by traversing them without external model calls. Source record `GRAPHOS:24` SHA-256 `b2e5de8386b3ca72b59a81ca5fa3193eaf7736af86aca472a720b9e4511961c0`. Preserve existing obligations: `EG-FEDERATED-QUERY-R081.9.7.1, EG-FEDERATED-QUERY-R081.9.7.2, EG-FEDERATED-QUERY-R081.9.7.3, EG-FEDERATED-QUERY-R081.9.7.4, EG-FEDERATED-QUERY-R081.9.7.5, EG-FEDERATED-QUERY-R081.9.7.6`. | Serve all three granularities over a nested authorized section tree. Compare selected path/span ids with an independent tree oracle. Instrument external model, embedding and vector calls and require zero calls on every positive query. Malformed or stale section records and exhausted depth/visit/token limits refuse before extra dispatch. Tenant isolation and existing community traversal outputs remain unchanged. No runtime proof is claimed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.9.7.8 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Definition hold — offline TOC producer and finite span-read policy are unbound.** Preserve existing space/section mappings. Do not recreate interaction spaces. The requested producer builds an offline line-numbered TOC from an immutable document revision. Each entry binds section id, title/path, inclusive start/end lines and source digest. EG needs a bounded line-span read from the pinned document. It returns exact lines, source digest and line range; it never returns the whole document. The current SDK source-ingest -> EG document/section -> GraphOS retrieval.space -> AU path leaves the TOC producer unresolved. It does not define who builds or refreshes the TOC. Source byte/line encoding and finite line-span/response-byte limits are also undefined. Those owner decisions and their producer/consumer schema are required before this can be executable. Existing directory mappings do not fill the gap. Source objective: Documents in a retrieved space are preprocessed offline into line-numbered TOCs. Agents use them to navigate sub-document spans without reading whole files. Source record `GRAPHOS:25` SHA-256 `6797cff839c16c3b9c3877d6bbf48bf8953eae8696087abc99f2b57147daed93`. Preserve existing obligations: `ARBORA-OPS-R053.1, ARBORA-OPS-R053.2, ARBORA-OPS-R053.3, ARBORA-OPS-R053.6, EG-FEDERATED-QUERY-R081.9.7.1, EG-FEDERATED-QUERY-R081.9.7.5`. | Once the owner supplies TOC generation and versioned positive finite `max_lines` and `max_bytes`, index a multisection fixture offline. Read a bounded middle span and verify exact line numbers and source digest. Refuse stale document/TOC revision, invalid or too-wide range, a response above the bound, and whole-file requests. Verify current GRAPHOS space/section links still resolve. Until producer and caps are named, no served acceptance is claimed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R040.2.7 Source-backed definition disposition Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Source-backed definition disposition.** **Revision-bound per-document topic responsibilities.** Extend the existing `TopicBackend` result and `weighted_topic_dense` score in `run_unified_with` before final truncation. For each eligible candidate, the backend supplies a `DocumentTopicAssignment`. It binds document id/content revision, corpus generation, backend identity/revision and the retriever's `EmbeddingSpaceRef`. Each assignment identifies topic id and that document’s responsibility. Compute each candidate's topic component from its revision-matched responsibilities and the existing centroid similarity formula. Feed it into existing weighted dense/topic fusion. Preserve hard constraints, fusion weight, deterministic ties, tenant scope and all R040.2 refusals. Missing, duplicate, stale or cross-space assignments refuse the requested topic contribution. The planner must not silently fall back to dense-only ranking. GraphOS projects reads and does not rank; ARBORA-FLEET-R014 is unrelated. Source objective: Retrieval uses document topic metadata as semantic guidance to improve ranking and relevance. Source record `GRAPHOS:28` SHA-256 `f7654cd07d4d95f32f09fec742c4172b35c689749b3228aef9424830b1f7cc1b`. Preserve existing obligations: `EG-FEDERATED-QUERY-R040.2.1, EG-FEDERATED-QUERY-R040.2.2, EG-FEDERATED-QUERY-R040.2.3, EG-FEDERATED-QUERY-R040.2.6`. | Serve the same corpus/backend with two candidates whose assignments differ. Independently recompute both topic components and final scores. Change only one candidate’s responsibility vector and prove only the expected candidate contribution/order changes. Refuse missing/duplicate document assignment, stale document or corpus revision, backend mismatch and embedding-space mismatch before truncation. Verify hard exclusions still hold and `run_unified_with` records the assignment/backend revision in the existing topic receipt. No implementation or served receipt is claimed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.8.100 Retriever-bound query strategy and transfer revalidation Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Retriever-bound query strategy and transfer revalidation.** Extend existing retrieval feedback with retriever id/version, strategy id/digest, corpus/model revisions, evaluation-set digest and transfer-validation receipt. A strategy is reusable without new validation only for the same target retriever id/version. Corpus, model and policy revisions must be byte-identical. A target or bound-revision change requires a target-bound validation receipt. It contains target retriever id/version, strategy id/digest, evaluation-set digest and metric id. It also binds measured value, acceptance threshold, pass/fail outcome and corpus/model/policy revisions. Activate only when measured value meets or exceeds the declared threshold. A valid receipt below threshold refuses activation and retains the prior strategy. A different retriever never receives a copied strategy by default. Reuse R081.8 feedback and R082 budgets. Producer/consumer boundary: Authenticated crossmodal -> `eg-plan::exec` R081.8 feedback -> selected retriever. Preserve existing R081.8.1-.6 tiering, feedback and refusal behavior. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R081.8.1-.6; R082`. Source record `AU:77` SHA-256 `213700ec5b9e8648657ec47d0c587483a978db10f4661475b467be451d3bb2e1`. Parent `R081.8` remains unchanged. | Planned served acceptance: Same-retriever feedback reuse succeeds. A retriever-version change requires validation. Failed, stale or missing transfer receipts refuse retrieval. Verify the receipt binds the strategy digest and target retriever. Keep feedback budgets unchanged. Rejected critiques must not change the active strategy. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R053.100 Generated Cypher property keys use grammar-valid backtick quoting and build refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Generated Cypher property keys use grammar-valid backtick quoting and build refusal.** Extend the existing Cypher federation renderer so every generated property key is emitted as a backtick-quoted identifier. Embedded backticks use the Cypher grammar escape representation, and values remain parameters rather than interpolated identifiers. The renderer is shared by every Cypher generation path. The build gate validates generated query fixtures and fails on any property key that is unquoted or malformed. It must not add a second renderer or rely on SQL identifier quoting. Producer/consumer boundary: `ForeignSourceSpec::Cypher` federation renderer -> generated Cypher -> configured build gate. Preserve R053 typed source registration. Cypher Manual naming rules define backtick quoting and doubled backtick representation. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R053; EG-DURABLE-KERNEL-R024.1/.3; EG-FEDERATED-QUERY-R069`. Source record `EG:37` SHA-256 `803f4e4ffbcd939af750e23451469835555beaa37e14ce555ffd0a59c0a3ac48`. Parent `R053` remains unchanged. | Planned served acceptance: Gate fixtures cover plain, reserved, spaced, Unicode and embedded-backtick identifiers. They also include an intentionally unescaped generated key. Parse/execute safe cases against the Cypher grammar and assert build refusal for unescaped/malformed output. The existing ForeignSourceSpec capability matrix and Spark batch-only constraint remain unchanged. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R032.100 Layer- and history-weighted impact traverses both dependency directions Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Layer- and history-weighted impact traverses both dependency directions.** Extend the existing authenticated R032 `PROPAGATE` result with a separate historical-risk dimension. Bind target node/revision, direction and bounded HOPS. Also bind ordered layer taxonomy/weights, authorized failure-dataset id/revision/window/digest, observation counts, policy revision and request digest. For each node with observations compute `failure_rate = failures / observations` and `layer_contribution = layer_weight * failure_rate`, with weights and rates in [0,1]. For a path, compute `path_risk = 1 - product(1 - layer_contribution)` over its unique nodes. Aggregate duplicate paths to a node by maximum path risk. list upstream and downstream path sets separately. Suppress repeated-node cycles within a path and order ties by hop count, node id and path-edge ids. Return per-node path, layer contribution, counts, coverage state and risk. Missing per-node history yields `unknown` and a partial result with `aggregate_risk = null`. An unavailable or unauthorized dataset refuses. The new score is an additional dimension and cannot replace or alter R032 Noisy-OR or Independent-Cascade results. Producer/consumer boundary: EG owns graph impact query/risk decision; AU requests and consumes the result. Existing numeric risk helpers are not this two-direction historical impact contract. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R032 existing Noisy-OR and Independent-Cascade obligations`. Source record `AU:43` SHA-256 `327ced0e0605f34366c662017d82ac892a481c5ca5f40bba2f3693ba6a5f7649`. Parent `R032` remains unchanged. | Planned served acceptance: Graph fixtures cover ancestors and descendants across three layers. Include differing historical failure counts, a cycle boundary and missing-history data. Verify both directions and deterministic layer/history contribution. Refuse stale or malformed history, and compare existing R032 propagation outputs unchanged. Owner-source review only. No runtime/test receipt is inferred. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R086 Inductive n-ary hypothesis-only link prediction (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Inductive n-ary hypothesis-only link prediction (rollup).** Defines ordered n-ary inference that returns unasserted hypotheses. It does not mutate graph facts or replace observed-edge query/write contracts. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R086.100 Ordered n-ary inductive link prediction emits hypotheses only Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Ordered n-ary inductive link prediction emits hypotheses only.** **Definition hold — current graph learner is binary and has a write path.** The source requires ordered n-ary hyperedge prediction and generalization to unseen-at-fit entities. Hypotheses carry an evidence class and are never asserted facts. Current `Method::GraphLearnPredict`/`src/server/handlers/graphlearn.rs` scores binary `(src,dst)` pairs over a resident graph and optionally writes `PredictedEdge`. It cannot satisfy ordered n-ary tuples, unseen-entity induction, or hypothesis-only guarantees. Preserve it unchanged. Before defining a public producer, the owner must choose the n-ary model/training artifact. The owner must also define ordered-tuple inference semantics for unseen entities. Define the evidence-class vocabulary and source binding. Choose the read-only capability/auth action. And name the AU proposal consumer receipt. Only then can a separate method be attached in the existing graphlearn method family and routed through `src/server/handlers/graph_ops/gateway_mining_ml.rs`/`src/server/handlers/graphlearn.rs`. Do not route this through the binary `GraphLearnPredict` write-capable method. No model, endpoint, or authority is invented here. Source record `EG:14` SHA-256 `7223250e7f899a187aad0b152e597c6174b772c49779ca2bdd12d3ba68f4f5ef`. Preserve existing obligations: EG-FEDERATED-QUERY-R086, binary GraphLearnPredict behavior, and its graph-write authority. | Acceptance is blocked until model, evidence-class, authorization and AU receipt decisions are published. A served ordered three-source fixture includes an unseen-at-fit entity. Return candidates with tuple order, graph/model/policy revisions and evidence class. Leave graph revision unchanged. Changing source order must change request digest. Refuse unary tuples, unresolved/unauthorized sources, stale revisions and malformed relation constraints. Confirm `GraphLearnPredict` binary results and write authority are unchanged. No producer test is currently defined as runnable. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.101 Reusable compressed document state with decoding-free reranking Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Reusable compressed document state with decoding-free reranking.** Build a document-only state keyed by document id/content digest, encoder revision and compression-policy revision. Store ordered segment boundaries, compressed token representations and the key/value projections required by the scorer. The state must not depend on candidate order or query context. At query time, score queries against stored projections without decoding/generation. Return document digest, state revision, segment policy, score and scorer revision. Measure interaction cost against the declared full-token baseline using the same document/query set and report denominator and result digest. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R081`. Source record `AU:126` SHA-256 `deca151180a749cb3784d9946da0de17205eca89c92e5eb4f275859e1d4be165`. | Build state once, then rerank under two query contexts and reversed candidate order. Assert the state digest stays identical and per-document scores remain aligned. Assert no decoder/model-generation call. Compare measured interaction cost with the same full-token baseline. Refuse stale document/encoder revisions, malformed segment coverage or any query-time state rewrite. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.102 Index-time teacher distillation with measured quality and zero query model calls Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Index-time teacher distillation with measured quality and zero query model calls.** Persist an index-time distilled scorer with corpus/index revision, teacher model revision and teacher-judgment dataset digest. Bind scorer artifact digest and quality metric/threshold policy. The scorer is eligible for query use only when its measured quality reaches the declared held-out target-set threshold. Query-time retrieval applies the stored scorer without any model-service call. It never distills or repairs the scorer on demand. A below-threshold, stale or unbound artifact refuses activation and leaves the prior scorer active. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R081`. Source record `GRAPHOS:27` SHA-256 `baac22c9fb42470957b5b91499c6e42e1bb2410d24446d15f6f364638c88138e`. | Distill and read back an artifact meeting held-out quality threshold. Serve queries and assert zero model-service calls plus scorer-digest binding. Below-threshold, missing held-out evidence, stale corpus/index or teacher revision all refuse activation. Verify the prior scorer remains active. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.100 Joint sparse nonnegative reconstruction selects a diverse document set Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Joint sparse nonnegative reconstruction selects a diverse document set.** Given query vector q and candidate matrix V, select a joint coefficient vector x by minimizing `||q - Vᵀx||₂² + λ||x||₁`. V rows are revision-pinned embeddings in the same declared embedding space. Require xᵢ >= 0 and existing result-count/tenant bounds. λ, solver version, convergence tolerance, embedding-space revision and input digest are bound to the request. Return selected document ids, nonnegative coefficients, reconstruction residual, solver status and policy revision in deterministic coefficient-descending then document-id order. Do not substitute independent dense/lexical dual-score ranking. Preserve the distinct R081.7 mechanism. Refuse mismatched embedding revisions, invalid λ, solver non-convergence or a result set that exceeds existing bounds. Producer/consumer boundary: EG retrieval selection owns the joint objective and set result. The existing served UnifiedQuery/retrieval path consumes it. Preserve R081.1-.9 selection and tenant bounds. No new caller-controlled score authority. Preserve existing parent obligations: `EG-FEDERATED-QUERY-R081`. Source record `EG:41` SHA-256 `bceeed106b5db2933cf5161d58b4203fc7afe9d714503a31d68323992906c23b`. Parent `R081` remains unchanged. | Planned served acceptance: Compare served retrieval on a tiny fixture with an independent exhaustive nonnegative-sparse oracle. Include two highly correlated documents and an alternative diverse pair. Assert exact selection, coefficients, residual and deterministic order. Refuse embedding-space mismatch, invalid policy and non-convergence. Verify existing tenant and result-count filters still apply. No implementation or receipt is claimed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R081.103 Viewport-bounded scatter and line queries over billion-point indexed sources Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Viewport-bounded scatter and line queries over billion-point indexed sources.** Add a closed `ViewportQueryV1` plan variant to existing authenticated `Method::UnifiedQuery`/`run_unified_with` and public `Method::ResolveViewportSelection` (`ResolveViewportSelectionV1`) operation. Request binds tenant authority, indexed source id/revision/cardinality, `scatter or line` variant and typed axes/units. It also binds filter digest, viewport domain, `pixel_width` and `pixel_height` (each 1..4096), binning-policy revision and required byte ceiling (1..16777216). For v1, the effective encoded response ceiling is `min(requested_byte_ceiling, formula_cap)`. Invalid or too-small ceilings that cannot contain the mandatory response envelope refuse with `BYTE_CEILING_TOO_SMALL` before scanning. Results are never silently truncated. Scatter cap is `min(pixel_width * pixel_height, 262144)` bins. Line cap is `min(4 * pixel_width, 65536)` bins. Both are positive integer formulas independent of source cardinality. Encoded response cap is `min(16777216, 65536 + 96 * max_bin_count)` bytes, measured after wire serialization. Scatter bins return stable id, count and axis extrema. Line bins return first/last/min/max/count and an explicit continuity/gap flag. Results bind source revision, viewport, policy revision, full-source cardinality and query digest. No path may transfer the full source. Selection tokens form a closed union. `ExactPoint` binds one authorized point id/revision. `AggregateBin` binds one bin id plus source/index/viewport revisions. It cannot expand into unbounded raw points. Refuse absent/outdated spatial index, stale source revision, invalid viewport, unauthorized source/selection and exceeded caps. Never silently drop bins. Consumer: GraphOS typed query adapter and `WEBUI-APPS-R001.2` chart renderer. Source objective WEBUI:7: The interface renders interactive scatter/line charts with pan, zoom and selection for billion-point datasets. Screen-bounded binning keeps payloads bounded. Source record SHA-256 `483b80b268ba6924ced162740792071fb43f482b1cddf16d9fbd424727d4ed89`. | On a real indexed source with at least 1,000,000,000 points, serve scatter and line queries at three viewport sizes. Verify versioned formulas, encoded byte cap, exact source revision, continuity and no full-source transfer. Pan/zoom changes the query digest and bins. Exact and aggregate selection tokens resolve only within their pinned revisions. Stale index, denied selection, invalid/exceeded caps and absent source refuse. No runtime or owner receipt is claimed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R087 Native visualization static export (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Native visualization static export (rollup).** The engine renders a validated view specification to PNG, SVG or PDF bytes through the served visualization method. Export is an engine capability, not a connector capability. All listed children are required before this rollup can be LANDED. | Generated status requires every child to be LANDED and VERIFIED. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R087.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** The export contract is the `StaticExportBackend` trait at `crates/eg-viz-core/src/traits.rs:115`. Its `export` method takes a view specification, a resolved result and a format. The formats are `StaticExportFormat` at `crates/eg-viz-core/src/traits.rs:106`: PNG, SVG and PDF. The wire mirror is `VizFormat` at `crates/eg-types/src/viz.rs:73`, with the same three snake-case values. The code has no HTML export. Surface `StaticExport` at `crates/eg-viz-core/src/capability.rs:33` names this capability. The engine must not add HTML without a new requirement. | A served-path test observes this behavior. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R087.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** A render request carries a view specification, a dataset reference, canvas pixels, a primitive ceiling and a byte ceiling. The handler at `src/server/handlers/viz.rs:116` must validate the specification and clamp the canvas to 16..8192 pixels. It must resolve the specification against the dataset under the frame budget. It must export through `ColumnStoreExportBackend` at `crates/eg-viz-export/src/backend.rs:84`. It must return bytes, a content type, a result reference and a cached flag. The same inputs must give a cache hit. | A served-path test observes this behavior. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R087.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The served wire method is `Method::Viz` with `VizOp::Render`. Dispatch routes it at `src/server/dispatch/router/control_plane.rs:654` to `handle` at `src/server/handlers/viz.rs:104`. The export call sits at `src/server/handlers/viz.rs:366`. Feature `viz-static-export` at `Cargo.toml:486` gates the route, and the default `full` feature set includes it. The Python `VizClient` at `epistemic_graph/client.py:3165` wraps the method. No production caller beyond that client was found in this repository today. | A served-path test observes this behavior. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R087.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** The handler must refuse, never return an empty image. An unparseable or invalid specification refuses with a typed message from `src/server/handlers/viz.rs:310`. An empty dataset reference refuses with `ACCESS_DENIED`. An unknown dataset reference refuses with `ENGINE_UNAVAILABLE` at `src/server/handlers/viz.rs:328`. A result reference outside the verified owner scope refuses with `ACCESS_DENIED`. A resolve or export failure must surface as an error response. | A served-path test observes this behavior. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R087.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Tests at `tests/viz_dispatch.rs` drive the dispatch path and assert valid PNG bytes. The test at line 341 asserts the unavailable-dataset refusal. The test at line 304 asserts the invalid-specification refusal. The test at line 448 asserts the repeat-render cache hit. SVG and PDF output have no served-path test at present. Verification must add one for each before this child is VERIFIED. | A served-path test observes this behavior. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R087.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Method::Viz` wire method with `VizOp::Render`. A test must request each of PNG, SVG and PDF through `dispatch`. It must observe the returned content type and a non-empty body for each format. It must also observe the refusal for an unknown dataset reference. Today only the PNG path has such a test, in `tests/viz_dispatch.rs`. | A served-path test observes this behavior. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.4 Natural-language planning context, dialect choice and bounded steps (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Natural-language planning context, dialect choice and bounded steps (rollup).** The engine must build the schema context, choose the dialect and run a bounded correction loop for a natural-language request. Each step runs as disclosed read-only text under `EG-FEDERATED-QUERY-R058`. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.4.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `SchemaContext{labels, tables, properties, digest}` and `NlPlanStep{dialect, query_text, outcome}` in `crates/eg-plan/src/nl/context.rs`. Extend `Method::NlQuery` at `crates/eg-types/src/protocol/method/method_05.rs:394` with `dialect` and `max_steps`. Closed `dialect` values are `auto`, `uql`, `sql`, `sparql` and `cypher`. `max_steps` ranges from 1 to 4. Proving test: `context.rs::tests::context_round_trips`. | A serde round trip keeps every field and rejects `max_steps = 5`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.4.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Schema linking scores labels and tables by token overlap with the request. It keeps at most 60 labels, 60 tables and 16 properties per label. Choice `auto` selects UQL, except for relational-only or RDF-only linked schemas. A parse or execution error returns to the planner as a typed message. The loop stops at `max_steps`. | Unit tests cover linking, each dialect choice and one corrected step. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.4.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The loop attaches in `handle_nl_query_plan` at `src/server/handlers/query/nl.rs:48`. The schema comes from the in-process graph schema read. The planner is the configured `NlPlanner` port. Each step runs through the read-only pipelines of `EG-FEDERATED-QUERY-R058`. | A dispatch test observes one schema read per request. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.4.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** An exhausted step budget must return `NL_QUERY_STEPS_EXHAUSTED` with every step's text. A missing planner must return `NL_PLANNER_UNCONFIGURED`. The generated error contract must declare both codes. A mutation-shaped candidate keeps the `EG-FEDERATED-QUERY-R058` refusal. | Each case returns its code and no rows. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.4.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The result must carry every step's dialect, text and typed outcome. It must carry the schema context digest and the planner id and revision. | A test reads the step list and the digest. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.4.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served `NlQuery` method. The test `tests/nl_query_bounded_steps.rs::second_step_corrects_parse_error` uses a scripted planner that returns invalid text, then valid text. The result must show two steps and rows equal to the direct `Uql` call. Engine overhead must stay under 10 ms at p99 per step, excluding planner latency. | The served test passes, and the measured overhead meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R058.5 Configurable NL planner request Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Configurable NL planner request.** The standalone planner reads a read timeout and an extra request body. They come from the same configuration as the endpoint and model. The `nl_query` or `llm` config section holds `read_timeout_secs` (default 30, accepted 1 to 600). It also holds `extra_body`, a JSON object that the planner merges into the request top level. The default `extra_body` is `{"chat_template_kwargs":{"enable_thinking":false}}`, so a reasoning model answers directly. The env keys `EPISTEMIC_GRAPH_NL_READ_TIMEOUT_SECS` and `EPISTEMIC_GRAPH_NL_EXTRA_BODY` (JSON) override the file. A configured `extra_body` replaces the default and cannot set `model` or `messages`. The planner refuses invalid values with the typed `NlConfigError` (`ReadTimeoutOutOfRange`, `ExtraBodyNotObject`, `ExtraBodyReservedKey`, `InvalidValue`). `Method::NlQuery` then refuses with the `ENGINE_UNAVAILABLE` code and a detail that names the bad key. | Tests against a local stub HTTP server confirm the default and a configured extra body reach the request body. They also confirm a peer slower than the configured read timeout fails within bounds. Refusal tests confirm each `NlConfigError` variant. A config test confirms the keys parse and invalid values are refused. An unparseable env or config value is refused with `InvalidValue`, which carries the source name and the raw text. A handler test confirms the served refusal carries the code and names the key. | requirement | EG-FEDERATED-QUERY | VERIFIED | 545288fec504 8d0681dc8250 f555f9a29661 crates/eg-plan/src/nl_regressions.rs:278 crates/eg-plan/src/nl_regressions.rs:290 crates/eg-plan/src/nl_regressions.rs:319 src/server/handlers/query/nl.rs:253 src/server/nl.rs:450 |
| EG-FEDERATED-QUERY-R088 UQL text rows carry governance and an epistemic summary (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**UQL text rows carry governance and an epistemic summary (rollup).** The served `Uql` method must apply owner and scope visibility before rows leave the engine. On request it must attach an epistemic summary to each row from the same snapshot. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R088.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `include_epistemic: bool` to `Method::Uql` at `crates/eg-types/src/protocol/method/method_05.rs:112`. Add `UqlRowSummary{status, confidence_q16, evidence_count, revision}` to `UqlResult`. A request without the flag returns the existing row shape. Proving test: `crates/eg-types/src/wire.rs::tests::uql_summary_round_trips`. | A serde round trip keeps every field and the default row shape. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R088.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Visibility through `row_visibility` runs before `LIMIT` and ranking trims. Summaries resolve in one batch from the same snapshot. Cost is O(r) in returned rows. | A unit test shows that hidden rows do not displace visible rows. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R088.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The attach point is `handle_uql` at `src/server/handlers/query/uql_statement.rs:17`. It reuses the provenance-by-ids resolver in process. It makes no second wire call. | A dispatch test observes one snapshot for rows and summaries. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R088.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A build without the epistemic feature must return `METHOD_NOT_YET_SERVED` for `include_epistemic`. Existing parameter refusals stay unchanged. | The test asserts the code and no partial rows. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R088.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The result header must carry snapshot revision, hidden row count and summary revision. | A test reads the header fields. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R088.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Uql` method. The test `tests/uql_governed_summary.rs::governed_rows_carry_summary` uses two principals. Hidden rows must be absent. The row order must match a request without the flag. Summaries must add under 2 ms at p99 for 100 rows. | The served test passes, and the measured cost meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R089 Discover returns a retrieval-quality verdict (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Discover returns a retrieval-quality verdict (rollup).** The served `Discover` method must return a fail-closed retrieval-quality verdict with its rows. The harness applies the received verdict and computes none. Children `.1` to `.7` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R089.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Extend `Method::Discover` at `crates/eg-types/src/protocol/method/method_03.rs:362` with an optional quality policy reference. Add `RetrievalVerdict{gate_passed, failure_modes, composite_quality_q16, index_population_ratio_q16, above_threshold, total_candidates, policy_revision}`. Closed failure modes are `drift`, `context_truncation`, `stale_index`, `low_relevance_topk` and `sparse_index`. Proving test: `crates/eg-types/src/wire.rs::tests::verdict_round_trips`. | A serde round trip keeps every field and rejects an unknown failure mode. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R089.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The verdict uses the scores that `Discover` already computes. The population ratio divides embedded nodes by candidate-type nodes from semantic store counters. `stale_index` fires when the index generation trails the graph write watermark. A keyword-only result sets `sparse_index`. Cost is O(k). | Unit tests cover each failure mode. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R089.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The attach point is `discover` at `src/server/handlers/graph_ops/semantic.rs:88`. Its caller is the `Discover` arm at `semantic.rs:297`. The policy thresholds come from a policy node. The defaults are a minimum composite quality of 0.3 and a population ratio of 0.5. | A dispatch test reads the policy node and returns the verdict. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R089.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** An unknown policy reference must return `INVALID_ARGUMENT`. A failed verdict is not a refusal. It must return `gate_passed = false` with the rows. | Tests assert the code and a failed verdict with rows. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R089.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The verdict must carry the policy revision, the index generation and the thresholds used. | A test reads the three fields. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R089.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Discover` method. The test `tests/discover_quality_verdict.rs::sparse_index_fails_closed` embeds 10% of a fixture graph. It must observe `gate_passed = false` with `sparse_index`. A fully embedded fixture must pass. The verdict must add under 50 µs at p99. | The served test passes, and the measured cost meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R089.7 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The `drift` failure mode fires when a drift signal of `EG-DECISION-ENGINE-R174.8` is firing for a candidate shard. Add `adapter_digest: Option<String>` and `shard_generations` to `RetrievalVerdict`. A verdict with no active adapter names `base`. Proving test: `crates/eg-plan/src/retrieval_verdict.rs::tests::drift_mode_reads_monitor_and_names_adapter`. | A firing signal sets `drift`, and the verdict names the adapter digest and each shard generation. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R090 Discover plans expansions, recency and multi-hop context (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Discover plans expansions, recency and multi-hop context (rollup).** The served `Discover` method must plan query expansions, apply recency decay as of a date and expand multi-hop context. The harness passes query text and an embedding only. Children `.1` to `.7` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R090.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Extend `Method::Discover` at `crates/eg-types/src/protocol/method/method_03.rs:362` with `query_text`, `mode`, `as_of` and `hops`. Closed `mode` values are `standard` and `deep`. `hops` ranges from 0 to 2. Add per-row `arm_ranks`, `recency_boost` and `hop_path` to the result. Proving test: `crates/eg-types/src/wire.rs::tests::discover_plan_round_trips`. | A serde round trip keeps every field and rejects `hops = 3`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R090.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Mode `deep` asks the planner port for at most 4 hypothetical passages and sub-queries. The embedding endpoint embeds them. Arms fuse by reciprocal rank with `k = 60`. Recency boost is at least 1.0 and decays from `as_of` by the pack's per-type spec. A node without a date gets 1.0. Hop expansion keeps at most 32 neighbors per hop. Retrieved rows that score below the cutoff feed hard-negative mining. | Unit tests cover fusion, decay, the neutral date and the frontier cap. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R090.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The attach point is `discover` at `src/server/handlers/graph_ops/semantic.rs:88`. The planner port is the one `EG-FEDERATED-QUERY-R058.4` uses. The embedding endpoint is the one `EG-DECISION-ENGINE-R174` uses. Neighbor reads use the batched adjacency path. | A dispatch test observes one planner call and batched neighbor reads. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R090.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Mode `deep` without a configured planner must return `DISCOVER_PLANNER_UNCONFIGURED`. An unparsable `as_of` must return `INVALID_ARGUMENT`. The generated error contract must declare the new code. | Each case returns its code and no rows. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R090.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The result must list each expansion digest, the per-arm ranks, the recency boost and the hop path of each row. | A test reads each field. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R090.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served `Discover` method. The test `tests/discover_planning_served.rs::deep_recency_multihop` uses `deep`, `as_of` and `hops = 2`. It must observe a two-hop neighbor and recency order in the fused rows. The benchmark `benches/discover_planning.rs` must show p99 under 15 ms in `standard` mode at 1,000,000 vectors. It must show engine overhead under 40 ms in `deep` mode, excluding model latency. | The served test passes, and the benchmark receipt meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R091 Virtual-query plans evolve by measured improvement (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Virtual-query plans evolve by measured improvement (rollup).** The engine records each virtual-query execution. In downtime windows it tries better plans for frequent question shapes. It keeps a plan only on a measured gain and reverts otherwise. Candidate kinds are a rewrite, a pushdown choice, a cached sub-graph, a pre-materialized hot sub-graph and an index suggestion. Materialization reuses the acceleration policy of `EG-UNIFIED-DATA-PLANE-R038`. The downtime scheduler is `EG-DURABLE-KERNEL-R101`. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R091.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `PlanObservation{shape_digest, plan_digest, sources, pushdowns, latency_us, rows_fetched, bytes_fetched, cache_hit, graph_revision}` and `PlanCandidate{shape_digest, kind, plan_digest, baseline_digest}` in `crates/eg-plan/src/federation_opt/plan_evolution.rs`. Closed `kind` values are `rewrite`, `pushdown_choice`, `cache_subgraph`, `materialize_subgraph` and `index_suggestion`. The store keeps 4,096 observations per shape and 1,024 shapes per tenant. It evicts the least recently seen shape, as `stats.rs:77` does. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::observation_store_bounds`. | A serde round trip keeps every field and rejects an unknown kind; the store evicts at its bound. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R091.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** A downtime job replays the 32 most frequent shapes against the baseline and one candidate. The named default `keep_on_measured_gain` keeps a candidate under three conditions. The p50 latency or bytes fetched must improve by 10% or more. The test needs 20 or more replays. The result multiset must equal the baseline. Otherwise the job reverts the candidate. A kept plan re-validates when source statistics drift by more than 25%. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::keep_or_revert_by_measurement`. | A faster equal candidate is kept, and a slower or unequal candidate is reverted. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R091.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Recording attaches at `record` in `crates/eg-plan/src/federation_opt/run.rs:102`. `foreign_scan` at `run.rs:26` reads the kept plan by shape digest. The evaluation runs as an `eg-jobs` job of the downtime job type `plan_evolution`. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::served_path_records_and_reads`. | A served query records one observation, and a later query uses the kept plan. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R091.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A candidate with a different result must revert with `PLAN_RESULT_MISMATCH`. An exhausted budget must stop with `DOWNTIME_BUDGET_EXHAUSTED` and keep the baseline. A materialization that `validate_policy` (`crates/eg-types/src/metadata_acceleration.rs:91`) refuses must not run. An index suggestion for a source index must record a suggestion fact and change no source. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::evolution_refusals`. | Each case returns its code, and the active plan stays the baseline. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R091.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** `PlanEvolutionReceipt` must carry shape digest, baseline digest, candidate digest and replay count. It must also carry p50 and bytes before and after, the decision and the reason. EXPLAIN must name the kept plan digest and its receipt. Proving test: `crates/eg-plan/src/federation_opt/plan_evolution.rs::tests::receipt_names_measurements`. | A served read finds the receipt linked to the shape. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R091.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served SPARQL method over two connectors. The test runs one shape 50 times and opens a downtime window. A later served query must use the kept plan. A second, unequal candidate must revert. Recording overhead must stay under 20 microseconds per execution. Proving test: `tests/federation/test_plan_evolution_served.py::test_kept_plan_measurably_faster_and_mismatch_reverts`. | The kept plan improves p50 by 10% or more, the unequal candidate reverts, and the overhead meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R090.7 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Mode `deep` passes each expansion embedding through the scoped adapter of `EG-DECISION-ENGINE-R174.7` before arm fusion. A row from a freshness refresh of `EG-DECISION-ENGINE-R174.9` lists its source, retrieval time and query digest in the row evidence. Proving test: `tests/discover_planning_served.rs::deep_arms_use_scoped_adapter`. | A dispatch test observes one adapter application per arm and the refresh provenance on a fresh row. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R607 Topology analytics find communities, analogies and cross-domain synergy (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Topology analytics find communities, analogies and cross-domain synergy (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R607.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** `crates/eg-analytics/src/topology.rs` defines CommunityResult, MincutPartition, SpectralCluster, AnalogyMatch, SynergyBridge, PositionalEncoding. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R607.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Spectral clustering and mincut partitioning return stable community ids across runs. Analogy search matches structurally similar subgraphs across domains. Synergy ranks concept bridges and pillar couplings from shared types and edge patterns. Positional interaction encodings support inductive scoring on unseen hyperedges. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R607.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Exposed as engine analytics methods reachable through the federated query surface; reuses EG-REPO-INGEST-R011 for Leiden. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R607.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A request whose graph exceeds the payload bound of EG-PLACEMENT-R003 is refused with the bound. The stable code is `ANALYTICS_PAYLOAD_BOUND`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R607.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Per call: modularity, partition cut, match scores. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R607.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** spectral clustering of 100k nodes: p50 under 4 s, p99 under 10 s; analogy match on 10k-edge subgraphs under 800 ms. The benchmark is `benches/r607_federated_query_and_reasoning.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R608 Rule inference, causal verification and paradigm routing run in the engine (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Rule inference, causal verification and paradigm routing run in the engine (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R608.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** `crates/eg-reasoning/src/rules.rs` defines InferenceRule, DerivedFact, CausalEdge, ParadigmRouter, OpsCausalLink. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R608.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Inference rules derive new facts to a fixpoint with provenance. Subsumption follows the ontology. Causal verification checks a structural causal model against observed data. A router picks a reasoning paradigm per task from capability tags and learns from outcomes. Operational entities (traces, services, changes, incidents) join into one causal chain with links carrying evidence. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R608.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Reached through the reasoning methods of EG-FEDERATED-QUERY and the decision ladder of EG-DECISION-ENGINE-R001. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R608.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A rule set that does not converge within the step bound stops and returns the partial derivation flagged incomplete. The stable code is `RULE_FIXPOINT_BOUND`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R608.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Per run: rules fired, facts derived, steps, causal verdict. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R608.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** fixpoint over 1M facts and 200 rules: p50 under 2 s, p99 under 6 s. The benchmark is `benches/r608_federated_query_and_reasoning.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R650 Context bundle compilation under a certified token budget (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Context bundle compilation under a certified token budget (rollup).** Given a ranked candidate set and a token budget, EG compiles one context bundle. The bundle holds items at the resolution that maximizes value inside the budget. Each item has a citation and proof edges. The bundle has a stable cache key. EG also owns the score fusion, cut-off and per-source budget rules that shape the candidate set. The Rust home is `crates/eg-plan/src/context_bundle.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R650.1`-`EG-FEDERATED-QUERY-R650.6` are satisfied. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R650.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `ContextBundleRequest`, `ContextItem{resolution,tokens,value}`, `Citation`, `ProofEdge`, `BundleKey` (BLAKE3 of tenant, request, graph revision, policy digest), `KnapsackCertificate{bound,gap}` in `crates/eg-plan/src/context_bundle.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R650.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Solve the multi-resolution 0-1 knapsack by dynamic programming over quantized token cost (O(n*B/q)). Fall back to a greedy density order only when the certificate reports a gap under the configured tolerance. Fuse per-source scores by reciprocal-rank and calibrated-score rules. Cut the tail at the largest score gap. Reject nothing silently. Every excluded item carries a reason. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R650.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Attach after retrieval fusion in `crates/eg-plan/src/exec.rs`. Expose it as the served `ContextCompile` method in `contract/methods.json`. The AU harness only submits the request and renders the returned bundle. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R650.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A request without a token budget returns a typed refusal. So does a request with a negative item cost or one over the tenant's visibility scope. A bundle never contains a row the caller cannot read. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R650.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record input scores and normalization. Record selected and excluded item IDs with reasons. Record resolution per item, budget used, certificate bound and cache-key inputs. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R650.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Benchmark `context_bundle_compile` (256 candidates, 8k-token budget): p50 2 ms, p99 12 ms, peak memory 16 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan context_bundle_compile` against the stored baseline. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R651 Query understanding, expansion and stopping (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Query understanding, expansion and stopping (rollup).** EG analyses a query into filters and a relational intent. It plans hypothetical-document and iterative expansion rounds with relevance feedback. It reconstructs evidence by bounded neighbour walks and runs executable retrieval plans. It stops when the answer repeats or the gain falls below a threshold. The Rust home is `crates/eg-plan/src/query_understanding.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R651.1`-`EG-FEDERATED-QUERY-R651.6` are satisfied. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R651.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `QueryFilters`, `RelationalIntent{subject,relation,object}`, `ExpansionRound{terms,feedback_ids}`, `ReconstructionStep`, `RetrievalProgram{ops}`, `StopDecision{reason,round}` in `crates/eg-plan/src/query_understanding.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R651.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Parse filters and relational intent without a model call. Expand terms with relevance feedback in at most the configured number of rounds. Walk neighbours breadth-first to a hop and node cap (O(V+E) in the visited subgraph). Execute a linear or branching retrieval program over the existing plan operators. Stop when two consecutive normalized answers match. Also stop when marginal gain is under the threshold. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R651.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Planner entry in `crates/eg-plan/src/nl.rs` feeding `Discover`; the model-backed hypothetical-document step is a pluggable `ExpansionProvider` whose output is data, never a decision. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R651.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** EG refuses unbounded hop, round or program-length requests with a stable code. It refuses a program step that names an unknown operator before execution. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R651.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record each round's terms, feedback IDs, visited nodes, program trace and the stop reason. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R651.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Benchmark `query_understanding_plan` (typical 20-token query, 3 rounds): p50 300 us, p99 2 ms, peak memory 4 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan query_understanding_plan` against the stored baseline. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R652 Reranking and learned retrieval signals (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Reranking and learned retrieval signals (rollup).** EG reranks candidates with a cross-encoder or reasoning-aware scorer. It calibrates raw scores to probabilities and routes hierarchical and spectral topology signals. It encodes temporal semantic identifiers. It produces recommender-style candidates from text-to-identifier bridges. The Rust home is `crates/eg-plan/src/rerank.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R652.1`-`EG-FEDERATED-QUERY-R652.6` are satisfied. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R652.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `RerankScorer` trait, `CalibrationCurve`, `TopologyRoute`, `TemporalSemanticId`, `SidBridge` in `crates/eg-plan/src/rerank.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R652.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Score the top-k only (k bounded). Calibrate with isotonic fitting stored per scorer version. Run the scorer through the `eg-tensor` kernels. Fall back to the lexical scorer when the model scorer is unavailable, and say so in the receipt. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R652.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Operator before terminal fusion in `crates/eg-plan/src/exec.rs` beside the hierarchy operator of `EG-FEDERATED-QUERY-R081.9`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R652.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A scorer whose version differs from the pinned calibration is refused rather than mixed. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R652.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record scorer ID and version, calibration digest, input and output ranks and any fallback. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R652.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Benchmark `rerank_top64` (64 candidates, 256-token passages, CPU): p50 6 ms, p99 25 ms, peak memory 64 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan rerank_top64` against the stored baseline. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R653 Document, corpus, memory and entity retrieval (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Document, corpus, memory and entity retrieval (rollup).** EG retrieves by document section tree and by direct grep over a corpus. It also retrieves by community-level local and global search, by session history, by memory tier and by entity neighbourhood. It resolves the lineage of any answer back to its sources. The Rust home is `crates/eg-plan/src/corpus_retrieval.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R653.1`-`EG-FEDERATED-QUERY-R653.6` are satisfied. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R653.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `SectionMatch{path,span}`, `GrepMatch`, `CommunityReport`, `SessionHit`, `EntityContext`, `LineagePath` in `crates/eg-plan/src/corpus_retrieval.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R653.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Rank sections on the section tree top-down with pruning. Scan the corpus with a bounded regular-expression engine. Answer global questions from precomputed community reports. Answer local questions from the entity neighbourhood. Resolve lineage by a bounded provenance walk. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R653.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Served `Discover` sub-operators in `crates/eg-plan/src/exec.rs`; community reports come from the `eg-core` community phase. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R653.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** EG refuses regular expressions past the complexity cap, lineage walks past the depth cap and scopes the caller cannot read. Each refusal has a stable code. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R653.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record visited sections, matches, community IDs, lineage hops and the visibility filter applied. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R653.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Benchmark `corpus_retrieval_mixed` (10k sections, 1M-token corpus): p50 4 ms, p99 20 ms, peak memory 32 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan corpus_retrieval_mixed` against the stored baseline. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R653.7 Web Document citations Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Web Document citations.** A hybrid hit on a web Document must cite its source URL, retrieval time, content digest, backend and originating query. Retrieval fuses vector, graph and keyword scores through `fuse_rrf` at `crates/eg-plan/src/exec.rs:848`. The citation reuses `Citation` of `EG-FEDERATED-QUERY-R650.1`. Proving test: `tests/retrieval/test_web_citation_served.py::test_hybrid_hit_cites_source_url`. | A served `Discover` returns a fused hit whose citation names the URL, the retrieval time and the query. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R654 Code, operations and deployment context (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Code, operations and deployment context (rollup).** EG answers how, usage and impact questions over the resolved code graph. It computes code-scoped hubs, communities and surprising connections. It diagnoses operations, deployment and symptom queries from causal hub types. The Rust home is `crates/eg-plan/src/code_context.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R654.1`-`EG-FEDERATED-QUERY-R654.6` are satisfied. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R654.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `CodeContextAnswer{anchors,usages,impact}`, `CodeMetrics`, `OpsCausalStage`, `SymptomDiagnosis` in `crates/eg-plan/src/code_context.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R654.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Resolve anchors by symbol index. Expand callers and callees to a bounded depth across repositories. Rank hubs by centrality on the code subgraph. Map operations nodes to causal stages for diagnosis. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R654.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Served `CodeContext` and `Diagnose` methods built on the repository index of `EG-REPO-INGEST`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R654.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** An ambiguous anchor returns the candidate list rather than a guess; a degraded engine read returns a typed degraded answer. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R654.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record anchors, hop counts, centrality inputs and causal stage per node. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R654.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Benchmark `code_context_impact` (1M-symbol graph, depth 3): p50 3 ms, p99 15 ms, peak memory 24 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan code_context_impact` against the stored baseline. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R655 Retrieval quality gates and evaluation corpora (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Retrieval quality gates and evaluation corpora (rollup).** EG gates retrieval on measured quality. The gate covers failure modes, context provenance, Bayesian trust and evaluation corpora. It also covers intent-selection accuracy, structured-retrieval adoption decisions, embedding versions and the governance rules applied to results. The Rust home is `crates/eg-plan/src/retrieval_quality.rs`. Satisfied only when children `EG-FEDERATED-QUERY-R655.1`-`EG-FEDERATED-QUERY-R655.6` are satisfied. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R655.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `RetrievalFailureMode`, `QualityReport`, `EvaluationCorpus`, `AccuracyReport`, `EmbeddingVersion`, `AdoptionDecision` in `crates/eg-plan/src/retrieval_quality.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R655.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Score each retrieval for sufficiency, staleness and provenance coverage. Update a Beta posterior of trust per source. Refuse results whose embedding version differs from the index version. Decide adoption of a retrieval strategy from paired corpus runs. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R655.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Verdict attached to every `Discover` response beside the sufficiency verdict of `EG-FEDERATED-QUERY-R081`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R655.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A result set with unknown embedding version or without provenance is marked insufficient and never reported as complete. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R655.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Record corpus ID, per-query verdicts, posterior parameters and the adoption decision inputs. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R655.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** Benchmark `retrieval_quality_gate` (100 results, 20 sources): p50 400 us, p99 2 ms, peak memory 8 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-plan retrieval_quality_gate` against the stored baseline. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R700 Argument maps with a Dung projection (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Argument maps with a Dung projection (rollup).** The engine stores argument maps in the Argument Interchange Format. It imports and exports the interchange JSON and validates map well-formedness. It projects a map to an abstract argumentation framework. It computes the grounded and preferred extensions of that framework natively. Implemented in eg-reason, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R700.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** `AifNode`, `AifEdge`, `ArgumentMap` and `DungProjection { arguments, attacks }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R700.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Grounded extension is a fixed-point iteration in O(arguments + attacks); preferred extensions are enumerated under a node budget (as R011). | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R700.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Reachable as a UQL stage and as a served method; stored as native OWL/RDF relationships. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R700.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A map with a dangling edge or an invalid node kind is refused with the offending id. Enumeration past the budget returns a certified-gap result. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R700.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Every extension result carries the map digest it was computed from. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R700.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/reasoning/test_aif_dung_served.py::test_grounded_extension_matches_fixture` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/dung_grounded.rs` must show p50 under 1 ms and p99 under 6 ms with peak memory under 16 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R701 Live artifacts re-derive from a query and keep the prior value on failure (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Live artifacts re-derive from a query and keep the prior value on failure (rollup).** A live artifact is a bounded-JSON document with a template and a query source. A refresh re-runs the query and replaces the data. On failure the engine keeps the prior data and records the failure with provenance. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R701.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** `LiveArtifact { id, template, source: QuerySource, data, provenance }` with a validated size and depth bound in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R701.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Refresh is compare-and-set on the artifact version; interpolation is a single non-recursive pass over the template. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R701.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Stored as graph content; refresh is a served method so a scheduler or a viewer can request it. Presentation belongs to the web front end. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R701.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** The engine refuses template text that executes code or exceeds the depth bound. A failed refresh never clears data. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R701.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Each refresh records start, end, row count and error. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R701.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/query/test_live_artifact_served.py::test_failed_refresh_preserves_prior_data` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/live_artifact_refresh.rs` must show p50 under 5 ms and p99 under 30 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R702 Search-task synthesis with shortcut-risk diagnostics (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Search-task synthesis with shortcut-risk diagnostics (rollup).** From an evidence subgraph the engine formulates multi-hop search questions. It diagnoses four shortcut risks. The first is a single clue that selects the answer. The second is evidence that co-covers other clues. The third is exposed constants. The fourth is answers bound by prior knowledge. A risky question is refined or rejected. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R702.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** `EvidenceGraph`, `SearchTask`, `RiskFinding` and `RiskReport` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R702.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Each detector is a bounded query over the evidence graph; formulation refines for at most the configured number of rounds. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R702.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Consumes the epistemic graph through UQL; used to build evaluation sets for retrieval and for the gold set (DE R053). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R702.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A task failing any detector beyond threshold is refused with the detector name. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R702.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Reports list every detector value and the nodes involved. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R702.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/query/test_search_task_synthesis_served.py::test_single_clue_task_is_rejected` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/shortcut_detectors.rs` must show p50 under 6 ms and p99 under 40 ms with peak memory under 48 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R053.700 Trino and Spark job sources with idempotent submission: model and behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Trino and Spark job sources with idempotent submission: model and behavior.** A Trino query source reads against a named snapshot and refuses an unknown snapshot. A Spark transform submission is idempotent on a submission id derived from its inputs. It refuses an unavailable preset with a typed reason. Its change envelope carries the fence fields the consumer needs. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R053.701 Trino and Spark job sources with idempotent submission: refusal, evidence and hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Trino and Spark job sources with idempotent submission: refusal, evidence and hot-path proof.** A missing fence field is refused; an unknown snapshot is refused. Test `tests/query/test_spark_trino_sources_served.py::test_resubmission_returns_same_submission`; benchmark `benches/spark_submission_id.rs` p50 under 0.02 ms and p99 under 0.2 ms, memory under 8 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R005.700 Graph integrity validation as shape checks: model and behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Graph integrity validation as shape checks: model and behavior.** Graph integrity (required properties, orphan nodes, dangling edges, invalid references) is a set of named shapes. VALIDATE SHAPE evaluates them. It produces a report with severity and a fatal class that blocks the caller. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R005.701 Graph integrity validation as shape checks: refusal, evidence and hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Graph integrity validation as shape checks: refusal, evidence and hot-path proof.** A fatal finding blocks with its shape id; validation over a graph exceeding the node budget returns a certified-gap result. Test `tests/query/test_graph_integrity_shapes_served.py::test_fatal_finding_blocks`; benchmark `benches/graph_integrity_validate.rs` p50 under 50 ms and p99 under 250 ms per 100,000 nodes, memory under 128 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R703 Query-time access check for dynamic-access sources (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Query-time access check for dynamic-access sources (rollup).** Some sources decide access only at read time. For their records, the engine must confirm access through the source before a hit enters a context bundle. It fails closed. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R703.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `AccessCheckRequest{source, principal, record_refs}` and `AccessCheckAnswer{allowed, denied, checked_at}` in `crates/eg-plan/src/access_check.rs`. A source pack declares `access_mode` as `synced` or `checked_at_read`. | `crates/eg-plan/tests/access_check.rs::request_round_trips` round-trips both records. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R703.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Before bundle compile, the engine groups `checked_at_read` hits by source. It sends one bounded check per source with up to 200 records. It caches each answer per principal for 300 s at most. A timeout of 2 s drops every hit of that source. | `crates/eg-plan/tests/access_check.rs::timeout_drops_hits` simulates a slow source. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R703.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** `ContextCompile` of R650 calls the check after retrieval fusion in `crates/eg-plan/src/exec.rs`. The SDK access-check port of `SDK-SOURCE-INGEST-R805.5` answers it. | `tests/retrieval/test_access_check_served.py::test_denied_hit_never_enters_bundle` denies one record and reads the bundle. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R703.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A source that declares `checked_at_read` without a registered check port must refuse every hit with `ACCESS_CHECK_UNAVAILABLE`. | `tests/retrieval/test_access_check_served.py::test_missing_port_fails_closed` asserts the code and an empty bundle. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R703.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** The bundle evidence of R650.5 lists each dropped record with its reason: `denied`, `timeout` or `unavailable`. | `tests/retrieval/test_access_check_served.py::test_drop_reasons_read_back` reads the reasons back. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R703.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-plan/benches/access_check.rs` filters 256 hits over 4 sources with warm caches. The added p99 stays under 1 ms. | `cargo bench -p eg-plan --bench access_check` fails on a 10 percent regression. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R704 Agent knowledge scope (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Agent knowledge scope (rollup).** An agent profile must bind a knowledge scope: knowledge sets, source container subtrees and source filters. Retrieval for that agent intersects the scope with the caller access. A scope only narrows access. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R704.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `KnowledgeScope{agent_ref, knowledge_sets, container_refs, source_kinds, time_floor}` in `crates/eg-plan/src/knowledge_scope.rs`. | `crates/eg-plan/tests/knowledge_scope.rs::scope_round_trips` round-trips the record. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R704.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The planner adds the scope as a prefilter before candidate truncation, beside the tenant predicates of R078. An empty scope means the caller access alone. | `crates/eg-plan/tests/knowledge_scope.rs::scope_prefilters_before_truncation` checks recall inside the scope. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R704.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** `Discover` and `ContextCompile` read the scope of the requesting agent profile. The scope stores as a graph fact of EG-ORCH-VOCAB-R800. The containers come from EG-INGEST-WORKER-R904. | `tests/retrieval/test_knowledge_scope_served.py::test_agent_sees_only_scoped_sources` runs two agents over one corpus. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R704.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A scope that names a knowledge set outside the caller tenant must refuse with `SCOPE_SET_FOREIGN`. A scope can never widen access. | `tests/retrieval/test_knowledge_scope_served.py::test_scope_refusals` asserts the code and no widened read. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R704.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Each answer records the scope digest it applied. | `tests/retrieval/test_knowledge_scope_served.py::test_scope_digest_recorded` reads the digest back. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R704.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-plan/benches/knowledge_scope.rs` adds a 50-container scope to a 1M-document hybrid search. The added p99 stays under 2 ms. | `cargo bench -p eg-plan --bench knowledge_scope` fails on a 10 percent regression. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R705 Feedback-adjusted document rank (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Feedback-adjusted document rank (rollup).** The engine must turn explicit and implicit retrieval feedback into a bounded rank boost per document. The boost decays with time. It never overrides access or safety ordering. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R705.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `RetrievalFeedback{tenant, principal, document_ref, kind, weight, at}` and `DocumentBoost{document_ref, value, half_life_s}` in `crates/eg-plan/src/feedback_boost.rs`. `kind` is a closed set: `upvote`, `downvote`, `cited`, `ignored`. | `crates/eg-plan/tests/feedback_boost.rs::feedback_round_trips` round-trips both records. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R705.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The boost is the decayed sum of weights, clamped to the range -0.5 to 0.5. The default half life is 30 days. Fusion of R650.2 adds the boost after score calibration. The ordering stays monotone in safety per EG-DECISION-ENGINE-R009. | `crates/eg-plan/tests/feedback_boost.rs::boost_decays_and_clamps` checks the decay and both clamps. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R705.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Add the served method `RetrievalFeedbackRecord`. arbora serves it through the generated `eg.*` operations. The `cited` kind comes from the answer citations of R650. | `tests/retrieval/test_feedback_boost_served.py::test_upvote_raises_rank` records feedback and observes the rank change. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R705.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Feedback on a document the principal cannot read must refuse with `FEEDBACK_TARGET_HIDDEN`. More than 100 feedback events per principal per hour must refuse with `FEEDBACK_RATE_LIMIT`. | `tests/retrieval/test_feedback_boost_served.py::test_feedback_refusals` asserts both codes. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R705.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Each feedback event joins the outcome evidence of EG-DECISION-ENGINE-R100. A rank answer lists the boost per hit. | `tests/retrieval/test_feedback_boost_served.py::test_boost_listed_per_hit` reads the boost back. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R705.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-plan/benches/feedback_boost.rs` applies boosts to 256 fused candidates. The added p99 stays under 200 microseconds. | `cargo bench -p eg-plan --bench feedback_boost` fails on a 10 percent regression. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R706 Tag-based column masking and row filters (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Tag-based column masking and row filters (rollup).** The engine must enforce masking and row-filter policies inside the query plan. A policy binds to a classification tag. The tag propagates from EG-TYPED-PACKS-R652 markings and EG-TYPED-PACKS-R803 detections. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R706.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `MaskPolicy{tag, principals_exempt, method}` and `RowFilterPolicy{tag, predicate}` in `crates/eg-plan/src/policy_mask.rs`. `method` is a closed set: `null`, `hash`, `partial`, `redact`. | `crates/eg-plan/tests/policy_mask.rs::policies_round_trip` round-trips both records. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R706.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** The planner rewrites each tagged column projection with the mask expression. It adds each row filter beside the R078 predicates. SQL, UQL, SPARQL and the wire protocol of EG-DURABLE-KERNEL-R035 share one rewrite. | `crates/eg-plan/tests/policy_mask.rs::one_rewrite_serves_every_language` compares the four language plans. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R706.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Attach the rewrite in `crates/eg-plan/src/exec.rs` before pushdown. A pushed source query carries the masked projection. | `tests/test_policy_mask_served.py::test_masked_column_over_sql_and_uql` reads one tagged column through two languages. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R706.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A policy on an unknown tag must refuse with `POLICY_TAG_UNKNOWN`. A query that requests the raw value of a masked column must still receive the masked value. | `tests/test_policy_mask_served.py::test_mask_refusals` asserts the code and the masked value. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R706.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** EXPLAIN of R044 lists each applied policy and its tag. | `tests/test_policy_mask_served.py::test_explain_lists_policies` reads the policy list back. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R706.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-plan/benches/policy_mask.rs` masks 4 columns over 1M rows. The overhead stays under 8 percent of the unmasked scan. | `cargo bench -p eg-plan --bench policy_mask` fails on a 10 percent regression. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R707 SPARQL 1.1 Update and Graph Store semantics (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**SPARQL 1.1 Update and Graph Store semantics (rollup).** The engine must apply SPARQL 1.1 Update operations to named graphs. It must also apply Graph Store HTTP semantics. Each update commits as one MutationBatch of EG-DURABLE-KERNEL-R043. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R707.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add the update algebra for `INSERT DATA`, `DELETE DATA`, `DELETE/INSERT WHERE`, `LOAD`, `CLEAR`, `CREATE`, `DROP`, `COPY`, `MOVE` and `ADD` in `crates/eg-rdf/src/update.rs`. | `crates/eg-rdf/tests/sparql_update.rs::update_forms_parse` parses each form. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R707.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** An update request applies as one atomic batch. A failure in any operation leaves the store unchanged. Graph Store `GET`, `PUT`, `POST` and `DELETE` map to read, replace, merge and drop. | `crates/eg-rdf/tests/sparql_update.rs::multi_operation_update_is_atomic` fails the third operation and checks the store. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R707.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Add the served method `SparqlUpdate` beside the SPARQL query path. arbora serves the protocol endpoint through `ARBORA-OPS-R857`. | `tests/test_sparql_update_served.py::test_insert_then_select` inserts data and reads it with a query. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R707.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** An update without the write scope must refuse with `SPARQL_UPDATE_FORBIDDEN`. `LOAD` from a private address must refuse through the outbound guard of R054. | `tests/test_sparql_update_served.py::test_update_refusals` asserts both refusals. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R707.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Each update records its request digest and the batch receipt. | `tests/test_sparql_update_served.py::test_update_receipt_reads_back` compares the receipt. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R707.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-rdf/benches/sparql_update.rs` applies `INSERT DATA` of 10,000 triples. The p99 stays under 50 ms. | `cargo bench -p eg-rdf --bench sparql_update` fails on a 10 percent regression. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R708 Named stored queries and materialized results (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Named stored queries and materialized results (rollup).** The engine must hold named, parameterized, versioned queries in any query language. A stored query may keep a materialized result. The engine refreshes it on change or on a schedule. Children `.1` to `.7` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R708.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `StoredQuery{name, version, language, text, params, materialize, refresh}` in `crates/eg-plan/src/stored_query.rs`. `refresh` is `on_change` or a period of at least 60 s. | `crates/eg-plan/tests/stored_query.rs::stored_query_round_trips` round-trips the record. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R708.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** A call binds typed parameters through R025 and runs the named version. An `on_change` result recomputes when the dependency tracker of R017 marks an input changed. | `crates/eg-plan/tests/stored_query.rs::on_change_refreshes` changes an input and reads the new result. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R708.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Add the served methods `StoredQueryPut` and `StoredQueryCall`. UQL resolves `CALL STORED name(...)` to the same path. | `tests/test_stored_query_served.py::test_put_then_call` stores and calls one query. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R708.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A missing parameter must refuse with `STORED_QUERY_PARAM_MISSING`. A write to a published version must refuse with `STORED_QUERY_IMMUTABLE`. | `tests/test_stored_query_served.py::test_stored_query_refusals` asserts both codes. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R708.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** A materialized result records its input generation and refresh time. A read reports staleness in seconds. | `tests/test_stored_query_served.py::test_staleness_reported` reads the staleness back. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R708.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-plan/benches/stored_query.rs` reads a materialized result of 10,000 rows. The p99 stays under 3 ms. | `cargo bench -p eg-plan --bench stored_query` fails on a 10 percent regression. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R708.7 Shared query workspace Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Shared query workspace.** A stored query must carry an author, a share scope and an optional run schedule of at least 300 s. Before a save or a scheduled run, the engine lints the query against trust flags of EG-TYPED-PACKS-R802.7. A query that reads a deprecated asset returns a typed warning. | `tests/test_stored_query_served.py::test_workspace_share_schedule_and_lint` shares one query, schedules it and deprecates its table. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R709 GeoSPARQL query functions (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**GeoSPARQL query functions (rollup).** SPARQL evaluation must support the GeoSPARQL simple-features topology functions and the distance, buffer and envelope functions. The functions reuse the geometry kernels of `crates/eg-geo`. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R709.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Register `geof:sfEquals`, `sfDisjoint`, `sfIntersects`, `sfTouches`, `sfWithin`, `sfContains`, `sfOverlaps`, `sfCrosses`, `distance`, `buffer` and `envelope` in `crates/eg-rdf/src/geosparql.rs`. Literals use WKT. | `crates/eg-rdf/tests/geosparql.rs::functions_registered` lists the function set. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R709.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Each function delegates to `crates/eg-geo`. Shared-boundary cases follow EG-DURABLE-KERNEL-R046. | `crates/eg-rdf/tests/geosparql.rs::topology_matches_kernel` compares each function with the kernel on 50 fixtures. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R709.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** The SPARQL evaluator calls the registry for the `geof:` namespace. | `tests/test_geosparql_served.py::test_within_query` answers a served within-query. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R709.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Malformed WKT must refuse with `GEO_LITERAL_INVALID`. An unknown coordinate reference must refuse with `GEO_CRS_UNSUPPORTED`. | `tests/test_geosparql_served.py::test_geo_refusals` asserts both codes. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R709.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** EXPLAIN names each spatial function and whether a spatial index served it. | `tests/test_geosparql_served.py::test_explain_names_spatial_index` reads the plan back. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R709.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The benchmark `crates/eg-rdf/benches/geosparql.rs` filters 1M points by `sfWithin` on one polygon with the spatial index. The p99 stays under 40 ms. | `cargo bench -p eg-rdf --bench geosparql` fails on a 10 percent regression. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R720 One UQL plan across graph, vector, SQL, SPARQL and epistemic stages (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**One UQL plan across graph, vector, SQL, SPARQL and epistemic stages (rollup).** One UQL program must compile to one plan DAG with one root. The DAG may mix graph traversal, vector similarity, SQL analytics, SPARQL with OWL entailment and epistemic stages. Every stage must exchange the `RowSet` of `crates/eg-plan/src/rowset.rs:79`. Children `.1` to `.6` deliver it. | Each child requirement has its own verification. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R720.1 Epistemic row fields Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Epistemic row fields.** `Row` at `crates/eg-plan/src/rowset.rs:68` must carry an optional confidence, valid time and transaction time. A stage that reads none of these fields must pass them through unchanged. | `crates/eg-plan/src/rowset.rs` unit test round-trips the three fields through a traversal and a vector stage. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R720.2 Confidence, bitemporal and time-decay stages Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Confidence, bitemporal and time-decay stages.** `CONFIDENCE` at `crates/eg-plan/src/uql/grammar.rs:316` must drop rows below its threshold. `BELIEF AS OF` at line 311 must read the bitemporal state at its time. A new `DECAY HALF_LIFE <seconds>` stage must multiply each score by the age decay of its valid time. | `crates/eg-plan/tests/uql_epistemic_stages.rs::confidence_asof_decay` checks each stage on a fixed fixture. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R720.3 Embedding-similarity clustering stage Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Embedding-similarity clustering stage.** A new `CLUSTER BY EMBEDDING K <n>` stage must group rows by vector similarity. It must reuse the kernels of `crates/eg-compute/src/mining/cluster.rs`. Each row must gain a cluster id and a distance to its centroid. | `crates/eg-plan/tests/uql_epistemic_stages.rs::cluster_by_embedding_is_deterministic` checks fixed clusters with a fixed seed. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R720.4 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** `handle_uql` at `src/server/handlers/query/uql_statement.rs:17` must compile and run the whole program as one plan. arbora serves the program through `ARBORA-OPS-R018`. | A served test shows the program reaches `handle_uql` and runs no second planner. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R720.5 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** `DECAY` over rows without valid time must refuse with `UQL_E_DECAY_NO_TIME`. `CLUSTER BY EMBEDDING` over rows without vectors must refuse with `UQL_E_CLUSTER_NO_VECTOR`. A refused program must return no partial rows. | `crates/eg-plan/tests/uql_epistemic_stages.rs::decay_and_cluster_refusals` asserts each code and an empty result. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R720.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The test must enter at the served query method with a program of all five stage kinds. `EXPLAIN` must report one plan id and the modality of each stage. `EG-DURABLE-KERNEL-R042.2` measures the latency. | `tests/uql_single_plan_all_modalities.rs::five_stage_kinds_one_plan` passes through the served path. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R721 Modalities are views over one RowSet algebra in one store (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Modalities are views over one RowSet algebra in one store (rollup).** Graph, vector, SQL, RDF with OWL, time series, KV and blob data must each adapt to the `RowSet` algebra. The one planner in `crates/eg-plan` must plan every modality. Each modality must keep its durable authority in a registered redb store. Children `.1` to `.4` deliver it. | Each child requirement has its own verification. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R721.1 Each modality implements the modality contract Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Each modality implements the modality contract.** Each of the seven modalities must implement `ModalityContract` of `crates/eg-modality/src/contract.rs:232`. Its `to_rowset` must give the row that a value contributes. | `crates/eg-modality/tests/rowset_views.rs::seven_modalities_implement_contract` lists the seven modalities and finds one implementation each. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R721.2 Wiring and store authority Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring and store authority.** The plan executor must fold each modality output into a `RowSet` through `RowSet::from_rows` at `crates/eg-plan/src/rowset.rs:146`. The registry of `EG-DURABLE-KERNEL-R055` must map each modality to a redb store. A derived projection may exist only when the committed stream feeds it. | A registry test maps each modality to one registered redb store. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R721.3 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** A query that names an unregistered modality must refuse with `UQL_E_UNKNOWN_MODALITY`. | A parser test asserts the code and no plan. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R721.4 Hot-path proof: cross-modal queries with default configuration Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof: cross-modal queries with default configuration.** A fresh engine with default configuration must answer a cross-modal query after ingest. The query must need no per-tenant setup, extension load or index build command. Ingest must build the indexes that the query reads. | `tests/advanced_crossmodal_roundtrip.rs::fresh_engine_answers_cross_modal_query` starts a fresh engine, ingests a fixture and runs a graph, vector and SQL query. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R722 Connector data resources register as virtual-graph sources at pack import (rollup) Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Connector data resources register as virtual-graph sources at pack import (rollup).** The pack contract of `EG-TYPED-PACKS-R101` and `SDK-CONNECTOR-CONTROL-R074` declares each data resource with its ontology class, access method and pagination. Import registers one `vg:SourceConnection` and one `vg:VirtualMapping` per resource, and one typed foreign source per `EG-FEDERATED-QUERY-R073`. A mapping serves reads only after admission approves it (`ARBORA-FLEET-R042`). Queries resolve through the active contract version of `EG-TYPED-PACKS-R107`. UQL and NL queries then answer from native facts and these sources together. Each read records usage and freshness on the catalog asset of `EG-TYPED-PACKS-R106`. The engine reads the source at query time and copies nothing. A declared materialisation policy of `EG-CQ-CONN-R067.6` is the only exception. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R722.1 Model Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Model.** Add `PackSourceRegistration{connector, contract_iri, resource_uri, source_kind, approval, class_iri}` in `crates/eg-types/src/connector_pack.rs`. `source_kind` maps `mcp_tool`, `http_endpoint`, `graphql_query`, `a2a_skill` and `virtual_graph` to the `ForeignSourceSpec` kinds of `EG-FEDERATED-QUERY-R073.1` and `EG-UNIFIED-DATA-PLANE-R037`. `approval` is `held` or `approved`. | `crates/eg-types/tests/pack_source.rs::access_kinds_map_to_foreign_source_kinds`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R722.2 Behavior Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Behavior.** Import registers each declared resource as a held source and mapping. An `approved` mapping serves reads and a `held` one serves none. A re-import with an unchanged contract digest changes nothing. A changed contract replaces the mapping and returns it to `held`. The planner pushes down only the pagination and key filters the contract declares. The exact local residual filter always stays. | `crates/eg-plan/tests/pack_source.rs::held_serves_none_approved_serves_rows_and_changed_contract_returns_to_held`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R722.3 Wiring Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Wiring.** Registration calls `ForeignSourceCatalog::register` (`src/server/foreign_catalog.rs:133`) from `project` (`src/server/connector_pack_projection.rs:228`). Reads go through `foreign_scan` (`crates/eg-plan/src/federation_opt/run.rs:26`). The approval call is a served engine method that arbora invokes. Nothing else registers a pack source. | `tests/federated/test_pack_source_served.py::test_import_registers_through_the_one_catalog`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R722.4 Refusal Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Refusal.** Import refuses a contract that names a literal secret with `CONTRACT_SECRET`. The outbound guard refuses a source whose target is a forbidden destination. A query over a `held` mapping returns `SOURCE_HELD` and names the mapping. A source that is down returns `SOURCE_UNAVAILABLE` with the native rows still answered and the gap flagged. | `tests/federated/test_pack_source_served.py::test_secret_guard_held_and_unavailable_refuse_with_named_codes`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R722.5 Evidence Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Evidence.** Each answer row from a pack source carries the connector, the contract IRI, the mapping IRI and the fetch time. The read records one usage count and a freshness age on the catalog asset. A store audit shows zero source rows written for a non-materialised source. | `tests/federated/test_pack_source_served.py::test_rows_carry_contract_provenance_and_nothing_is_copied`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FEDERATED-QUERY-R722.6 Hot-path proof Definition — EG-FEDERATED-QUERY / EG-FEDERATED-QUERY — Federated query, search, and reasoningCanonical requirement and verification source**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method, then the served UQL method. A fixture connector with a mock operation backs one data resource. The test approves the mapping, then runs a UQL query that joins a native fact to the connector rows. It counts source rows in the store. | `tests/federated/test_pack_source_served.py::test_uql_joins_native_fact_to_live_connector_rows_with_zero_copy`. | requirement | EG-FEDERATED-QUERY | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidence | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R001 Cross-host BacktestRun digest and Pine parity for finance-core Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Cross-host BacktestRun digest and Pine parity for finance-core.** The BacktestRun content digest is canonical across supported host architectures by normalizing serialization, floating-point and timestamp inputs before hashing. A Pine companion script for the SuperTrend and ATR kernels produces the same signal transitions as the Rust implementation from a shared checked-in bar fixture and parameter version, and finance-specific classes are folded into one finance-v1 ontology with duplicate class definitions removed. | Independent builds on two architectures are compared for equal digests, and a parity fixture test asserts the Pine and Rust implementations produce identical signal transitions. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 0374378eb9db ae7b0d664749 crates/eg-compute/src/finance/market/record_tests.rs:405 src/server/graph_schema/finance_tests.rs:139 |
| EG-FINANCE-PRIMITIVES-R002 Rehome generic finance evaluation kernels into eg-numeric Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Rehome generic finance evaluation kernels into eg-numeric.** Rolling z-score, EWMA, information coefficient and ratio, effective sample size, Diebold-Mariano, deflated Sharpe, purged combinatorial cross-validation, probability of backtest overfitting, Brier, Kalman, Ornstein-Uhlenbeck, ADF and regime HMM calculations are owned by eg-numeric evaluation and calibration modules and are callable as UQL time-series functions. Finance-specific method wrappers are removed or remain only as thin documented aliases over the shared kernels, with callers migrated to the generic surface and generated method counts reconciled in one change. A regime derivation that requires an unbounded prefix refit declares a bound or refuses with a typed state-budget error rather than reporting an unverified result. Children R002.1 through R002.10 retain this entire contract and add causal, adaptive state-space filtering. | Unit tests cover each relocated kernel. A method-count reconciliation confirms that the generated inventory matches client bindings with no duplicate implementation. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | 0374378eb9db 31cbdeb6d98b crates/eg-numeric/src/evaluation/backtest.rs:193 crates/eg-numeric/src/evaluation/backtest.rs:204 crates/eg-numeric/src/evaluation/skill.rs:237 |
| EG-FINANCE-PRIMITIVES-R002.1 Complete the original shared-kernel inventory Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Complete the original shared-kernel inventory.** Rollup: every child below is required; the original acceptance remains mandatory. Model: the original kernel inventory remains mandatory. Behavior: eg-numeric owns rolling z-score, EWMA, information coefficient, information ratio and effective sample size. It also owns Diebold-Mariano, deflated Sharpe, purged combinatorial cross-validation, probability of backtest overfitting, Brier, Kalman, Ornstein-Uhlenbeck, ADF and regime HMM. Wiring: reuse `crates/eg-numeric/src/series/` and `crates/eg-numeric/src/evaluation/`; migrate remaining finance implementations. Refusal: invalid inputs produce typed outcomes; duplicate implementations fail qualification. Evidence: independent vectors cover every listed kernel. | Proposed test: `tests/test_finance_shared_kernel_inventory.py::test_complete_kernel_inventory`. Compare each relocated kernel with independent vectors, including malformed and short inputs. Preserve every original R002 unit-test obligation. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.1 Rolling z-score shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Rolling z-score shared kernel.** Model: The Rolling z-score inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/series/kernel.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/series/kernel.rs::tests::rolling_z_score_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.2 EWMA shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**EWMA shared kernel.** Model: The EWMA inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/series/kernel.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/series/kernel.rs::tests::ewma_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.3 Information coefficient shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Information coefficient shared kernel.** Model: The Information coefficient inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::information_coefficient_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.4 Information ratio shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Information ratio shared kernel.** Model: The Information ratio inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::information_ratio_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.5 Effective sample size shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Effective sample size shared kernel.** Model: The Effective sample size inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::effective_sample_size_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.6 Diebold-Mariano shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Diebold-Mariano shared kernel.** Model: The Diebold-Mariano inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::diebold_mariano_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.7 Deflated Sharpe shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Deflated Sharpe shared kernel.** Model: The Deflated Sharpe inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/backtest.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/backtest.rs::tests::deflated_sharpe_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.8 Purged combinatorial cross-validation shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Purged combinatorial cross-validation shared kernel.** Model: The Purged combinatorial cross-validation inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/backtest.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/backtest.rs::tests::purged_cv_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.9 Probability of backtest overfitting shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Probability of backtest overfitting shared kernel.** Model: The Probability of backtest overfitting inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/backtest.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/backtest.rs::tests::pbo_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.10 Brier shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Brier shared kernel.** Model: The Brier inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/skill.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/skill.rs::tests::brier_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.11 Kalman shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Kalman shared kernel.** Model: The Kalman inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::kalman_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.12 Ornstein-Uhlenbeck shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Ornstein-Uhlenbeck shared kernel.** Model: The Ornstein-Uhlenbeck inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/mod.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/mod.rs::tests::ou_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.13 ADF shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**ADF shared kernel.** Model: The ADF inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/mod.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/mod.rs::tests::adf_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.1.14 Regime HMM shared kernel Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Regime HMM shared kernel.** Model: The Regime HMM inputs and numeric policy retain their original meaning. Behavior: The shared authority computes only this kernel. Reuse an existing implementation when present. Wiring: Extend `crates/eg-numeric/src/evaluation/mod.rs`; caller migration belongs to R002.2. Refusal: Malformed, nonfinite and insufficient inputs produce typed outcomes. Evidence: Independent fixed vectors match this kernel and its declared precision. | Proposed test: `crates/eg-numeric/src/evaluation/mod.rs::tests::regime_hmm_independent_vectors`. Independent fixed vectors match this kernel and its declared precision. Malformed and short vectors refuse; a duplicate authority fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2 Migrate callers and preserve generic time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Migrate callers and preserve generic time-series exposure.** Rollup: every child below is required; the original acceptance remains mandatory. Model: one generic operation owns each original kernel. Behavior: finance wrappers are removed or documented thin aliases. All callers migrate to the generic surface. Wiring: `src/server/handlers/finance/route_families.rs:576` and the existing series execution path call shared kernels. Every original kernel remains callable as a UQL time-series function. Refusal: unknown aliases and incompatible precision refuse. Evidence: real generic, retained-alias and UQL requests agree. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_generic_alias_and_uql_equivalence`. Test every R002 kernel through its served route. Detect duplicate implementations and precision drift. Missing textual exposure remains an explicit prerequisite under the query hold. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1 Generic caller migration rollup Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Generic caller migration rollup.** Model: Fourteen kernel-specific children retain every original kernel. Behavior: Each caller uses the shared numerical authority. Wiring: Reuse `crates/eg-compute/src/finance/`. Each child names its proving entry. Refusal: Any missing kernel or uncovered caller prevents completion. Evidence: Every kernel-specific child passes its served positive and negative cases. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_generic_inventory`. Every kernel-specific child passes its served positive and negative cases. One passing kernel cannot satisfy this rollup. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.1 Rolling z-score generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Rolling z-score generic caller migration.** Model: One Rolling z-score caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/signals.rs` and the R002.1.1 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_rolling_z_score_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.2 EWMA generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**EWMA generic caller migration.** Model: One EWMA caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/signals.rs` and the R002.1.2 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ewma_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.3 Information coefficient generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Information coefficient generic caller migration.** Model: One Information coefficient caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.3 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_coefficient_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.4 Information ratio generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Information ratio generic caller migration.** Model: One Information ratio caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.4 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_ratio_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.5 Effective sample size generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Effective sample size generic caller migration.** Model: One Effective sample size caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.5 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_effective_sample_size_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.6 Diebold-Mariano generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Diebold-Mariano generic caller migration.** Model: One Diebold-Mariano caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.6 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_diebold_mariano_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.7 Deflated Sharpe generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Deflated Sharpe generic caller migration.** Model: One Deflated Sharpe caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.7 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_deflated_sharpe_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.8 Purged combinatorial cross-validation generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Purged combinatorial cross-validation generic caller migration.** Model: One Purged combinatorial cross-validation caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.8 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_purged_cv_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.9 Probability of backtest overfitting generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Probability of backtest overfitting generic caller migration.** Model: One Probability of backtest overfitting caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.9 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_pbo_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.10 Brier generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Brier generic caller migration.** Model: One Brier caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/quant/validation.rs` and the R002.1.10 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_brier_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.11 Kalman generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Kalman generic caller migration.** Model: One Kalman caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/statespace.rs` and the R002.1.11 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_kalman_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.12 Ornstein-Uhlenbeck generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Ornstein-Uhlenbeck generic caller migration.** Model: One Ornstein-Uhlenbeck caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/statespace.rs` and the R002.1.12 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ou_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.13 ADF generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**ADF generic caller migration.** Model: One ADF caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/statespace.rs` and the R002.1.13 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_adf_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.1.14 Regime HMM generic caller migration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Regime HMM generic caller migration.** Model: One Regime HMM caller boundary consumes its shared contract. Behavior: Repoint this kernel's compute caller to the shared authority. Preserve numeric policy and typed outcomes. Wiring: Use `crates/eg-compute/src/finance/regime.rs` and the R002.1.14 authority. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real generic request reaches this caller and matches its independent vectors. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_regime_hmm_generic_caller`. A real generic request reaches this caller and matches its independent vectors. Short inputs and incompatible precision refuse without producing a fabricated result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2 Finance alias compatibility rollup Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Finance alias compatibility rollup.** Model: Fourteen kernel-specific children retain every original kernel. Behavior: Each retained method is a documented thin alias; removed methods follow the declared compatibility contract. Wiring: Reuse `src/server/handlers/finance/route_families.rs`. Each child names its proving entry. Refusal: Any missing kernel or uncovered caller prevents completion. Evidence: Every kernel-specific child passes its served positive and negative cases. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_alias_inventory`. Every kernel-specific child passes its served positive and negative cases. One passing kernel cannot satisfy this rollup. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.1 Rolling z-score finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Rolling z-score finance alias compatibility.** Model: One Rolling z-score caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_rolling_z_score_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.2 EWMA finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**EWMA finance alias compatibility.** Model: One EWMA caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ewma_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.3 Information coefficient finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Information coefficient finance alias compatibility.** Model: One Information coefficient caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_coefficient_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.4 Information ratio finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Information ratio finance alias compatibility.** Model: One Information ratio caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_ratio_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.5 Effective sample size finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Effective sample size finance alias compatibility.** Model: One Effective sample size caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_effective_sample_size_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.6 Diebold-Mariano finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Diebold-Mariano finance alias compatibility.** Model: One Diebold-Mariano caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_diebold_mariano_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.7 Deflated Sharpe finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Deflated Sharpe finance alias compatibility.** Model: One Deflated Sharpe caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_deflated_sharpe_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.8 Purged combinatorial cross-validation finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Purged combinatorial cross-validation finance alias compatibility.** Model: One Purged combinatorial cross-validation caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_purged_cv_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.9 Probability of backtest overfitting finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Probability of backtest overfitting finance alias compatibility.** Model: One Probability of backtest overfitting caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_pbo_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.10 Brier finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Brier finance alias compatibility.** Model: One Brier caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_brier_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.11 Kalman finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Kalman finance alias compatibility.** Model: One Kalman caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_kalman_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.12 Ornstein-Uhlenbeck finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Ornstein-Uhlenbeck finance alias compatibility.** Model: One Ornstein-Uhlenbeck caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ou_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.13 ADF finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**ADF finance alias compatibility.** Model: One ADF caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_adf_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.2.14 Regime HMM finance alias compatibility Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Regime HMM finance alias compatibility.** Model: One Regime HMM caller boundary consumes its shared contract. Behavior: Remove this wrapper or keep only a documented call to its generic owner. Preserve admitted compatibility. Wiring: Use `src/server/handlers/finance/route_families.rs:576` through its existing finance dispatch. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: Real generic and retained-alias requests agree in values, precision and typed outcomes. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_regime_hmm_alias`. Real generic and retained-alias requests agree in values, precision and typed outcomes. An unknown alias refuses; a second implementation fails qualification. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3 UQL time-series exposure rollup Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**UQL time-series exposure rollup.** Model: Fourteen kernel-specific children retain every original kernel. Behavior: Each kernel remains callable through the served UQL time-series path. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs`. Each child names its proving entry. Refusal: Any missing kernel or uncovered caller prevents completion. Evidence: Every kernel-specific child passes its served positive and negative cases. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_uql_inventory`. Every kernel-specific child passes its served positive and negative cases. One passing kernel cannot satisfy this rollup. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.1 Rolling z-score uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Rolling z-score uql time-series exposure.** Model: One Rolling z-score caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_rolling_z_score_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.2 EWMA uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**EWMA uql time-series exposure.** Model: One EWMA caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ewma_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.3 Information coefficient uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Information coefficient uql time-series exposure.** Model: One Information coefficient caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_coefficient_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.4 Information ratio uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Information ratio uql time-series exposure.** Model: One Information ratio caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_information_ratio_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.5 Effective sample size uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Effective sample size uql time-series exposure.** Model: One Effective sample size caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_effective_sample_size_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.6 Diebold-Mariano uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Diebold-Mariano uql time-series exposure.** Model: One Diebold-Mariano caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_diebold_mariano_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.7 Deflated Sharpe uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Deflated Sharpe uql time-series exposure.** Model: One Deflated Sharpe caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_deflated_sharpe_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.8 Purged combinatorial cross-validation uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Purged combinatorial cross-validation uql time-series exposure.** Model: One Purged combinatorial cross-validation caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_purged_cv_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.9 Probability of backtest overfitting uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Probability of backtest overfitting uql time-series exposure.** Model: One Probability of backtest overfitting caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_pbo_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.10 Brier uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Brier uql time-series exposure.** Model: One Brier caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_brier_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.11 Kalman uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Kalman uql time-series exposure.** Model: One Kalman caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_kalman_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.12 Ornstein-Uhlenbeck uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Ornstein-Uhlenbeck uql time-series exposure.** Model: One Ornstein-Uhlenbeck caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_ou_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.13 ADF uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**ADF uql time-series exposure.** Model: One ADF caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_adf_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.3.14 Regime HMM uql time-series exposure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Regime HMM uql time-series exposure.** Model: One Regime HMM caller boundary consumes its shared contract. Behavior: The series operation invokes its shared kernel. Textual admission is a prerequisite owned by the held query lane. Wiring: Reuse `crates/eg-tsdb/src/derive/mod.rs` and `crates/eg-plan/src/exec/derive.rs:21`. Refusal: No silent fallback or duplicate numerical authority is permitted. Evidence: A real UQL request reaches the shared kernel and matches independent vectors through readback. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_regime_hmm_uql`. A real UQL request reaches the shared kernel and matches independent vectors through readback. Invalid arguments and incompatible precision refuse; absent textual admission leaves this obligation unfulfilled. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.2.4 Complete caller coverage check Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Complete caller coverage check.** Model: A versioned census maps every original kernel caller and alias to its migration child. Behavior: Compare the full reference census with the child coverage. Add explicit children for any remaining independent caller before completion. Wiring: The proposed `tests/test_finance_shared_kernel_routes.py` check inspects production references and corresponding served receipts. Refusal: An unmapped, unmigrated or duplicate caller fails qualification. Evidence: Every discovered caller has a named child and observed use of the generic authority. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_complete_caller_coverage`. Every discovered caller has a named child and observed use of the generic authority. Removing a census entry or leaving an old implementation must fail. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.3 Reconcile generated methods and client bindings Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Reconcile generated methods and client bindings.** Model: Rust descriptors remain the method authority. Behavior: reconcile counts, schemas and all generated client bindings in the caller-migration change. Wiring: `crates/eg-capabilities/src/bin/gen_contract.rs` generates the projections. Refusal: stale, missing or duplicated bindings fail qualification. Evidence: compare method identities as well as counts. | Proposed test: `tests/test_finance_shared_kernel_routes.py::test_generated_method_identity_reconciliation`. Regenerate and compare the full identity set. A same-count substitution and a stale client must fail. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.4 Bound original regime derivations and streaming work Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Bound original regime derivations and streaming work.** Model: explicit limits cover dimensions, retained observations, checkpoint bytes, update work and replay work. Behavior: bound every prefix refit before allocation. Wiring: extend `crates/eg-tsdb/src/derive/maintain.rs` and shared numerical admission. Refusal: exhausted limits return typed state-budget or work-budget outcomes. No uncomputed result appears as complete. Evidence: exact-limit and limit-plus-one tests include original regime HMM and new filters. | Proposed test: `crates/eg-tsdb/src/derive/maintain_tests.rs::state_space_resource_bounds`. Compare reported consumption with observed allocations and updates. A rejected update preserves the previous checkpoint. Existing bounded partial progress must expose its cursor and lag. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.5 Define versioned state-space inputs and checkpoints Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Define versioned state-space inputs and checkpoints.** Model: observations carry sequence, event time, known-at time, source revision and typed finite vectors. State includes mean, covariance, cursor, model revision and kernel revision. Behavior: validate dimensions, units, ordering, noise assumptions and all budgets before updating. Wiring: `crates/eg-types/src/series_expr.rs` owns public carriers consumed by eg-numeric. Refusal: conflicting retries, unsupported revisions and invalid covariance refuse without state changes. Evidence: model and checkpoint round trips preserve all fields. | Proposed test: `crates/eg-types/src/series_expr.rs::tests::state_space_model_and_refusals`. Exercise all four models, exact retries, conflicting retries, nonfinite values, dimension errors and invalid covariance. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.6 Apply causal predict-update filtering to four state models Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Apply causal predict-update filtering to four state models.** Rollup: every child below is required; the original acceptance remains mandatory. Model: explicit profiles cover volatility regime, mean-reversion strength, hedge ratio and time-varying factor sensitivity. Behavior: perform the recurrence and initialization defined in plan.md once per ordered observation. State the conditions for optimal linear gain. Wiring: extend `crates/eg-numeric/src/series/kalman.rs`; all profiles share its recurrence. Refusal: invalid transforms and singular innovation covariance refuse. Evidence: independent numerical oracles cover each profile and causal prefix replay. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::four_models_match_independent_oracles`. Compare prior, innovation, gain, posterior and covariance at every step. Future observations must never change an earlier prefix result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.6.1 Shared causal linear recurrence Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Shared causal linear recurrence.** Model: Versioned prior, observation and mutually uncorrelated process/measurement noises define one update. Behavior: Apply the plan recurrence and Joseph covariance once per observation. Preserve causal prefix replay. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs`; R002.5 carriers are a prerequisite. Refusal: Singular innovation covariance and unsupported correlated-noise declarations refuse before state changes. Evidence: The existing scalar rational vectors match every intermediate and checkpoint. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::causal_linear_recurrence_and_noise_refusal`. The existing scalar rational vectors match every intermediate and checkpoint. The Q=1, R=4, cross-covariance=1 declaration refuses; it must not return the independent-noise gain. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.6.2 Volatility regime profile Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Volatility regime profile.** Model: Log variance uses random-walk dynamics and the declared log-return transform. Behavior: Emit latent variance and configured bands after the declared prior or causal warmup. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs` after R002.5 and R002.6.1. Refusal: Invalid profile inputs preserve the prior checkpoint. Evidence: Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Zero returns without an admitted floor and invalid transform revisions refuse. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::volatility_profile_oracle`. Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Zero returns without an admitted floor and invalid transform revisions refuse. Zero returns without an admitted floor and invalid transform revisions refuse. Future observations cannot alter earlier prefix results. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.6.3 Mean-reversion strength profile Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Mean-reversion strength profile.** Model: The varying phi profile binds dt and centering revision. Behavior: Apply the shared recurrence and emit theta only for 0 < phi < 1. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs` after R002.5 and R002.6.1. Refusal: Invalid profile inputs preserve the prior checkpoint. Evidence: Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Other phi values produce the typed non-reverting outcome; invalid dt refuses. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::mean_reversion_profile_oracle`. Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Other phi values produce the typed non-reverting outcome; invalid dt refuses. Other phi values produce the typed non-reverting outcome; invalid dt refuses. Future observations cannot alter earlier prefix results. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.6.4 Hedge ratio profile Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Hedge ratio profile.** Model: The state contains intercept and hedge coefficient with H = [1, hedge_input]. Behavior: Apply the shared recurrence to one aligned pair and preserve units and hedge direction. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs` after R002.5 and R002.6.1. Refusal: Invalid profile inputs preserve the prior checkpoint. Evidence: Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Misaligned pairs and incompatible units refuse. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::hedge_profile_oracle`. Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Misaligned pairs and incompatible units refuse. Misaligned pairs and incompatible units refuse. Future observations cannot alter earlier prefix results. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.6.5 Time-varying factor sensitivity profile Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Time-varying factor sensitivity profile.** Model: Ordered coefficients bind factor identities and source timestamps. Behavior: Apply the shared recurrence to contemporaneously available factor returns. Wiring: Extend `crates/eg-numeric/src/series/kalman.rs` after R002.5 and R002.6.1. Refusal: Invalid profile inputs preserve the prior checkpoint. Evidence: Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Unequal factor arrays, changed ordering and future factor observations refuse. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::factor_profile_oracle`. Independent seeded vectors match every prior, innovation, gain, posterior and covariance. Unequal factor arrays, changed ordering and future factor observations refuse. Unequal factor arrays, changed ordering and future factor observations refuse. Future observations cannot alter earlier prefix results. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.7 Detect innovation shifts and retune within fixed bounds Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Detect innovation shifts and retune within fixed bounds.** Model: versioned windows, thresholds, confirmation count, cooldown and retuning clamps follow plan.md. Behavior: detect persistent innovation-variance shifts and publish the parameter revision effective on the next observation. Wiring: extend the shared eg-numeric filter state. Refusal: invalid windows, unavailable warmup and retuning-budget exhaustion produce typed outcomes. Evidence: stable, shifted and isolated-outlier sequences identify exact trigger indices. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::bounded_innovation_retuning`. Compare window statistics, clamp results, cooldown and revision timing with an independent seeded oracle. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.8 Bound nonlinear approximation and robust tail influence Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Bound nonlinear approximation and robust tail influence.** Model: registered differentiable transition and observation profiles declare Jacobians, domains and approximation revisions. Behavior: linearize once, then apply the bounded robust gain from plan.md. Wiring: extend the existing eg-numeric numerical authority. Refusal: unsupported models, invalid derivatives and nonfinite results refuse. Evidence: linear reduction, nonlinear goldens and extreme innovations cover covariance and bounded influence. No universal optimality claim applies. | Proposed test: `crates/eg-numeric/src/series/kalman.rs::tests::nonlinear_robust_gain`. Use the specified nonlinear profile, both residual signs and seeded heavy-tail vectors. Compare Joseph covariance and bounded corrections with an independent oracle. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.9 Wire versioned filtering through served series operations Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Wire versioned filtering through served series operations.** Model: results expose revisions, cursor, state, covariance, innovation, gain, tail weight, retuning and consumed budgets. Behavior: reuse the existing authorized series and structured-query routes. Wiring: `src/server/handlers/timeseries.rs:367` reaches `derived::maintain_after_append`; `src/server/handlers/query/sql_read.rs:305` handles structured queries. Both reach eg-tsdb and shared eg-numeric kernels. Refusal: unavailable schema support, scope denial and stale checkpoints return typed outcomes. Evidence: authenticated requests reach these production call sites. | Proposed test: `tests/test_finance_state_space_served.py::test_served_filter_wiring`. A real server receives append and structured-query requests. Readback exposes every required diagnostic and revision. Invalid requests must preserve prior derived state. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.10 Prove filtering on the production hot paths Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Prove filtering on the production hot paths.** Model: fixtures pin source, model, schema, kernel and seed identities. Behavior: qualify streaming, chunked and restart replay through the real server. Wiring: `src/server/handlers/timeseries/derived.rs:222` commits derived points and checkpoints; served range queries read them back. Refusal: invalid-input, scope, revision and budget cases must remain observable. Evidence: execute the complete numerical and served matrix in test-spec.md. Helper-only tests cannot satisfy this row. | Proposed test: `tests/test_finance_state_space_served.py::test_stream_restart_refusals_and_hot_path_receipts`. Record exact head, feature set, entry methods, exercised production call sites, request IDs and readback digests. Require all original residual children too. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R003 Compute PBO from a BacktestRun's own CSCV splits Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Compute PBO from a BacktestRun's own CSCV splits.** Probability of backtest overfitting is computed from a BacktestRun's own combinatorial symmetric cross-validation splits rather than a separate caller-supplied summary of performance rows. For each split the implementation selects the top in-sample candidate by a deterministic tie rule, ranks its out-of-sample performance against all candidates, and counts it as overfit only when strictly below the exact median, treating equality to the median as not overfit. | A skilled-strategy fixture and an overfit-strategy fixture each assert the expected PBO value computed directly from the record's own split matrix. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 458eb5bb9475 69979c407216 72c7dfa478ba crates/eg-compute/src/finance/market/record_tests.rs:446 |
| EG-FINANCE-PRIMITIVES-R004 finance-v1 asset, account, and strategy record types Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**finance-v1 asset, account, and strategy record types.** finance-v1 defines validated asset classes for equity, ETF, fund, index, FX pair, commodity spot and future with contract spec, crypto, real-estate holding, and cash, along with Account, Activity, Lot, Position, PortfolioGroup with Basic and Holdings views, StrategySpec, StrategyRun, and LeverageTerms record types. Delivered as child requirements, one per code root, producer first: `EG-FINANCE-PRIMITIVES-R004.1` (ontology/SHACL asset-class vocabulary), `.2` (the Rust record types), `.3` (server wiring and contract regeneration). Every child must satisfy its acceptance before this parent is complete. | Ontology and SHACL schema validation tests confirm each record type enforces its required fields, links, and controlled vocabulary. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | 0ae2193fae8d |
| EG-FINANCE-PRIMITIVES-R004.1 finance-v1 asset-class controlled vocabulary Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**finance-v1 asset-class controlled vocabulary.** The `:assetClass` SHACL shape accepts the canonical `equity`, `etf`, `fund`, `index`, `fx_pair`, `commodity_spot`, `commodity_future`, `crypto`, `real_estate` and `cash` values, plus the deprecated migration aliases `stock`, `forex` and `commodity` preserved from the prior vocabulary. Code root: `crates/eg-core/ontology/finance-v1.ttl` and `finance-v1.shapes.ttl`. | SHACL validation tests assert every canonical and legacy alias value conforms and an unlisted value (for example `bond`) is refused. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 0ae2193fae8d src/server/graph_schema/finance_tests.rs:299 |
| EG-FINANCE-PRIMITIVES-R004.2 finance-v1 Account/Activity/Lot/Position/PortfolioGroup/StrategySpec/StrategyRun/LeverageTerms Rust record types Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**finance-v1 Account/Activity/Lot/Position/PortfolioGroup/StrategySpec/StrategyRun/LeverageTerms Rust record types.** Delivered as child requirements, one per record-type group, producer first: `EG-FINANCE-PRIMITIVES-R004.2.1` (the `Account` and `Position` OWL classes and SHACL shapes), `.2.2` (`Activity` and `Lot`), `.2.3` (`PortfolioGroup`), `.2.4` (`StrategySpec`), `.2.5` (`StrategyRun`) and `.2.6` (`LeverageTerms`). Every child must satisfy its acceptance before this parent is complete. | Ontology and SHACL schema validation tests confirm each record type enforces its required fields, links, and controlled vocabulary. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | a189dbe4067f fd0aa73cb7b5 |
| EG-FINANCE-PRIMITIVES-R004.2.1 Account and Position OWL classes and SHACL shapes Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Account and Position OWL classes and SHACL shapes.** finance-v1 defines `:Account` (a portfolio owner's brokerage/custodial account: `accountId`, `baseCurrency`, closed-vocabulary `accountKind`) and `:Position` (an account's signed holding of one instrument under one cost-basis method: `positionAccount`, `positionInstrument`, `positionQuantity`, closed-vocabulary `costBasisMethod`), distinct from the pre-existing exchange-execution `:PortfolioPosition`. Code root: `crates/eg-core/ontology/finance-v1.ttl` and `finance-v1.shapes.ttl`. | SHACL validation tests assert required fields/links are enforced and each closed vocabulary (`accountKind`, `costBasisMethod`) refuses an unlisted value. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | 1d12fc4e1fff 994ffe8ffa60 a189dbe4067f fd0aa73cb7b5 src/server/graph_schema/finance_tests.rs:230 src/server/graph_schema/finance_tests.rs:260 src/server/graph_schema/finance_tests.rs:45 |
| EG-FINANCE-PRIMITIVES-R004.2.2 Activity and Lot OWL classes and SHACL shapes Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Activity and Lot OWL classes and SHACL shapes.** finance-v1 defines `:Activity` (a point-in-time ledger event against a position: buy, sell, dividend, transfer, split, fee) and `:Lot` (one FIFO/LIFO/specific-lot cost-basis parcel opened by an acquiring activity). Code root: `crates/eg-core/ontology/finance-v1.ttl` and `finance-v1.shapes.ttl`. | SHACL validation tests assert required fields/links are enforced and each closed vocabulary value is checked. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | 1d12fc4e1fff 994ffe8ffa60 a189dbe4067f fd0aa73cb7b5 src/server/graph_schema/finance_tests.rs:230 src/server/graph_schema/finance_tests.rs:260 src/server/graph_schema/finance_tests.rs:45 |
| EG-FINANCE-PRIMITIVES-R004.2.1.1 Account/Position complete shape acceptance Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Account/Position complete shape acceptance.** Run the full required-field and vocabulary matrix against the existing finance SHACL module. Source: `crates/eg-core/ontology/finance-v1.shapes.ttl; src/server/graph_schema/finance_tests.rs`. | Omit each required field independently: accountId, baseCurrency, positionAccount, positionInstrument and positionQuantity. Every omission must refuse. Each IRI link must refuse literal values. Wrong datatypes and duplicate singleton fields refuse. Accept every declared value of accountKind and costBasisMethod; refuse unknown values. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::account_position_complete_schema_matrix (intended test)`. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.2.2.1 Activity/Lot complete shape acceptance Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Activity/Lot complete shape acceptance.** Run the full required-field and vocabulary matrix against the existing finance SHACL module. Source: `crates/eg-core/ontology/finance-v1.shapes.ttl; src/server/graph_schema/finance_tests.rs`. | Omit each required field independently: activityPosition, activityKind, activityQuantity, activityTradeDate, lotPosition, lotOpenedBy, lotQuantity and lotUnitCostBasis. Every omission must refuse. Each IRI link must refuse literal values. Wrong datatypes and duplicate singleton fields refuse. Accept every declared value of activityKind; refuse unknown values. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::activity_lot_complete_schema_matrix (intended test)`. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.2.3 PortfolioGroup ontology and shapes Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**PortfolioGroup ontology and shapes.** Declare `PortfolioGroup` in the existing finance module. Define its SHACL fields and links from the existing versioned record contract. Reuse shared vocabulary. Source: `crates/eg-core/ontology/finance-v1.ttl; crates/eg-core/ontology/finance-v1.shapes.ttl`. | Native SHACL tests accept a valid record. Missing required fields, invalid links, and unknown closed-vocabulary values refuse. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::portfolio_group_schema_acceptance (intended test)`. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.2.4 StrategySpec ontology and shapes Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**StrategySpec ontology and shapes.** Declare `StrategySpec` in the existing finance module. Define its SHACL fields and links from the existing versioned record contract. Reuse shared vocabulary. Source: `crates/eg-core/ontology/finance-v1.ttl; crates/eg-core/ontology/finance-v1.shapes.ttl`. | Native SHACL tests accept a valid record. Missing required fields, invalid links, and unknown closed-vocabulary values refuse. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::strategy_spec_schema_acceptance (intended test)`. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.2.5 StrategyRun ontology and shapes Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**StrategyRun ontology and shapes.** Declare `StrategyRun` in the existing finance module. Define its SHACL fields and links from the existing versioned record contract. Reuse shared vocabulary. Source: `crates/eg-core/ontology/finance-v1.ttl; crates/eg-core/ontology/finance-v1.shapes.ttl`. | Native SHACL tests accept a valid record. Missing required fields, invalid links, and unknown closed-vocabulary values refuse. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::strategy_run_schema_acceptance (intended test)`. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.2.6 LeverageTerms ontology and shapes Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**LeverageTerms ontology and shapes.** Declare `LeverageTerms` in the existing finance module. Define its SHACL fields and links from the existing versioned record contract. Reuse shared vocabulary. Source: `crates/eg-core/ontology/finance-v1.ttl; crates/eg-core/ontology/finance-v1.shapes.ttl`. | Native SHACL tests accept a valid record. Missing required fields, invalid links, and unknown closed-vocabulary values refuse. Intended test: `src/server/graph_schema/finance_tests.rs::shapes::leverage_terms_schema_acceptance (intended test)`. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3 finance-v1 record-type server wiring and contract regeneration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**finance-v1 record-type server wiring and contract regeneration.** The R004.2 record types are wired into server handlers and the generated contract/client surfaces are regenerated to carry them. Split per the dependency-first sizing rule: `EG-FINANCE-PRIMITIVES-R004.3.1` (the wire-boundary schema-version gate) and further children for the served method registration and generated-client contract regeneration. Code root: `src/server/`, `contract/`, generated clients. | A handler test reads/writes each record type through its entry point, and the contract-freshness check passes with the regenerated artifacts committed. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | fcca865a0505 fd0aa73cb7b5 |
| EG-FINANCE-PRIMITIVES-R004.3.1 The wire boundary refuses an unknown finance-v1 schema version Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**The wire boundary refuses an unknown finance-v1 schema version.** `admit_finance_record_version` accepts only the current `finance-v1` declared schema version at the wire boundary, refusing an unknown or empty one rather than silently accepting it or guessing a migration. Code root: `crates/eg-types/src/wire_finance.rs`. | Unit tests assert the current schema version is admitted and an unknown or empty declared version is refused. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 69979c407216 fcca865a0505 crates/eg-types/src/wire_finance.rs:80 crates/eg-types/src/wire_finance.rs:86 crates/eg-types/src/wire_finance.rs:93 |
| EG-FINANCE-PRIMITIVES-R004.3.2 Served record registration and round trips Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Served record registration and round trips.** Rollup of record-specific handler acceptance below. The server must preserve the R004.3 read/write and schema-version acceptance. Intended source: `src/server/handlers/finance.rs`. | Each record-specific child passes through a served entry point. A typed schema gate alone does not satisfy handler acceptance. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.2.1 Account served entry point Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Account served entry point.** The server must register the `Account` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::account_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `Account` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.2.2 Activity served entry point Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Activity served entry point.** The server must register the `Activity` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::activity_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `Activity` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.2.3 Lot served entry point Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Lot served entry point.** The server must register the `Lot` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::lot_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `Lot` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.2.4 Position served entry point Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Position served entry point.** The server must register the `Position` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::position_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `Position` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.2.5 PortfolioGroup served entry point Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**PortfolioGroup served entry point.** The server must register the `PortfolioGroup` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::portfolio_group_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `PortfolioGroup` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.2.6 StrategySpec served entry point Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**StrategySpec served entry point.** The server must register the `StrategySpec` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::strategy_spec_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `StrategySpec` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.2.7 StrategyRun served entry point Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**StrategyRun served entry point.** The server must register the `StrategyRun` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::strategy_run_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `StrategyRun` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.2.8 LeverageTerms served entry point Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**LeverageTerms served entry point.** The server must register the `LeverageTerms` entry point and read/write permitted records through it. It must enforce the declared schema version and existing record policy. Intended source: `src/server/handlers/finance.rs; src/server/handlers/finance/records.rs (intended handler module)`. | Intended test: `src/server/handlers/finance/records/tests.rs::leverage_terms_served_round_trip_and_refusals (intended test)`. A served request round-trips a valid `LeverageTerms` record. Unknown versions and cross-tenant access refuse. Derived-record writes refuse where the record policy prohibits them. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.3 Record contract and generated-client acceptance Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Record contract and generated-client acceptance.** Rollup of schema export and generated-client acceptance below. Both children depend on the served record registration. Intended source: `crates/eg-capabilities/src/bin/gen_contract.rs`. | Both generated-surface children pass. A schema-version constant alone does not establish generated-client support. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.3.1 Finance record contract regeneration Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Finance record contract regeneration.** The contract generator must export the served record schemas and entry points from their authoritative Rust definitions. Intended source: `crates/eg-capabilities/src/bin/gen_contract.rs; contract/methods.json; contract/schemas/`. | Intended test: `tests/test_contract_wave_surface.py::test_finance_record_contract_surface (intended test)`. The generated contract represents each R004.2 record and served entry point. The contract freshness check rejects stale generated artifacts. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R004.3.3.2 Finance generated-client round trips Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Finance generated-client round trips.** The generator must produce clients from the record contract. Client tests must round-trip every served record. Intended source: `crates/eg-capabilities/src/bin/gen_contract.rs; epistemic_graph/generated/`. | Intended test: `tests/test_generated_client_contract.py::test_finance_record_client_round_trips (intended test)`. Generated clients preserve all required record fields through served requests. Unknown versions refuse; omitted required fields fail. The generator check rejects stale clients. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R005 Deterministic fixed-point portfolio accounting Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Deterministic fixed-point portfolio accounting.** Portfolio accounting uses fixed-point arithmetic for lot and cost-basis tracking under FIFO, LIFO, specific-lot, and average-cost elections, and derives realized and unrealized profit and loss, time-weighted return, money-weighted return and XIRR, dividend handling, multi-currency conversion at trade and valuation dates, and benchmark comparison. Delivered as child requirements, producer first: `EG-FINANCE-PRIMITIVES-R005.1` (the FIFO/LIFO fixed-point lot-matching engine), `.2` (specific-lot/average-cost elections and transfer/split invariants), further children for P&L/TWR/XIRR/FX/benchmark. Every child must satisfy its acceptance before this parent is complete. | Deterministic unit and golden fixture tests reproduce byte-identical results across replays of the same ordered inputs. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R005.1 FIFO/LIFO fixed-point lot-matching engine Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**FIFO/LIFO fixed-point lot-matching engine.** A pure function over an ordered slice of signed fixed-point buy/sell activities matches sells to open lots under FIFO or LIFO, refusing non-positive quantity/price, out-of-order sequence, and oversold quantity. Code root: `crates/eg-compute/src/finance/lot_accounting.rs`. | Unit tests assert FIFO/LIFO matching order, each refusal, and that replaying the same ordered activities is byte-identical. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 72c7dfa478ba ac32740601a8 eee78d6b3d1d crates/eg-compute/src/finance/lot_accounting.rs:283 crates/eg-compute/src/finance/lot_accounting.rs:284 crates/eg-compute/src/finance/lot_accounting.rs:304 crates/eg-compute/src/finance/lot_accounting.rs:305 crates/eg-compute/src/finance/lot_accounting.rs:323 |
| EG-FINANCE-PRIMITIVES-R005.1.1 FIFO/LIFO lot-matching tests are confirmed to run and pass against mixed buy/sell activity Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**FIFO/LIFO lot-matching tests are confirmed to run and pass against mixed buy/sell activity.** `fifo_closes_the_oldest_lot_first` and its two siblings assert closing behavior using buy-only activity fixtures; confirm these tests actually execute and pass, and extend them to a representative mixed buy/sell activity sequence rather than buy-only fixtures. Code root: `crates/eg-compute/src/finance/lot_accounting.rs`. | Test: `crates/eg-compute/src/finance/lot_accounting.rs::tests::fifo_and_lifo_lot_matching_tests_run_and_pass_against_a_mixed_buy_sell_sequence`. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | ac32740601a8 crates/eg-compute/src/finance/lot_accounting.rs:284 crates/eg-compute/src/finance/lot_accounting.rs:305 |
| EG-FINANCE-PRIMITIVES-R005.2 Specific-lot/average-cost elections and transfer/split invariants Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Specific-lot/average-cost elections and transfer/split invariants.** Oversized; delivered as grandchildren, producer first: `EG-FINANCE-PRIMITIVES-R005.2.1` (the specific-lot election), further grandchildren for average-cost election and transfer/split invariants. Every grandchild must satisfy its acceptance before this parent is complete. | Deterministic unit and golden fixture tests reproduce byte-identical results across replays of the same ordered inputs | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R005.2.1 Specific-lot election Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Specific-lot election.** `LotMethod::Specific(opened_by)` closes exactly the open lot named by its opening sequence instead of a FIFO/LIFO choice, refusing a named lot that is not open and a named lot without enough remaining quantity even when other lots have it. Code root: `crates/eg-compute/src/finance/lot_accounting.rs`. | Unit tests assert the named lot closes instead of the FIFO/LIFO choice, and that an absent or insufficient named lot is refused. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | eadb412ffa03 crates/eg-compute/src/finance/lot_accounting.rs:382 crates/eg-compute/src/finance/lot_accounting.rs:410 crates/eg-compute/src/finance/lot_accounting.rs:431 |
| EG-FINANCE-PRIMITIVES-R005.2.2 Average-cost election Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Average-cost election.** The lot engine must apply an explicit average-cost election using checked fixed-point arithmetic and declared rounding. Intended source: `crates/eg-compute/src/finance/lot_accounting.rs`. | Intended test: `crates/eg-compute/src/finance/lot_accounting.rs::tests::average_cost_election_preserves_basis (intended test)`. Mixed-price buys and partial sells reproduce expected basis and realized gains. Identical ordered inputs replay identically. Oversell and arithmetic overflow refuse. Rounding follows the declared scale without floating-point money. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R005.2.3 Transfer conservation Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Transfer conservation.** The lot engine must conserve aggregate quantity, cash and basis across an ordered paired transfer, accounting for explicit fees. Intended source: `crates/eg-compute/src/finance/lot_accounting.rs`. | Intended test: `crates/eg-compute/src/finance/lot_accounting.rs::tests::paired_transfer_conserves_quantity_cash_and_basis (intended test)`. A transfer preserves source-lot identity and basis across included accounts. Identical ordered inputs replay identically. Unbalanced transfers and insufficient source quantity refuse without a partial ledger update. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R005.2.4 Split basis preservation Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Split basis preservation.** The lot engine must adjust quantity for a declared split ratio while preserving aggregate basis with explicit rounding. Intended source: `crates/eg-compute/src/finance/lot_accounting.rs`. | Intended test: `crates/eg-compute/src/finance/lot_accounting.rs::tests::split_preserves_aggregate_basis (intended test)`. Forward and reverse splits preserve aggregate basis. Identical ordered inputs replay identically. Invalid ratios and arithmetic overflow refuse. Fractional quantities follow the declared rounding policy. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R006 Point-in-time corporate actions and exchange session calendars Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Point-in-time corporate actions and exchange session calendars.** Corporate actions, including splits, dividends, symbol changes, and delistings, are recorded as point-in-time facts, and exchange calendars model regular, pre-market, and post-market sessions. Every price result carries the session in which it was observed. | Golden fixtures covering corporate-action and session-boundary cases assert correct point-in-time resolution and session tagging. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 0374378eb9db 86432b21655e b9870e23567b crates/eg-compute/src/finance/market/resolve.rs:167 |
| EG-FINANCE-PRIMITIVES-R007 Versioned StrategySpec evaluator with DCA, trend, rebalancing Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Versioned StrategySpec evaluator with DCA, trend, rebalancing.** A versioned, typed StrategySpec is evaluated deterministically and ships default strategies for dollar-cost averaging by fixed amount, by shares, or by value-averaging target, trend following using moving-average and trend-flip signals, and calendar- or threshold-based rebalancing. Evaluation emits proposed actions only and never places or authorizes an order. | Deterministic unit tests exercise each default strategy's proposed-action output against fixed input fixtures. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 6602649a6bff 82cf765518b6 crates/eg-compute/src/finance/strategy.rs:70 crates/eg-compute/src/finance/strategy.rs:85 crates/eg-compute/src/finance/strategy.rs:97 |
| EG-FINANCE-PRIMITIVES-R007.1 DCA-by-fixed-amount default strategy evaluator Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**DCA-by-fixed-amount default strategy evaluator.** A versioned `StrategySpec` with a dollar-cost-averaging-by-fixed-amount kind is evaluated deterministically into a proposed buy action, and a non-positive configured amount is refused rather than proposed. Evaluation never places or authorizes an order. | Deterministic unit tests assert the proposed-action output for a fixed-amount input fixture, the refusal on a non-positive amount, and repeat-call determinism. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 6602649a6bff 82cf765518b6 crates/eg-compute/src/finance/strategy.rs:70 crates/eg-compute/src/finance/strategy.rs:85 crates/eg-compute/src/finance/strategy.rs:97 |
| EG-FINANCE-PRIMITIVES-R008 Strategy backtests sealed through BacktestRun Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Strategy backtests sealed through BacktestRun.** Strategy backtests are sealed as BacktestRun records that mandate purged combinatorial cross-validation, deflated Sharpe, probability of backtest overfitting, and transaction costs, and support standard comparisons of dollar-cost averaging, lump-sum, and trend strategies over the same point-in-time universe. | Integration tests seal a BacktestRun for each compared strategy and assert the mandatory validation fields are present and mutually consistent. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 82cf765518b6 b96ef8ebd9df crates/eg-compute/src/finance/market/strategy_backtest.rs:105 crates/eg-compute/src/finance/market/strategy_backtest.rs:120 crates/eg-compute/src/finance/market/strategy_backtest.rs:129 |
| EG-FINANCE-PRIMITIVES-R008.1 Dollar-cost-averaging backtest seals through BacktestRun Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Dollar-cost-averaging backtest seals through BacktestRun.** A dollar-cost-averaging-by-fixed-amount strategy's simulated contributions seal as a BacktestRun through the existing mandatory-validation seal path, refusing a non-positive contribution amount and any fill outside the point-in-time universe. | An integration test seals a BacktestRun for the fixed-amount DCA strategy and asserts the mandatory CV/Sharpe/PBO fields are present, plus refusal fixtures for a non-positive amount and an out-of-universe fill. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 82cf765518b6 b96ef8ebd9df crates/eg-compute/src/finance/market/strategy_backtest.rs:105 crates/eg-compute/src/finance/market/strategy_backtest.rs:120 crates/eg-compute/src/finance/market/strategy_backtest.rs:129 |
| EG-FINANCE-PRIMITIVES-R009 Calibrated abstaining recommendations with scorecards Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Calibrated abstaining recommendations with scorecards.** Each holding or watchlist item receives a calibrated recommendation of accumulate, hold, de-risk, or abstain, citing the strategy version and supporting evidence, and per-strategy scorecards compare prior recommendations against later outcomes. Recommendations are sealed as informational-only AnalysisSnapshot records that authorize no order. | Unit tests assert that insufficient-evidence conditions produce an abstain result and that a non-abstaining recommendation cites its strategy version and evidence. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 82cf765518b6 e93220a15cd2 crates/eg-compute/src/finance/market/recommendation.rs:81 crates/eg-compute/src/finance/market/recommendation.rs:94 |
| EG-FINANCE-PRIMITIVES-R009.1 Calibrated recommendation decision over flip confidence Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Calibrated recommendation decision over flip confidence.** A calibrated flip-confidence outcome maps to one of accumulate, hold, de-risk, or abstain, citing the strategy version and the calibrated evidence. An abstained confidence outcome always recommends abstain. | Unit tests assert an abstained confidence outcome recommends abstain and a non-abstaining recommendation's result carries its strategy version and the cited evidence. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 82cf765518b6 e93220a15cd2 crates/eg-compute/src/finance/market/recommendation.rs:81 crates/eg-compute/src/finance/market/recommendation.rs:94 |
| EG-FINANCE-PRIMITIVES-R010 Margin-trading risk module with margin, sizing, live-order boundary Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Margin-trading risk module with margin, sizing, live-order boundary.** The margin-trading module models Reg T margin, futures contract specs, leveraged-ETF daily-reset decay, and US FX limits, and simulates margin calls, liquidation, position sizing, and risk of ruin. Analysis defaults to paper mode; a live leveraged order requires a per-instrument policy and designated approvers, and CFDs are flagged unavailable for US retail accounts. | Scenario-based unit tests assert margin-call and liquidation simulation results and confirm live-order eligibility is refused without a matching policy and approver. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 76107c24568d 82cf765518b6 crates/eg-compute/src/finance/leverage.rs:113 crates/eg-compute/src/finance/leverage.rs:131 crates/eg-compute/src/finance/leverage.rs:151 crates/eg-compute/src/finance/leverage.rs:171 crates/eg-compute/src/finance/leverage.rs:98 |
| EG-FINANCE-PRIMITIVES-R010.1 Live-order eligibility boundary Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Live-order eligibility boundary.** A live leveraged order is eligible only with a per-instrument policy naming the acting approver; a paper-mode order is never eligible, and a CFD is refused for a US retail account regardless of policy. | Unit tests confirm live-order eligibility is refused for paper mode, a missing policy, an undesignated approver, and a US-retail CFD, and confirm eligibility with a matching policy and approver. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 76107c24568d 82cf765518b6 crates/eg-compute/src/finance/leverage.rs:113 crates/eg-compute/src/finance/leverage.rs:131 crates/eg-compute/src/finance/leverage.rs:151 crates/eg-compute/src/finance/leverage.rs:171 crates/eg-compute/src/finance/leverage.rs:98 |
| EG-FINANCE-PRIMITIVES-R011 Finance alerts published through the finance outbox Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Finance alerts published through the finance outbox.** Price, trend-flip, DCA-due, and margin-threshold alerts are published as finance events through the outbox topic family for delivery by existing channels. | Integration tests assert each alert condition produces the correct typed event on the outbox and that delivery is idempotent on replay. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | 3eeb3126f421 |
| EG-FINANCE-PRIMITIVES-R011.1 Typed finance alert envelope (producer-first split of R011) Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Typed finance alert envelope (producer-first split of R011).** `FinanceAlertEnvelope` validates its identity, listing, timestamp and message. `FinanceAlertKind` assigns distinct schema names to price, trend-flip, DCA-due and margin-threshold alerts. Source: `crates/eg-types/src/finance_event_envelope.rs`. | Module tests admit a valid envelope and refuse empty identity, listing or message fields and non-positive timestamps. `each_alert_kind_has_a_distinct_outbox_schema` checks four distinct schema names. Transactional append and replay acceptance remain under R011.2 and R011.3. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 3eeb3126f421 crates/eg-types/src/finance_event_envelope.rs:102 |
| EG-FINANCE-PRIMITIVES-R011.2 Finance transactional append Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Finance transactional append.** Rollup of envelope conversion and atomic append acceptance below. The existing transaction owner remains the outbox authority. Intended source: `src/server/mutation_batch/compile/finish_helpers.rs`. | Both append children preserve the existing flip identity. Envelope validation alone does not establish committed delivery. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R011.2.1 Finance envelope to outbox intent Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Finance envelope to outbox intent.** The mutation compiler must convert each validated finance alert into the matching typed outbox intent. Intended source: `src/server/mutation_batch/compile/finish_helpers.rs`. | Intended test: `src/server/mutation_batch/compile.rs::tests::finance_alert_intents_preserve_schema_and_identity (intended test)`. Price, trend-flip, DCA-due and margin-threshold alerts preserve their schema, payload and event identity. Invalid envelopes refuse. Existing `finance.flip` identifiers remain unchanged. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R011.2.2 Finance event atomic commit Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Finance event atomic commit.** The server must append each finance event and its outbox fact within the existing owner transaction. Intended source: `src/server/mutation_batch.rs; src/server/mutation_batch/compile.rs`. | Intended test: `src/server/mutation_batch/tests.rs::finance_alert_and_outbox_commit_atomically (intended test)`. Each alert condition commits its typed event and outbox fact together. Failed transactions publish neither record. Unauthorized tenants and conflicting source revisions refuse. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R011.3 Finance delivery replay Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Finance delivery replay.** The server must preserve one event identity and one outbox fact when it replays a committed finance alert. Intended source: `src/server/mutation_batch.rs; crates/eg-transaction/src/outbox/mod.rs`. | Intended test: `src/server/mutation_batch/tests.rs::finance_alert_replay_preserves_one_outbox_fact (intended test)`. All four alert kinds retain their event identity across replay and restart. Existing `finance.flip` delivery remains compatible. Duplicate replay creates no extra event or delivery fact. Alert delivery never authorizes an order. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R012 Optional one-way Ghostfolio activity import Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Optional one-way Ghostfolio activity import.** An optional Ghostfolio instance on the shared Postgres database attaches through the typed source registry, and a one-way mapper converts its activities into finance-v1 records without EG writing back into Ghostfolio's own schema. Net-new, sliced per the sizing rule: `EG-FINANCE-PRIMITIVES-R012.1` (the typed flow-direction gate and activity mapping) and `.2` (the typed source-registry attachment and disposable-fixture integration tests). | Integration tests against a disposable Ghostfolio fixture assert idempotent, one-way import of activities into finance-v1. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 82cf765518b6 eadb412ffa03 fcca865a0505 crates/eg-compute/src/finance/ghostfolio_import.rs:152 crates/eg-compute/src/finance/ghostfolio_import.rs:158 crates/eg-compute/src/finance/ghostfolio_import.rs:166 crates/eg-compute/src/finance/ghostfolio_import.rs:174 crates/eg-compute/src/finance/ghostfolio_import.rs:184 |
| EG-FINANCE-PRIMITIVES-R012.1 A typed gate admits only a one-way Ghostfolio import, never a write-back Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**A typed gate admits only a one-way Ghostfolio import, never a write-back.** `GhostfolioFlowDirection` distinguishes importing FROM Ghostfolio (admitted) from writing BACK to it (refused unconditionally); `map_ghostfolio_activity` maps one activity into a fixed-point `MappedGhostfolioActivity`, refusing a missing source id or a non-positive price. Code root: `crates/eg-compute/src/finance/ghostfolio_import.rs`. | Unit tests assert the import direction is admitted, the write-back direction is always refused, a valid activity maps, and a missing source id or non-positive price is refused. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 82cf765518b6 fcca865a0505 crates/eg-compute/src/finance/ghostfolio_import.rs:152 crates/eg-compute/src/finance/ghostfolio_import.rs:158 crates/eg-compute/src/finance/ghostfolio_import.rs:166 crates/eg-compute/src/finance/ghostfolio_import.rs:174 crates/eg-compute/src/finance/ghostfolio_import.rs:184 |
| EG-FINANCE-PRIMITIVES-R012.2 Ghostfolio attaches through the typed source registry with disposable-fixture coverage Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Ghostfolio attaches through the typed source registry with disposable-fixture coverage.** Depends on `EG-FINANCE-PRIMITIVES-R012.1`. `register_ghostfolio_source` attaches an optional Ghostfolio instance under a source name, admitted only via the `ImportFromGhostfolio` direction. `import_ghostfolio_fixture` maps a disposable fixture of raw activity rows, deduplicating by `ghostfolio_activity_id` so a repeated row or a re-run import is idempotent. Code root: `crates/eg-compute/src/finance/ghostfolio_import.rs`. | Integration tests against a disposable Ghostfolio fixture assert idempotent, one-way import of activities into finance-v1. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | eadb412ffa03 crates/eg-compute/src/finance/ghostfolio_import.rs:191 crates/eg-compute/src/finance/ghostfolio_import.rs:198 crates/eg-compute/src/finance/ghostfolio_import.rs:221 |
| EG-FINANCE-PRIMITIVES-R013 Golden accounting and risk fixtures with full provenance Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Golden accounting and risk fixtures with full provenance.** Finance golden fixtures cover broker statements, corporate actions, daylight-saving and session boundaries, leveraged-ETF decay against published returns, and futures rolls, using fixed-point arithmetic with no floating-point money. Every displayed figure carries its source, as-of time, and session. Net-new, sliced per the sizing rule: `EG-FINANCE-PRIMITIVES-R013.1` (the figure shape and provenance-refusal gate) and `.2` (the fixtures themselves, compared against published reference values). | Golden fixture tests compare computed results against published reference values and assert the source, as-of, and session provenance fields are present on every output. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R013.1 A golden-fixture figure is refused when its provenance is incomplete Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**A golden-fixture figure is refused when its provenance is incomplete.** `GoldenFixtureFigure` carries a fixed-point `value_ticks`, `source`, `as_of`, and `session`; `check_figure_provenance` refuses a figure missing any provenance field. Code root: `crates/eg-compute/src/finance/golden_fixture.rs`. | Unit tests assert a fully-provenanced figure is admitted and a figure missing its source, as-of time, or session is refused. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 168b52ef6307 fcca865a0505 crates/eg-compute/src/finance/golden_fixture.rs:117 crates/eg-compute/src/finance/golden_fixture.rs:123 crates/eg-compute/src/finance/golden_fixture.rs:132 crates/eg-compute/src/finance/golden_fixture.rs:140 |
| EG-FINANCE-PRIMITIVES-R013.2 Golden fixtures compare computed figures against published reference values Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Golden fixtures compare computed figures against published reference values.** Depends on `EG-FINANCE-PRIMITIVES-R013.1`. Oversized; delivered as grandchildren, producer first: `EG-FINANCE-PRIMITIVES-R013.2.1` (the broker-statement comparison fixture), `.2.2` (corporate-action fixtures), `.2.3` (DST/session-boundary fixtures), `.2.4` (leveraged-ETF-decay fixtures), and `.2.5` (futures-roll fixtures). Comparison-fixture unit tests alone do not establish independent broker-statement dataset acceptance. Every grandchild must satisfy its acceptance before this parent is complete. | Golden fixture tests compare computed results against published reference values and assert the source, as-of, and session provenance fields are present on every output. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R013.2.1 Broker-statement golden fixture comparison Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Broker-statement golden fixture comparison.** `compare_broker_statement_figure` refuses a computed `GoldenFixtureFigure` with incomplete provenance (via `check_figure_provenance`) before comparing it, then refuses a `value_ticks` that diverges from its published reference tick value. Code root: `crates/eg-compute/src/finance/golden_fixture.rs`. | Golden fixture tests compare a computed figure against its published reference value and assert provenance is checked first. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | eadb412ffa03 crates/eg-compute/src/finance/golden_fixture.rs:148 crates/eg-compute/src/finance/golden_fixture.rs:156 crates/eg-compute/src/finance/golden_fixture.rs:168 |
| EG-FINANCE-PRIMITIVES-R013.2.2 Corporate-action golden fixtures against published notices Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Corporate-action golden fixtures against published notices.** Reuse the existing corporate-action and fixed-point accounting authorities to replay checked-in split and dividend vectors from independently published issuer or exchange notices. Record the notice URL, publication/version and content digest, effective/as-of time, session and currency; every computed figure passes R013.1. Planned code root: `crates/eg-compute/src/finance/`. | Exact reference share, basis and cash ticks match before and after the action; a changed reference value or missing source/as-of/session fails. Expected values must be independently transcribed from the cited source, never computed by the implementation under test. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R013.2.3 DST and session-boundary golden fixtures against published exchange calendars Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**DST and session-boundary golden fixtures against published exchange calendars.** Replay checked-in opening/closing and daylight-saving transition vectors using versioned exchange calendar and offset source records. Record the source URL, publication/version and content digest, as-of time and expected session on each result. Every displayed figure passes R013.1. Planned code root: `crates/eg-compute/src/finance/`. | Published boundary and offset vectors reproduce the expected session and timestamp across both DST transitions. Incorrect offsets/session labels and missing source/as-of/session fail. Replaying under different host time zones cannot change the reference result. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R013.2.4 Leveraged-ETF daily-reset decay golden fixtures against published returns Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Leveraged-ETF daily-reset decay golden fixtures against published returns.** Run the existing daily-reset calculation over a checked-in multi-session path and compare with independently published fund return/NAV references under explicit fee and rounding assumptions. Record the provider URL, publication/version and content digest, as-of time, session and currency; use fixed-point money and the R013.1 gate. Planned code root: `crates/eg-compute/src/finance/`. | The reference path matches exact ticks under the documented scale/rounding policy and exhibits the published daily-reset result; a changed return/reference, an omitted reset, or missing source/as-of/session fails. Expected values cannot be derived by the implementation under test. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R013.2.5 Futures-roll golden fixtures against published contract and settlement records Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Futures-roll golden fixtures against published contract and settlement records.** Replay a checked-in expiring-to-successor contract roll through existing finance authorities using independently published exchange settlements, expiry dates, tick sizes and multipliers. Record source URLs, publication/versions and content digests, as-of time, session and currency; use fixed-point money and the R013.1 gate. Planned code root: `crates/eg-compute/src/finance/`. | Roll cash and position values match independent reference ticks for the declared contracts and roll policy; wrong contract terms/reference ticks and missing source/as-of/session fail. Replaying the same sourced vector is byte-identical. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R014 finance-v1 thin instrument and signal module Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**finance-v1 thin instrument and signal module.** finance-v1 defines a thin module of Instrument, Listing, Venue, BarSeries, IndicatorSpec, SignalState, TrendFlip, and MacroEvent types aligned to the FIBO ontology. | Schema validation tests confirm each type's required fields and its alignment to the FIBO ontology. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 46c93a87f9ed 532418b7e55b src/server/graph_schema/finance_tests.rs:230 src/server/graph_schema/finance_tests.rs:83 |
| EG-FINANCE-PRIMITIVES-R015 AnalysisSnapshot records with share.read control leases Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**AnalysisSnapshot records with share.read control leases.** AnalysisSnapshot records capture informational analysis output together with a share.read control-lease link for access control, and each snapshot carries a notice marking the output as informational-only. | Unit tests assert a sealed AnalysisSnapshot includes its control-lease link and informational-only notice. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | 3899594fed44 |
| EG-FINANCE-PRIMITIVES-R016 Incremental deterministic indicator kernels with Pine parity Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Incremental deterministic indicator kernels with Pine parity.** Indicator kernels for ATR, SuperTrend, SMA and EMA, 200-week SMA, the 20/21 band, and Heikin-Ashi are computed incrementally and deterministically, with Pine parity fixtures proving the reference implementation matches. | Parity fixture tests compare each kernel's output against the Pine reference implementation on shared bar data. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 532418b7e55b 8bb121fedd18 crates/eg-compute/src/finance/market/pine_parity_tests.rs:102 crates/eg-compute/src/finance/market/pine_parity_tests.rs:112 crates/eg-compute/src/finance/market/pine_parity_tests.rs:122 crates/eg-compute/src/finance/market/pine_parity_tests.rs:134 crates/eg-compute/src/finance/market/pine_parity_tests.rs:165 |
| EG-FINANCE-PRIMITIVES-R017 BacktestRun provenance record with mandatory fields Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**BacktestRun provenance record with mandatory fields.** A BacktestRun record captures full provenance for a backtest, including mandatory purged combinatorial cross-validation, deflated Sharpe, probability of backtest overfitting, transaction costs, the fill rule, the point-in-time universe, and a no-look-ahead check. | Unit tests assert sealing a BacktestRun without any mandatory field is refused and that a valid record passes the no-look-ahead check. | requirement | EG-FINANCE-PRIMITIVES | VERIFIED | 46c93a87f9ed 532418b7e55b crates/eg-compute/src/finance/market/record_tests.rs:379 crates/eg-compute/src/finance/market/record_tests.rs:420 |
| EG-FINANCE-PRIMITIVES-R018 Factor research records each factor as a typed node (rollup) Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Factor research records each factor as a typed node (rollup).** The finance domain must compute information coefficient and information ratio per factor and rank the factors. It must record each factor as a typed graph node with provenance to its inputs. | Tests prove ranking, node recording and typed abstention on thin input. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R018.1 Model Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Model.** `crates/eg-compute/src/finance/factor.rs` must define `FactorRecord` with factor id, information coefficient, information ratio, rank and input provenance keys. | Unit test round-trips a record and rejects an empty provenance list. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R018.2 Behavior Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Behavior.** `rank_factors` must call `information_coefficient` and `information_ratio` at `crates/eg-numeric/src/evaluation/skill.rs:16` and `:31`. The rank rule should default to absolute information ratio. | Unit test ranks three factors in the expected order. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R018.3 Wiring Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Wiring.** The route for `FinanceInformationCoefficient` at `src/server/handlers/finance/route_families.rs:211` must dispatch to `rank_factors` for a factor set. Its production caller is the served finance wire method. | Test asserts a factor-set request reaches `rank_factors`. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R018.4 Refusal Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Refusal.** Empty or single-row input must return the typed abstention `FACTOR_INSUFFICIENT_DATA` and record no node. | Test sends zero and one row and asserts the abstention and no node. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R018.5 Evidence Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Evidence.** Each recorded node must carry `derivedFrom` edges to its inputs and the kernel versions used. | Test reads one node and asserts the edges and versions. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R018.6 Hot-path proof Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Hot-path proof.** The entry point is the served finance wire method. It must rank three factors and write three nodes. | Integration test `tests/finance_factor_ranking.rs` asserts the ranking, the nodes and the edges. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R015.1 Immutable order-proposal snapshot and atomic admission boundary Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Immutable order-proposal snapshot and atomic admission boundary.** EG owns `OrderProposalSnapshotV1` with `{tenant_id, proposal_id, revision, predecessor_digest, decision_id, decision_revision, decision_digest, payload_schema_id, payload_schema_revision, canonical_payload_bytes, payload_sha256, policy_id, policy_revision, policy_digest, evidence_refs: [{owner_requirement_id, record_id, revision, digest}]}`. EG defines typed `FinanceOrderProposal.StageV1` and `FinanceOrderProposal.PromoteV1` methods. `StageV1` accepts the snapshot plus expected head revision/digest. It creates a sealed, create-only, content-addressed snapshot. It returns `{proposal_id, revision, predecessor_digest, snapshot_digest, state=staged}`. Revision 1 has no predecessor. Each later revision names the exact prior digest and uses expected-head compare-and-set. An exact same-revision/digest retry is idempotent. Conflicting bytes at that revision refuse. `PromoteV1` accepts `{tenant_id, proposal_id, candidate_revision, snapshot_digest, expected_promoted_revision, required_gate_manifest_digest, gate_receipts}`. Each gate receipt binds `{gate_id, gate_revision, candidate_digest, pass_fail, evidence_digest}`. Recompute SHA-256 over schema-versioned canonical payload bytes and the staged digest. Validate R019 decision verification/approval and applicable R010 risk/sizing policy. Include per-instrument policy and designated approvers when applicable. Atomically write the promoted pointer, append-only `derivedFrom` history, and `OrderAdmissionReceiptV1`. The receipt binds `{proposal_id, revision, snapshot_digest, decision_digest, policy_id, policy_revision, policy_digest, gate_manifest_digest, gate_receipt_digests, transaction_revision}`. A stale head, payload/hash mismatch, missing or mismatched evidence, failed or unavailable gate, incomplete receipts, or hook veto refuses. Refusal writes no pointer, history, or admission receipt. Output means host-review admission only. It is not an order or provider effect. Preserve `EG-DECISION-ENGINE-R019`, `EG-DURABLE-KERNEL-R057`, and `EG-FINANCE-PRIMITIVES-R015`. **Exact cross-owner hold:** the reviewed evidence lacks the SDK writeback payload schema/version. It lacks the admission-gate manifest owner, complete gate-id set, and required hook contracts. It also lacks GraphOS confirmation operation and receipt fields. Until those owners define them, EG may stage and validate the opaque versioned snapshot. EG must refuse promotion for host review. SDK writeback must not cause an effect. Source record SHA-256 `e3ad9b1e3121eb3278c3e2b52ce948817e317db3de48d5886a624ffe2ba9be47`. This remains SPECIFIED; no implementation or consumer receipt is claimed. | Planned tests: `StageV1` creates and independently reads back revision 1. Stage revision 2 with the correct predecessor. Prove exact retries are idempotent. Refuse same-revision byte changes, hash mismatches, stale heads, missing/mismatched DecisionCommit or R010 evidence, incomplete receipts, and each failed/unavailable gate. Each refusal leaves pointer, history, and receipt absent and unchanged. Promotion must refuse with no writes until the SDK schema, gate registry, and GraphOS confirmation contract are served. Then prove atomic admission with host-review-only output. No order is sent. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R002.11 Multi-horizon Markov regime forecast and policy-bound sizing input Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Multi-horizon Markov regime forecast and policy-bound sizing input.** Extend the existing `eg-numeric` regime-HMM kernel and typed model route from R002.1.14/R002.9. `RegimeForecastV1` accepts `{model_id, model_revision, source_series_id, source_revision, as_of, increasing_positive_horizons, horizon_unit, calibration_policy_id, calibration_policy_revision, calibration_policy_digest, heldout_dataset_digest}`. Resolve ordered state IDs, posterior `p0`, and transition matrix `T` only from the pinned HMM model/source revision. Refuse caller-supplied state probabilities or `T`. For each horizon `h`, compute `p_h=p0*T^h` and preserve state order. Return `{forecast_digest, model/source revisions, as_of, ordered_state_ids, posterior_p0, transition_matrix_digest, per_horizon_probability_vectors, per_horizon_top_state_probability, calibration_evidence_by_horizon}`. Require finite nonnegative probabilities. Require the posterior, held-out prediction, output vectors, and transition rows to sum to one within pinned model precision. Each held-out sample binds `{sample_id, model_revision, source_series_id, origin_as_of, horizon, ordered_state_ids, predicted_probability_vector, realized_state_id, target_observation_at, scoring_revision}`. Require origin before target observation. Require unique sample IDs and matching state order/model revision. Require one row per source/origin/horizon. Compute categorical Brier separately for each horizon: `Brier_h = (1/N_h) Σ_n Σ_s (p_{n,h,s} - 1[y_n=s])²`. Bind dataset, model, state-order, and scoring revisions. Require positive `N_h` meeting `minimum_heldout_examples_by_horizon`. A versioned policy supplies per-horizon `max_brier_by_horizon` in [0,2]. It supplies `min_top_state_probability_by_horizon` in [0,1]. It supplies positive integer `minimum_heldout_examples_by_horizon`. Each policy map covers every requested horizon exactly once. All thresholds must pass before sizing eligibility. Return `{horizon, dataset_digest, model_revision, state_ids_digest, scoring_revision, calibration_policy_digest, sample_count, brier, applied_thresholds, passed}`. R010 sizing consumes the forecast digest and `RegimeSizingPolicyV1` `{policy_id, revision, instrument_id, target_weight_by_state, unit, fixed_point_scale, risk_cap}`. All state weights and the risk cap use the same R010 policy unit/scale. Compute `expected_target_weight_h=Σ_s p_{h,s}×target_weight_s`, then apply its risk cap. Missing weights, exceeded cap, stale revision, or failed calibration returns typed abstention and no sizing value. Never create an order. Invalid dimensions, duplicate state IDs, negative/nonfinite probabilities, and non-stochastic rows refuse. Empty/unsorted horizons and stale model/source revisions also refuse. Duplicate, missing, or future-leaking calibration rows refuse. Zero denominator, sample counts below the policy floor, invalid policy, or unknown thresholds refuse. A refused forecast is never sizing-eligible. Preserve `EG-DECISION-ENGINE-R103`, `EG-FINANCE-PRIMITIVES-R002`, R010, R002.1.14, R002.6.2, and R009.1. R009.1 remains flip calibration, not state calibration. **Exact policy hold:** source evidence supplies no Brier thresholds, confidence floors, sample floors, state weights, or risk cap. A complete versioned policy must supply each value. No defaults exist. Missing or invalid values refuse sizing. Source record SHA-256 `037f3edf5fe38f55ac24d6e0cc7bd85f1efc60cadf7c97b66b44978613a7acb6`. This remains SPECIFIED; no implementation or served receipt is claimed. | Planned tests: Seed a three-state transition matrix and compare independent `p0*T^h` vectors at every horizon. Confirm each vector sum is one. Compare held-out Brier with the formula using a positive denominator. Bind dataset, model, state order, and scoring revision. Confirm deterministic sizing with a complete policy. Refuse malformed matrices/vectors, nonfinite/negative values, duplicate/reordered states, stale revisions, and invalid horizons. Also refuse missing/duplicate samples and future-leaking origins. Refuse zero denominator, low sample counts, threshold failures, missing weights, and risk-cap excess. Vary one state probability and prove sizing changes only through bound R010 policy. No live-order effect occurs. Missing policy values refuse; they are not runtime test claims. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R613 Regime detection and optimal-execution schedules are engine numeric kernels (rollup) Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Regime detection and optimal-execution schedules are engine numeric kernels (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` pass their tests. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R613.1 Model Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Model.** `crates/eg-numeric/src/execution.rs` defines RegimeState, TransitionMatrix, ExecutionPlan, AlmgrenChriss, MarketMakingQuote, PairsSignal. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R613.2 Behavior Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Behavior.** A Markov chain over thresholded returns estimates a transition matrix and forecasts regime probabilities with a backtest summary. Execution schedules solve discrete and continuous impact-minimizing trajectories, market-making quotes and pairs signals from declared parameters. All results are deterministic for fixed input. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R613.3 Wiring Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Wiring.** Registered with the numeric kernel and reachable through the finance methods of EG-FINANCE-PRIMITIVES. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R613.4 Refusal Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Refusal.** Non-positive risk aversion, horizon or volatility is refused with the field name. The stable code is `EXEC_PARAM_INVALID`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R613.5 Evidence Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Evidence.** Result carries parameters, objective and solver status. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R613.6 Hot-path proof Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Hot-path proof.** schedule solve of 1000 slices under 2 ms p99; regime fit over 1M bars under 250 ms p99. The benchmark is `benches/r613_finance_primitives.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R750 Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure (rollup) Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure (rollup).** Rust-native in `crates/eg-numeric/src/finance`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R750.750 Model: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Model: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure.** The numeric crate holds deterministic kernels, and the finance domain exposes them. The kernels cover alpha factors, mean-variance and risk-parity optimization, cointegration and pairs statistics, and regime detection. They also cover microstructure estimators, price-action pattern classification, signal fusion, profit attribution and a risk-first limit pipeline. Types: `AlphaFactor`, `PortfolioWeights`, `RiskLimitSet`, `RegimeState`, `CointegrationTest`, `PatternMatch`, `AttributionBreakdown`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R750.751 Behavior: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Behavior: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure.** Kernels use fixed-point or pinned software floating point, so results are identical across targets. They take explicit windows. They return typed insufficient-data results. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R750.752 Refusal: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Refusal: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure.** The engine refuses a window shorter than the minimum, a singular covariance and a limit breach. Each refusal carries a typed reason and no partial result. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R750.753 Hot-path proof: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Hot-path proof: Quantitative finance research kernels: factors, portfolio, risk, regimes and microstructure.** Criterion benchmark `finance_kernels` runs over 500 assets by 1k bars. The p50 is under 25 ms and the p99 is under 60 ms. Memory stays under 48 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R751 Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion (rollup) Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion (rollup).** Rust-native in `crates/eg-types/src/finance`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R751.750 Model: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Model: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion.** The engine stores these as typed graph records with provenance. They are bull and bear debate rounds, journal entries with bias audits, and immutable versioned orders. They are also forensic screens, filing differences, and sentiment and geopolitical scores. The last group is copy-trade cards and shared strategy cards. Types: `DebateRound`, `TradeJournalEntry`, `BiasAudit`, `VersionedOrder`, `ForensicFlag`, `SentimentFusion`, `GeopoliticalRisk`, `StrategyCard`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R751.751 Behavior: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Behavior: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion.** Orders are append-only revisions with a digest chain. Scores are computed from cited records and carry their evidence ids. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R751.752 Refusal: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Refusal: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion.** An order revision that rewrites history, a score without evidence and a strategy card without a licence-class fact are refused. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R751.753 Hot-path proof: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Hot-path proof: Strategy research records: debates, journals, versioned orders, forensic screens and sentiment fusion.** Criterion benchmark `order_chain_append`. The p50 is under 150 microseconds and the p99 is under 700 microseconds. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R900 Position sizing and distribution-shift detection (rollup) Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Position sizing and distribution-shift detection (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` pass. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R900.1 Model Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Model.** `crates/eg-numeric/src/sizing.rs` defines `KellyInput { accuracy, win_loss_ratio, fraction, max_risk }` and `ShiftResult { statistic, p_value, shifted }`. Accuracy lies in [0, 1]. The fraction defaults to one half and the cap to 0.02. | Unit test round-trips both types and rejects an accuracy outside [0, 1]. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R900.2 Behavior Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Behavior.** `kelly_fraction` returns `(p * b - q) / b`, scaled by the fraction and clamped to [0, max_risk]. A ratio of zero or less returns zero. `distribution_shift` calls `eg_numeric::stats::ks_2samp` and reports a shift when the statistic exceeds the threshold. Both are pure. Sizing is O(1); shift detection is O(n log n). | Unit tests compare against published Kelly values and `ks_2samp` vectors. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R900.3 Wiring Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Wiring.** The finance route family in `src/server/handlers/finance/route_families.rs` serves both kernels. Callers that size positions call this route and hold no copy of the formula. | Test calls the served route and asserts the kernel ran. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R900.4 Refusal Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Refusal.** A non-finite input is refused with `SIZING_INPUT_INVALID`. An empty sample is refused with `SHIFT_SAMPLE_EMPTY`. | Test submits each invalid input and asserts the code. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R900.5 Evidence Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Evidence.** Each call records the inputs digest, the result and the cap that applied. | Test reads the trace after one call. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R900.6 Hot-path proof Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Hot-path proof.** Shift detection over two samples of 100k values: p50 under 25 ms, p99 under 60 ms, memory under 8 MiB. The benchmark is `benches/r900_sizing_shift.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R901 Banking risk calculations: AML screening, capital ratios, credit loss and settlement legs (rollup) Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Banking risk calculations: AML screening, capital ratios, credit loss and settlement legs (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` pass. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R901.1 Model Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Model.** `crates/eg-numeric/src/banking.rs` defines `AmlRule`, `AmlAlert`, `CapitalInputs`, `CapitalRatios`, `CreditExposure` and `SettlementLeg`. Severities are a closed enum: info, warning, critical, report-required. | Unit test round-trips each type and rejects an unknown severity. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R901.2 Behavior Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Behavior.** `screen_transaction` raises a structuring alert for an amount in [0.8 t, t) and a threshold alert at or above t. `capital_ratios` divides CET1, AT1 and Tier 2 capital by risk-weighted assets and compares them with the 4.5 percent CET1, 8 percent total capital and 3 percent Tier 1 to total exposure minimums. `expected_loss` returns PD times LGD times EAD. `settlement_chain` builds ordered legs through the correspondent chain. All are pure and O(n) in their inputs. | Unit tests cover each rule at, below and above every boundary. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R901.3 Wiring Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Wiring.** The finance route family serves these kernels. Banking records arrive from the SDK `finance.banking` models of SDK-FINANCE-SOURCES-R900. No connector computes them. | Test calls each served route and asserts the kernel ran. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R901.4 Refusal Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Refusal.** Zero or negative risk-weighted assets are refused with `CAPITAL_RWA_INVALID`. A PD or LGD outside [0, 1] is refused with `CREDIT_INPUT_INVALID`. | Test submits each invalid input and asserts the code. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R901.5 Evidence Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Evidence.** Each call records the rule set version, the inputs digest and the outcome. | Test reads the trace after one call of each kernel. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-FINANCE-PRIMITIVES-R901.6 Hot-path proof Definition — EG-FINANCE-PRIMITIVES / EG-FINANCE-PRIMITIVES — Finance primitives: accounts, strategies, risk and evidenceCanonical requirement and verification source**Hot-path proof.** Screening of 100k transactions: p50 under 20 ms, p99 under 50 ms, memory under 8 MiB. The benchmark is `benches/r901_banking_risk.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-FINANCE-PRIMITIVES | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER EG-INGEST-WORKER — Durable ingest worker | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001 Ingest worker capability is served by the engine queue and run by the SDK runner (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Ingest worker capability is served by the engine queue and run by the SDK runner (rollup).** Replaces agent-utilities `kg-ingest-worker` (ingest_worker.py, deleted by commit b02e39950). Split into `EG-INGEST-WORKER-R001.1`-`EG-INGEST-WORKER-R001.17`; satisfied only when every child is satisfied. | See each child. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.1 Typed ingest job envelope with refusal tests Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Typed ingest job envelope with refusal tests.** `eg-types` (file to be created: crates/eg-types/src/ingest_job.rs) defines `IngestJobEnvelope{job_id, tenant, corpus_key, kind, target, attempt}`. A blank job_id, blank target, unknown kind or attempt above the retry ceiling is refused with a typed error. | Unit tests in the same file cover each refusal and a serde round trip. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.2 Typed job kinds and lane derivation Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Typed job kinds and lane derivation.** One `IngestJobKind` enum (document, codebase, skill_workflows, capability_hydration) and one pure function `lane_for(kind)` returning hydration for skill_workflows and capability_hydration, general otherwise, in the same file as R001.1. | Unit test asserts the lane for every kind. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.3 Partition key function Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Partition key function.** One pure function `partition_key(envelope)` in the same file returns the tenant, then corpus, then kind hierarchy so the queue can keep per-tenant and per-corpus ordering without global serialization. | Unit test asserts equal keys for jobs of one corpus and different keys across tenants. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.4 Enqueue maps onto the served task queue with deterministic ids Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Enqueue maps onto the served task queue with deterministic ids.** One function `enqueue_ingest_job` in crates/eg-capabilities/src (file to be created: ingest_queue.rs) wraps `TaskQueueEnqueue` from EG-DURABLE-KERNEL-R072 on queues `ingest` and `ingest-hydration`, deriving the task id from job_id so a duplicate enqueue is a no-op. | Integration test enqueues the same job twice and asserts one claimable task. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.5 Prerequisite: durable task queue (this repository, EG-DURABLE-KERNEL-R071, R072, R073) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Prerequisite: durable task queue (this repository, EG-DURABLE-KERNEL-R071, R072, R073).** Typed enqueue/claim/ack model, served RPC pair and generated Python client methods must land before R001.4 and R001.11. Not re-specified here. | Linked rows verified by their own tests. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.6 Prerequisite: worker registry, reserved admission and scheduler floors (this repository, EG-DURABLE-KERNEL-R074, R075, R076) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Prerequisite: worker registry, reserved admission and scheduler floors (this repository, EG-DURABLE-KERNEL-R074, R075, R076).** The reserved hydration floor in R001.10 is computed from the served `SchedulerConfig` lane floors, not a worker-side environment knob. | Linked rows verified by their own tests. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.7 Typed retry policy with validation Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Typed retry policy with validation.** One `IngestRetryPolicy{max_attempts, base_delay, max_delay, jitter}` model in the same file as R001.1; zero attempts, base above max, or negative jitter is refused. | Unit tests for each refusal. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.8 Retry delay function with jitter Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Retry delay function with jitter.** One function `next_delay(policy, attempt, seed)` returns a bounded exponential delay with jitter so idle or failed workers do not retry in lockstep. | Unit test asserts the bound, monotonic growth and that two seeds differ. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.9 Failure routing: retry then dead letter Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Failure routing: retry then dead letter.** The ack path of R001.4 maps a failed outcome to redelivery with `next_delay` while attempts remain, and to a dead-letter record carrying the last error once exhausted. Reuse the SourceIngest dead_letter capability named in EG-REPO-INGEST-R002 rather than a second dead-letter writer. | Integration test fails a job past max_attempts and asserts one dead-letter record and no further delivery. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.10 Hydration-reserved lane served as a distinct queue Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hydration-reserved lane served as a distinct queue.** Claim on `ingest-hydration` is admitted first for reserved workers using `AdmitWorkerTask` (EG-DURABLE-KERNEL-R075); a lone worker is never fully reserved. | Integration test with a one-worker pool asserts it still claims general work; with two, one claims hydration first. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.11 Backpressure read and producer refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Backpressure read and producer refusal.** One read op `IngestQueueDepth` returns depth and oldest-age per queue. `enqueue_ingest_job` refuses above a configured depth with stable code INGEST_QUEUE_FULL and bounded detail so producers can slow down. | Integration test fills the queue to the limit and asserts the refusal code and that depth is unchanged. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.12 Lease renewal for long jobs Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Lease renewal for long jobs.** The runner renews the claim through the existing `RenewWorkItemLease` method at a third of the lease. A missed renewal lets the job redeliver. Already provided by the work-item coordination domain. Verify with a test. | Integration test pauses renewal and asserts redelivery after expiry. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.13 Ingest queue metrics Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Ingest queue metrics.** Engine exports gauges `eg_ingest_queue_depth`, `eg_ingest_oldest_age_seconds` and counters `eg_ingest_jobs_total{outcome}`, `eg_ingest_dead_letter_total`, from the R001.11 read. | Metrics test scrapes after one success, one retry and one dead letter and asserts the values. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.14 Cross-repo (connector SDK repository): ingest worker runner Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Cross-repo (connector SDK repository): ingest worker runner.** Add a runner module with one function `run_ingest_worker` that claims through the generated client, executes the job body, acks success or failure, and commits only after the ack (at-least-once). The job body reuses the SDK's existing source-effect runners; EG holds no source credentials. | SDK unit test with a fake client asserts ack after execution and no ack when the body is killed. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.15 Cross-repo (connector SDK repository): CLI entry point and autosize Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Cross-repo (connector SDK repository): CLI entry point and autosize.** Add one console command `ingest-worker` with `--workers` (default CPU and memory autosized, 0.36 of cores, 3 GiB per worker) and `--engine-endpoint`; it fails loud with a non-zero exit if the engine is unreachable or lacks the task-queue methods before claiming anything, and drains on SIGTERM. | CLI test asserts exit code 2 against an unreachable engine and clean drain on SIGTERM. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.16 Cross-repo (graph-os): host and supervise the worker Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Cross-repo (graph-os): host and supervise the worker.** graph-os declares the worker as a supervised deployment unit and surfaces its health and the R001.13 metrics through its existing health route. It does not contain job logic. | Graph-os health test asserts a stopped worker shows as unhealthy. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.17 Parity test against the deleted module Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Parity test against the deleted module.** One test enumerates the parity table in plan.md and asserts every row marked exists or to-build has a passing proving test, and rows marked dropped carry a reason. | The test runs in the spec checks. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.1006 Model: catalogue, log and declaration ingest Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model: catalogue, log and declaration ingest.** `eg-ingest` defines `ToolCatalogEntry{server_ref, tool_name, schema_digest, freshness_digest}`, `LogRecord{source_ref, level, at_ms, body_ref}` and `DataPrepDeclaration{field_refs, policy_digest, capability}`. No record holds a credential. Arbora deleted its engine discovery mixin, its log self-ingest and its declaration loader. | Planned: model tests in `crates/eg-ingest/tests/catalog_logs.rs` | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.1007 Behavior: catalogue, log and declaration ingest Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior: catalogue, log and declaration ingest.** A catalogue ingest compares the freshness digest and writes only changed entries, in O(tools). A log batch appends in arrival order. A new declaration replaces the old one in one transaction. | Planned: behavior tests in `crates/eg-ingest/tests/catalog_logs.rs` | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.1008 Wiring: catalogue, log and declaration ingest Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring: catalogue, log and declaration ingest.** The served methods are `ingest.tool_catalog`, `ingest.process_logs` and `ingest.data_prep_declaration`. Each method takes the verified request context and writes through `MutationBatch`. | Planned: a contract test checks that the manifest lists every method. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.1009 Refusal: catalogue, log and declaration ingest Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal: catalogue, log and declaration ingest.** The engine refuses a catalogue entry with inline credentials. It refuses a log batch over 4 MiB. It refuses a declaration that names an import path or an executable. | Planned: refusal tests in `crates/eg-ingest/tests/catalog_logs.rs` | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.1010 Evidence: catalogue, log and declaration ingest Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence: catalogue, log and declaration ingest.** Per batch, the engine reports written, unchanged and refused counts. An unchanged catalogue writes nothing. | Planned: an evidence test reads the counts after one success and one refusal. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R001.1011 Hot-path proof: catalogue, log and declaration ingest Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof: catalogue, log and declaration ingest.** Criterion benchmark `tool_catalog_ingest` ingests 1,000 servers of 50 tools with 16 concurrent writers. The p50 per server is under 2 ms and the p99 under 10 ms, under 128 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress by more than 10 percent. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R002 Ontology induction from text stays a draft until it passes checks (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Ontology induction from text stays a draft until it passes checks (rollup).** The ingest worker must propose classes and properties from unstructured text, then populate instances against that proposal. A proposal must be admitted only after property-coverage and redundancy checks pass. Otherwise it must stay a draft. | Tests prove a passing proposal is admitted and a failing one stays a draft. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R002.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** `crates/eg-types/src/ontology_proposal.rs` must define `OntologyProposal` with classes, properties, a `state` of `Draft` or `Admitted`, and provenance. New proposals must start as `Draft`. | Unit test round-trips a proposal and asserts the initial state. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R002.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** `score_proposal` must compute property coverage and class redundancy. The defaults should be coverage of at least 0.8 and redundancy of at most 0.1, replaced by measurement. | Unit test checks three proposals against both thresholds. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R002.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** The `ingest_document` job body must call `score_proposal` after induction. This row creates the call site in `crates/eg-capabilities/src/ingest_queue.rs`, reached from the runner of R001.14. | Test runs one document job and asserts the check ran. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R002.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** A proposal that fails a check must stay `Draft` and return `PROPOSAL_NOT_ADMITTED` with the failing check. Instances must not populate against it. | Test fails coverage and asserts the draft state and zero instances. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R002.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Each job must record `coverage`, `redundancy` and `decision` in its trace. | Test reads the trace after one admitted and one draft job. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R002.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The entry point is the served ingest queue claim. A worker claims a document job and the passing proposal must reach `Admitted`. | Integration test `tests/ingest_ontology_induction.rs` runs one passing and one failing document and asserts both states. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003 Documents become typed knowledge atoms with mandatory provenance (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Documents become typed knowledge atoms with mandatory provenance (rollup).** The ingest worker must decompose documents and interactions into typed atoms, each with a provenance key. A query must select only relevant atoms to build context. Children `.1` to `.18` cover atoms, normalized documents and transcript records. | Satisfied only when `.1` to `.18` are verified. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** `crates/eg-types/src/knowledge_atom.rs` (new; search terms in `plan.md`) must define `KnowledgeAtom` with `atom_id`, `kind`, `text`, `provenance_key` and `tenant`. The `kind` set is closed: fact, event, preference, procedure. | Unit test round-trips an atom and rejects an unknown kind. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** `decompose(document, policy)` must emit atoms from the parsed chunks of `crates/eg-document/src/contract.rs:141`. `select_atoms(query, atoms, budget)` must rank atoms by relevance and stop at the token budget. Both defaults should be replaced by measurement. | Unit test decomposes one document and selects under a budget. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** The `ingest_document` job body must call `decompose` and store atoms. This row creates the call site in `crates/eg-capabilities/src/ingest_queue.rs`, reached from the runner of R001.14. The context query path must call `select_atoms`. No production caller exists for either function today. | Test runs one document job and asserts atoms exist. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** An atom without a provenance key must return `ATOM_PROVENANCE_MISSING` and must not be stored. A query over zero relevant atoms must return an empty context, not a guess. | Test submits an atom without provenance and asserts the refusal and zero stored atoms. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Each job must record `atoms_emitted`, `atoms_refused` and the context query must record `atoms_selected` and `tokens_used` in its trace. | Test reads the trace after one job and one query. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The entry point is the served ingest queue claim. A worker claims a document job. A later query assembles context from atoms alone and cites each provenance key. | Integration test `tests/ingest_knowledge_atoms.rs` ingests one document, queries it and asserts selected atoms and provenance. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.7 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** The engine must add `NormalizedDocument`, `NormalizationReceipt` and `QuarantineReceipt` in new `crates/eg-types/src/source_document.rs`. They must reuse `SourceIngestionRequest` at `crates/eg-types/src/source_ingestion.rs:265`. Fields must include source digest, mapping revision, document ID, atom IDs and concept IDs. `SourceIngestionOutcome` must distinguish `Accepted(SourceIngestionReceipt)` from `Quarantined(QuarantineReceipt)`. The quarantine receipt must carry a typed reason, restricted evidence reference, replay disposition and optional prior accepted checkpoint. The engine must derive tenant and policy identities from verified server authority. | Planned proving test: `crates/eg-types/src/source_document.rs::tests::document_receipt_round_trips`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.8 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** The engine must validate normalized documents against resolved mappings in `src/server/handlers/source_ingestion.rs`. The named default `complete_document` must require valid structure and provenance for every atom. The default `content_identity` must bind tenant, connector, stream, source record ID and digest. Successful retries must reuse the committed receipt. Validators must consume one resolved mapping snapshot before source admission or graph projection. | Planned proving test: `src/server/handlers/source_ingestion.rs::tests::complete_document_is_idempotent`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.9 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** The engine must extend `prepare` at `src/server/handlers/source_ingestion.rs:155`. Authorization and the authorized committed-replay shortcut at lines 159–170 must remain first. New batches must resolve trusted mappings once at line 174, then validate before reconciliation and admission. The existing caller is `route_source_ingestion_request` at `src/server/dispatch/graph_pipeline/native_routes.rs:408`. It must commit one accepted or quarantine envelope at line 428, then call `finish` at line 429. This row creates the document validator call; no production caller reaches that validator today. | Planned proving test: `src/server/handlers/source_ingestion.rs::tests::prepare_validates_document_after_resolution`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.10 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** The engine must add typed `DocumentIngestError` in `crates/eg-types/src/source_document.rs`. Codes must include `NormalizationFailed`, `MissingProvenance` and `MappingRevisionMismatch`. Normalization failure must produce a prepared quarantine outcome, not an error that bypasses commit. Its envelope must store restricted evidence without accepted projections, source-marker changes or checkpoint advancement. The prior accepted checkpoint must remain unchanged, including `None`. Authorization or commit failure must return refusal without claiming durable quarantine. | Planned proving test: `src/server/handlers/source_ingestion.rs::tests::invalid_document_quarantines_without_partial_graph`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.11 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** The engine must extend `finish` and `prepared_replay` at `src/server/handlers/source_ingestion.rs:1683` and `src/server/handlers/source_ingestion.rs:1791`. They must return the stored typed outcome only after commit or authorized committed replay. Accepted outcomes must retain `SourceIngestionReceipt`; quarantine must not fabricate its mandatory accepted checkpoint. Quarantine evidence must include source digest, mapping revision, rule ID, optional prior checkpoint and committed graph version. Replay must preserve that receipt and must not reset the current source checkpoint. Quarantine detail must omit source text. | Planned proving test: `src/server/handlers/source_ingestion.rs::tests::quarantine_finish_and_replay_preserve_outcome`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.12 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The entry point must be the served `SourceIngest` wire method. `tests/ingest/test_document_normalization_served.py::test_document_batch_is_atomic` must prove accepted replay and zero partial projections for a mixed invalid batch. `test_first_batch_quarantine_and_replay` must prove durable quarantine with prior checkpoint `None`, then replay without another quarantine record. `test_quarantine_preserves_prior_checkpoint` must cover prior acceptance and later successful ingestion before quarantine replay. `test_failed_quarantine_commit_is_not_reported_durable` must reject false durable receipts. `test_quarantine_reads_require_policy` must deny same-tenant unauthorized receipt, provenance and raw-reference reads. | Planned proving test: `tests/ingest/test_document_normalization_served.py::test_document_batch_is_atomic`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.13 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** The engine must add `TranscriptThread` and `TranscriptMessage` in new `crates/eg-types/src/source_transcript.rs`. Fields must include connector, stream, session ID, message ID, role, event time, storage time, concept references and provenance. Roles must be `System`, `User`, `Assistant` or `Tool`. A thread must hold ordered message references. The engine must derive tenant and policy identities from verified server authority. Connector and stream must match the validated source request. | Planned proving test: `crates/eg-types/src/source_transcript.rs::tests::transcript_round_trips`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.14 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** The engine must add `validate_transcript` in new `src/server/handlers/source_ingestion/transcript.rs`. The named default `source_sequence` must preserve source order and distinguish event time from storage time. The default `source_identity` must namespace threads by tenant, connector, stream and session ID. Message identity must also include message ID. IDs must reuse the scoped convention at `src/server/handlers/source_ingestion.rs:2187` with unambiguous record-key encoding. Concept links must reference concepts visible under verified tenant and policy authority. | Planned proving test: `src/server/handlers/source_ingestion/transcript.rs::tests::source_sequence_and_identity_are_preserved`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.15 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** The engine must call `validate_transcript` from `prepare` at `src/server/handlers/source_ingestion.rs:155` after mapping resolution at line 174. It must pass the same resolved mapping snapshot and verified authority into validation and admission. The validator must not resolve mappings again. The existing caller at `src/server/dispatch/graph_pipeline/native_routes.rs:408` must retain its single-envelope commit and authorized committed-replay shortcut. No production caller reaches this new validator today. | Planned proving test: `src/server/handlers/source_ingestion/transcript.rs::tests::prepare_routes_declared_transcript_format`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.16 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** The engine must add typed `TranscriptIngestError` in `crates/eg-types/src/source_transcript.rs`. Codes must include `UnknownFormat`, `MissingEventTime`, `DuplicateMessageConflict` and `ForeignConcept`. The engine must refuse unsupported revisions and conflicting duplicate IDs before graph mutation. It must publish zero thread, message or concept links on refusal. Read authorization must deny transcript text and provenance to unauthorized callers, including callers within the same tenant. Source payloads must not override tenant or policy authority. | Planned proving test: `src/server/handlers/source_ingestion/transcript.rs::tests::unknown_format_and_foreign_concept_are_refused`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.17 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** The engine must extend the receipt projection in `src/server/handlers/source_ingestion/transcript.rs`. It must record connector, stream, source session, source digest, format revision, message count, concept-link count and accepted checkpoint. Each message must retain its source-record reference. Context, provenance and receipt reads must enforce verified tenant and policy authority. Quarantine evidence and raw-content retrieval must enforce their stored policy independently of tenant membership. | Planned proving test: `src/server/handlers/source_ingestion/transcript.rs::tests::receipt_preserves_message_provenance`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.18 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The entry point must be the served `SourceIngest` wire method. `tests/ingest/test_transcript_served.py::test_thread_messages_are_shared_within_scope` must use identical session/message IDs across different connectors and streams. Records must remain distinct; same-source replay must remain idempotent. A second authorized agent must read timestamped messages and concept links. Same-tenant unauthorized callers and other tenants must read neither transcript text nor provenance. Payload authority spoofing and unknown formats must leave graph and checkpoint unchanged. | Planned proving test: `tests/ingest/test_transcript_served.py::test_thread_messages_are_shared_within_scope`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R604 Ingest tasks run through lane-fair queues with reserved workers and stage tiers (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Ingest tasks run through lane-fair queues with reserved workers and stage tiers (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R604.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** `crates/eg-capabilities/src/ingest_lanes.rs` defines Lane, QueueClass{fast, medium, slow_heavy}, SchedulerConfig, WorkerRegistry, LaneMetrics. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R604.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** Tasks map to a lane by kind. They map to a queue class by semantic stage. Source commit is fast. Projection and lexical are medium. Vector and index are slow. Claims rotate across lanes, then by priority bucket inside a lane. The engine refuses a free worker if the claim drops the reserved hot-spare count. The exception is a lane with pending work and no running worker. A lane with an unhealthy model folds onto a healthy lane. The engine exports per-lane depth, oldest age and in-flight count. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R604.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** Extends the claim path of EG-DURABLE-KERNEL-R071 and the floors of EG-INGEST-WORKER-R001.6; the runner asks `AdmitWorkerTask` before every claim. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R604.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** The engine answers a claim that starves the reserve with a retry hint and the lane. It never waits silently. The stable code is `ADMIT_HELD_FOR_RESERVE`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R604.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Gauges eg_lane_depth, eg_lane_oldest_age_seconds, eg_lane_inflight; counter eg_admit_refused_total. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R604.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** claim plus admit under 64 workers and 8 lanes: p50 under 150 us, p99 under 1 ms, no allocation per claim. The benchmark is `benches/r604_ingest_worker.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R605 Queue backends, chunked source drains and graph routing are one durable engine surface (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Queue backends, chunked source drains and graph routing are one durable engine surface (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R605.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** `crates/eg-capabilities/src/drain.rs` defines DrainHandle{drain_id}, PageCheckpoint, GraphRoute, IngestProfile. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R605.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** A full-source drain returns a handle at once. It runs as a chain of bounded page tasks. Each task carries the advanced cursor and enqueues the next while pages remain. One pure policy routes ingestion graph names (source, repository, tenant or default). Shard writers commit in parallel and reads union the routed graphs. Each stage records wall time, token usage and embedding usage. The queue is the engine's durable task queue; no second queue backend exists. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R605.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** Enqueue and ack use EG-DURABLE-KERNEL-R071; `route_graph` is called by SourceIngest before graph resolution. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R605.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** A page task whose cursor is older than the stored checkpoint is dropped and counted, so a redelivery never double-ingests. The stable code is `DRAIN_CURSOR_STALE`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R605.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Per drain: pages, items, cursor, per-stage profile. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R605.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** Page task overhead is p50 under 5 ms and p99 under 25 ms, excluding source reads. The route_graph call takes under 2 us. The benchmark is `benches/r605_ingest_worker.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R606 One materialization path writes every connector's records with provenance, hash filtering and partition routing (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**One materialization path writes every connector's records with provenance, hash filtering and partition routing (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R606.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** `crates/eg-capabilities/src/materialize.rs` defines MaterializeBatch, ContentHash, SourceProvenance, SourcePartition, ExtractorRegistry. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R606.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** Every connector batch converges on one write path. The path normalizes labels and drops records with an unchanged content hash. It stamps source system, source id and ingest time on every node and edge. It places the data in a per-source named graph. Connector rows may also mirror into native engine tables. Extractor modules self-register by category, and the written set is reported per category. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R606.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** SourceIngest is the sole write path; the SDK vendor extractors of SDK-SOURCE-INGEST-R006 emit the batches. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R606.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** A batch without a source system is refused whole. The stable code is `MATERIALIZE_NO_PROVENANCE`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R606.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Per batch: written, unchanged, refused. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R606.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** hash filter of 100k records: p50 under 120 ms, p99 under 300 ms, memory under 64 MiB. The benchmark is `benches/r606_ingest_worker.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R700 Multi-modal readers produce typed fragments with span provenance (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Multi-modal readers produce typed fragments with span provenance (rollup).** Readers turn PDF, office (email, presentation, spreadsheet), HTML, delimited text, audio transcript and scanned-image OCR into fragments. Each fragment carries source span provenance. Each format has one bounded, license-approved path. Implemented in eg-ingest. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R700.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** `Fragment { source, span, text, modality }` and `ReaderRegistry` keyed by media type in `crates/eg-ingest`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R700.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** Readers stream per file with a fixed per-reader memory bound. Page and sheet readers are independent. They run in parallel up to the worker lane limit. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R700.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** Run by the ingest worker queue (R001); results enter the atom pipeline (R003). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R700.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** The engine refuses a file over the size bound, an encrypted document or an unsupported media type. The refusal carries a typed code. The engine does not skip the file. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R700.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Each fragment is traceable to byte or page span. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R700.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/ingest/test_readers_served.py::test_each_format_yields_spanned_fragments` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/reader_pdf.rs` must show p50 under 20 ms and p99 under 120 ms with peak memory under 128 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R701 Fact and claim extraction is grounded to the ontology and repaired by direction (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Fact and claim extraction is grounded to the ontology and repaired by direction (rollup).** Text routed as prose yields atomic facts and candidate claims with evidence spans. Each fact is grounded to ontology classes and properties. Its relation direction is repaired from domain and range. The engine drops duplicates incrementally and aggregates confidence. The language-model call itself runs in the worker runner, not in the engine. Implemented in eg-ingest, eg-reason. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R701.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** `ExtractedFact`, `CandidateClaim`, `EvidenceSpan` and `GroundingResult` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R701.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** Grounding is a lookup against the compiled ontology cache (UDP R035). Direction repair swaps subject and object when only the swapped pair satisfies domain and range. The deduper is an incremental hash set. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R701.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** Structure routing (prose or structured) precedes extraction; results commit as atoms with mandatory provenance (R003). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R701.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** A fact without an evidence span is refused. A fact that grounds to no class stays an ungrounded claim. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R701.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Outcome per unit (created, updated, unchanged, rejected) is recorded with the content hash. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R701.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/ingest/test_fact_grounding_served.py::test_direction_repair_and_ungrounded_claims` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/fact_grounding.rs` must show p50 under 2 ms and p99 under 12 ms with peak memory under 48 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R702 Near-duplicate detection with a locality-sensitive index (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Near-duplicate detection with a locality-sensitive index (rollup).** The engine fingerprints documents and chunks with MinHash and indexes them by banded locality-sensitive hashing. This finds near duplicates without comparing all pairs. The engine deduplicates knowledge before it enters the graph. Implemented in eg-vector, eg-ingest. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R702.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** `MinHashSignature` and `LshIndex { bands, rows }` in `crates/eg-vector`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R702.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** Insert and query are O(bands). Memory is O(documents x bands). The Jaccard threshold is configurable. The engine reports the false-negative rate. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R702.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** Used at ingest admission before enrichment is scheduled (R006). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R702.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** A duplicate above threshold is linked, not stored twice. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R702.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Each link stores the estimated similarity. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R702.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/ingest/test_lsh_dedup_served.py::test_near_duplicates_link_and_distinct_pass` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/lsh_index.rs` must show p50 under 1 ms and p99 under 5 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.700 Knowledge-base run outcomes, entity and claim extraction, link inference and note-vault sync: model and behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Knowledge-base run outcomes, entity and claim extraction, link inference and note-vault sync: model and behavior.** Each extraction unit gets a deterministic outcome (created, updated, unchanged, rejected) from its content hash. The engine classifies entities, claims and relationships. It links them by inference over shared mentions. A note vault syncs incrementally by file hash. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R003.701 Knowledge-base run outcomes, entity and claim extraction, link inference and note-vault sync: refusal, evidence and hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Knowledge-base run outcomes, entity and claim extraction, link inference and note-vault sync: refusal, evidence and hot-path proof.** A unit without provenance is rejected; a link below the calibrated threshold is not created. Test `tests/ingest/test_kb_outcomes_served.py::test_unchanged_content_is_unchanged`; benchmark `benches/kb_outcomes.rs` p50 under 2 ms and p99 under 10 ms per document, memory under 48 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R910 Source ingest content versions chain per stream (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Source ingest content versions chain per stream (rollup).** The engine must version source content per connector stream, not per batch. A second batch on one stream must admit. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R910.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** The content version object id must derive from tenant, connector, source and stream. The batch id `source-ingest:<digest>` at `src/server/handlers/source_ingestion.rs:162` must not name the object. | `crates/eg-types` unit test `stream_content_version_id_is_stable` builds two batches of one stream and asserts one object id. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R910.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** The first batch of a stream must carry no previous digest. Each later batch must name the digest of the prior batch on that stream. A batch with equal content must count as unchanged and write nothing. | Test submits three batches on one stream and asserts admitted, admitted and unchanged. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R910.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** `admit_records` in `src/server/handlers/source_ingestion.rs` must stamp the stream object id. The content check at `src/redb_store/store_state.rs:481` must read the stream chain. The SDK runner of SDK-SOURCE-INGEST-R004.20 reaches this path. | Test drives two served `SourceIngest` batches and asserts no `STALE_CONTENT_VERSION`. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R910.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** A batch whose previous digest differs from the stored stream head must refuse with `STALE_CONTENT_VERSION`. A refused batch writes nothing. | Test races two writers on one stream and asserts one refusal and no partial write. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R910.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** The receipt must name the stream object id, the previous digest and the new digest. | Test reads the receipt after two batches and compares the digest chain. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R910.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The entry point is the served `SourceIngest` method. The test submits two batches on one stream, as ARBORA-OPS-R020.6.6 does. Version chaining for 10k records must stay under 20 ms p99. The benchmark is `benches/r910_stream_content_version.rs`. | `tests/test_source_stream_versions_served.py::test_second_batch_on_one_stream_admits` passes, and the benchmark meets the budget. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R900 Source records enforce the governance properties that connectors send (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Source records enforce the governance properties that connectors send (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R900.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** `crates/eg-types/src/source_governance.rs` defines `RecordGovernance` with `classification`, `retention`, `legal_hold`, `access_public`, `access_read_roles` and `access_markings`. `Classification` is a closed enum: public, internal, confidential, restricted. Read roles and markings are bounded sorted sets of at most 256 entries each. | Unit test round-trips the type and rejects an unknown classification. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R900.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** Admission parses `RecordGovernance` from the reserved properties of each `SourceRecord`. It writes one ACL and the markings for the record node. The node then carries its retention and legal hold. A public classification must match `access_public`. Parsing is O(p) in the property count and holds no lock. | Unit tests cover public, restricted, marked and legal-hold records. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R900.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** `admit_records` in `src/server/handlers/source_ingestion.rs` calls the parser before the projection. The SDK sources of SDK-SOURCE-INGEST-R901 and SDK-SOURCE-INGEST-R900 send these properties. No other caller writes record ACLs from a connector. | Test drives `SourceIngest` and asserts the ACL exists before the projection. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R900.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** A record whose classification and public flag disagree is refused with `SOURCE_GOVERNANCE_CONFLICT`. A record without retention under a retention-required policy is refused with `SOURCE_RETENTION_MISSING`. A refused record writes nothing. | Test submits each invalid record and asserts the code and zero writes. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R900.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Each batch records governed, refused and marked counts in the receipt. | Test reads the receipt after one success and one refusal. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R900.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** Governance parsing of 10k records: p50 under 15 ms, p99 under 40 ms, memory under 16 MiB. The benchmark is `benches/r900_source_governance.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R901 Source records may carry a row-version evidence locus (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Source records may carry a row-version evidence locus (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R901.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** The admission path reuses the `RowVersion { row_ref, version }` locus of `crates/eg-modality/src/artifact.rs`. `SourceRowVersion` adds the table reference and the evidence digest. All references are opaque. | Unit test round-trips the type and rejects an empty table reference. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R901.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** A record can name its table and an integer version. Admission then stores the row text as an evidence artifact with that locus. A later version of the same row supersedes the earlier one. The store is O(1) per record. | Unit tests cover a first version, a newer version and a replayed version. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R901.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** `admit_records` stores the locus after the record commits. The SDK database source of SDK-SOURCE-INGEST-R900 refuses its `table` option until this row is verified. | Test drives `SourceIngest` with a versioned record and reads the locus back. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R901.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** A non-integer or decreasing version is refused with `ROW_VERSION_INVALID` and stores no evidence. | Test submits each invalid version and asserts the code. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R901.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Each batch records stored, superseded and refused evidence counts. | Test reads the receipt after one success and one refusal. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R901.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** Locus storage for 10k rows: p50 under 60 ms, p99 under 150 ms, memory under 32 MiB. The benchmark is `benches/r901_row_version.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R902 Source permission and group sync (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Source permission and group sync (rollup).** The engine must refresh the access of held source records without a content re-ingest. It must hold the group membership of each source. Retrieval expands groups at query time, so a membership change applies without a record rewrite. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R902.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** Add `AccessSnapshot{source, record_ref, access_public, read_principals, read_groups, synced_at}` and `SourceGroup{source, group_id, members, synced_at}` in `crates/eg-types/src/source_governance.rs`. | `crates/eg-types/tests/source_governance.rs::access_snapshot_round_trips` round-trips both records. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R902.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** An access-only batch replaces the ACL of each named record as a new version. It never touches content, vectors or edges. A group batch replaces the member set of each group. A record whose access is older than its source bound becomes `acl_stale`. The default bound is 3,600 s. | `crates/eg-core/tests/source_permission_sync.rs::access_batch_leaves_content_unchanged` compares content digests before and after. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R902.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** `admit_records` in `src/server/handlers/source_ingestion.rs` routes a batch of kind `access` or `groups` to the new path. The SDK permission sync of `SDK-SOURCE-INGEST-R805` sends these batches. The read-RLS gate of EG-DURABLE-KERNEL-R029 expands groups. | `tests/test_source_permission_sync_served.py::test_group_change_applies_without_rewrite` deletes a member and observes a denied read. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R902.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** An access batch for an unknown record must refuse that record with `SOURCE_RECORD_UNKNOWN`. A group with more than 100,000 members must refuse with `SOURCE_GROUP_TOO_LARGE`. A refusal writes nothing for that item. | `tests/test_source_permission_sync_served.py::test_permission_sync_refusals` asserts both codes. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R902.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Each batch receipt counts updated, refused and stale records. A restricted record in `acl_stale` state must fail closed on retrieval. | `tests/test_source_permission_sync_served.py::test_stale_restricted_record_fails_closed` ages one record past the bound. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R902.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The entry point is the served `SourceIngest`. The benchmark `benches/source_permission_sync.rs` applies 100,000 access updates. The p99 per 1,000-record batch stays under 20 ms. A group expansion on read adds under 50 microseconds at p99. | `cargo bench --bench source_permission_sync` fails on a 10 percent regression. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R903 Source deletion reconciliation (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Source deletion reconciliation (rollup).** The engine must delete held records that their source no longer holds. It compares an identifier-only enumeration with the held set. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R903.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** Add `SourceEnumeration{source, run_id, ids_digest, complete}` and `ReconcilePlan{source, missing, grace_until}` in `crates/eg-types/src/source_governance.rs`. | `crates/eg-types/tests/source_governance.rs::reconcile_plan_round_trips` round-trips both records. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R903.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** A complete enumeration yields the held identifiers that it lacks. Each missing record enters a grace window of 86,400 s by default. After the window, the engine deletes it through the cascade of EG-UNIFIED-DATA-PLANE-R651. A record that reappears leaves the plan. | `crates/eg-core/tests/source_reconcile.rs::missing_records_delete_after_grace` advances the clock past the window. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R903.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** `admit_records` in `src/server/handlers/source_ingestion.rs` accepts a batch of kind `enumeration`. The SDK identifier enumeration of `SDK-SOURCE-INGEST-R805` sends it. | `tests/test_source_reconcile_served.py::test_enumeration_prunes_deleted_record` deletes one source record and observes the prune. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R903.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** An incomplete enumeration must never delete. A plan that deletes more than 20 percent of a source must refuse with `SOURCE_MASS_DELETE_GUARD`. An admin override lifts the guard. | `tests/test_source_reconcile_served.py::test_mass_delete_guard_refuses` enumerates an empty set. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R903.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** The receipt names the enumeration digest, the missing count, the deleted count and the override principal. | `tests/test_source_reconcile_served.py::test_reconcile_receipt_reads_back` compares every field. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R903.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/source_reconcile.rs` compares an enumeration of 1M identifiers with 1M held records. It stays under 2 s and 256 MiB. | `cargo bench --bench source_reconcile` fails on a 10 percent regression. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R904 Source container hierarchy (rollup) Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Source container hierarchy (rollup).** The engine must hold the container tree of a source, such as spaces, folders and channels. A record links to its container. A scope filter may name a container subtree. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R904.1 Model Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Model.** Add `:SourceContainer` with `containedIn` and `inContainer` edges to `crates/eg-core/ontology/sdd-v1.ttl`. Add `SourceContainer{source, container_id, parent_id, title}` in `crates/eg-types/src/source_governance.rs`. | `crates/eg-types/tests/source_governance.rs::container_round_trips` round-trips a container. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R904.2 Behavior Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Behavior.** A container batch upserts nodes and parent edges. A subtree query returns the container and its descendants to depth 32. | `crates/eg-core/tests/source_hierarchy.rs::subtree_returns_descendants` checks a three-level fixture. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R904.3 Wiring Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Wiring.** `admit_records` accepts a batch of kind `containers`. The SDK hierarchy declaration of `SDK-SOURCE-INGEST-R805` sends it. EG-FEDERATED-QUERY-R704 reads the subtree. | `tests/test_source_hierarchy_served.py::test_containers_ingest_and_scope` ingests a tree and scopes a search to one folder. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R904.4 Refusal Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Refusal.** A parent cycle must refuse with `SOURCE_CONTAINER_CYCLE`. A depth over 32 must refuse with `SOURCE_CONTAINER_TOO_DEEP`. | `tests/test_source_hierarchy_served.py::test_container_refusals` asserts both codes. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R904.5 Evidence Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Evidence.** Each container records its source path and sync time. A readback must equal the written tree. | `tests/test_source_hierarchy_served.py::test_container_tree_reads_back` compares the tree. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-INGEST-WORKER-R904.6 Hot-path proof Definition — EG-INGEST-WORKER / EG-INGEST-WORKER — Durable ingest workerCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/source_hierarchy.rs` resolves a subtree of 10,000 containers. The p99 stays under 5 ms. | `cargo bench --bench source_hierarchy` fails on a 10 percent regression. | requirement | EG-INGEST-WORKER | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB EG-MEDIA-VOCAB — Media and personal-content vocabulary | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001 Shared media ontology Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Shared media ontology.** `crates/eg-core/ontology/media-v1.ttl` defines media classes and properties. It reuses core terms. The vocabulary covers `{work, series, season, episode, album, track, audiobook, podcast, game, ROM, library, library item, media file, playback session, download request, transfer, indexer, broadcast, viewer sample, transcript segment}`. Children R001.1-.6 remain mandatory. Children R001.100-.102 add authorized tags, transcript/summary provenance, and bookmark search/relationships. | Preserve every landed child. Close extensions only with producer/consumer acceptance. Infer no provider or export receipt. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001.1 Add `mv:MediaWork` (⊑ `:CreativeWork`) with `mv:Film`, `mv:TelevisionSeries`, `mv:TelevisionSeason`, `mv:TelevisionEpisode`, `mv:MusicAlbum`, `mv:MusicTrack`, `mv:Audiobook`, `mv:PodcastShow`, `mv:PodcastEpisode`, `mv:Game` to media-v1.ttl Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd `mv:MediaWork` (⊑ `:CreativeWork`) with `mv:Film`, `mv:TelevisionSeries`, `mv:TelevisionSeason`, `mv:TelevisionEpisode`, `mv:MusicAlbum`, `mv:MusicTrack`, `mv:Audiobook`, `mv:PodcastShow`, `mv:PodcastEpisode`, `mv:Game` to media-v1.ttl. | Test: ontology load test asserts each class and its subClassOf path to `:CreativeWork`. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001.2 Add `mv:MediaLibrary`, `mv:LibraryItem` (links a work to a library, `mv:itemOf`, `mv:inLibrary`), `mv:MediaFile`, `mv:RomFile`, `mv:GamePlatform`, `mv:MusicArtist` (⊑ `:Organization`) to media-v1.ttl Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd `mv:MediaLibrary`, `mv:LibraryItem` (links a work to a library, `mv:itemOf`, `mv:inLibrary`), `mv:MediaFile`, `mv:RomFile`, `mv:GamePlatform`, `mv:MusicArtist` (⊑ `:Organization`) to media-v1.ttl. | Test: ontology load test. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001.3 Add `mv:PlaybackSession` (⊑ `:Session`) with `mv:playedBy`, `mv:lastPlayedAt`, `mv:playCount`, `mv:playbackPositionSeconds`, and `mv:BroadcastStream` (⊑ `:Event`) with `mv:ViewerSample`, `mv:viewerCount`, `mv:sampledAt`, `mv:lastConnectAt` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd `mv:PlaybackSession` (⊑ `:Session`) with `mv:playedBy`, `mv:lastPlayedAt`, `mv:playCount`, `mv:playbackPositionSeconds`, and `mv:BroadcastStream` (⊑ `:Event`) with `mv:ViewerSample`, `mv:viewerCount`, `mv:sampledAt`, `mv:lastConnectAt`. | Test: ontology load test; domain and range check. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001.4 Add `mv:DownloadRequest` (states requested, wanted, grabbed, importing, imported, failed), `mv:DownloadTransfer`, `mv:GrabEvent`, `mv:MediaIndexer` and properties `mv:requestsWork`, `mv:transferOf`, `mv:grabbedFromIndexer`, `mv:transferState`, `mv:shareRatio`, `mv:lastActivityAt`, `mv:addedAt` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd `mv:DownloadRequest` (states requested, wanted, grabbed, importing, imported, failed), `mv:DownloadTransfer`, `mv:GrabEvent`, `mv:MediaIndexer` and properties `mv:requestsWork`, `mv:transferOf`, `mv:grabbedFromIndexer`, `mv:transferState`, `mv:shareRatio`, `mv:lastActivityAt`, `mv:addedAt`. | Test: ontology load test. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001.5 Add `mv:TranscriptSegment` (part of the existing `:Transcript` in personal-v1.ttl: reuse, do not redefine) with `mv:segmentStart`, `mv:segmentEnd`, `mv:noSpeechProb`, `mv:transcriptOf` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd `mv:TranscriptSegment` (part of the existing `:Transcript` in personal-v1.ttl: reuse, do not redefine) with `mv:segmentStart`, `mv:segmentEnd`, `mv:noSpeechProb`, `mv:transcriptOf`. | Test: ontology load test asserts `:Transcript` is not redefined in media-v1.ttl. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001.6 Resolve the two name collisions: connector packages declare `:Episode` (TV) and `:Author` in the shared `:` namespace, while core-foundation-v1.ttl already defines `:Episode` (interaction unit) and software-v1.ttl `:Author` (git author). media-v1.ttl uses `mv:TelevisionEpisode`; cross-repo rows EG-MEDIA-VOCAB-R032 and EG-MEDIA-VOCAB-R033 move the connectors onto it Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceResolve the two name collisions: connector packages declare `:Episode` (TV) and `:Author` in the shared `:` namespace, while core-foundation-v1.ttl already defines `:Episode` (interaction unit) and software-v1.ttl `:Author` (git author). media-v1.ttl uses `mv:TelevisionEpisode`; cross-repo rows EG-MEDIA-VOCAB-R032 and EG-MEDIA-VOCAB-R033 move the connectors onto it. | Test: collision test lists every duplicate class IRI across ontology/*.ttl and the baseline names exactly the two connector aliases. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R002 Content-channel vocabulary: content-v1.ttl Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Content-channel vocabulary: content-v1.ttl.** crates/eg-core/ontology/content-v1.ttl defines feed, article, research paper, search query and result, social post and channel, email campaign, mailing list, subscriber, message channel and chat message. Children R002.1 to R002.4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R002.1 Add `cv:Feed`, `cv:FeedSubscription`, `cv:Article` (⊑ `:Document`), `cv:ResearchPaper` (⊑ `:Document`, seeAlso `bibo:AcademicArticle`), `cv:SearchQuery`, `cv:SearchResult`, `cv:SearchEngine` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd `cv:Feed`, `cv:FeedSubscription`, `cv:Article` (⊑ `:Document`), `cv:ResearchPaper` (⊑ `:Document`, seeAlso `bibo:AcademicArticle`), `cv:SearchQuery`, `cv:SearchResult`, `cv:SearchEngine`. | Test: ontology load test. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R002.2 Add `cv:SocialPost`, `cv:PublishingChannel`, `cv:EngagementMetric`, `cv:EmailCampaign`, `cv:MailingList`, `cv:Subscriber` (opaque identity), with `cv:sentCount`, `cv:viewCount`, `cv:clickCount`, `cv:postState`, `cv:subscriptionStatus` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd `cv:SocialPost`, `cv:PublishingChannel`, `cv:EngagementMetric`, `cv:EmailCampaign`, `cv:MailingList`, `cv:Subscriber` (opaque identity), with `cv:sentCount`, `cv:viewCount`, `cv:clickCount`, `cv:postState`, `cv:subscriptionStatus`. | Test: ontology load test. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R002.3 Add `cv:MessageChannel` and `cv:ChatMessage`; reuse existing `kg:Team` from core-foundation-v1.ttl without redeclaration, with `cv:memberCount`, `cv:lastPostAt`, `cv:postedAt`, `cv:postedBy` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd `cv:MessageChannel` and `cv:ChatMessage`; reuse existing `kg:Team` from core-foundation-v1.ttl without redeclaration, with `cv:memberCount`, `cv:lastPostAt`, `cv:postedAt`, `cv:postedBy`. | Test: ontology load test. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R002.4 Add content properties `cv:publishedAt`, `cv:isRead`, `cv:feedUrl`, `cv:resultUrl`, `cv:rank`, `cv:servedByEngine`, `cv:doi`, `cv:arxivId`, `cv:citationCount` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd content properties `cv:publishedAt`, `cv:isRead`, `cv:feedUrl`, `cv:resultUrl`, `cv:rank`, `cv:servedByEngine`, `cv:doi`, `cv:arxivId`, `cv:citationCount`. | Test: ontology load test. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R003 Cross-source identity keys Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-source identity keys.** Shared join keys so independent connectors meet on one IRI: `mv:tmdbId`, `mv:tvdbId`, `mv:imdbId`, `mv:musicBrainzId`, `mv:isbn`, `mv:infoHash`, `cv:canonicalUrl`, `mv:contentSha256`. Children R003.1 to R003.3. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R003.1 Declare the eight key properties as datatype correlation properties in media-v1.ttl and content-v1.ttl, without global inverse-functionality. Work identity keys include the class and provider namespace (Film and TelevisionSeries IDs cannot collide). Article identity uses its class-scoped normalized canonical URL. SearchResult uses source, query and native result key; SocialPost and EmailCampaign retain source-native IDs. Shared target URLs support joins without identifying the result, post, campaign and document as one entity. Repeated reads of the same source-native key upsert the same entity Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceDeclare the eight key properties as datatype correlation properties in media-v1.ttl and content-v1.ttl, without global inverse-functionality. Work identity keys include the class and provider namespace (Film and TelevisionSeries IDs cannot collide). Article identity uses its class-scoped normalized canonical URL. SearchResult uses source, query and native result key; SocialPost and EmailCampaign retain source-native IDs. Shared target URLs support joins without identifying the result, post, campaign and document as one entity. Repeated reads of the same source-native key upsert the same entity. | Test: equal URLs across Article, two queries' SearchResults and two SocialPosts preserve distinct records and their provenance; repeated same-key reads are idempotent; Film and TelevisionSeries with the same numeric provider ID remain distinct. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R003.2 Specify normalisation (infoHash lower-case hex; canonicalUrl via scheme/host lower-case, tracking parameters and fragment stripped) as an `rdfs:comment` and a fixture table Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceSpecify normalisation (infoHash lower-case hex; canonicalUrl via scheme/host lower-case, tracking parameters and fragment stripped) as an `rdfs:comment` and a fixture table. | Test: normalisation fixture table passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R003.3 Add the keyed-hash identity rule for email-derived joins (`cv:subscriberKey`), never storing the raw address Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the keyed-hash identity rule for email-derived joins (`cv:subscriberKey`), never storing the raw address. | Test: SHACL rejects a `cv:Subscriber` carrying a raw address property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R004 SHACL shapes Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**SHACL shapes.** Shapes in media-v1.shapes.ttl and content-v1.shapes.ttl. Children R004.1 to R004.4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R004.1 Shape: `mv:Film`/`mv:TelevisionSeries` carry at least one of `mv:tmdbId`, `mv:tvdbId`, `mv:imdbId` when sourced from a connector Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceShape: `mv:Film`/`mv:TelevisionSeries` carry at least one of `mv:tmdbId`, `mv:tvdbId`, `mv:imdbId` when sourced from a connector. | Test: SHACL pass and fail fixture. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R004.2 Shape: `mv:DownloadTransfer` has exactly one `mv:infoHash` matching `^[0-9a-f]{40}$` or `^[0-9a-f]{64}$` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceShape: `mv:DownloadTransfer` has exactly one `mv:infoHash` matching `^[0-9a-f]{40}$` or `^[0-9a-f]{64}$`. | Test: SHACL pass and fail fixture. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R004.3 Shape: `mv:DownloadRequest` `mv:downloadRequestState` in the closed set (requested, wanted, grabbed, importing, imported, failed) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceShape: `mv:DownloadRequest` `mv:downloadRequestState` in the closed set (requested, wanted, grabbed, importing, imported, failed). | Test: SHACL pass and fail fixture. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R004.4 Shape: `cv:Article`, `cv:SearchResult` carry exactly one normalised `cv:canonicalUrl`; shapes are aggregate-free per the virtual-graph shapes convention Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceShape: `cv:Article`, `cv:SearchResult` carry exactly one normalised `cv:canonicalUrl`; shapes are aggregate-free per the virtual-graph shapes convention. | Test: SHACL pass and fail fixture. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R005 arr virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**arr virtual-graph mapping.** Mapping table for the `arr` connector (arr-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R005`. Children R005.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R005.1 Add the `arr` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `arr` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R005.2 Add the `arr` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R005.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `arr` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R005.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R005.3 Add the test that answers the `arr` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `arr` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R005.4 Update `EG-CQ-CONN-R005` vocabulary column from MISSING to media-v1 / content-v1 once R005.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R005` vocabulary column from MISSING to media-v1 / content-v1 once R005.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R006 jellyfin virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**jellyfin virtual-graph mapping.** Mapping table for the `jellyfin` connector (jellyfin-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R027`. Children R006.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R006.1 Add the `jellyfin` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `jellyfin` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R006.2 Add the `jellyfin` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R027.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `jellyfin` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R027.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R006.3 Add the test that answers the `jellyfin` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `jellyfin` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R006.4 Update `EG-CQ-CONN-R027` vocabulary column from MISSING to media-v1 / content-v1 once R006.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R027` vocabulary column from MISSING to media-v1 / content-v1 once R006.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R007 audiobookshelf virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**audiobookshelf virtual-graph mapping.** Mapping table for the `audiobookshelf` connector (audiobookshelf-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R007`. Children R007.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R007.1 Add the `audiobookshelf` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `audiobookshelf` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R007.2 Add the `audiobookshelf` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R007.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `audiobookshelf` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R007.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R007.3 Add the test that answers the `audiobookshelf` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `audiobookshelf` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R007.4 Update `EG-CQ-CONN-R007` vocabulary column from MISSING to media-v1 / content-v1 once R007.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R007` vocabulary column from MISSING to media-v1 / content-v1 once R007.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R008 qbittorrent virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**qbittorrent virtual-graph mapping.** Mapping table for the `qbittorrent` connector (qbittorrent-agent): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R051`. Children R008.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R008.1 Add the `qbittorrent` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `qbittorrent` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R008.2 Add the `qbittorrent` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R051.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `qbittorrent` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R051.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R008.3 Add the test that answers the `qbittorrent` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `qbittorrent` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R008.4 Update `EG-CQ-CONN-R051` vocabulary column from MISSING to media-v1 / content-v1 once R008.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R051` vocabulary column from MISSING to media-v1 / content-v1 once R008.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R009 rom-manager virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**rom-manager virtual-graph mapping.** Mapping table for the `rom-manager` connector (rom-manager): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R053`. Children R009.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R009.1 Add the `rom-manager` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `rom-manager` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R009.2 Add the `rom-manager` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R053.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `rom-manager` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R053.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R009.3 Add the test that answers the `rom-manager` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `rom-manager` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R009.4 Update `EG-CQ-CONN-R053` vocabulary column from MISSING to media-v1 / content-v1 once R009.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R053` vocabulary column from MISSING to media-v1 / content-v1 once R009.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R010 owncast virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**owncast virtual-graph mapping.** Mapping table for the `owncast` connector (owncast-agent): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R045`. Children R010.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R010.1 Add the `owncast` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `owncast` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R010.2 Add the `owncast` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R045.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `owncast` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R045.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R010.3 Add the test that answers the `owncast` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `owncast` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R010.4 Update `EG-CQ-CONN-R045` vocabulary column from MISSING to media-v1 / content-v1 once R010.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R045` vocabulary column from MISSING to media-v1 / content-v1 once R010.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R011 media-downloader virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**media-downloader virtual-graph mapping.** Mapping table for the `media-downloader` connector (media-downloader): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R038`. Children R011.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R011.1 Add the `media-downloader` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `media-downloader` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R011.2 Add the `media-downloader` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R038.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `media-downloader` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R038.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R011.3 Add the test that answers the `media-downloader` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `media-downloader` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R011.4 Update `EG-CQ-CONN-R038` vocabulary column from MISSING to media-v1 / content-v1 once R011.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R038` vocabulary column from MISSING to media-v1 / content-v1 once R011.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R012 audio-transcriber virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**audio-transcriber virtual-graph mapping.** Mapping table for the `audio-transcriber` connector (audio-transcriber): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R008`. Children R012.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R012.1 Add the `audio-transcriber` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `audio-transcriber` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R012.2 Add the `audio-transcriber` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R008.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `audio-transcriber` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R008.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R012.3 Add the test that answers the `audio-transcriber` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `audio-transcriber` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R012.4 Update `EG-CQ-CONN-R008` vocabulary column from MISSING to media-v1 / content-v1 once R012.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R008` vocabulary column from MISSING to media-v1 / content-v1 once R012.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R013 freshrss virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**freshrss virtual-graph mapping.** Mapping table for the `freshrss` connector (freshrss-agent): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R022`. Children R013.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R013.1 Add the `freshrss` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `freshrss` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R013.2 Add the `freshrss` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R022.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `freshrss` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R022.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R013.3 Add the test that answers the `freshrss` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `freshrss` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R013.4 Update `EG-CQ-CONN-R022` vocabulary column from MISSING to media-v1 / content-v1 once R013.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R022` vocabulary column from MISSING to media-v1 / content-v1 once R013.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R014 scholarx virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**scholarx virtual-graph mapping.** Mapping table for the `scholarx` connector (scholarx): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R055`. Children R014.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R014.1 Add the `scholarx` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `scholarx` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R014.2 Add the `scholarx` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R055.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `scholarx` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R055.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R014.3 Add the test that answers the `scholarx` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `scholarx` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R014.4 Update `EG-CQ-CONN-R055` vocabulary column from MISSING to media-v1 / content-v1 once R014.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R055` vocabulary column from MISSING to media-v1 / content-v1 once R014.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R015 searxng virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**searxng virtual-graph mapping.** Mapping table for the `searxng` connector (searxng-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R056`. Children R015.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R015.1 Add the `searxng` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `searxng` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R015.2 Add the `searxng` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R056.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `searxng` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R056.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R015.3 Add the test that answers the `searxng` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `searxng` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R015.4 Update `EG-CQ-CONN-R056` vocabulary column from MISSING to media-v1 / content-v1 once R015.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R056` vocabulary column from MISSING to media-v1 / content-v1 once R015.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R016 pulselink virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**pulselink virtual-graph mapping.** Mapping table for the `pulselink` connector (pulselink-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R050`. Children R016.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R016.1 Add the `pulselink` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `pulselink` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R016.2 Add the `pulselink` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R050.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `pulselink` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R050.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R016.3 Add the test that answers the `pulselink` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `pulselink` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R016.4 Update `EG-CQ-CONN-R050` vocabulary column from MISSING to media-v1 / content-v1 once R016.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R050` vocabulary column from MISSING to media-v1 / content-v1 once R016.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R017 postiz virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**postiz virtual-graph mapping.** Mapping table for the `postiz` connector (postiz-agent): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R049`. Children R017.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R017.1 Add the `postiz` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `postiz` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R017.2 Add the `postiz` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R049.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `postiz` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R049.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R017.3 Add the test that answers the `postiz` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `postiz` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R017.4 Update `EG-CQ-CONN-R049` vocabulary column from MISSING to media-v1 / content-v1 once R017.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R049` vocabulary column from MISSING to media-v1 / content-v1 once R017.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R018 listmonk virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**listmonk virtual-graph mapping.** Mapping table for the `listmonk` connector (listmonk-api): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R035`. Children R018.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R018.1 Add the `listmonk` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `listmonk` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R018.2 Add the `listmonk` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R035.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `listmonk` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R035.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R018.3 Add the test that answers the `listmonk` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `listmonk` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R018.4 Update `EG-CQ-CONN-R035` vocabulary column from MISSING to media-v1 / content-v1 once R018.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R035` vocabulary column from MISSING to media-v1 / content-v1 once R018.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R019 mattermost virtual-graph mapping Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**mattermost virtual-graph mapping.** Mapping table for the `mattermost` connector (mattermost-mcp): operation -> class/property -> contract kind, as `vg:VirtualMapping` rows with `vg:sourceKind` mcp, plus question outcomes for `EG-CQ-CONN-R036`. Children R019.1 to .4. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R019.1 Add the `mattermost` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `mattermost` `vg:VirtualMapping` source file (operation to class/property rows listed in plan.md section Connector mapping tables) as a mapping fixture under crates/eg-core/tests. | Test: mapping loads and every row names an existing class or property. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R019.2 Add the `mattermost` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R036.1` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the `mattermost` fixture (recorded tool response) for its single-source question for `EG-CQ-CONN-R036.1`. | Test: fixture round-trips through the mapping. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R019.3 Add the test that answers the `mattermost` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceAdd the test that answers the `mattermost` single-source question from the fixture, or returns the typed abstention naming the missing operation for the BLOCKED part. | Test: `connector-specific media_vocab_<connector>_single` passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R019.4 Update `EG-CQ-CONN-R036` vocabulary column from MISSING to media-v1 / content-v1 once R019.1 is LANDED (wire one call site: specs/connector-competency/design.md) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceUpdate `EG-CQ-CONN-R036` vocabulary column from MISSING to media-v1 / content-v1 once R019.1 is LANDED (wire one call site: specs/connector-competency/design.md). | Test: connector-competency docs-truth check passes. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R020 Cross-source worked examples Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-source worked examples.** Two federated examples run by the existing federated query planner (specs/federated-query-and-reasoning), not new routing. Children .1 and .2. | Children LANDED. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R020.1 Fixture and test: 'Which requested films are downloaded but not yet in the library?' across arr, qbittorrent, jellyfin. Returns the film set difference with provenance per leg Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceFixture and test: 'Which requested films are downloaded but not yet in the library?' across arr, qbittorrent, jellyfin. Returns the film set difference with provenance per leg. | Test: `media_vocab_films_downloaded_not_in_library`. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R020.2 Fixture and test: 'Which feed articles are not archived and have no matching search result?' across freshrss, searxng, archivebox on `cv:canonicalUrl` Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification sourceFixture and test: 'Which feed articles are not archived and have no matching search result?' across freshrss, searxng, archivebox on `cv:canonicalUrl`. | Test: `media_vocab_articles_unarchived`. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R021 Cross-repo, owner arr-mcp: per-title 'last searched indexer' (Radarr/Sonarr keep no per-title search log; Prowlarr history is query-keyed, not title-keyed): add a prowlarr_action history-by-title projection Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner arr-mcp: per-title 'last searched indexer' (Radarr/Sonarr keep no per-title search log; Prowlarr history is query-keyed, not title-keyed): add a prowlarr_action history-by-title projection.** Blocks the arr competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: arr-mcp (agent-packages). One 5-minute unit: add the operation and its test in arr-mcp. | Test in arr-mcp: operation returns the documented fields; EG-side test `media_vocab_arr_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R022 Cross-repo, owner audiobookshelf-mcp: user listening progress: add a library_operations or users action for media progress per user and item Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner audiobookshelf-mcp: user listening progress: add a library_operations or users action for media progress per user and item.** Blocks the audiobookshelf competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: audiobookshelf-mcp (agent-packages). One 5-minute unit: add the operation and its test in audiobookshelf-mcp. | Test in audiobookshelf-mcp: operation returns the documented fields; EG-side test `media_vocab_audiobookshelf_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R023 Cross-repo, owner media-downloader: see media-downloader B1 Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner media-downloader: see media-downloader B1.** Blocks the audiobookshelf competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: media-downloader (agent-packages). One 5-minute unit: add the operation and its test in media-downloader. | Test in media-downloader: operation returns the documented fields; EG-side test `media_vocab_audiobookshelf_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R024 Cross-repo, owner rom-manager: reference-set verification: add a romm_roms verify action returning per-ROM checksum verdict Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner rom-manager: reference-set verification: add a romm_roms verify action returning per-ROM checksum verdict.** Blocks the rom-manager competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: rom-manager (agent-packages). One 5-minute unit: add the operation and its test in rom-manager. | Test in rom-manager: operation returns the documented fields; EG-side test `media_vocab_rom_manager_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R025 Cross-repo, owner media-downloader: see media-downloader B1 Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner media-downloader: see media-downloader B1.** Blocks the rom-manager competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: media-downloader (agent-packages). One 5-minute unit: add the operation and its test in media-downloader. | Test in media-downloader: operation returns the documented fields; EG-side test `media_vocab_rom_manager_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R026 Cross-repo, owner owncast-agent: past broadcast list with start/end and peak viewers: add an owncast_internal stream-history action or persist sessions Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner owncast-agent: past broadcast list with start/end and peak viewers: add an owncast_internal stream-history action or persist sessions.** Blocks the owncast competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: owncast-agent (agent-packages). One 5-minute unit: add the operation and its test in owncast-agent. | Test in owncast-agent: operation returns the documented fields; EG-side test `media_vocab_owncast_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R027 Cross-repo, owner media-downloader: download history: add a list_downloads operation returning job id, source URL, status, error, completedAt, output path Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner media-downloader: download history: add a list_downloads operation returning job id, source URL, status, error, completedAt, output path.** Blocks the media-downloader competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: media-downloader (agent-packages). One 5-minute unit: add the operation and its test in media-downloader. | Test in media-downloader: operation returns the documented fields; EG-side test `media_vocab_media_downloader_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R028 Cross-repo, owner audio-transcriber: transcript list/get operation by recording id and date Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner audio-transcriber: transcript list/get operation by recording id and date.** Blocks the audio-transcriber competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: audio-transcriber (agent-packages). One 5-minute unit: add the operation and its test in audio-transcriber. | Test in audio-transcriber: operation returns the documented fields; EG-side test `media_vocab_audio_transcriber_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R029 Cross-repo, owner audio-transcriber: expose avg_logprob (confidence) per segment Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner audio-transcriber: expose avg_logprob (confidence) per segment.** Blocks the audio-transcriber competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: audio-transcriber (agent-packages). One 5-minute unit: add the operation and its test in audio-transcriber. | Test in audio-transcriber: operation returns the documented fields; EG-side test `media_vocab_audio_transcriber_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R030 Cross-repo, owner scholarx: citing-papers operation: add sx_search action 'citations' returning papers that cite a given id Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner scholarx: citing-papers operation: add sx_search action 'citations' returning papers that cite a given id.** Blocks the scholarx competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: scholarx (agent-packages). One 5-minute unit: add the operation and its test in scholarx. | Test in scholarx: operation returns the documented fields; EG-side test `media_vocab_scholarx_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R031 Cross-repo, owner searxng-mcp: pass through per-engine result counts and unresponsive_engines from the SearXNG response Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner searxng-mcp: pass through per-engine result counts and unresponsive_engines from the SearXNG response.** Blocks the searxng competency question; EG answers with a typed abstention naming this operation until it lands. Owning repository: searxng-mcp (agent-packages). One 5-minute unit: add the operation and its test in searxng-mcp. | Test in searxng-mcp: operation returns the documented fields; EG-side test `media_vocab_searxng_blocked_abstains` then flips to a positive answer. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R032 Cross-repo, owner arr-mcp: rename connector :Episode to mv:TelevisionEpisode subclass (collision with core :Episode) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner arr-mcp: rename connector :Episode to mv:TelevisionEpisode subclass (collision with core :Episode).** Resolves the R001.6 collision. One 5-minute unit in the owning package ontology plus its test. | Test in the owning package: ontology load test shows no duplicate IRI with core. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R033 Cross-repo, owner jellyfin-mcp and audiobookshelf-mcp: stop declaring :Author in the shared namespace; use mv:contributor to :Person Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Cross-repo, owner jellyfin-mcp and audiobookshelf-mcp: stop declaring :Author in the shared namespace; use mv:contributor to :Person.** Resolves the R001.6 collision. One 5-minute unit in the owning package ontology plus its test. | Test in the owning package: ontology load test shows no duplicate IRI with core. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R002.5 Receipt-bound paper facts; citation-edge hold Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Receipt-bound paper facts; citation-edge hold.** Reuse SDK `PaperSearchResult`, `PaperRecord`, and `DocumentReceipt` with EG `Method::SourceIngest`. Accept records only from a tenant-scoped `PaperQuery`. Require provider identity, stable canonical identity, revision, and SDK `exact_identity`. Require a matching tenant receipt for the same paper/revision. The receipt binds `{source_url, media_type, byte_count, sha256, authorized_local_artifact}`. Require source-field provenance for every asserted fact. Map accepted records to `cv:ResearchPaper` and existing DOI/arXiv/publication-date/citation-count facts. Attach receipt and document digest as provenance. Exact identity/revision/digest replay is idempotent. Refuse only the offending paper before graph writes for invalid identity, receipt mismatch, unavailable/incomplete artifact, or provenance mismatch. Keep healthy siblings from partial provider results. **Hold:** SDK records/receipts omit cited-paper IDs. Paper-serving registration is unestablished. Citation counts cannot create edges. Emit no citation edges until SDK serves reference IDs, identity normalization, and paper-serving registration. Select no provider here. Preserve `EG-MEDIA-VOCAB-R002.1`, `.4`, `SDK-SOURCE-INGEST-R005.1`, `.2`, `.4`, and `EG-REPO-INGEST-R002`. Source SHA-256 `b6d12a184f1c5812c8f4fd56a0a299e48381e85ad9b18af4eb0ed19faf3d7e0b`. Remains SPECIFIED; no producer/readback receipt is claimed. | Planned served acceptance: Ingest a valid tenant-scoped `PaperRecord` and matching `PaperQuery`/`DocumentReceipt`. Independently read back paper facts, receipt digest, and field provenance. Replay the same identity/revision/digest idempotently. In a mixed result, refuse an unidentified paper while persisting its identified sibling. Refuse mismatched revision/digest, incomplete artifact, or field-provenance mismatch before graph writes. Confirm count-only records create no citation edges. Hold citation-edge acceptance until SDK reference IDs and serving registration are reviewed and merged. Do not count held cases as passing. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001.100 Provenanced object/context tags and authorized media search Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Provenanced object/context tags and authorized media search.** Define each tag as `{media_item, media_revision, taxonomy_id, taxonomy_version, object_or_context, confidence, evidence_span_or_ref, opaque_producer_id, producer_revision, provenance_digest}`. Store source-backed assertions on the media item. Do not store unqualified labels. Search returns only caller-authorized tags. Bind matched tag IDs, media revisions, and authorization revision. Missing provenance or stale media revision refuses. Unauthorized queries reveal no protected tags. Vision producer identity and served extraction remain unresolved. Do not invent the producer. Preserve parent `EG-MEDIA-VOCAB-R001`. Source `EG:69` SHA-256 `38f71f6a205cf8df27631a4aa86ec3312a91f7902dfd8bfe843db2a142d1d30f`. | Read back tag provenance and media revision from an authorized tagged item. Query as allowed and denied principals. Assert only authorized results appear. Refuse missing producer/evidence provenance and stale media revisions. Keep producer testing pending until its identity and contract are resolved. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001.101 Meeting transcript revisions and provider-bound summary context Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Meeting transcript revisions and provider-bound summary context.** Add public `Method::MeetingTranscriptRevision` with `{Append, Correct, DeleteSegment, Finalize, GetFinal}`. Commit immutable revisions through SourceIngest/ChangeEnvelope and `TranscriptSegment`. Each revision binds `{meeting_id, base_revision, new_revision, monotonic_event_sequence, idempotency_key, ordered_segment_ids, start_ms, end_ms, optional_speaker_ref, text_digest, provenance_ref, finalization_digest}`. A base mismatch or reordered/repeated event with a different digest returns typed conflict. Exact replay is idempotent. Finalization seals ordered segments and transcript digest. Later corrections create a new revision. They stale old-digest summaries without rewriting them. `MeetingSummaryContextV1` accepts a current finalized transcript digest, provider-admission ref `{provider, model, policy_revision, admission_id, admission_digest}`, and pinned `MeetingSummaryLimitPolicyV1`. Require positive finite `max_spans` ≤128, `max_segment_bytes` ≤16384, and `max_tokens` ≤8192. Return ordered spans, citations, context digest, and applied policy revision. Make no model call. Missing/invalid limits or exceeded caps refuse before summary effects. `CommitMeetingSummaryV1` accepts AU receipt `{owner_requirement_id, receipt_id, receipt_digest, provider, model, policy_revision, input_context_digest, output_digest}` plus per-claim citations. EG validates the receipt. EG never mints it or uses model weights. Refuse unfinalized/stale transcript, missing admission, unknown/mismatched AU receipt, citation outside sealed text, or cross-tenant request before writes. **AU hold:** AU owns provider admission, retry/attempt accounting, and disabled-provider refusal. `AU-SEMANTIC-R030` remains pending. Wrapper retries do not count as one invocation without its receipt contract. Consumer `WEBUI-APPS-R001.5` uses this contract. WebUI owns provider choice/rendering. AU owns admission, invocation, and receipt. Source WEBUI:10 SHA-256 `c82a815c87428a5baf4379ef7790bafb24a5d3367d16ebd85a6c39ff9b52521d`. | Serve ordered append/correction/finalization. Independently read back the sealed digest. Late corrections must stale old summaries. Read bounded context from a current transcript with validated provider admission. Accept only summaries with matching AU provider/model/policy/context/output receipt and valid citations. Refuse stale, unfinalized, unauthorized, or mismatched cases before mutation. AU R030 admission/retry/disable/receipt tests and WebUI journey remain required. EG does not claim them. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R001.102 Bookmark semantic search and authorized relation projection Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Bookmark semantic search and authorized relation projection.** Add no parallel ingestion path. SDK `SDK-SOURCE-INGEST-R005.7-.12` envelopes enter existing `Method::SourceIngest` and ChangeEnvelope commit. Reuse `src/server/dispatch/graph_pipeline/native_routes.rs` and `src/server/handlers/source_ingestion.rs`. Add read methods `Method::BookmarkSemanticSearch` (`BookmarkSemanticSearchV1`) and `Method::BookmarkRelations` (`BookmarkRelationsV1`). Use existing `Method::SemanticSearch` and UQL paths. Bind `{source/bookmark_ids, ingestion_receipt_id/digest, source_revision, index_revision, query_digest, graph_snapshot_revision, authorization_revision, limit_policy_digest}`. `BookmarkQueryLimitPolicyV1` requires positive finite `max_hits` ≤100, `max_relationships` ≤500, and `max_response_bytes` ≤1048576. Search returns score, provenance, explicit unknown metadata, and a tenant/query/index/snapshot-bound cursor. Relations return authorized node/edge IDs and mindmap provenance only. Filter before counting. Never leak denied edges/counts. Missing metadata remains unknown. Missing/invalid policy or exceeded cap refuses before truncated success. Identical source receipt is idempotent. Stale/unavailable indexes or mismatched revisions return typed refusal, never empty success. EG owns bookmark meaning/index/query/relationship data. GraphOS owns served query/export adapter. `WEBUI-APPS-R001.6` owns mindmap and CSV/JSON rendering. Source WEBUI:11 specifies `{searchable bookmark knowledge base, meaning-based semantic filtering, interactive mindmap, CSV or JSON export}`. Source SHA-256 `b1708c96d6b9cadcb1c9f35cc5cb7dde4e60ed2cb1250598e55b9ce4cc66907e`. | Ingest through named SDK envelopes and SourceIngest. Read back the committed bookmark and receipt. Search/read relations on the same pinned index/snapshot. Confirm paging and unknown metadata. Refuse stale indexes, mismatched revisions, and denied edges/counts without leakage. GraphOS/WebUI separately prove served export and mindmap. Add no duplicate EG ingest path. No runtime/owner receipt is claimed. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R650 Multimodal memory over the blob substrate (rollup) Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Multimodal memory over the blob substrate (rollup).** EG stores media the user sends (image, voice note, chart) as a content-addressed blob node. The node links to its transcription and to the memory entry that cites it. EG recalls it through the same tiers as text memory. The Rust home is `crates/eg-modality/src/media_memory.rs`. Satisfied only when children `EG-MEDIA-VOCAB-R650.1`-`EG-MEDIA-VOCAB-R650.6` are satisfied. | See each child. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R650.1 Model Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Model.** Add `MediaMemory{blob_id,mime,transcript_ref,source_message}`, `MediaRecall` in `crates/eg-modality/src/media_memory.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R650.2 Behavior Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Behavior.** Write the blob once by digest. Attach modality-specific derivations (transcript, caption) as separate derived nodes. Recall by digest or by derivation text. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R650.3 Wiring Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Wiring.** Served `MediaRemember` and `MediaRecall` over the existing blob substrate. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R650.4 Refusal Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Refusal.** A blob over the size ceiling or with a mismatched declared and sniffed type is refused. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R650.5 Evidence Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Evidence.** Record digest, size, type, derivation IDs and the citing memory entry. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-MEDIA-VOCAB-R650.6 Hot-path proof Definition — EG-MEDIA-VOCAB / EG-MEDIA-VOCAB — Media and personal-content vocabularyCanonical requirement and verification source**Hot-path proof.** Benchmark `media_memory_write` (1 MiB image): p50 1 ms, p99 8 ms, peak memory bounded by blob size. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-modality media_memory_write` against the stored baseline. | requirement | EG-MEDIA-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-OBJECT-STORAGE-BACKEND EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost Gate | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-OBJECT-STORAGE-BACKEND-R001 Typed object-store backend specification Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source**Typed object-store backend specification.** Model: a `StorageBackendSpec` declares the durable-store backend for a graph. Two variants exist. `local` is redb and is the default. `object-store` is S3-compatible. The spec names endpoint, bucket, and root by secret reference only. It declares a durability class. It names a layout lineage entry. Behavior: the engine opens the graph from the spec. An unbound spec refuses with a named reason before any effect. An unsupported spec refuses the same way. Wiring: extend the physical store binding in `crates/eg-storage`. Reuse the owner-store layout lineage registry (EG-DURABLE-KERNEL-R003). Reuse the store-authority binding (EG-DURABLE-KERNEL-R021). Refusal: the engine refuses a missing secret reference. It refuses an unknown variant. It refuses a layout absent from the lineage registry. Every refusal is atomic and typed. Evidence: the spec round-trips over the wire. Each refusal case stays typed with no state change. | `tests/test_object_storage_backend_spec.py::test_backend_spec_roundtrip_and_refusals` round-trips both variants. It asserts each refusal leaves the registry unchanged. | requirement | EG-OBJECT-STORAGE-BACKEND | SPECIFIED | No recorded commit/test evidence |
| EG-OBJECT-STORAGE-BACKEND-R002 Object-store read path Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source**Object-store read path.** Model: durable state on object storage is immutable content-addressed segments. A version manifest joins them. A snapshot read at a committed version fetches exactly the segments that version's manifest names. Behavior: reads never mutate store state. They trigger no copy-on-read. They trigger no compaction. Reads at any committed version are consistent with the commit chain. A corrupt segment refuses with a typed layout or corruption error. It never reinterprets. Wiring: extend the physical read path in `crates/eg-storage` with an object-store fetcher. Reuse the existing `GraphView` snapshot machinery. Refusal: the engine refuses a manifest naming a missing segment. It refuses a segment whose digest mismatches. Each refusal is typed and names the version. Evidence: a read at version N equals the write set at N. The corrupt-segment case refuses. Earlier versions stay readable. | `tests/test_object_storage_reads.py::test_versioned_reads_and_corruption_refusal` reads three versions. It corrupts one segment. It asserts the typed refusal with earlier versions intact. | requirement | EG-OBJECT-STORAGE-BACKEND | SPECIFIED | No recorded commit/test evidence |
| EG-OBJECT-STORAGE-BACKEND-R003 Object-store commit path (commit before ack) Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source**Object-store commit path (commit before ack).** Model: a commit writes immutable versioned segments. It publishes the new version by a single conditional manifest swap. The swap is a compare-and-set on the manifest object. The manifest carries version, digest, tenant, graph, and parent version. Behavior: the engine acks the client only after the manifest publish is durable. Durability follows the store's declared durability class. A failed or interrupted publish leaves the prior version intact. No partial version appears. No dangling publish appears. Wiring: extend the commit path with an object-store publisher. Reuse the commit/raft path. Reuse the existing receipt shape. Refusal: a publish that loses the CAS to a concurrent writer refuses as stale. It reconciles per the existing rules. A spec without a declared durability class refuses at open. Evidence: a crash between segment write and manifest publish reopens the graph at the prior version. The CAS-loss case never produces two heads. | `tests/test_object_storage_commits.py::test_commit_before_ack_and_partial_publish` interrupts publish between phases. It reopens. It asserts the prior version is whole. The concurrent-CAS case yields one head. | requirement | EG-OBJECT-STORAGE-BACKEND | SPECIFIED | No recorded commit/test evidence |
| EG-OBJECT-STORAGE-BACKEND-R004 Shared-root multi-node access Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source**Shared-root multi-node access.** Model: any engine node opens any tenant graph directly from the shared object-store root. Branch and commit coordination keep their existing owners. The consensus and placement authorities coordinate. The store layer adds no second consensus. Behavior: a node with no local pre-materialized copy serves tenant reads. It first re-fetches the current version's manifest and segments in a bounded pass. It never re-materializes full history. A node that lost local state reopens from the root. It loses no data. Wiring: extend the open and placement path (catalog-driven resharding, M3). Reuse the existing placement authority. Reuse the resharding handoff. Refusal: the engine refuses a node without a placement grant for the tenant. The refusal happens before reads. A stale local cache behind a newer manifest discards. It never serves. Evidence: two nodes open the same root. They read identical state. A node that drops local state rejoins from the root within the bounded re-fetch. | `tests/test_object_storage_shared_root.py::test_multi_node_cold_open_and_rejoin` opens one root on two nodes. It drops one node's local state. It asserts identical served state after rejoin. | requirement | EG-OBJECT-STORAGE-BACKEND | SPECIFIED | No recorded commit/test evidence |
| EG-OBJECT-STORAGE-BACKEND-R005 Comparative cost gate across releases Definition — EG-OBJECT-STORAGE-BACKEND / EG-OBJECT-STORAGE-BACKEND — Object-Storage-Native Durable Store and Comparative Cost GateCanonical requirement and verification source**Comparative cost gate across releases.** Model: a pinned, environment-stamped comparative cost harness drives the same logical cold lifecycle against two builds. The lifecycle covers open, read, commit, and merge. The harness records four dimensions. Time, object actions, bytes, and peak memory. Output is versioned JSONL with a pass/fail reporter. Behavior: a bounded regression guard fails the release on unexplained growth in the fixed open cost. Storage-traffic and timing measurements use separate matched runs. A counting proxy perturbs timing. Wiring: add the harness under `benches/` and `scripts/`. Reuse the existing benchmark and cost-model machinery (transport benchmarks, multi-shard scaling, cost model). Refusal: the harness refuses a run missing its environment stamp. It refuses a run missing its pinned revision. The run is claim-ineligible. It never enters the gate's evidence. Evidence: an injected regression in the fixed open cost trips the guard. A clean run records the stamped JSONL. Stated advantage: the harness counts cross-shard federation actions. A single-store comparative harness cannot express those. | `tests/test_comparative_cost_gate.py::test_regression_guard_and_claim_eligibility` injects a fixed-cost regression. It asserts the release gate fails. It asserts an unstamped run is claim-ineligible. | requirement | EG-OBJECT-STORAGE-BACKEND | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH EG-CQ-ORCH — Orchestration competency questions | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R001 Q1: "What steps do I need to follow to complete task XYZ?" (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q1: "What steps do I need to follow to complete task XYZ?" (rollup).** Answered by one query over the ontology reading L0 (task, process and standard ontologies), L3 (stored agent graphs and workflows), L5 (past runs and outcomes). Mechanism: EG-DECISION-ENGINE-R036 (graph.assemble composes tasks), R003 (is_a derivation records), EG-FEDERATED-QUERY-R006 (proof-carrying results). Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R001.1 Q1 Ontology gap: ordered step Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q1 Ontology gap: ordered step.** Add `eg:TaskStep`, `eg:hasStep` and `eg:precedes` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R001.2 Q1 SHACL shape Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q1 SHACL shape.** Add one SHACL shape for the Q1 answer inputs (step order is acyclic) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R001.3 Q1 Source-authority mapping Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q1 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q1 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R001.4 Q1 Query fixture Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q1 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q1` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R001.5 Q1 Acceptance test Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q1 Acceptance test.** Add one acceptance test running Q1 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R002 Q2: "How many agents and what type of agents are needed to complete the task?" (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q2: "How many agents and what type of agents are needed to complete the task?" (rollup).** Answered by one query over the ontology reading L3 (topology slots), L2 (agent kinds), L5 (observed width/outcomes). Mechanism: EG-DECISION-ENGINE-R046 and R111 (topology decision), R014 (composition as bounded 0-1 optimization), R036. Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R002.1 Q2 Ontology gap: agent kind Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q2 Ontology gap: agent kind.** Add `eg:AgentKind` and `eg:fillsAgentKind` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R002.2 Q2 SHACL shape Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q2 SHACL shape.** Add one SHACL shape for the Q2 answer inputs (slot role and width bounds) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R002.3 Q2 Source-authority mapping Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q2 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q2 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R002.4 Q2 Query fixture Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q2 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q2` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R002.5 Q2 Acceptance test Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q2 Acceptance test.** Add one acceptance test running Q2 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R003 Q3: "Can we use an agent template we already have, or an external A2A agent we have added to our Agent Library, based on their capabilities?" (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q3: "Can we use an agent template we already have, or an external A2A agent we have added to our Agent Library, based on their capabilities?" (rollup).** Answered by one query over the ontology reading L2 (agents, templates, A2A cards in the Agent Library), L1 (capabilities of components). Mechanism: EG-DECISION-ENGINE-R126 and children (capability coverage over Agent Library candidates and A2A cards), R044 (A2A routing), EG-TYPED-PACKS-R013 (capability IRI validation), R006 (pack projection). Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R003.1 Q3 Ontology gap: agent template Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q3 Ontology gap: agent template.** Add `eg:AgentTemplate` to `crates/eg-core/ontology/catalog-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R003.2 Q3 SHACL shape Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q3 SHACL shape.** Add one SHACL shape for the Q3 answer inputs (candidate has a provided capability) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R003.3 Q3 Source-authority mapping Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q3 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q3 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R003.4 Q3 Query fixture Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q3 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q3` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R003.5 Q3 Acceptance test Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q3 Acceptance test.** Add one acceptance test running Q3 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R004 Q4: "What standards, best practices, or guardrails should I follow?" (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q4: "What standards, best practices, or guardrails should I follow?" (rollup).** Answered by one query over the ontology reading L0 (standards, shapes, policies), L1 (component-level constraints). Mechanism: EG-DECISION-ENGINE-R127 and children (guardrail entailment with entailment path and source generation), EG-FEDERATED-QUERY-R005 (VALIDATE SHAPE), R006. Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R004.1 Q4 Ontology gap: best practice and rule scope Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q4 Ontology gap: best practice and rule scope.** Add `eg:BestPractice` and `eg:appliesToTaskClass` to `crates/eg-core/ontology/capability-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R004.2 Q4 SHACL shape Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q4 SHACL shape.** Add one SHACL shape for the Q4 answer inputs (rule names its task class and source) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R004.3 Q4 Source-authority mapping Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q4 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q4 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R004.4 Q4 Query fixture Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q4 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q4` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R004.5 Q4 Acceptance test Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q4 Acceptance test.** Add one acceptance test running Q4 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R005 Q5: "What skills, tools, prompts, and LLM models does each agent need to complete each subtask?" (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q5: "What skills, tools, prompts, and LLM models does each agent need to complete each subtask?" (rollup).** Answered by one query over the ontology reading L1 (skills, tools, prompts, model profiles), L2 (which agent holds them). Mechanism: EG-DECISION-ENGINE-R036 (assembly binds components), R126 (coverage), R014 (knapsack/cardinality constraints), R002 (evidence class). Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R005.1 Q5 Ontology gap: model profile Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q5 Ontology gap: model profile.** Add `eg:ModelProfile` and `eg:needsSkill` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R005.2 Q5 SHACL shape Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q5 SHACL shape.** Add one SHACL shape for the Q5 answer inputs (binding names agent, model and prompt) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R005.3 Q5 Source-authority mapping Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q5 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q5 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R005.4 Q5 Query fixture Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q5 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q5` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R005.5 Q5 Acceptance test Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q5 Acceptance test.** Add one acceptance test running Q5 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R006 Q6: "What workflow do the agents need to follow?" (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q6: "What workflow do the agents need to follow?" (rollup).** Answered by one query over the ontology reading L3 (workflows and agent graphs), L4 (harness hooks and extension points), L5 (past runs). Mechanism: EG-DECISION-ENGINE-R036 (assembled graph carries workflow), R044 (routing to an existing graph), plus the durable-run kernel already in orchestration-v1. Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R006.1 Q6 Ontology gap: handoff Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q6 Ontology gap: handoff.** Add `eg:handsOffTo` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R006.2 Q6 SHACL shape Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q6 SHACL shape.** Add one SHACL shape for the Q6 answer inputs (handoff names source and target step) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R006.3 Q6 Source-authority mapping Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q6 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q6 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R006.4 Q6 Query fixture Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q6 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q6` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R006.5 Q6 Acceptance test Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q6 Acceptance test.** Add one acceptance test running Q6 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R007 Q7: "What does the agent graph shape (DAG) look like?" (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q7: "What does the agent graph shape (DAG) look like?" (rollup).** Answered by one query over the ontology reading L3 (agent graphs and topology templates). Mechanism: EG-DECISION-ENGINE-R046, R111 and R111.1 (topology as typed Decide question), R036. Split into `.1` ontology gap, `.2` shape, `.3` source-authority mapping, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R007.1 Q7 Ontology gap: slot edge Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q7 Ontology gap: slot edge.** Add `eg:feeds` between `swarm:Slot` nodes to `crates/eg-core/ontology/swarm_topology-v1.ttl`. Owner: epistemic-graph. | Ontology load test asserts the term resolves and the reasoner stays consistent. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R007.2 Q7 SHACL shape Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q7 SHACL shape.** Add one SHACL shape for the Q7 answer inputs (graph is acyclic with one root) next to its ontology file. Owner: epistemic-graph. | Shape validation test accepts a conforming fixture and rejects a planted-invalid one. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R007.3 Q7 Source-authority mapping Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q7 Source-authority mapping.** Add one source-authority mapping declaring which connected source is the authority for the Q7 concept (`vg:mapsOntologyClass` plus the MISSING authority statement). Owner: epistemic-graph. | Mapping test asserts the declared source is selected and an unconnected source yields the typed abstention. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R007.4 Q7 Query fixture Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q7 Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/q7` holding a worked task XYZ and the expected answer rows. Owner: epistemic-graph. | Fixture-load test asserts the expected rows are returned by the query sketch in design.md. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R007.5 Q7 Acceptance test Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Q7 Acceptance test.** Add one acceptance test running Q7 end to end through the engine mechanism and asserting a non-empty, provenance-carrying answer. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::q{n}_answers_with_provenance`; a second case asserts the typed abstention when the source is not connected. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R008 Composed answer to "How can I execute task XYZ?" (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Composed answer to "How can I execute task XYZ?" (rollup).** One response carries all seven parts, each with provenance, produced through the engine's assembly (`graph.assemble()` / AgentAssemble, `EG-DECISION-ENGINE-R036`), not a second planner. Split into `.1` envelope type, `.2` assemble wiring, `.3` abstention per part, `.4` fixture, `.5` acceptance test. | Rollup closes when children .1-.5 are verified. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R008.1 Composed Envelope type Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Composed Envelope type.** Add the typed `ExecutionAnswer` DTO (`crates/eg-types/src/decision/`) with seven part slots, each `answer|abstain` plus provenance and evidence class. Owner: epistemic-graph. | Serde round-trip test and golden-digest test for the envelope. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R008.2 Composed Assemble wiring Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Composed Assemble wiring.** Populate the envelope from the existing assemble handler output and the R126 and R127 queries; add no new solver or planner. Owner: epistemic-graph. | Test asserts the envelope's `assembled_by` is the assemble path and the certificate digest matches R004 verification. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R008.3 Composed Typed abstention per part Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Composed Typed abstention per part.** Each part that lacks data returns a typed `AbstainReason`, never an omitted field. Owner: epistemic-graph. | Negative test removes one source and asserts that part abstains while the others answer. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R008.4 Composed Query fixture Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Composed Query fixture.** Add one fixture graph under `crates/eg-core/tests/fixtures/orchestration_competency/composed` for task XYZ spanning all seven parts. Owner: epistemic-graph. | Fixture-load test asserts every part has expected rows. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R008.5 Composed Acceptance test Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Composed Acceptance test.** Add the end-to-end test asserting all seven parts non-empty with provenance. Owner: epistemic-graph. | Test: `crates/eg-core/tests/orchestration_competency.rs::composed_answer_has_seven_parts_with_provenance`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R009 Probe questions through the intent surface (rollup, owned by graph-os, cross-repo) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Probe questions through the intent surface (rollup, owned by graph-os, cross-repo).** Each probe is an acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Split into one child per probe (`.1` to `.6`). | Rollup closes when children .1-.6 pass in graph-os. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R009.1 Probe: "How many nodes does the graph hold, by label?" Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Probe: "How many nodes does the graph hold, by label?"** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: correct SQL, empty answer. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R009.2 Probe: "How can I deploy a container with container-manager?" Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Probe: "How can I deploy a container with container-manager?"** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: 1-step plan. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R009.3 Probe: "Which agents are in the Agent Library?" Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Probe: "Which agents are in the Agent Library?"** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: routed. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R009.4 Probe: "Why does graph-os use the intent surface?" Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Probe: "Why does graph-os use the intent surface?"** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: pending. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R009.5 Probe: "Find a tool that lists Docker containers." Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Probe: "Find a tool that lists Docker containers."** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: pending. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R009.6 Probe: "Delegate: list running containers." Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Probe: "Delegate: list running containers."** (owner: graph-os, cross-repo prerequisite). Acceptance test through the graph-os intent tools asserting a non-empty, correct, provenance-carrying answer. Previously observed: pending. | graph-os acceptance test over the intent surface; EG records the receipt link in status evidence. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R010 The graph serves architecture views (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**The graph serves architecture views (rollup).** The engine derives container-level architecture views from ingested code and ingested diagrams, and serves them as a read-only view. Children .1-.6. | Rollup closes when children .1-.6 are verified. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R010.1 Model Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Model.** Add `ArchitectureView`, `ViewContainer` and `ViewEdge` in new file `crates/eg-types/src/architecture_view.rs`. A container carries a name, a technology label and the source paths that support it. An edge carries a kind and a count of supporting calls. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::view_types_round_trip`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R010.2 Behavior Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Behavior.** Add `derive_architecture_view(graph, scope) -> ArchitectureView` in `crates/eg-core/src/architecture_view.rs`. Each rule is a named, replaceable default. One container per deployable package. Edges come from cross-package calls. Ingested diagram elements merge by name. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::derivation_merges_code_and_diagram_elements`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R010.3 Wiring Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Wiring.** Call `derive_architecture_view` from the read handler at `src/server/handlers/mining/impact.rs:264`. The `handle_impact` function already runs for the served impact operation in production. The view branch of that handler creates the call site. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::served_operation_returns_view`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R010.4 Refusal Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Refusal.** `derive_architecture_view` must return the typed abstention `ViewAbstained::NoSupportingSource` for a scope with no ingested code and no diagram. It must never invent a container. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::empty_scope_abstains`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R010.5 Evidence Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Evidence.** Every container and edge in the served view must list its supporting node ids. A reader traces each box to the ingested files that justify it. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::every_container_cites_support`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R010.6 Hot-path proof Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Hot-path proof.** Entry point: the served impact operation with an architecture-view request over a fixture repository and one ingested diagram. The test passes through `impact.rs:264` and observes the view with containers, edges and support ids. Owner: epistemic-graph. | `crates/eg-core/tests/architecture_view.rs::served_view_over_fixture_repository`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R010.7 Preplanning architecture-gap admission and unwired-feature refusal Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Preplanning architecture-gap admission and unwired-feature refusal.** Reuse the served architecture view from `EG-CQ-ORCH-R010.1-.6` and existing capability query. Do not re-derive architecture. Before `Method::Decide` accepts a plan-producing `TaskPlan`, require `PlanAdmissionV1` with `{repository_id, repository_revision, architecture_view_ref, architecture_snapshot_revision, study_gap_ref, study_gap_revision, plan_request_digest, features}`. Each feature binds a stable id and description digest. It binds a hot-path attach point `{file, symbol, operation}`. It binds input/output schema digests and at least one typed wiring edge. The edge targets an existing EG producer/consumer or scoped external owner. Compare every feature with pinned architecture and AU study-gap evidence. Return ordered `DesignDifference` records with feature id, existing container/edge refs, missing edge/attach point, and source ids. Refuse stale/mismatched revisions, omitted features, missing attach points, empty edge sets, and unreachable producer-consumer paths. Use `ARCHITECTURE_EVIDENCE_MISSING`, `STUDY_GAP_EVIDENCE_MISSING`, `FEATURE_ATTACH_POINT_REQUIRED`, or `FEATURE_UNWIRED`. Refusal emits no plan. Architecture producer: `EG-CQ-ORCH-R010.1-.6`. AU study-gap producer/consumer: `AU-HARNESS-R019.5-.7`. AU rows bind the same repository/revision and return stable proposal id/revision. If absent, keep this dependency open and refuse admission. Wire admission before TaskPlan returns at `src/server/handlers/decide/stat_decide.rs`. Use served architecture view from `src/server/handlers/mining/impact.rs`. Add no architecture derivation path. Proving tests: `src/server/handlers/decide/stat_tests/architecture_admission_tests.rs::unwired_feature_refuses_before_task_plan`, `src/server/handlers/decide/stat_tests/architecture_admission_tests.rs::stale_architecture_or_study_gap_refuses`, and `tests/decide/test_architecture_admission_served.py::test_plan_requires_pinned_architecture_and_attach_points`. Preserve `EG-CQ-ORCH-R010.1`, `EG-CQ-ORCH-R010.2`, `EG-CQ-ORCH-R010.3`, `EG-CQ-ORCH-R010.4`, `EG-CQ-ORCH-R010.5`, `EG-CQ-ORCH-R010.6`, `AU-HARNESS-R019.5`, `AU-HARNESS-R019.6`, and `AU-HARNESS-R019.7`. Source GRAPHOS:20 SHA-256 `bbc3f62e74bc899e49191e1d9bf324afe5e6dc2553df9e8d8651aae1311a8418`. Remains SPECIFIED pending AU field confirmation, implementation, and served receipts. | Planned acceptance: Matching pinned architecture/study-gap evidence and feature attach points return differences and a TaskPlan. Missing edges/attach points, stale revisions, omitted features, or absent owner receipts return named refusals and no plan. Use served impact and Decide handlers. Independently read back revisions and source refs. Keep AU proposal producer separate. Do not duplicate architecture derivation. These are future cases, not evidence. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R011 Job, downtime and plan competency questions (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Job, downtime and plan competency questions (rollup).** The ontology answers five questions about job loading, downtime work, plan choice, connector usage and connect-time contracts. Each answer carries provenance. Capability-to-component questions belong to `EG-CQ-CONN-R084`. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R011.1 Question Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Question.** Q1 asks: Which tools, skills and local agents should be loaded for job J? The answer shape is rows of component kind, component id, prompt and premise. It is answered through `EG-DECISION-ENGINE-R176`. Fixture: `crates/eg-core/tests/fixtures/orchestration_competency/q11_load_set`. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_load_set`. | The answer is non-empty, bounded and carries one premise per row. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R011.2 Question Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Question.** Q2 asks: Which downtime jobs run next, given priorities and the current window? The answer shape is rows of job type, priority, budget and skip reason. It is answered through `EG-DURABLE-KERNEL-R101`. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_downtime_next`. | The answer lists jobs in priority order with reasons for skipped types. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R011.3 Question Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Question.** Q3 asks: Which virtual query plan is best for question Q across connectors A and B? The answer shape is the kept plan digest, its receipt and the measured gain. It is answered through `EG-FEDERATED-QUERY-R091`. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_best_plan`. | The answer names the kept plan and its measured gain over the baseline. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R011.4 Question Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Question.** Q4 asks: How and when should an agent use connector X for job J? The answer shape is conditions, ordered steps and cautions. It is answered through `EG-DECISION-ENGINE-R177`. An unknown connector must abstain with a typed reason. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_usage_guidance`. | The answer lists ordered steps with citations, and an unknown connector abstains. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R011.5 Question Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Question.** Q5 asks: Which seed facts did connector X contribute, and which parts changed at the last connect? The answer shape is part, outcome, digest and graph revision. It is answered through `EG-TYPED-PACKS-R104`. Proving test: `crates/eg-core/tests/orchestration_competency.rs::q11_seed_changes`. | The answer lists each part outcome of the last import. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R011.6 Hot-path proof Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Hot-path proof.** The entry point is the graph-os intent surface. The test connects two fixture connectors and asks Q1 to Q5 through `find`. Proving test: `tests/competency/test_job_downtime_plan_served.py::test_five_questions_through_intent_surface`. | Each answer is non-empty and carries provenance. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R800 Run provenance, trace ontology and incident views answer operations questions (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Run provenance, trace ontology and incident views answer operations questions (rollup).** The engine stores run traces, token usage, repository provenance, incidents and portfolio rollups under the trace ontology. It answers operations questions (what ran, what it cost, what failed, what changed) from graph queries. This replaces the in-process aggregators of the old harness. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R800.1 Model Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Model.** `RunTrace`, `Incident` and `PortfolioView` are ontology classes in `crates/eg-rdf` with typed links to runs, repositories and usage records. | Planned: `crates/eg-rdf/tests/trace_competency.rs::questions_answer_with_provenance`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R800.2 Behavior Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Behavior.** Questions compile to UQL over the trace graph. Incident grouping is a single pass keyed by correlation id in O(events). Replay reads events in append order. | Planned: `crates/eg-rdf/tests/trace_competency.rs::incident_groups_by_correlation_id`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R800.3 Wiring Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Wiring.** Self-ingest writes through `MutationBatch` from the served trace method; views are read through the generated client and the web presentation layer. | Planned: `crates/eg-rdf/tests/trace_competency.rs::tenantless_trace_is_refused`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R800.4 Refusal Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Refusal.** The engine refuses a trace without a tenant. It refuses an event whose correlation id is empty. A view over another tenant's runs returns empty with no content. | Planned: `crates/eg-rdf/tests/trace_competency.rs::cross_tenant_view_is_empty`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R800.5 Evidence Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Evidence.** Evidence is the competency question set with expected answers over a fixed trace corpus and the provenance of each answer. | Planned: `crates/eg-rdf/tests/trace_competency.rs::replay_preserves_append_order`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R800.6 Hot-path proof Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Hot-path proof.** Hot-path proof: a Criterion benchmark answers each question over 1 million trace events. The p50 stays under 20 ms. The p99 stays under 100 ms. Memory stays under 256 MiB. | Planned: `crates/eg-rdf/tests/trace_competency.rs::question_bench_within_budget`. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R700 Business processes compile to executable workflows stored with replay (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Business processes compile to executable workflows stored with replay (rollup).** A modeled business process compiles deterministically into an executable workflow graph (steps, gates, hand-offs). Workflows persist as graph content with versions. The engine can replay them. Natural-language authoring of a workflow is an agent-harness concern that submits a typed workflow. Implemented in eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R700.1 Model Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Model.** `WorkflowSpec`, `WorkflowVersion` and `ProcessCompilationError` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R700.2 Behavior Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Behavior.** Compilation is a topological traversal of the process graph in linear time. The engine refuses a cycle without a declared loop gate. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R700.3 Wiring Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Wiring.** Extends R006 and R007; storage is versioned with compare-and-set. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R700.4 Refusal Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Refusal.** An unbound task or a cycle without a loop gate is refused with the node id. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R700.5 Evidence Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Evidence.** A stored workflow cites the process revision it compiled from. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R700.6 Hot-path proof Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/competency/test_process_compile_served.py::test_cycle_without_gate_refused` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/process_compile.rs` must show p50 under 3 ms and p99 under 20 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R701 External governance process models import to and export from workflows (rollup) Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**External governance process models import to and export from workflows (rollup).** External process models (activity and gate models) import into workflows with gates recognized. A workflow exports back to the interchange format. Implemented in eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R701.1 Model Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Model.** `ImportedProcess` and gate classification in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R701.2 Behavior Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Behavior.** Import is a single streaming pass; a round trip preserves steps, gates and hand-offs. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R701.3 Wiring Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Wiring.** Served as import and export methods beside the architecture views (R010). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R701.4 Refusal Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Refusal.** A model with an unmapped element type is refused listing the element type. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R701.5 Evidence Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Evidence.** Imported nodes keep the source model id and element id. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-CQ-ORCH-R701.6 Hot-path proof Definition — EG-CQ-ORCH / EG-CQ-ORCH — Orchestration competency questionsCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/competency/test_governance_roundtrip_served.py::test_roundtrip_preserves_gates` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/governance_import.rs` must show p50 under 5 ms and p99 under 30 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-CQ-ORCH | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB EG-ORCH-VOCAB — Orchestration vocabulary | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R001 Task steps (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Task steps (rollup).** Adds the ordered-step vocabulary so "what steps" is one graph query. Step order reuses the existing core `:precedes`; no new order property. Children .1-.4. | Rollup closes when children .1-.4 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R001.1 Add class `:TaskStep` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add class `:TaskStep`.** Add `:TaskStep` (subclass of `bfo:0000001` so the existing `:precedes` domain and range accept it) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-rdf/tests/orchestration_vocabulary.rs::task_step_resolves_and_precedes_accepts_it`: term loads, reasoner consistent. | requirement | EG-ORCH-VOCAB | VERIFIED | 232da0d60c91 481fa6ea2c55 fcf70c5bf0a8 crates/eg-rdf/tests/orchestration_vocabulary.rs:31 |
| EG-ORCH-VOCAB-R001.2 Add property `:hasStep` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:hasStep`.** Add `:hasStep` (object property, range `:TaskStep`, no domain because a task is any class-typed IRI) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::has_step_resolves`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R001.3 Add step-order acyclicity shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add step-order acyclicity shape.** Create `crates/eg-core/ontology/orchestration-v1.shapes.ttl` with `:TaskStepShape` (target `:TaskStep`): no `$this :precedes+ $this`; a step has exactly one `:hasStep` owner. Aggregate-free `sh:sparql`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::step_shape_rejects_a_precedes_cycle` accepts the fixture and rejects a planted cycle. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R001.4 Add Q1 fixture and query test Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add Q1 fixture and query test.** Add `crates/eg-core/tests/fixtures/orchestration_vocabulary/deploy_container.ttl` (worked example in design.md) and a test running the Q1 query. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q1_returns_four_ordered_steps`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R002 Agent kinds and staffing (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Agent kinds and staffing (rollup).** Adds the agent-kind taxonomy and the slot-to-kind link so "how many and which agents" is answerable from a topology template. Children .1-.5. | Rollup closes when children .1-.5 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R002.1 Add class `:AgentKind` and seed members Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add class `:AgentKind` and seed members.** Add `:AgentKind` and seven named individuals (`:agentKindSupervisor`, `:agentKindWorker`, `:agentKindVerifier`, `:agentKindAggregator`, `:agentKindPlanner`, `:agentKindResearcher`, `:agentKindExecutor`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::agent_kind_members_resolve`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R002.2 Add property `:hasAgentKind` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:hasAgentKind`.** Add `:hasAgentKind` (domain `:Agent`, range `:AgentKind`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::has_agent_kind_resolves`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R002.3 Add property `swarm:requiresAgentKind` and the import Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `swarm:requiresAgentKind` and the import.** Add `swarm:requiresAgentKind` (domain `swarm:Slot`, range `:AgentKind`) to `crates/eg-core/ontology/swarm_topology-v1.ttl` and add `owl:imports <http://knuckles.team/kg/orchestration>` to the swarm ontology header. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::slot_requires_agent_kind_resolves`; the import-closure test passes with no cycle. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R002.4 Add slot-kind shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add slot-kind shape.** Extend `swarm:SlotShape` in `crates/eg-core/ontology/swarm_topology-v1.shapes.ttl` with `sh:path swarm:requiresAgentKind; sh:maxCount 1; sh:class :AgentKind`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::slot_shape_rejects_a_non_kind`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R002.5 Add Q2 query test Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add Q2 query test.** Test the Q2 query over the fixture: slot, role, kind, width bounds. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q2_returns_slots_roles_kinds_and_width`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R003 Agent Library, templates and A2A members (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Agent Library, templates and A2A members (rollup).** Adds `:AgentTemplate`, `:AgentLibrary` and library membership, and makes a registered `:A2AAgentCard` a library member the assembler can use. Children .1-.7. | Rollup closes when children .1-.7 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R003.1 Add class `:AgentTemplate` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add class `:AgentTemplate`.** Add `:AgentTemplate` (subclass of `:Agent`) to `crates/eg-core/ontology/orchestration-v1.ttl`, mirroring `crates/eg-types/src/agent_template.rs`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::agent_template_is_an_agent`: `:hasSkill` and `:usesModel` accept it. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R003.2 Add class `:AgentLibrary` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add class `:AgentLibrary`.** Add `:AgentLibrary` to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::agent_library_resolves`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R003.3 Add property `:memberOfLibrary` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:memberOfLibrary`.** Add `:memberOfLibrary` (range `:AgentLibrary`; no domain, because members are `:Agent`, `:AgentTemplate` and `:A2AAgentCard`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::member_of_library_resolves`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R003.4 Add property `:instanceOfTemplate` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:instanceOfTemplate`.** Add `:instanceOfTemplate` (domain `:Agent`, range `:AgentTemplate`) to `crates/eg-core/ontology/orchestration-v1.ttl`, mirroring `TemplateInstanceRef`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::instance_of_template_resolves`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R003.5 Add library-member shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add library-member shape.** Add `:LibraryMemberShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`: every `:memberOfLibrary` subject has at least one `:providesCapability` (a member with none is useless to coverage). Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::member_shape_rejects_a_member_without_capability`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R003.6 Wire the Agent Library projection to emit membership Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Wire the Agent Library projection to emit membership.** In the Agent Library outbox projection (`src/server/connector_pack_projection.rs` and `src/server/persistence/agent_library/`), emit `:hasAgentKind` from typed component annotations, `:memberOfLibrary`, `:instanceOfTemplate` and, for kind `a2a_agent_card` components, `a :A2AAgentCard` plus `:providesCapability` from `declared_capabilities`. Capability triples from a card carry claim strength (EG-DECISION-ENGINE-R126.1). Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::a2a_card_component_projects_as_library_member_with_claim_capabilities`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R003.7 Add Q3 query test Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add Q3 query test.** Test the Q3 query returns the template and the A2A card as separate candidate kinds for one required capability. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q3_lists_template_and_a2a_candidates`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R004 Best practices and guardrail scope (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Best practices and guardrail scope (rollup).** Adds `:BestPractice` and the rule-to-task-class link; rule storage is the existing `GuardrailRule` component (EG-DECISION-ENGINE-R127.2.1). Children .1-.5. | Rollup closes when children .1-.5 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R004.1 Add class `:BestPractice` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add class `:BestPractice`.** Add `:BestPractice` (subclass of `:DevelopmentStandard`) to `crates/eg-core/ontology/capability-v1.ttl`. Owner: epistemic-graph. | `crates/eg-rdf/tests/orchestration_vocabulary.rs::best_practice_is_a_development_standard`. | requirement | EG-ORCH-VOCAB | VERIFIED | 232da0d60c91 481fa6ea2c55 fcf70c5bf0a8 crates/eg-rdf/tests/orchestration_vocabulary.rs:64 |
| EG-ORCH-VOCAB-R004.2 Add property `:appliesToTaskClass` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:appliesToTaskClass`.** Add `:appliesToTaskClass` (domain `:DevelopmentStandard`, range `owl:Class`) to `crates/eg-core/ontology/capability-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::applies_to_task_class_resolves`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R004.3 Add rule-scope shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add rule-scope shape.** Add `:RuleScopeShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`: target every projected `:BestPractice`, including nodes missing the scope property, and require exactly one IRI-valued `:appliesToTaskClass`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::rule_scope_shape_rejects_a_rule_without_a_class`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R004.4 Project `GuardrailRule` components Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Project `GuardrailRule` components.** In the Agent Library projection, emit `a :BestPractice` and `:appliesToTaskClass` from the `applies_to_class` attribute and the source generation as provenance for each `guardrail_rule` component. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::guardrail_rule_component_projects_applies_to_task_class`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R004.5 Add Q4 query test Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add Q4 query test.** Test that a rule on a superclass of the task class is returned with its entailment path (reuses R127.1 `entailed_guardrails`) and an unrelated rule is not. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q4_returns_entailed_rules_only`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R005 Per-subtask bindings (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Per-subtask bindings (rollup).** Adds `:ModelProfile`, `:needsSkill` and a typed step-to-agent assignment so "skills, tools, prompts, models per subtask" is one query. Children .1-.6. | Rollup closes when children .1-.6 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R005.1 Add class `:ModelProfile` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add class `:ModelProfile`.** Add `:ModelProfile` (subclass of `:Model`, so `:usesModel` and `:contextWindow` apply) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::model_profile_is_a_model`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R005.2 Add property `:needsSkill` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:needsSkill`.** Add `:needsSkill` (domain `:TaskStep`, range `:Skill`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::needs_skill_resolves`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R005.3 Add property `:stepAssignedAgent` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:stepAssignedAgent`.** Add `:stepAssignedAgent` (domain `:TaskStep`, no range) to `crates/eg-core/ontology/orchestration-v1.ttl`; the existing `:assignedAgent` is range-restricted to `:A2AAgentCard` and is left alone. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::step_assigned_agent_resolves`; reasoner does not infer an agent to be an A2A card. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R005.4 Add binding shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add binding shape.** Add `:StepBindingShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`: an assigned step has an agent that is `sh:or (:Agent :A2AAgentCard)`, and an `:Agent` assignee has exactly one `:usesModel` and one `:hasPrompt`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::binding_shape_rejects_agent_without_model`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R005.5 Project `model_profile` components Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Project `model_profile` components.** In the Agent Library projection, emit `a :ModelProfile` with `:contextWindow` for each `model_profile` component. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::model_profile_component_projects_with_context_window`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R005.6 Add Q5 query test Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add Q5 query test.** Test the Q5 query returns skills, tools, prompt and model per step. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q5_returns_bindings_per_step`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R006 Hand-off and agent-graph DAG (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Hand-off and agent-graph DAG (rollup).** Adds the hand-off property and the slot-to-slot edge with an acyclicity shape. Children .1-.6. | Rollup closes when children .1-.6 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R006.1 Add property `:handsOffTo` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:handsOffTo`.** Add `:handsOffTo` (domain and range `:TaskStep`, sub-property of `:precedes`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::hands_off_to_implies_precedes`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R006.2 Add property `swarm:feeds` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `swarm:feeds`.** Add `swarm:feeds` (domain and range `swarm:Slot`) to `crates/eg-core/ontology/swarm_topology-v1.ttl`: the forward data-flow edge. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::feeds_resolves`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R006.3 Add property `swarm:loopsBackTo` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `swarm:loopsBackTo`.** Add `swarm:loopsBackTo` (domain and range `swarm:Slot`) to `crates/eg-core/ontology/swarm_topology-v1.ttl`: the only legal back-edge, used by `CritiqueLoop`, `Debate` and `Council`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::loops_back_to_resolves`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R006.4 Add DAG acyclicity shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add DAG acyclicity shape.** Add `swarm:FeedsAcyclicShape` to `crates/eg-core/ontology/swarm_topology-v1.shapes.ttl` (target `swarm:TopologyTemplate`): no slot reaches itself through `swarm:feeds+`, and both ends of every `swarm:feeds` belong to the template's own `swarm:hasSlot`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::feeds_shape_rejects_a_forward_cycle_and_accepts_a_loop_back_edge`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R006.5 Project template topology facts to `swarm:feeds` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Project template topology facts to `swarm:feeds`.** Where the AgentGraph template projection (EG-DECISION-ENGINE-R106) writes `swarm:hasSlot`, also write `swarm:requiresAgentKind` from slot facts and `swarm:feeds` from `AgentGraphEdge` (`from`, `to`, unconditional) and `swarm:loopsBackTo` from an edge flagged as a loop back. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::template_projection_emits_feeds_edges`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R006.6 Add Q6 and Q7 query tests Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add Q6 and Q7 query tests.** Test the workflow query (steps, hand-offs) and the DAG query (nodes, edges, acyclic) over the fixture. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::q6_returns_handoffs` and `crates/eg-core/tests/orchestration_vocabulary.rs::q7_returns_dag_adjacency`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R007 Assembly consumption (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Assembly consumption (rollup).** `graph.assemble()` (EG-DECISION-ENGINE-R036) reads the vocabulary for its task list and writes it back for its result; no planner is added. Children .1-.4. | Rollup closes when children .1-.4 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R007.1 Expand a task's steps into assembly tasks Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Expand a task's steps into assembly tasks.** In `src/server/handlers/decide/assemble.rs`, a task IRI with `:hasStep` steps produces one typed assembly task per step. Each task carries its step's `:requiresCapability` and `:needsSkill` capabilities. A task without steps stays one task. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::assemble_expands_has_step_into_tasks`: capability sets per step reach the solver. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R007.2 Project the assembled graph back Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Project the assembled graph back.** After `DecisionCommit` publishes the `AgentGraphDraft`, the projection emits `:stepAssignedAgent` per step and `swarm:feeds` per edge so the Q1-Q7 queries see the assembled graph. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::committed_assembly_is_queryable_through_q5_and_q7`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R007.3 Add the composed read Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add the composed read.** A test runs Q1-Q7 against one committed assembly and asserts every part is non-empty with provenance. This feeds `EG-CQ-ORCH-R008`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::all_seven_parts_present_after_assembly`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R007.4 Enforce slot agent-kind constraints before assembly selection Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Enforce slot agent-kind constraints before assembly selection.** Resolve `swarm:requiresAgentKind` and candidate `:hasAgentKind` from the visible projections in `src/server/handlers/decide/assemble.rs`; a constrained slot accepts only candidates carrying that kind. Unconstrained slots retain current behavior; no matching visible candidate yields a typed abstention. Kinds remain data, with no solver term list. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::assemble_enforces_slot_agent_kind` excludes an executor-only candidate from a verifier slot, accepts a verifier, and abstains when no visible verifier exists. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R008 Catalog registration and ontology gates (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Catalog registration and ontology gates (rollup).** Registers the new shapes file and keeps generated artifacts in step. Children .1-.2. | Rollup closes when children .1-.2 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R008.1 Register `orchestration-v1.shapes.ttl` with the shape loader Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Register `orchestration-v1.shapes.ttl` with the shape loader.** Add the new shapes file to the same loader list as `finance-v1.shapes.ttl` and `governance-core-v1.shapes.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::orchestration_shapes_are_loaded`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 99743823dcfa fb545f2289df crates/eg-rdf/tests/orchestration_vocabulary.rs:168 |
| EG-ORCH-VOCAB-R008.2 Regenerate ontology artifacts Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Regenerate ontology artifacts.** Regenerate the ontology digests and the catalog import list, then run the byte-for-byte generated-artifact test. The file `catalog-v1.ttl` is import-only and gains no term. Owner: epistemic-graph. | Existing generated-artifact test passes on the regenerated files. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009 Harness run-trace vocabulary (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Harness run-trace vocabulary (rollup).** Adds the harness run-trace properties to `:RunTrace`, their shapes, and the ingestion proof. Existing children .1-.17 remain mandatory; reviewed extensions .18, .100 and .101 define the additional run-boundary, trace-export and indexed-session contracts without replacing those fields. | Preserve every original shape/ingestion acceptance; the extended rollup closes only when .1-.17 and each accepted extension are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.1 Add property `:terminationReason` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:terminationReason`.** Add owl:DatatypeProperty `:terminationReason` (`:RunTrace` -> xsd:string) to `crates/eg-core/ontology/orchestration-v1.ttl`. `sh:in` (final_answer|context_overflow|stuck|step_budget|error), in the shapes file. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`. Also `termination_reason_uses_the_closed_vocabulary`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 crates/eg-rdf/tests/orchestration_vocabulary.rs:126 crates/eg-rdf/tests/orchestration_vocabulary.rs:178 |
| EG-ORCH-VOCAB-R009.2 Add property `:peakContextTokens` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:peakContextTokens`.** Add owl:DatatypeProperty `:peakContextTokens` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 crates/eg-rdf/tests/orchestration_vocabulary.rs:127 |
| EG-ORCH-VOCAB-R009.3 Add property `:contextBudgetTokens` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:contextBudgetTokens`.** Add owl:DatatypeProperty `:contextBudgetTokens` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 crates/eg-rdf/tests/orchestration_vocabulary.rs:128 |
| EG-ORCH-VOCAB-R009.4 Add property `:elisionCount` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:elisionCount`.** Add owl:DatatypeProperty `:elisionCount` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 crates/eg-rdf/tests/orchestration_vocabulary.rs:129 |
| EG-ORCH-VOCAB-R009.5 Add property `:summarizationCount` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:summarizationCount`.** Add owl:DatatypeProperty `:summarizationCount` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 crates/eg-rdf/tests/orchestration_vocabulary.rs:130 |
| EG-ORCH-VOCAB-R009.6 Add property `:turnCount` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:turnCount`.** Add owl:DatatypeProperty `:turnCount` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 crates/eg-rdf/tests/orchestration_vocabulary.rs:131 |
| EG-ORCH-VOCAB-R009.7 Add property `:toolCallCount` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:toolCallCount`.** Add owl:DatatypeProperty `:toolCallCount` (`:RunTrace` -> xsd:integer) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 crates/eg-rdf/tests/orchestration_vocabulary.rs:132 |
| EG-ORCH-VOCAB-R009.8 Add property `:costUsd` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:costUsd`.** Add owl:DatatypeProperty `:costUsd` (`:RunTrace` -> xsd:decimal) to `crates/eg-core/ontology/orchestration-v1.ttl`. Cost in US dollars; `:tokenCost` (`EG-CQ-CONN-R079.3`) stays as the raw token cost. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::run_trace_properties_have_declared_domain_and_datatype`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 crates/eg-rdf/tests/orchestration_vocabulary.rs:133 |
| EG-ORCH-VOCAB-R009.9 Add property `:appliedHarnessConfig` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:appliedHarnessConfig`.** Add owl:ObjectProperty `:appliedHarnessConfig` (`:RunTrace` -> `:Decision`) to `crates/eg-core/ontology/orchestration-v1.ttl`. The range is the committed `HarnessConfig` decision node that the `EG-DECISION-ENGINE` row for `HarnessConfig` writes. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::applied_harness_config_links_trace_to_decision`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.10 Add property `:runModel` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:runModel`.** Add owl:ObjectProperty `:runModel` (`:RunTrace` -> `:ModelProfile`) to `crates/eg-core/ontology/orchestration-v1.ttl`. The existing `:usesModel` has an `:Agent` domain, so the per-model queries need this property. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::run_model_declared`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.11 Add property `:runTaskClass` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:runTaskClass`.** Add owl:ObjectProperty `:runTaskClass` (`:RunTrace` -> `:TaskClass`) to `crates/eg-core/ontology/orchestration-v1.ttl`. The `EG-TYPED-PACKS` rows for the task class own `:TaskClass` and `shellCentric`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::run_task_class_declared`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.12 Add counter shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add counter shape.** Add `:RunTraceCounterShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`. Each of the six counters and `:costUsd` must be a non-negative number; a negative or non-integer counter fails. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::counter_shape_rejects_negative_and_fractional_counts`. | requirement | EG-ORCH-VOCAB | VERIFIED | 4039e99f3a6e 6ff9f3cda295 de7ab65f3ee0 f27723c2b36c crates/eg-rdf/tests/orchestration_vocabulary.rs:194 |
| EG-ORCH-VOCAB-R009.13 Add context-budget shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add context-budget shape.** Add `:RunTraceBudgetShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl` as an `sh:sparql` constraint. `:peakContextTokens` must not exceed `:contextBudgetTokens` unless `:terminationReason` is `context_overflow`. Owner: epistemic-graph. | Native test: `crates/eg-rdf/tests/orchestration_vocabulary.rs::run_trace::budget_shape_allows_overshoot_only_for_overflow`. | requirement | EG-ORCH-VOCAB | VERIFIED | 6ff9f3cda295 de7ab65f3ee0 crates/eg-rdf/tests/orchestration_vocabulary.rs:226 |
| EG-ORCH-VOCAB-R009.14 Add completed-trace shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add completed-trace shape.** Add `:RunTraceCompletedShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`. A trace with a terminal status must carry `:terminationReason`, all counters, `:runModel`, `:runTaskClass` and `:appliedHarnessConfig`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::completed_trace_shape_rejects_missing_termination_reason`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.15 Refuse a shape-invalid RunTrace write Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refuse a shape-invalid RunTrace write.** In `src/server/handlers/graph_ops/gateway_graph.rs` (the `Method::AddNode` arm at line 62), validate a node whose `node_type` is `RunTrace` against the three shapes. A violation returns a typed refusal that names the shape and writes nothing. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::invalid_trace_is_refused_and_not_stored`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.16 Fixture trace for each termination reason Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Fixture trace for each termination reason.** Add `crates/eg-core/tests/fixtures/run_traces.json` with five valid traces, one per termination reason, and one overflow trace whose peak exceeds its budget. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::fixtures_pass_all_run_trace_shapes`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.17 Prove the ingestion hot path Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Prove the ingestion hot path.** Send each fixture through the generated client method (`EG-CONTRACT-R051.1`) and `Method::AddNode`, then read it back with Cypher `MATCH (t:RunTrace {id: $tid})`. The read must return every harness property and the `:appliedHarnessConfig` edge. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::client_ingest_round_trips_harness_properties`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R010 Run-trace metric queries (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Run-trace metric queries (rollup).** Defines the per-model, per-task-class queries that the measured-fact loop reads. A solved task is a trace with `final_answer` and `:evaluationScore` of 1.0. Existing children .1-.6 remain mandatory; .100 and .101 add proposal/progress joins and project/agent usage accounting. | Preserve the original solved-task and metric semantics; the extended rollup closes only when .1-.6 and .100-.101 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R010.1 Query success rate Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Query success rate.** Query `harness_success_rate` returns solved traces divided by all traces, grouped by `:runModel` and `:runTaskClass`. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::success_rate_per_model_and_task_class`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R010.2 Query cost per solved task Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Query cost per solved task.** Query `harness_cost_per_solved_task` returns the summed `:costUsd` of all traces divided by the solved-trace count. It groups by model, task class and `:appliedHarnessConfig`. It abstains when no trace is solved. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::cost_per_solved_task_abstains_without_solved_trace`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R010.3 Query overflow rate Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Query overflow rate.** Query `harness_overflow_rate` returns the share of traces with `:terminationReason` equal to `context_overflow`, grouped by model and task class. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::overflow_rate_counts_only_context_overflow`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R010.4 Query peak-to-budget ratio Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Query peak-to-budget ratio.** Query `harness_mean_peak_ratio` returns the mean of `:peakContextTokens` divided by `:contextBudgetTokens`, grouped by model and task class. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::mean_peak_ratio_per_model_and_task_class`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R010.5 Query mechanism counts Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Query mechanism counts.** Query `harness_mechanism_counts` returns mean `:elisionCount`, `:summarizationCount`, `:turnCount` and `:toolCallCount`, grouped by model and `:appliedHarnessConfig`. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::mechanism_counts_per_config`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R010.6 Query competency question Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Query competency question.** Query `harness_best_config` answers one question. For model M and task class C, it names the cheapest configuration per solved task, with evidence. It returns the configuration, its cost, and the trace ids. It abstains below a named default of 20 traces per configuration. A measured value may replace that default. Fixtures live in `crates/eg-core/tests/fixtures/run_traces.json`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::best_config_names_evidence_and_abstains_on_small_samples`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011 Measured model facts from evaluation (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Measured model facts from evaluation (rollup).** Turns an evaluation result into a governed, replaceable model fact that cites its evidence. Storage of the model facts belongs to the `EG-TYPED-PACKS` rows for the measured model facts. Children .1-.11. | Rollup closes when children .1-.11 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.1 Add class `:EvaluationRun` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add class `:EvaluationRun`.** Add `:EvaluationRun`` (subclass of `:RunTrace`) to `crates/eg-core/ontology/orchestration-v1.ttl`. One node represents one matched ablation run; its traces link through `:HAS_EVENT` or `:produced`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::evaluation_run_is_a_run_trace`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.2 Add class `:MeasuredModelFact` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add class `:MeasuredModelFact`.** Add `:MeasuredModelFact` to `crates/eg-core/ontology/orchestration-v1.ttl`. One node records one measured value of one property of one model profile. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::measured_model_fact_declared`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.3 Add properties `:factOfModel` and `:measuredProperty` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add properties `:factOfModel` and `:measuredProperty`.** Add `:factOfModel` (-> `:ModelProfile`) and `:measuredProperty` (xsd:string) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::fact_of_model_and_measured_property_declared`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.4 Add property `:evidencedByRun` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:evidencedByRun`.** Add owl:ObjectProperty `:evidencedByRun` (`:MeasuredModelFact` -> `:EvaluationRun`) to `crates/eg-core/ontology/orchestration-v1.ttl`. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::evidenced_by_run_declared`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.5 Add property `:measuredSupersedes` Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add property `:measuredSupersedes`.** Add owl:ObjectProperty `:measuredSupersedes` (`:MeasuredModelFact` -> `:MeasuredModelFact`) to `crates/eg-core/ontology/orchestration-v1.ttl`. A newer measurement replaces an older one by this edge, never by deletion. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::measured_supersedes_declared`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.6 Add measured-fact shape Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Add measured-fact shape.** Add `:MeasuredModelFactShape` to `crates/eg-core/ontology/orchestration-v1.shapes.ttl`. A fact has exactly one `:evidencedByRun`; `:measuredProperty` is `sh:in` (shellProficiency|stoppingBehaviour|contextWindowTokens); the value matches that property's value set. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::measured_fact_shape_rejects_missing_evidence`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.7 Build the measured-fact envelope Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Build the measured-fact envelope.** Add `measured_fact_envelope(model_ref, property, value, evaluation_run_id, digest) -> ChangeEnvelope` in new file `crates/eg-types/src/change_envelope/measured_fact.rs`. It emits one `EvidenceRecord` (`change_envelope.rs:158`) whose `object_id` is the evaluation run id. Owner: epistemic-graph. | `crates/eg-types/src/change_envelope/measured_fact.rs::tests::envelope_carries_run_evidence`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.8 Refuse a measured fact without evidence Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refuse a measured fact without evidence.** `ChangeEnvelope::validate` (`crates/eg-types/src/change_envelope.rs:248`) must refuse an envelope that writes a `:MeasuredModelFact` without an `EvidenceRecord` naming an `:EvaluationRun`. The refusal is typed `MeasuredFactWithoutEvidence`. Owner: epistemic-graph. | `crates/eg-types/src/change_envelope/measured_fact.rs::tests::missing_evidence_is_refused`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.9 Replace a fact by a newer measurement Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Replace a fact by a newer measurement.** The envelope builder must add `:measuredSupersedes` to the current fact of the same model and property. The query `current_measured_fact` returns the newest fact that nothing supersedes. Owner: epistemic-graph. | `crates/eg-core/tests/orchestration_vocabulary.rs::newer_measurement_replaces_older_and_old_stays_readable`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.10 Apply the envelope through the governed path Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Apply the envelope through the governed path.** `dispatch_change_envelopes` (`src/server/dispatch/change_envelope.rs:36`) applies the envelope; the existing `ApplyChangeEnvelopes` wire method needs no new variant. A client calls it once per evaluation result. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::evaluation_result_writes_fact_through_apply_change_envelopes`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R011.11 Prove the loop closes Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Prove the loop closes.** Ingest an evaluation, write `contextWindowTokens`, then call `Decide` for `HarnessConfig` (`EG-DECISION-ENGINE` row for `HarnessConfig`). The answer must cite the fact. Without the fact, the answer must abstain, per the `EG-TYPED-PACKS` rows. Owner: epistemic-graph. | `crates/eg-core/tests/run_trace_ingest.rs::harness_config_decision_reads_measured_fact_and_abstains_without`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012 Spec-folder contents map to typed graph nodes (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Spec-folder contents map to typed graph nodes (rollup).** Workspace ingestion maps each file of a specification folder to one typed node: task, goal, document, memory or policy. Children .1-.6. | Rollup closes when children .1-.6 are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012.1 Model Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Model.** Add `SpecNodeKind` (closed set: `task`, `goal`, `document`, `memory`, `policy`) in new file `crates/eg-core/src/spec_folder.rs`. Add the matching classes `:SpecTask`, `:SpecGoal`, `:SpecMemory` and `:SpecPolicy` to `crates/eg-core/ontology/sdd-v1.ttl`; documents reuse `:Specification`. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::node_kinds_are_closed_and_declared`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012.2 Behavior Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Behavior.** Add `classify_spec_file(relative_path, front_matter) -> Result<SpecNodeKind, SpecFolderRefusal>` in `crates/eg-core/src/spec_folder.rs`. Each rule is a named, replaceable default. `tasks.md` maps to task. `spec.md` and `plan.md` map to document. A constitution file maps to policy. A memory folder maps to memory. A goal line maps to goal. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::default_rules_classify_each_file_kind`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012.3 Wiring Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Wiring.** Call `classify_spec_file` from the non-code branch of the `IndexRepository` handler at `src/server/dispatch/router/source_ingest.rs:24`. The dispatch router calls that handler for every `IndexRepository` request in production. The call site for the non-code branch is new. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::index_repository_writes_typed_nodes`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012.4 Refusal Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refusal.** `classify_spec_file` must return the typed refusal `SpecFolderRefusal::UnknownKind` for a file that matches no rule. The indexer must store a plain `:Document` for it and must not guess a kind. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::unknown_file_is_refused_not_guessed`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012.5 Evidence Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Evidence.** Each node written by the classifier must carry `:classifiedByRule` (xsd:string, the rule name) and the source path. A query must list every node with the rule that produced it. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::node_records_deciding_rule`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012.6 Hot-path proof Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Hot-path proof.** Entry point: the `IndexRepository` wire method with a fixture spec folder. The test passes through `source_ingest.rs:24` and then queries the graph. It must observe one task, one goal, one document, one memory and one policy node. Owner: epistemic-graph. | `crates/eg-core/tests/spec_folder_mapping.rs::index_repository_on_spec_folder_yields_five_kinds`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R013 Run trace step record with request, argument and result digests (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Run trace step record with request, argument and result digests (rollup).** EG stores a model-request digest, tool-argument digest, and result digest for each run step. Replays compare step digests with stored values. Children `.1` to `.6` deliver this contract. | See each child. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R013.1 Model Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Model.** Add `StepRecord{step_index, kind, model_request_digest, tool_args_digest, result_digest}` in `crates/eg-types/src/outcome_bundle.rs` beside `ReceiptNodeKind` at line 130. Add the kind `ModelRequest` to `ReceiptNodeKind`. `kind` is closed: `model_request`, `tool_call`. Raw prompt and argument bytes stay in a referenced artifact. Proving test: `crates/eg-types/src/outcome_bundle.rs::tests::step_record_round_trips`. | A serde round trip keeps the three digests and rejects an unknown kind. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R013.2 Behavior Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Behavior.** Add `step_digest(kind, canonical_bytes) -> Digest256` in `crates/eg-types/src/outcome_bundle.rs`. The default is SHA-256 over canonical JSON, a named replaceable recipe. The harness and the engine must use this one recipe. The harness compares digests span by span and names the first index that differs. Proving test: `crates/eg-types/src/outcome_bundle.rs::tests::step_digest_is_canonical`. | Key order and whitespace do not change the digest. A changed value does. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R013.3 Wiring Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Wiring.** `StepRecord` validation attaches where a terminal commit binds its receipt nodes, in `crates/eg-types/src/outcome_bundle.rs:668` (`RunEvent`). The production caller is the `AddNode` arm at `src/server/handlers/graph_ops/gateway_graph.rs:62`, which `EG-ORCH-VOCAB` already uses for run traces. This row creates the call site that validates the digests of each ordered step. No production replay compare reads the stored digests today. Proving test: `src/server/handlers/graph_ops/gateway_graph.rs::tests::add_run_trace_checks_step_digests`. | A run trace with a malformed digest is refused. A valid one is stored in step order. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R013.4 Refusal Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refusal.** A step with a digest that is not 64 hex characters must be refused with `STEP_DIGEST_INVALID`. A step index that skips or repeats must be refused with `STEP_ORDER_INVALID`. Proving test: `crates/eg-types/src/outcome_bundle.rs::tests::bad_digest_and_gap_refused`. | Each fault returns its own code and stores nothing. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R013.5 Evidence Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Evidence.** Each stored step must carry `:stepIndex` and `:recordedBy`, the actor that wrote it. The run trace must expose the ordered step digests to a read. Proving test: `crates/eg-types/src/outcome_bundle.rs::tests::stored_steps_read_in_order`. | A read returns the steps in index order with the writing actor. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R013.6 Hot-path proof Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Hot-path proof.** The entry point is the generated client run-trace write, which reaches the `AddNode` wire method. The test writes three steps, reads them back, and compares them with a replayed copy that differs at step two. The call passes through `src/server/handlers/graph_ops/gateway_graph.rs:62`. It observes that the first differing index is two. Proving test: `tests/orchestration/test_run_trace_steps_served.py::test_first_divergence_is_step_two`. | The read-back digests let the compare report index two. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.18 Use one run observation window for model and width adjustments Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Use one run observation window for model and width adjustments.** EG SHALL accept one revisioned observation window per run. The window SHALL bind run ID, window ID, start time, and end time. It SHALL record latency samples and units, error count, and eligible-attempt denominator. It SHALL record token usage and measured cost. Cost SHALL include currency and rate revision. The window SHALL bind current model/profile and parallel width. It SHALL record consumed/remaining budgets and host-capacity receipt. Missing samples or rates SHALL remain unknown. Zero denominator, stale window, or run-revision mismatch SHALL remain unknown. Unknowns SHALL NOT become zero-cost or zero-error evidence. A versioned policy SHALL state latency/error thresholds and model-adequacy/profile inputs. It SHALL state cost-prediction basis and deterministic tie breaks. EG SHALL evaluate model and width jointly against observations and remaining budget. It SHALL return a committed feasible pair or typed abstention/stop. It SHALL trace before/after model, width, budget, window, policy, evidence, and reason. Mid-run continuation SHALL obey AU-CONTROL-R019. AU permits narrowing width to release capacity and prohibits mid-run widening. A later-run allocation requires separate admission and capacity grant. Production wiring: Feed proposed AU RunAdjustmentObservation from existing routing/continuation paths to Method::Decide. Reuse R136 model adequacy/stage allocation and R009.17 RunTrace ingestion/readback. Persist adjustments and abstentions before application. GraphOS remains capacity authority. Owner link: `AU-CONTROL-R006` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:10`. Owner link: `AU-CONTROL-R019` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:24`. Owner link: `EG-DECISION-ENGINE-R136.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/decision-engine/requirements.md:298`. Owner link: `EG-ORCH-VOCAB-R009.17` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/orchestration-vocabulary/requirements.md:69`. Owner link: `ARBORA-CAPACITY-R001.1` at `graph-os@069eebc785afb9fb26bbbcc907cf5a2a4bcab5c5:specs/adaptive-capacity/requirements.md:6`. Draft dependency `AU-CONTROL-R006.30` remains `draft_unmerged` at `50c313ab01871ff7e10aee2a9d0254fa55d71f07`. It is not a merged producer or implementation receipt. Its path is `specs/agent-control-plane/requirements.md`. Explicit hold: AU-CONTROL-R006.30 remains unmerged. The owner must version joint-policy thresholds, predictive cost inputs, and tie-break semantics. Do not infer tuning defaults or implementation claims from source text. Owner-review proposal: The joint carrier makes missing decisions explicit. A self-referential adjustment command does not replace the published policy. Original source record `AU:26`, SHA-256 `8d2f83f788c5fdd36c4dc47f85c9f7673393b6b9075dc46a5ac1c32afd2386e2`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run run_observations_change_model_and_width_with_trace through real AU routing/continuation and served EG Decide. Use identical budgets and controlled latency/cost/error windows. Demonstrate policy-directed model/width changes and budget-forced refusal/stop. Read back exact before/after trace facts. Reject stale windows and invalid rates/denominators. Keep unknown values unknown. Show width narrowing releases capacity. Reject mid-run widening. Host-only AIMD or model-only allocator tests do not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R013.7 Source-pinned walkthrough artifact and graph-bound execution notes Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Source-pinned walkthrough artifact and graph-bound execution notes.** Reuse `Method::UnifiedQuery` for source reads and `Method::AddNode` for the existing RunTrace. Preserve R013.1-.6 StepRecord ordering and the content-addressed artifact read path. Add no graph writer or model executor. Define `CodeWalkthroughV1` as `{run_id, repository_id, repository_revision, graph_snapshot_revision, query_digest, ordered_sections, interaction_edges, artifact_ref, artifact_digest, execution_notes}`. Each section has a contiguous ordinal, source refs, and a content ref/digest. Each source ref is `{entity_id, source_revision, source_digest, path, start_line, end_line}`. Edges bind source/target section ordinals and a relation IRI. The manifest is versioned and self-contained. Content is embedded or referenced by immutable digest, never a mutable URL. It binds the exact query and graph snapshot. Each note binds run id, trace step index, span id, closed `StepRecord.kind`, result digest, and source refs. Notes follow contiguous R013.4-.6 order. The AddNode validator refuses a missing or stale repository revision. It also refuses refs outside the pinned snapshot, uncited sections, and unresolved artifact refs/digests. It refuses cross-tenant refs, duplicate/gapped note indices, or spans outside the run. Refusal stores nothing. UQL readback returns the same ordered refs/digests. Artifact read verifies its digest. EG validates/stores the manifest; AU owns explanation generation and execution spans; WebUI owns interaction/rendering. `EG-REPO-INGEST-R009` and `AU-HARNESS-R024` do not define the AU artifact producer or run binding. No WebUI artifact-consumer ID was found. AU must publish producer inputs, outputs, and invocation receipt. WebUI must publish artifact-consumption and interaction binding. Keep closure open until both exact owner IDs and served receipts are linked. Wire validation at `crates/eg-types/src/outcome_bundle.rs` and `src/server/handlers/graph_ops/gateway_graph.rs`; read back through `Method::Uql`. Proving tests: `crates/eg-types/src/outcome_bundle.rs::tests::code_walkthrough_manifest_round_trips`; `src/server/handlers/graph_ops/gateway_graph.rs::tests::add_run_trace_rejects_stale_walkthrough_source_or_artifact`; `tests/orchestration/test_code_walkthrough_served.py::test_walkthrough_trace_and_artifact_read_back`. Preserve `EG-REPO-INGEST-R009`, `AU-HARNESS-R024`, and `EG-ORCH-VOCAB-R013.1/.3`. Ordered-step validation retains `EG-ORCH-VOCAB-R013.3`. Source AU:115 SHA-256 `445704f78ae07d1c4b62f42dd23797823d91bc470f04a9dc779e3f6777fffbf0`. Status remains SPECIFIED; no producer, consumer, implementation, or receipt is claimed. | Planned served acceptance accepts a valid manifest through AddNode. UQL and artifact readback must independently return identical ordering and digests. Refuse stale revisions and uncited sections before storage. Also refuse foreign-tenant refs, unresolved/tampered artifacts, invalid span/run links, duplicate indices, and step gaps. Confirm EG invokes no generator. AU and WebUI journeys remain held until owner rows and receipts are linked. Existing producer tests do not prove these contracts. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R003.8 Successful-team promotion, safe similarity reuse, and typed handlers Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Successful-team promotion, safe similarity reuse, and typed handlers.** Extend R135 `CompiledProgram`/`lookup_program`, AgentLibraryStore, and R003.6 projection. Do not create a second program model or library. Promote only after a successful terminal run links its RunTrace and compiled program durably. The canonical signature binds task-class IRI, sorted capability IRIs, input/output schema digests, and topology digest. Lookup requires exact task-class/schema digests and topology accepted by R036. Score remaining candidates with caller-pinned `SimilarityPolicyV1`. The policy binds revision, weights summing to one, feature definitions, and minimum score. Capability overlap uses Jaccard on sorted sets. Every other feature names a deterministic score function and source revision. Missing/stale features are unknown and exclude candidates; they are not zero. Select the highest score meeting the minimum. Stable program IRI breaks ties. Projected bindings carry `{capability_id, handler_id, handler_version, input_schema_digest, output_schema_digest, declared_effects}`. IDs are IRIs and schema digests are SHA-256. Effects are a non-empty closed set: `read`, `write`, `external`, or `irreversible`. `graph.assemble()` consumes them as compatibility/effect constraints. It still runs the full R036 solver and policy guards. EG never invokes handlers. Refuse promotion without successful-run evidence, valid metadata, and source links. Abstain `no_compatible_program` when no candidate meets threshold/constraints. Wire through `crates/eg-types/src/decision/program_store.rs`, `src/server/handlers/decide/stat_decide.rs`, `src/server/handlers/decide/candidates.rs`, `src/server/handlers/decide/assemble.rs`, `src/server/persistence/agent_library.rs`, and R003.6 projection files. Tests: `crates/eg-types/src/decision/program_store.rs::tests::similarity_policy_and_signature_round_trip`; `src/server/handlers/decide/stat_tests/program_store_tests.rs::team_reuse_rejects_stale_or_incompatible_handler`; `tests/decide/test_program_store_served.py::test_successful_team_promotes_and_similar_task_reuses_constrained_plan`. Preserve `EG-DECISION-ENGINE-R135.2/.4/R036` and `EG-ORCH-VOCAB-R003.5/.6`. Existing coverage includes `EG-DECISION-ENGINE-R135.4`. The existing solver dependency is `EG-DECISION-ENGINE-R036`; the projection dependency is `EG-ORCH-VOCAB-R003.6`. Source EG:12 SHA-256 `517823a931bb93e173b301a9a31fbe6bd75c14687233c72278a59ced1940673a`. Status remains SPECIFIED pending reviewed implementation and served receipts. | Planned tests promote only a successful trace/program pair and independently read source IDs/signature. A pinned policy selects an exact-compatible candidate above threshold. It selects the highest score and breaks ties by stable ID. It excludes incompatible task/schema/topology or missing/stale features. Refuse malformed handler ID/version/schema/effect set. Confirm EG does not invoke handlers. Served assembly names program, policy/revision, score, bindings, and R036 certificate. No candidate yields `no_compatible_program`. These are future tests, not evidence. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012.7 Synthesize reviewed repository policy with invariant-guarded activation Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Synthesize reviewed repository policy with invariant-guarded activation.** IndexRepository SHALL bind each classified policy source to repository, path, commit, blob digest, and source spans. It SHALL synthesize typed GuardrailRule candidates linked to those spans. A versioned synthesis profile SHALL declare its supported rule grammar. Unparsed or ambiguous clauses SHALL remain inactive with explicit reasons. Synthesis SHALL NOT give source prose authority to trigger operations or activate itself. Before activation, EG SHALL compare every rule against the pinned invariant generation through R129.3. EG SHALL validate the R012.8 review binding and compare expected active-policy revision. A contradiction SHALL name the invariant IRI, candidate rule, and source clause. Stale generation/review or unsupported clauses SHALL refuse activation and preserve the prior set. Successful activation SHALL atomically publish candidate-set digest and policy revision. Later reasoning SHALL load active graph policy and record its revision in decision evidence. Production wiring: Extend existing source_ingest/SourceIngest after classify_spec_file. Reuse GuardrailRule storage and `check_rule_against_invariants`. Connect activation to decision policy under EG-IDENTITY-R008.4. R129.5 human-override guarding alone does not establish repository-policy guarding. Owner link: `EG-ORCH-VOCAB-R012.2` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/orchestration-vocabulary/requirements.md:91`. Owner link: `EG-IDENTITY-R008.4` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/engine-identity-and-scope/requirements.md:16`. Owner link: `EG-DECISION-ENGINE-R129.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/decision-engine/requirements.md:247`. Owner link: `EG-DECISION-ENGINE-R129.5` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/decision-engine/requirements.md:249`. No draft consumer dependency is assigned. Explicit hold: The owner must publish and bind supported declarative grammar/synthesis profile. The owner must publish and bind a concrete review-receipt producer. Text synthesis may produce candidates. It cannot fill either authority gap. Owner-review proposal: Atomic publication covers the active graph-policy set only. It does not imply atomic cross-repository filesystem effects. Original source record `EG:46`, SHA-256 `9de4d3274232cb97a9a85ad17ea20b368fff1bd729bdb4e7b2799991da106c58`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. The generated status has no receipt arrays. No implementation or served receipt is claimed. | Exercise repository_policy_is_synthesized_guarded_and_used with real IndexRepository input. Inspect typed candidates/spans. Review the exact digest. Activate through owner path. The served decision SHALL prove active-rule use. A conflicting rule names the invariant and preserves prior active revision. Test unparsed prose, missing review, changed source digest, and invariant-generation race. Classification and direct helper-only tests do not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R004.6 Persist and query capability gaps and enhancements by task class Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Persist and query capability gaps and enhancements by task class.** EG SHALL persist distinct typed CapabilityGap and DesiredEnhancement nodes. Each node SHALL bind tenant, node ID/revision, capability reference, task-class reference, and domain-taxonomy reference. Each node SHALL also bind source evidence/digest, owner, and disposition. Edges SHALL connect each node to its capability, task class, and domain. A request-local `AbstainReason` SHALL NOT itself be the durable registry `CapabilityGap` record. A gap SHALL be a separately admitted node and may cite the abstention as source evidence. An enhancement records a requested improvement without asserting capability absence. The governed mutation path SHALL validate references, ownership, and expected revisions. It SHALL deduplicate repeated source events. Unknown taxonomy/task-class references SHALL refuse instead of creating arbitrary terms. UnifiedQuery SHALL return these types filtered by task class. It SHALL support exact or taxonomy-descendant matching at pinned taxonomy revision. Authorization SHALL run before rows, counts, and pagination. A gap/enhancement node SHALL NOT mark capability implemented, admitted, or successfully tested. Production wiring: Extend existing orchestration ontology/shapes and governed AddNode/ChangeEnvelope path. Reuse current task-class/domain taxonomy and Method::UnifiedQuery. Do not add a second capability registry. Keep the separate EG:7 owner-export manifest question out of these domain nodes. Owner link: `EG-ORCH-VOCAB-R004` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/orchestration-vocabulary/requirements.md:24`. Owner link: `EG-DECISION-ENGINE-R010` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/decision-engine/requirements.md:16`. No draft consumer dependency is assigned. Producer binding: The proposed typed authority/admission contract in plan.md is normative for this row. Configuration must be admitted before use; no deployed authority is claimed. Do not invent an owner role-export ID for the separate EG:7 hold. Owner-review proposal: Distinct gap/enhancement types and query match mode are proposed schema additions. Original source record `EG:51`, SHA-256 `ed01ad35731abc6a739b3e1a39ee198549103acf0d30ec51c77316ca7cf75c49`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run capability_gap_and_enhancement_are_queryable through served mutation and generated UnifiedQuery. Record gap from served abstention and enhancement from separate reviewed request. Query two task classes. Restart and repeat. Independently read typed fields, edges, and provenance. Test event deduplication, revision conflict, invalid taxonomy, exact/descendant matching, and denied-tenant pagination. Confirm capability implementation state did not change. In-memory fixtures alone do not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012.8 Bind active policy to reviewed normative files without graph writes Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Bind active policy to reviewed normative files without graph writes.** EG SHALL retain epistemic state and active runtime policy in the graph. It SHALL bind normative sources to reviewed, versioned repository files. Each active binding SHALL record repository/path/commit/blob and candidate-set digest. It SHALL record review actor/receipt digest, invariant generation, and expected active-policy revision. Review SHALL cover exact source and synthesized-rule digests. Missing, stale, rejected, or mismatched review SHALL refuse before active-policy mutation. EG graph mutations and reasoning SHALL NOT overwrite normative files. A source change SHALL use governed SDK writeback and GraphOS approval. EG SHALL reread committed revision and review it before graph-policy activation. A graph-policy edit SHALL NOT rewrite files or make unreviewed files runtime authority. R012.7 invariant guards and generation comparison apply at activation. Production wiring: Link R012.2 policy classification and EG-IDENTITY-R008.4 active policy to R012.7 activation. Bind review/approval to ARBORA-OPS-R050.2/.4 and the concrete SDK source effect. EG has no normative filesystem writer. Owner link: `EG-ORCH-VOCAB-R012.2` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/orchestration-vocabulary/requirements.md:91`. Owner link: `EG-IDENTITY-R008.4` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/engine-identity-and-scope/requirements.md:16`. Owner link: `ARBORA-OPS-R050.2` at `graph-os@069eebc785afb9fb26bbbcc907cf5a2a4bcab5c5:specs/hosted-api-operations/requirements.md:147`. Owner link: `ARBORA-OPS-R050.4` at `graph-os@069eebc785afb9fb26bbbcc907cf5a2a4bcab5c5:specs/hosted-api-operations/requirements.md:149`. No draft consumer dependency is assigned. Explicit hold: The owner must confirm a review-receipt producer and normative-source-effect binding. R050 establishes review/ops boundaries, not the proposed full carrier. Owner-review proposal: Reviewed files remain normative source. EG owns active policy. This does not adopt file-only runtime authority. Original source record `EG:61`, SHA-256 `c5f1dfe7867267169ebc8c75abba87a1d9ed47568a65cbfe1bf6d183b8026e59`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run reviewed_normative_source_activates_without_graph_overwrite through served ingestion/review/activation. Dispatch a decision that records active policy revision. Compare source bytes/Git revision before and after graph mutation/reasoning. A graph-originated normative write has no source effect. Missing/rejected review, modified blob, changed rules, or raced revisions preserve prior policy. Permitted source changes require governed writeback, reread, renewed review, then activation. Direct fixture activation does not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R012.9 Requirement rows become typed nodes Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Requirement rows become typed nodes.** The spec-folder indexer must parse each row of a `requirements.md` table into one `:Requirement` node. The node carries `id`, `parent_id`, `title`, `text_digest`, `spec_id`, `path` and `blob_digest`. A child row links to its parent by `:childOf`. Add the parser in `crates/eg-core/src/spec_folder.rs`. Call it from the non-code branch at `src/server/dispatch/router/source_ingest.rs:24`. A duplicate row ID must refuse that file with `SPEC_ROW_DUPLICATE`. EG-SDLC-R005 reads these nodes. | `crates/eg-core/tests/spec_folder_mapping.rs::requirement_rows_become_nodes` indexes a fixture spec with one rollup, two children and one duplicate ID. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R005.100 Nested inputs use declared projection and shielding Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Nested inputs use declared projection and shielding.** Extend the existing step contract with nested input schema and source-slot/path mapping per field. Before AU dispatch, project declared paths only. Withhold undeclared sibling/nested fields even when the coordinator can read the full ParallelWorkspace. Define the shielded-field policy. Bind projected-payload digest to step ID, schema revision, and source-slot digests. Reuse typed result/schema validation. EG declares projection/shield policy; AU `_dispatch_parallel_batch`/processor applies it before tool dispatch. DTO extra-field rejection alone is not data projection. Preserve `AU-HARNESS-R020.1/.2/.4/.6`. Source AU:33 SHA-256 `1a32741b0a97f0c31cd1a3df4ea31d6eee0069c62c3487c0d8057b1ced4b6cf4`; parent R005 is unchanged. | Planned served workflow includes secret undeclared nested field and declared sibling. The worker receives only its declared projection. Coordinator may synthesize typed outputs. Unknown paths, stale schema, or unauthorized source fields refuse before dispatch. Preserve R020 typed-result and schema-refusal behavior. Owner-source review only; no runtime/test receipt is inferred. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.100 Correlate trace records and export reads Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Correlate trace records and export reads.** Read data binds trace, parent/run, span, child-agent, tool-call, time range, source revision, and redaction profile. Child spans correlate to parent run. Consumers fetch complete export snapshots with pagination/completeness metadata and stable digest. This defines EG correlation/read only. AU owns span export; GraphOS owns MCP transport. AU `default_runtime_capabilities/run_agent` exports spans. GraphOS carries the export. EG supports correlated readback. Preserve R008/R024 ownership and `EG-ORCH-VOCAB-R009` trace fields plus `AU-HARNESS-R008/R024.1-.7`. Source AU:60 SHA-256 `5d53cbdda932456b27c6649360c3051d4ab09f2db42018550b4ee81c785748b4`; parent R009 is unchanged. | Planned served read exports a parent with multiple agents/tool calls. Fetch all correlated records across pages. Confirm stable digest, redaction, and completeness. Detect/refuse missing child, duplicate span, unauthorized read, and truncated pagination. EG read tests do not prove MCP delivery. Owner-source review only; no runtime/test receipt is inferred. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.101 Index, browse, and search harness sessions by tenant and full manifest Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Index, browse, and search harness sessions by tenant and full manifest.** Add `Method::IndexHarnessSessionBatch` and `Method::SearchHarnessSessions` over committed RunTrace nodes and existing graph/UQL index. This is an index projection, not SDK sync or a second trace store. Request binds tenant, manifest ID/revision/digest, SDK sync receipt ID/digest, and source cursor. Each record binds `{harness_id, adapter_revision, source_session_id, run_trace_id, run_trace_revision, trace_digest, source_sequence}`. Search every harness in the supported manifest. Accept bounded text/time/harness filters, page size, and snapshot cursor. Results include indexed revision, declared/received/indexed/unavailable coverage, per-entry status/reason, watermark, and cursor. A missing source stays in the denominator. Optional cost binds R010.101 accounting revision and currency/minor-unit exponent. Return totals with measured/unknown state and coverage. Missing attribution/price is never zero. Identical manifest/receipt/content replay is idempotent across restart. Changed content, unsupported manifest, stale cursor, or cross-tenant ref refuses without leakage. Attach to durable RunTrace/AddNode readback and existing UQL. GraphOS serves the adapter; its exact requirement ID remains a coordinator hold. Consumer: `WEBUI-APPS-R006.4`. Source WEBUI:3 SHA-256 `38936b5f2136263c40c29fe639c984243fed8be6dbb9a6d836f40d7b7672116e`. | Serve an SDK receipt for two declared harnesses and independently read referenced traces. Browse/search the full manifest across restart and repeated sync. Cover every manifest entry, including a third unavailable source. Return its reason, cursor paging, and cost currency/unit/unknown fields. Identical replay is idempotent. Refuse altered receipt/content, unsupported adapter, expired cursor, or cross-tenant access. SDK sync and GraphOS adapter tests remain separate dependencies. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R010.100 Join evolution proposals to measured source traces Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Join evolution proposals to measured source traces.** Add read-only `Method::EvolutionTraceMetrics` keyed by `{tenant_id, proposal_id, proposal_revision, prompt_version_id, prompt_revision, prompt_digest, metric_window_id, metric_window_revision, metric_window_digest}`. Join AU progress and ordered source run IDs to EG RunTrace IDs/revisions/digests and stored outcome/evaluation metrics. Each metric binds `{metric_id, metric_revision, metric_digest, name, value|null, unit, numerator|null, denominator|null, observed_at_ms, state: measured|unknown}`. Progress binds source ID/revision/digest, state, and observation time. Return ordered trace refs, missing IDs, query/window digest, coverage, and complete/partial state. Missing known trace is partial/unknown, never zero. Unknown proposal/prompt revision, stale window, digest mismatch, or tenant mismatch refuses without disclosure. Existing AddNode/ChangeEnvelope writes traces. UQL performs independent readback. GraphOS `runs.get/runs.metrics` serves it; its exact requirement ID awaits coordinator linkage. EG reads but never authors/advances AU state. Consumer: `WEBUI-APPS-R004.7`. Source AU:103 SHA-256 `68bae14976bd3581bc33ee65b153b5ad60f807fb894af09577b9debd19be7557`. AU has not supplied the exact producer schema binding progress to ordered runs. Do not invent that owner contract. | Serve proposal/prompt revision with two pinned traces and metrics. Independently read every trace, metric, and AU progress revision. Confirm joined window/coverage digest. Missing trace is partial/unknown, never zero. Refuse stale revisions, changed digests, and cross-tenant refs. Do not report calibration, coverage, or trace counts as optimization progress. AU producer and GraphOS adapter receipts remain required dependencies. No runtime/owner receipt is claimed. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R010.101 Index project/agent token and cost totals with finite latency Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Index project/agent token and cost totals with finite latency.** Extend immutable RunTrace with project/agent IDs and accounting-profile revision. Add four disjoint integer counters: uncached input, cached input, nonreasoning output, and reasoning output. Derive input/output totals by adding categories once. `RunTraceUsageQueryV1` accepts tenant, bounded window, model/project/agent grouping, currency, page size, and snapshot cursor. Return category totals, source coverage, index watermark, and accounting revision. Costs use pinned PriceTableV1 and currency-minor-unit revisions. Each rate is an integer minor-unit numerator per one million tokens, keyed by model/category. Sum exact rational numerators per group/category. Round once per final group/category using pinned currency exponent and half-even. Do not round per trace or intermediate group. Unknown price/attribution returns unknown with reason, never zero. Keep cross-currency groups separate unless pinned FX revision exists. Convert the exact aggregate and round once at final output. Profile binds both table revisions, currency, minor-unit exponent, and algorithm. Measure p95 ≤500 ms from authenticated handler entry to serialized response. Use 1,000,000 indexed traces, 32 readers, and 1,000 fixed-window grouped queries. Record data/index/cache-policy revisions. Preserve `harness_cost_per_solved_task`. Consumer: `WEBUI-APPS-R004.8`; GraphOS `handle_runs_metrics` and WebUI ObservabilityView serve it. Source WEBUI:4 SHA-256 `dd790b40c92758d720375c78ccd4278845b8d348022b4d69b978cba049461237`. | Serve all four categories under a pinned profile. Reconcile grouped totals with an independent reference ledger. Verify split-trace invariance, half-even boundaries, all price/currency revisions, unknown attribution/price, mixed-currency separation, and final FX rounding. Refuse stale profile/watermark, currency mismatch, or cross-tenant query. Measure the stated p95 boundary and dataset through GraphOS `handle_runs_metrics`. A helper benchmark does not count. No runtime/owner receipt is claimed. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R616 Agent, team, prompt and workflow specs are graph facts synthesized from capability search (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Agent, team, prompt and workflow specs are graph facts synthesized from capability search (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R616.1 Model Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Model.** `crates/eg-types/src/orchestration.rs` defines AgentSpec, TeamSpec, PromptSpec, WorkflowSpec, Synthesis. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R616.2 Behavior Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Behavior.** Specs are typed graph nodes with the capability facts they were built from. Synthesis picks skills and tools by capability search under a context budget. It composes a team or workflow. It evolves prompts from outcome evidence. Workflow graphs found in code facts convert to workflow specs. Teams export and import as OWL. Ecosystem packages and architecture layers become typed nodes with dependency edges. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R616.3 Wiring Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Wiring.** Authority for composition remains graph.assemble() of EG-DECISION-ENGINE-R036; synthesis proposes, assemble decides. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R616.4 Refusal Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refusal.** A spec that fails its SHACL shape is refused at publish. The stable code is `SPEC_SHAPE_INVALID`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R616.5 Evidence Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Evidence.** Per synthesis: capabilities used, budget, shape result. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R616.6 Hot-path proof Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Hot-path proof.** Synthesis over a 10k-skill catalog has p99 under 250 ms. The benchmark is `benches/r616_orchestration_vocabulary.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R750 Organization runtime, agent market, digital twin and lifecycle records (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Organization runtime, agent market, digital twin and lifecycle records (rollup).** Rust-native in `crates/eg-types/src/orchestration`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R750.750 Model: Organization runtime, agent market, digital twin and lifecycle records Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Model: Organization runtime, agent market, digital twin and lifecycle records.** The ontology defines these as typed graph nodes. They are roles, staffing, recruitment, work-item graphs, per-role experience, market bids and allocations. They also include point-in-time agent twins with pinned versions. They include persistent agent instances with mailboxes and activation sources. They include shared team todo lists. Types: `OrgChart`, `RoleSpec`, `EmployeeSpec`, `OrgPlanItem`, `Bid`, `Allocation`, `AgentTwin`, `AgentLifecycleState`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R750.751 Behavior: Organization runtime, agent market, digital twin and lifecycle records Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Behavior: Organization runtime, agent market, digital twin and lifecycle records.** A recruiter choice is an engine decision over role requirements. Counterfactual replay of a twin runs on the engine's replay path against pinned versions. Instance registration, drain and termination are state transitions in the statechart crate with durable history. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R750.752 Refusal: Organization runtime, agent market, digital twin and lifecycle records Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refusal: Organization runtime, agent market, digital twin and lifecycle records.** The engine refuses a twin that lacks a version pin. It refuses an allocation that exceeds its bids. It refuses an unknown lifecycle transition. It refuses an instance without a registered definition. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R750.753 Hot-path proof: Organization runtime, agent market, digital twin and lifecycle records Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Hot-path proof: Organization runtime, agent market, digital twin and lifecycle records.** Criterion benchmark `twin_capture` for 1k-node agent graphs. The p50 is under 8 ms and the p99 is under 20 ms. Memory stays under 16 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R751 Team composition, evolution, specialization discovery and social systems (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Team composition, evolution, specialization discovery and social systems (rollup).** Rust-native in `crates/eg-plan/src/teams`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R751.750 Model: Team composition, evolution, specialization discovery and social systems Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Model: Team composition, evolution, specialization discovery and social systems.** The engine composes teams from graph records and promotes proven teams. It discovers new specialists from execution traces. It also stores multi-agent social interaction records. All of these are engine facts and choices. Types: `TeamConfig`, `SpecialistProposal`, `PopulationOutcome`, `SocialInteraction`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R751.751 Behavior: Team composition, evolution, specialization discovery and social systems Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Behavior: Team composition, evolution, specialization discovery and social systems.** A proposed specialist enters as a claim with its trace evidence and is promoted only through the guarded promotion path. Trace-learned team scoring is a fixed-point computation over stored outcomes. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R751.752 Refusal: Team composition, evolution, specialization discovery and social systems Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refusal: Team composition, evolution, specialization discovery and social systems.** The engine refuses a proposal without trace evidence. It refuses a team that duplicates a stored configuration digest. It refuses a promotion that skips the guard. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R751.753 Hot-path proof: Team composition, evolution, specialization discovery and social systems Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Hot-path proof: Team composition, evolution, specialization discovery and social systems.** Criterion benchmark `team_score` over 10k stored teams. The p50 is under 6 ms and the p99 is under 15 ms. Memory stays under 12 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R800 Agent definitions, prompt templates and workflow patterns as graph facts (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Agent definitions, prompt templates and workflow patterns as graph facts (rollup).** `crates/eg-types` and `crates/eg-plan` hold agent definitions, prompt templates, reusable workflow patterns, spec-driven task graphs and compiled skill procedures. They hold them as typed graph facts, not packaged files. The decision ladder composes them by query. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R800.1 Model Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Model.** `AgentDefinition{id, role, prompt_ref, tools, guardrails}` and `PromptTemplate{id, version, slots, digest}` plus `WorkflowPattern{id, steps, preconditions}` in `crates/eg-types/src/orchestration/`. | Planned: `crates/eg-types/tests/orchestration_defs.rs::unfilled_slot_is_refused`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R800.2 Behavior Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Behavior.** Template rendering fills typed slots only and is O(template length). Pattern selection is a graph query over preconditions and prior outcomes. It is not a file lookup. | Planned: `crates/eg-types/tests/orchestration_defs.rs::wrong_slot_type_is_refused`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R800.3 Wiring Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Wiring.** Definitions are imported once through the typed-pack importer. `graph.assemble()` of R036 reads them. An edit creates a new version. It never mutates a published one. | Planned: `crates/eg-types/tests/orchestration_defs.rs::published_version_is_immutable`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R800.4 Refusal Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refusal.** The engine refuses four inputs. The first is a template with an unfilled slot. The second is a slot value of the wrong type. The third is a pattern that names an unknown step. The fourth is an edit that reuses a published version. | Planned: `crates/eg-types/tests/orchestration_defs.rs::pattern_unknown_step_is_refused`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R800.5 Evidence Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Evidence.** Evidence is a version history per definition and a render-digest golden per template. | Planned: `crates/eg-types/tests/orchestration_defs.rs::render_digest_golden`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R800.6 Hot-path proof Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Hot-path proof.** Hot-path proof: a Criterion benchmark renders 100000 templates. The p50 stays under 10 microseconds. The p99 stays under 50 microseconds. Allocation per render stays under 4 KiB. | Planned: `crates/eg-types/tests/orchestration_defs.rs::render_bench_within_budget`. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R004.700 Policy and rule documents ingest as guardrail scope: model and behavior Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Policy and rule documents ingest as guardrail scope: model and behavior.** A constitution-style policy document parses into typed policy and rule nodes with scope, severity and source digest. A bundled mini-markdown rule set parses the same way. Re-ingest is idempotent. A removed rule is withdrawn. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R004.701 Policy and rule documents ingest as guardrail scope: refusal, evidence and hot-path proof Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Policy and rule documents ingest as guardrail scope: refusal, evidence and hot-path proof.** A rule without scope is refused; a document over the size bound is refused. Test `tests/orchestration/test_policy_ingest_served.py::test_reingest_is_idempotent_and_withdraws_removed_rules`; benchmark `benches/policy_ingest.rs` p50 under 8 ms and p99 under 40 ms per document, memory under 32 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.700 Durable execution units mirror into the run-trace vocabulary: model and behavior Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Durable execution units mirror into the run-trace vocabulary: model and behavior.** The engine mirrors a durable run unit of the harness as a typed run-trace node. The node has a stable unit id, produced-artifact links, and a list query by status. A resumed run finds its history. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R009.701 Durable execution units mirror into the run-trace vocabulary: refusal, evidence and hot-path proof Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Durable execution units mirror into the run-trace vocabulary: refusal, evidence and hot-path proof.** A unit without a run id is refused. Test `tests/orchestration/test_durable_units_served.py::test_resume_finds_produced_artifacts`; benchmark `benches/durable_units.rs` p50 under 1 ms and p99 under 5 ms, memory under 16 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-ORCH-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-ORCH-VOCAB-R801 Versioned harness components as graph facts (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Versioned harness components as graph facts (rollup).** The engine stores the eight harness components as versioned graph facts. A component is one of system_prompt, guardrails, memory, tool_guidance, subagent, skill, script or plugin. Each version carries a content digest, a valid time, a confidence and an evidence link. A new version supersedes the older one by edge. A published version never mutates. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child. | requirement | EG-ORCH-VOCAB | VERIFIED | 70de3b70bbdc crates/eg-types/src/orchestration/mod.rs:487 crates/eg-types/tests/harness_components.rs:141 crates/eg-types/tests/harness_components.rs:209 crates/eg-types/tests/harness_components.rs:32 crates/eg-types/tests/harness_components.rs:70 |
| EG-ORCH-VOCAB-R801.1 Model Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Model.** Add `HarnessComponentVersion{component_id, kind, content_ref, content_digest, valid_from, valid_to, confidence, evidence_run_id, supersedes_id, applied_to_id}` in `crates/eg-types/src/orchestration/`. `kind` is the closed set named in the rollup. The `PromptTemplate` versioning of `EG-ORCH-VOCAB-R800.1` and the guardrail scope of `EG-ORCH-VOCAB-R004.700` are the reuse base. Planned test: `crates/eg-types/tests/harness_components.rs::component_version_round_trips`. | The serde round trip keeps every field and rejects an unknown kind. | requirement | EG-ORCH-VOCAB | VERIFIED | 70de3b70bbdc crates/eg-types/src/orchestration/mod.rs:487 crates/eg-types/tests/harness_components.rs:32 |
| EG-ORCH-VOCAB-R801.2 Behavior Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Behavior.** Writing a new version adds a `:supersedes` edge to the current version. The older version stays readable. The query `current_harness_component(component_id, as_of)` returns the newest valid version at that time. The engine keeps every version readable. | `crates/eg-types/tests/harness_components.rs::newer_version_supersedes_and_old_stays_readable`. | requirement | EG-ORCH-VOCAB | VERIFIED | 70de3b70bbdc crates/eg-types/tests/harness_components.rs:70 |
| EG-ORCH-VOCAB-R801.3 Wiring Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Wiring.** The write attaches in the existing ChangeEnvelope and AddNode path at `src/server/handlers/graph_ops/gateway_graph.rs:62`. The bitemporal stamps come from `EG-DURABLE-KERNEL-R078` and `EG-DURABLE-KERNEL-R081`. `graph.assemble()` of `EG-DECISION-ENGINE-R036` reads the current versions. | `src/server/handlers/graph_ops/gateway_graph.rs::tests::harness_component_write_stamps_and_links`. | requirement | EG-ORCH-VOCAB | VERIFIED | 70de3b70bbdc src/server/harness_admission/tests.rs:58 |
| EG-ORCH-VOCAB-R801.4 Refusal Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refusal.** A version without `evidence_run_id` refuses with `HarnessVersionWithoutEvidence`. An unknown `kind` refuses with `HarnessKindUnknown`. A confidence outside 0 to 1 refuses with `HarnessConfidenceInvalid`. A write that mutates a published version refuses with `HarnessVersionImmutable`. | `crates/eg-types/tests/harness_components.rs::evidence_kind_confidence_and_immutability_refusals`. | requirement | EG-ORCH-VOCAB | VERIFIED | 70de3b70bbdc crates/eg-types/tests/harness_components.rs:141 |
| EG-ORCH-VOCAB-R801.5 Evidence Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Evidence.** The version-history query returns the full supersession chain per component. Each node carries its evidence run id, confidence and valid interval. The content digest recomputes from the content reference. | `crates/eg-types/tests/harness_components.rs::version_history_cites_evidence_and_digests`. | requirement | EG-ORCH-VOCAB | VERIFIED | 70de3b70bbdc crates/eg-types/tests/harness_components.rs:209 |
| EG-ORCH-VOCAB-R801.6 Hot-path proof Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Hot-path proof.** The entry point is the generated client write through `ApplyChangeEnvelopes`. The test writes two versions, supersedes, and reads the current one at each valid time. The benchmark `benches/harness_components.rs` stays under 5 ms p99 for a 1k-version chain. | `tests/orchestration/test_harness_components_served.py::test_two_versions_and_bitemporal_read`. | requirement | EG-ORCH-VOCAB | VERIFIED | 70de3b70bbdc tests/orchestration/test_harness_components_served.py:63 |
| EG-ORCH-VOCAB-R802 Improvement library: adopted harnesses, contrasts and lessons (rollup) Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Improvement library: adopted harnesses, contrasts and lessons (rollup).** The engine stores the adopted harness, the behavioral contrast and the lesson of one task. A lesson retains only when its evidence shows measurable improvement. The library queries by deficiency, task class and trajectory features. A record without evidence refuses. Children `.1` through `.6` cover model, behavior, retrieval, supersession, refusal and hot-path proof. | See each child. | requirement | EG-ORCH-VOCAB | VERIFIED | a45d1b095bda crates/eg-types/tests/harness_lessons.rs:176 crates/eg-types/tests/harness_lessons.rs:253 crates/eg-types/tests/harness_lessons.rs:408 crates/eg-types/tests/harness_lessons.rs:568 crates/eg-types/tests/harness_lessons.rs:76 |
| EG-ORCH-VOCAB-R802.1 Model Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Model.** Add `AdoptedHarness{agent_ref, task_class, component_version_refs, decision_ref, contrast_ref}`, `HarnessContrast{task_ref, conditions_digest, run_a_trace_id, run_b_trace_id, retry_delta, tool_selection_delta, eval_score_delta, cost_delta}` and `HarnessLesson{task_class, deficiency, situation, changed_component_kind, what_changed, applicability, confidence, evidence_run_ids, supersedes_id}` in `crates/eg-types/src/orchestration/`. Planned test: `crates/eg-types/tests/harness_lessons.rs::improvement_records_round_trip`. | The serde round trip keeps every field and rejects an unknown field. | requirement | EG-ORCH-VOCAB | VERIFIED | a45d1b095bda crates/eg-types/tests/harness_lessons.rs:76 |
| EG-ORCH-VOCAB-R802.2 Behavior Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Behavior.** The engine retains a lesson only when its contrast shows measurable improvement. Improvement means fewer retries, better tool selection, a higher evaluation score or lower cost. A lesson cites its evidence runs by trace id. | `crates/eg-types/tests/harness_lessons.rs::lesson_requires_measurable_improvement`. | requirement | EG-ORCH-VOCAB | VERIFIED | a45d1b095bda crates/eg-types/tests/harness_lessons.rs:176 |
| EG-ORCH-VOCAB-R802.3 Query Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Query.** The query `retrieve_lessons(task_class, deficiency, trajectory_features)` ranks hits by confidence. It reads bitemporally with `AS OF`. It abstains with `NoLessons` when nothing matches. | `crates/eg-types/tests/harness_lessons.rs::retrieval_ranks_by_confidence_and_abstains`. | requirement | EG-ORCH-VOCAB | VERIFIED | a45d1b095bda crates/eg-types/tests/harness_lessons.rs:253 |
| EG-ORCH-VOCAB-R802.4 Supersession Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Supersession.** A newer lesson supersedes the older one by edge. A superseded lesson stays readable. An adopted harness supersedes the previous adoption of the same agent and task class. | `crates/eg-types/tests/harness_lessons.rs::supersession_keeps_old_readable`. | requirement | EG-ORCH-VOCAB | VERIFIED | a45d1b095bda crates/eg-types/tests/harness_lessons.rs:408 |
| EG-ORCH-VOCAB-R802.5 Refusal Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Refusal.** A lesson without evidence runs refuses with `LessonWithoutEvidence`. A contrast whose conditions digest differs from its runs refuses with `ContrastConditionsMismatch`. An adopted harness without a decision reference refuses with `AdoptedHarnessNoDecision`. | `crates/eg-types/tests/harness_lessons.rs::evidence_and_condition_refusals`. | requirement | EG-ORCH-VOCAB | VERIFIED | a45d1b095bda crates/eg-types/tests/harness_lessons.rs:568 |
| EG-ORCH-VOCAB-R802.6 Hot-path proof Definition — EG-ORCH-VOCAB / EG-ORCH-VOCAB — Orchestration vocabularyCanonical requirement and verification source**Hot-path proof.** The entry point is the generated client write through `ApplyChangeEnvelopes`. The test writes one contrast, one adopted harness and one lesson, queries by deficiency, and refuses the three negative cases. The benchmark `benches/harness_lessons.rs` stays under 10 ms p99 for 10k lessons. | `tests/orchestration/test_harness_lessons_served.py::test_contrast_lesson_and_retrieval_served`. | requirement | EG-ORCH-VOCAB | VERIFIED | a45d1b095bda tests/orchestration/test_harness_lessons_served.py:154 |
| EG-PLACEMENT EG-PLACEMENT — Placement, worker policy and analytics bound | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001 Deployment-placement question and assembled step graph go through the engine decision functionality (rollup) Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Deployment-placement question and assembled step graph go through the engine decision functionality (rollup).** Typed Decide question over in_process/compose/helm/swarm plus a `graph.assemble()` step graph; closes the prerequisite named by `ARBORA-DEPLOY-R017`. Split into `R001.1`-`R001.14`; satisfied only when every child is. Design: plan.md section A. | See each child. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.1 Prerequisite (decision-engine): standalone topology Decide question Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Prerequisite (decision-engine): standalone topology Decide question.** Owned by `EG-DECISION-ENGINE-R111.1`; supplies the standalone typed-question dispatch pattern placement follows. Not re-specified here; blocked until it lands. | Linked row verified by its own test `a_standalone_topology_decide_question_returns_a_typed_decision_record`. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.2 Add the `Placement` question kind Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Add the `Placement` question kind.** Add variant `Placement` to `QuestionKind` in crates/eg-types/src/decision/statistical.rs (snake_case wire name `placement`), documented evaluate-only like its siblings. | Unit test in the same file: serde round trip of `Placement` and that the schema lists it. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.3 Target registry Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Target registry.** New file crates/eg-types/src/decision/statistical/placement.rs: `PlacementTarget{InProcess,Compose,Helm,Swarm}` with `ALL`, `option_id()` (`placement:<name>`) and `from_option_id()`, mirroring ingestion_lane.rs. Systemd has no member. | Unit test: every target round trips through its option id; `placement:systemd` returns None. | requirement | EG-PLACEMENT | VERIFIED | 92a78d0a890b crates/eg-types/src/decision/statistical/placement.rs:107 crates/eg-types/src/decision/statistical/placement.rs:123 crates/eg-types/src/decision/statistical/placement.rs:139 |
| EG-PLACEMENT-R001.4 Typed request body with refusals Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Typed request body with refusals.** Same file: `PlacementRequestBody{subject: PlacementSubject{workload_iri,cpu_millis,memory_bytes,replicas,needs_persistent_volume}, constraints: PlacementConstraints{requires_ha,forbidden_targets,max_relative_cost,capacity_cells,priority}, candidate_targets}` with `check()` refusing empty or duplicate candidates, unknown option ids (`UNSUPPORTED_PLACEMENT_TARGET`), zero replicas and zero demand. | Unit tests, one per refusal, plus one accepted body. | requirement | EG-PLACEMENT | VERIFIED | 1c906420efa9 crates/eg-types/src/decision/statistical/placement.rs:180 crates/eg-types/src/decision/statistical/placement.rs:191 crates/eg-types/src/decision/statistical/placement.rs:202 crates/eg-types/src/decision/statistical/placement.rs:214 crates/eg-types/src/decision/statistical/placement.rs:227 |
| EG-PLACEMENT-R001.5 Add the placement vocabulary and shape Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Add the placement vocabulary and shape.** New crates/eg-core/ontology/placement-v1.ttl declares `placement:Target` and datatype properties `placement:supportsHa`, `placement:supportsVolumes`, `placement:maxReplicas` (xsd:nonNegativeInteger), `placement:relativeCost` (xsd:nonNegativeInteger). Placement-v1.shapes.ttl requires all four on every `placement:Target` (sh:minCount 1, sh:maxCount 1). Registered beside swarm_topology in crates/eg-core/src/graph/schema_sources.rs (line ~765). | SHACL test in crates/eg-core: a target missing `placement:relativeCost` fails validation. A complete one passes. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.6 Pure feasibility function Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Pure feasibility function.** In placement.rs: `place(body, facts, headroom) -> PlacementVerdict{feasible: Vec<(PlacementTarget, cost)>, eliminated: Vec<(PlacementTarget, PlacementReason)>}`; hard constraints are HA, volumes, max replicas, forbidden targets, cost cap, capacity headroom. A request can only tighten policy caps (`POLICY_LOOSENING` otherwise). | Table-driven unit tests: each constraint eliminates exactly its targets with the named reason; a loosening request is refused. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.7 Wire the kind into Decide Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Wire the kind into Decide.** New src/server/handlers/decide/stat_placement.rs with `placement_outcome(request) -> Option<Result<StatisticalOutcome,String>>`, modelled on stat_tool_subset.rs and called from the same site in stat_decide.rs. Cheapest feasible target is the top `Advisory` score; ties break by option id. | Server test in src/server/handlers/decide/stat_tests/: a Placement request returns a sealed record naming the cheapest feasible target. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.8 Capacity premise reuse, no lease Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Capacity premise reuse, no lease.** `stat_placement.rs` reads headroom through `capacity_premise::headroom` (src/server/handlers/decide/capacity_premise.rs) at the request priority and records it as Observation premises. Nothing is acquired. | Test: after the decision the capacity ledger is unchanged (no lease), and a priority-lower request sees less headroom. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.9 Why-not for every non-chosen target Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Why-not for every non-chosen target.** Each eliminated or lower-ranked target appears in the record's `why_not`/`eliminated` with a stable reason string (`placement:supportsHa=false`, `costlier than <id> (a > b)`). | Test asserts one why-not entry per non-chosen target with the expected reason. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.10 Typed abstention Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Typed abstention.** When no target is feasible, or capacity facts are unavailable (`CAPACITY_UNAVAILABLE`), the outcome is `StatisticalOutcome::Abstained` with a typed `AbstainReason` naming the binding constraint. No target is guessed. | Tests: infeasible demand abstains naming `lease:<cell>:<class>`. Missing ledger abstains with CAPACITY_UNAVAILABLE. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.11 Served contract test through the real dispatch Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Served contract test through the real dispatch.** One test drives the Placement question through the served `Decide` method (not the pure function) with the example from plan.md and asserts the typed record, resolution kind and evidence class. | src/server/handlers/decide/stat_tests/placement_tests.rs (new). | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.12 Assembled step graph fixture Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Assembled step graph fixture.** Publish a test deployment graph template (slots render-artifact, apply, verify) and three tool components in a test Agent Library. `AgentAssemble` with the chosen target's template returns `Solved` with the nodes in order and a certificate. Production components are published by graph-os (BLOCKED on them; the handler itself is not a stub, `assemble.rs:28-55`). | src/server/handlers/decide/ test `deployment_template_assembles_ordered_steps`. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.13 Assemble abstains rather than invents Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Assemble abstains rather than invents.** With a template whose tool component is not in the tenant library, `AgentAssemble` returns an Abstained record naming the uncovered capability and no graph. | Test in the same file as R001.12. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.14 Cross-repo (graph-os): correct R017 wording Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Cross-repo (graph-os): correct R017 wording.** Proposed edit to `ARBORA-DEPLOY-R017.5` and `R017`: replace "today both are refusal stubs" with "the engine handler is served when the engine is built with the decide feature; it refuses by name otherwise (assemble.rs:134-140); confirm remains the stub", and name the placement kind as `QuestionKind::Placement` (`EG-PLACEMENT-R001.2`). Owner: graph-os. | graph-os tests/deployment/test_deploy_refusal.py asserts distinct refusals for feature-absent engine and unavailable confirm. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002 Ingest-worker policy has one authority: the engine decides, the worker asks and obeys (rollup) Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Ingest-worker policy has one authority: the engine decides, the worker asks and obeys (rollup).** Removes the autosize, floor, routing and depth-limit policy that `EG-INGEST-WORKER-R001.x` placed in the worker and gives it to `EG-DURABLE-KERNEL-R074`-`R077`. Split into `R002.1`-`R002.15`; satisfied only when every child is. Design: plan.md section B. | See each child. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.1 Register carries capacity Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Register carries capacity.** Proposed edit to `EG-DURABLE-KERNEL-R074`: `WorkerRecord` includes `cores`, `memory_bytes` and `lanes_supported`, supplied at register. Add the fields in the eg-types file that defines `WorkerRecord` (created by R074). | R074's heartbeat/expiry test also asserts the fields round trip. | requirement | EG-PLACEMENT | VERIFIED | e7b0f9f670c9 crates/eg-types/src/worker_registry.rs:192 |
| EG-PLACEMENT-R002.2 Autosize and depth limit live in `SchedulerConfig` Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Autosize and depth limit live in `SchedulerConfig`.** Producer contract owned by `EG-DURABLE-KERNEL-R076.1` (served integration remains R076.2): fields `cores_per_mille` (default 360), `memory_per_worker_bytes` (default 3 GiB) and `max_queue_depth`, beside the lane floors. The over-subscription refusal is unchanged. | R076.1 native serde round-trip tests include defaults 360 and 3 GiB. This row does not claim a served setting. | requirement | EG-PLACEMENT | VERIFIED | 57050996421e crates/eg-types/src/scheduler_config.rs:111 crates/eg-types/src/scheduler_config.rs:126 |
| EG-PLACEMENT-R002.3 Pure grant function Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Pure grant function.** `worker_registry::granted_slots(record, config, WorkerSizingInput, shard_writer_width) -> WorkerSlotGrant` exposes `slots()` and a typed refusal. The explicit input carries an optional caller request ceiling, current available memory and engine-selected write-lane classification (not scheduler policy). Sizing: min(cores x cores_per_mille / 1000, memory / memory_per_worker), never above a request ceiling or the available-memory limit, and write-lane workers never above the R077 width. The floor of 1 applies only when every hard limit permits a worker; otherwise return a zero-slot grant with a typed capacity refusal. | Unit tests: memory-bound, core-bound, ceiling-bound, width-bound, a permitted floor of 1, and zero memory/ceiling/write-width refusing allocation. | requirement | EG-PLACEMENT | VERIFIED | d94bc10404ce crates/eg-types/src/worker_registry/grants.rs:116 crates/eg-types/src/worker_registry/grants.rs:135 crates/eg-types/src/worker_registry/grants.rs:188 |
| EG-PLACEMENT-R002.4 Admission returns a grant Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Admission returns a grant.** Proposed edit to `EG-DURABLE-KERNEL-R075`: `AdmitWorkerTask` answers `WorkerGrant{slots, reserved_lane}` or a typed refusal. The reserved lane for a worker is decided by the engine from `SchedulerConfig` floors. | R075 test also asserts a one-worker pool is granted the general lane. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.5 Routing is engine-side Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Routing is engine-side.** `lane_for` and `partition_key` (ingest-worker R001.2/R001.3) are called by the engine claim path only; the claim request carries no lane or partition field a worker could set. | Test: a claim request with a forged lane field is refused by schema (deny_unknown_fields). | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.6 Reword `EG-INGEST-WORKER-R001.2` Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Reword `EG-INGEST-WORKER-R001.2`.** Replace "returning hydration for skill_workflows and capability_hydration, general otherwise" with "returning a lane id from the lane set served in `SchedulerConfig` (R076); the engine, not the worker, calls it. Lane names are not redefined here." | Row text matches after the follow-up edit; ingest-worker spec check passes. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.7 Reword `EG-INGEST-WORKER-R001.3` Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Reword `EG-INGEST-WORKER-R001.3`.** Append "The engine claim path derives claim order from this key; workers never compute or send it." | As R002.6. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.8 Reword `EG-INGEST-WORKER-R001.6` Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Reword `EG-INGEST-WORKER-R001.6`.** Replace with "Prerequisite: worker registry, grants, reserved admission, lane floors, autosize defaults and queue-depth limit (EG-DURABLE-KERNEL-R074-R077 as extended by EG-PLACEMENT-R002.1-R002.4). Every worker-count, floor and limit in this spec is read from those served settings." | As R002.6. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.9 Reword `EG-INGEST-WORKER-R001.10` Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Reword `EG-INGEST-WORKER-R001.10`.** Replace "a lone worker is never fully reserved" with "which lane a worker serves is the `reserved_lane` of its engine `WorkerGrant`. This row only verifies the behaviour through the engine (R075 owns the rule)." | As R002.6. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.10 Reword `EG-INGEST-WORKER-R001.11` Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Reword `EG-INGEST-WORKER-R001.11`.** Replace "above a configured depth" with "above `SchedulerConfig.max_queue_depth` (R076)". | As R002.6. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.11 Reword `EG-INGEST-WORKER-R001.14` Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Reword `EG-INGEST-WORKER-R001.14`.** Append "The runner claims only after registering, uses the granted slot count and lane, and treats an admission refusal as a signal to back off, never to retry another lane." | As R002.6. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.12 Reword `EG-INGEST-WORKER-R001.15` Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Reword `EG-INGEST-WORKER-R001.15`.** Replace the autosize clause with "`--workers` is an optional request ceiling. The default is to register cores and memory and run the `slots` the engine grants. The worker holds no CPU/memory ratio constants." | As R002.6. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.13 Cross-repo (connector SDK repository): no policy constants in the worker Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Cross-repo (connector SDK repository): no policy constants in the worker.** The SDK worker reads no CPU ratio, memory-per-worker, floor or depth value; it sends `cores`, `memory_bytes`, `lanes_supported` and obeys the grant. Owner: connector SDK repository. | SDK test: fake engine grants 3 slots on a 16-core host; the worker runs 3. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.14 Fold the analytics pool knob into the same config Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Fold the analytics pool knob into the same config.** `EG_ANALYTICS_WORKERS` (executor_loop.rs:22-25) becomes a `SchedulerConfig` field read once, so colocated and remote workers share one sizing authority (aligns `EG-DURABLE-KERNEL-R082.9`). | Config test: unset env yields the SchedulerConfig default of 1; value 40 is refused or clamped to 32 exactly as today. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.15 Parity check that no duplicate policy remains Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Parity check that no duplicate policy remains.** A spec check greps `specs/ingest-worker` for the strings `0.36`, `3 GiB` and "reserved floor" outside rows that cite R074-R077 by ID. | Check passes after the rewordings land. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R003 Analytics payload bound is decided and defended (rollup) Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Analytics payload bound is decided and defended (rollup).** Closes the open question of `EG-DURABLE-KERNEL-R082.3`. Split into `R003.1`-`R003.6`; satisfied only when every child is. Design: plan.md section C and decisions D6-D8. | See each child. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R003.1 Name the constant Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Name the constant.** In src/server/handlers/jobs/submit.rs replace the literal `31` (line 289) with `const MAX_ASSOCIATION_DISTINCT_ITEMS: usize = (u32::BITS - 1) as usize;` documented as the rule-enumeration mask width. | Unit test asserts the constant equals 31. | requirement | EG-PLACEMENT | VERIFIED | 871e31f80156 src/server/handlers/jobs/submit.rs:453 |
| EG-PLACEMENT-R003.2 Separate refusal for cardinality Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Separate refusal for cardinality.** Split the merged check at submit.rs:285-295 so distinct-item overflow returns its own stable message `association job exceeds the distinct-item limit`, apart from the threshold message. | Table test: over-cap and bad-threshold payloads produce different typed refusals. | requirement | EG-PLACEMENT | VERIFIED | 23b021f818a8 src/server/handlers/jobs/submit.rs:464 |
| EG-PLACEMENT-R003.3 Accept at the cap, refuse above Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Accept at the cap, refuse above.** 31 distinct items accepted, 32 refused. | Test in src/server/handlers/jobs/graph_tests.rs. | requirement | EG-PLACEMENT | VERIFIED | 05b1cbdf1641 src/server/handlers/jobs/graph_tests.rs:204 |
| EG-PLACEMENT-R003.4 Defence in depth in the kernel Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Defence in depth in the kernel.** In `rules_for_itemset` (crates/eg-compute/src/mining/association.rs:402) return no rules when `k > 31` instead of overflowing `1u32 << k`. | Unit test calls `generate_rules` with a 32-item itemset and gets an empty rule list without panic. | requirement | EG-PLACEMENT | VERIFIED | 972d1c80e4bd crates/eg-compute/src/mining/association.rs:772 crates/eg-compute/src/mining/association.rs:785 |
| EG-PLACEMENT-R003.5 Plain labels are accepted and stored opaque Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Plain labels are accepted and stored opaque.** Proposed edit to `EG-DURABLE-KERNEL-R082.3`: drop "required every item to start with `eg:`" as a refusal. The engine maps labels to opaque refs at submit (submit.rs:266-278). Keep the cap, now `MAX_ASSOCIATION_DISTINCT_ITEMS`, with the 31/32 test above. | Test: a payload of plain labels is accepted and the stored job input contains only `eg:` refs. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R003.6 Cap is counted after hashing; verify deterministic behavior on bounded fixtures Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Cap is counted after hashing; verify deterministic behavior on bounded fixtures.** A repeated label yields the same opaque ref; the chosen distinct-label fixtures remain distinct. This is a regression check, not a proof that hashing is injective. | Test: 31 raw fixture labels yield 31 refs; a repeated label counts once. | requirement | EG-PLACEMENT | VERIFIED | bc01fdc30bb0 src/server/handlers/jobs/association_hash_tests.rs:33 src/server/handlers/jobs/association_hash_tests.rs:52 |
| EG-PLACEMENT-R004 Heavy compute routes to the host that declares the capability (rollup) Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Heavy compute routes to the host that declares the capability (rollup).** The engine routes a heavy compute job to a worker with a matching declared capability. It chooses from topology facts in the graph. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R004.1 Model Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Model.** Add `HostCapability{host_iri, capability, headroom}` and `RoutingFact{job_class, required_capability}` in `crates/eg-types/src/decision/statistical/placement.rs`. The capability set is closed and declared by the host. Proving test: `crates/eg-types/src/decision/statistical/placement.rs::tests::capability_types_round_trip`. | A serde round trip keeps every field and rejects an undeclared capability. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R004.2 Behavior Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Behavior.** Add `route_heavy_job(job_class, hosts)` returning hosts that declare the required capability, ordered by headroom. Ordering is a named replaceable default `most_headroom_first`. Proving test: `crates/eg-types/src/decision/statistical/placement.rs::tests::route_orders_by_headroom`. | Two capable hosts return in headroom order; an incapable host is absent. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R004.3 Wiring Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Wiring.** The behavior attaches at `crates/eg-jobs/src/store.rs:773` inside `claim_next` (`store.rs:736`), where worker capabilities already filter the ready queue. The production caller `crates/eg-quantum-jobs/src/job.rs:275` passes an empty capability list, so this row passes the declared capabilities from the topology facts. Proving test: `tests/jobs/test_capability_claim_served.py::test_claim_uses_declared_capability`. | A worker with the declared capability claims the job; a worker without it does not. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R004.4 Refusal Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Refusal.** When no host declares the capability, the engine must refuse with `no_capable_host` naming the capability. It must not fall back to any host. Proving test: `crates/eg-jobs/src/store.rs::tests::no_capable_host_refuses`. | The job stays queued and the refusal names the missing capability. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R004.5 Evidence Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Evidence.** Each routing decision must record `required_capability` and the candidate host list. It must also record the topology fact generation. Proving test: `crates/eg-jobs/src/store.rs::tests::routing_premises_name_generation`. | The decision record lists the candidates and the fact generation. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R004.6 Hot-path proof Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Hot-path proof.** The entry point is the served job submit and worker claim wire methods. The test `tests/jobs/test_capability_claim_served.py::test_backtest_job_lands_on_declared_host` submits a heavy job. It passes through the wired `claim_next` and observes the claim on the host that declares the capability. | The served claim returns the job only to the capable host. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R001.15 Capacity adjustment feasibility and applied-state reconciliation boundary Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Capacity adjustment feasibility and applied-state reconciliation boundary.** Define `CapacityAdjustmentProposalV1` with `proposal_id`, `tenant_id`, `resource_class_iri`, and `unit`. Include unsigned `current_capacity:u64`, `proposed_capacity:u64`, `min_capacity:u64`, and `max_capacity:u64`. Also include `measured_load:u64`, `available_headroom:u64`, `window_start_ms:u64`, and `window_end_ms:u64`. Pin `premise_revision` and `policy_revision`. Bind `proposal_digest:sha256`. Define `CapacityAdjustmentVerdictV1` with `proposal_id`, `proposal_digest`, `premise_revision`, and `policy_revision`. Include `verdict`, `reason_code: Option<CapacityRefusalCode>`, `effective_min_capacity`, `effective_max_capacity`, `observed_current_capacity`, and `observed_headroom`. `verdict` is `allow` or `refuse`. `allow` has no reason code. Every refusal has exactly one. `CapacityRefusalCode` is closed to `CAPACITY_PROPOSAL_DIGEST_INVALID`, `CAPACITY_MEASUREMENT_INVALID`, `CAPACITY_PREMISE_STALE`, `CAPACITY_TENANT_MISMATCH`, `CAPACITY_UNIT_MISMATCH`, `CAPACITY_WINDOW_INVALID`, `CAPACITY_LIMIT_INVALID`, `CAPACITY_LIMIT_EXCEEDED`, and `CAPACITY_HEADROOM_EXCEEDED`. The pure operation is `evaluate_capacity_adjustment(proposal, capacity_premise) -> CapacityAdjustmentVerdictV1`. It is read-only and reuses R001.6's placement/headroom premise. Allow only a fresh, tenant-bound premise and a valid SHA-256 proposal digest. Require non-negative measurements. Require `0 <= window_start_ms < window_end_ms`. Require consistent units. Require proposal current capacity and headroom to match graph premises. Require `min_capacity <= current_capacity <= max_capacity`. Require `min_capacity <= proposed_capacity <= max_capacity`. Require proposed increases to stay within observed headroom. Otherwise return the applicable refusal code. Do not mutate graph or host state. GraphOS owns mode, AIMD proposal generation, host actuation, and limits. EG does not add a second controller. Preserve `ARBORA-CAPACITY-R001.1`, `EG-DECISION-ENGINE-R112`, `ARBORA-CAPACITY-R001/R002`, and `EG-PLACEMENT-R001.6`. Owner source hash: `cb17ea03a7344584fed7a9f22a78c1e97c58919616433e7026481606fd0bdccb`. **Hold:** Owner evidence names no Decision method or QuestionKind for this proposal. It names no GraphOS request, actuation, or readback operation. It names no `CapacityAppliedReceiptV1` producer or fields. The typed EG input and verdict remain candidates, not a wired closed loop. Resolve these owner API and receipt bindings before claiming reconciliation. This row remains SPECIFIED. | **Planned acceptance:** A valid proposal within limits and headroom returns `allow` bound to proposal, premise, and policy revisions. Stale or cross-tenant premises, invalid digests or measurements, inconsistent units or windows, and graph-premise mismatches refuse without mutation. Out-of-bounds capacity and increases beyond observed headroom also refuse. GraphOS applies a valid proposal and exposes an independent readback receipt. Bind it to proposal digest, requested/applied capacity, host/resource, policy, and resulting state revision. Hold GraphOS acceptance until its operation and receipt contract are defined. No served end-to-end closure is claimed. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R611 Cluster discovery, placement routes and tenant client pooling follow the engine's placement authority (rollup) Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Cluster discovery, placement routes and tenant client pooling follow the engine's placement authority (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R611.1 Model Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Model.** `crates/eg-client/src/placement.rs` defines ClusterSnapshot, ClusterMember, PlacementRoute, TenantPool, Breaker. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R611.2 Behavior Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Behavior.** The client asks the engine for the member list and the full route of a graph. It rejects stale or divergent snapshots. It never computes a route itself. Per-tenant clients live in a bounded LRU pool. A circuit breaker opens after consecutive failures and half-opens on a timer. Transport selection (local socket, TLS, mTLS) is one function. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R611.3 Wiring Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Wiring.** Extends EG-PLACEMENT-R002; the Python client delegates to these functions through the generated client. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R611.4 Refusal Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Refusal.** A snapshot older than the routing epoch is rejected and refetched. The stable code is `PLACEMENT_STALE`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R611.5 Evidence Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Evidence.** Metrics: breaker state, pool size, evictions, stale rejects. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R611.6 Hot-path proof Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Hot-path proof.** route lookup from cache under 5 us; pool acquire p99 under 100 us. The benchmark is `benches/r611_placement_and_worker_policy.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R002.600 The engine answers reserved-worker admission Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**The engine answers reserved-worker admission.** `AdmitWorkerTask` refuses a claim that starves the hot-spare reserve unless a pending lane has no running worker, as `EG-INGEST-WORKER-R604` defines. | Integration test runs two workers over two lanes and asserts the admit and refuse outcomes. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R750 Admission pacing, priority classes, cognitive scheduling and model capacity control (rollup) Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Admission pacing, priority classes, cognitive scheduling and model capacity control (rollup).** Rust-native in `crates/eg-resource/src/admission`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R750.750 Model: Admission pacing, priority classes, cognitive scheduling and model capacity control Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Model: Admission pacing, priority classes, cognitive scheduling and model capacity control.** The engine owns work priority classes and the pacing of claims under load shedding. It runs a cognitive scheduler with preemption over per-process inference budgets. It sets per-model adaptive concurrency, with additive increase and multiplicative decrease against a latency signal. It also owns endpoint circuit breaking and shared-GPU group budgets. Types: `PriorityClass`, `ClaimPacer`, `InferenceBudget`, `AgentProcess`, `ModelCapacityController`, `CircuitState`, `GpuGroupBudget`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R750.751 Behavior: Admission pacing, priority classes, cognitive scheduling and model capacity control Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Behavior: Admission pacing, priority classes, cognitive scheduling and model capacity control.** Controllers are pure state machines advanced by explicit events with an injected clock, so replay is exact. Foreground work pauses background work through one throttle fact. A tripped breaker narrows capacity and never raises it above the declared ceiling. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R750.752 Refusal: Admission pacing, priority classes, cognitive scheduling and model capacity control Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Refusal: Admission pacing, priority classes, cognitive scheduling and model capacity control.** The engine refuses a concurrency limit above the declared cell ceiling. It refuses a priority class outside the closed set. It refuses a breaker transition without an observed outcome. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R750.753 Hot-path proof: Admission pacing, priority classes, cognitive scheduling and model capacity control Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Hot-path proof: Admission pacing, priority classes, cognitive scheduling and model capacity control.** Criterion benchmark `admission_decide` runs across 64 concurrent classes. The p50 is under 2 microseconds per decision and the p99 is under 10 microseconds. Memory stays under 1 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R751 Unified scheduling, leader election and cost-bounded resource allocation (rollup) Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Unified scheduling, leader election and cost-bounded resource allocation (rollup).** Rust-native in `crates/eg-jobs/src/schedule`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R751.750 Model: Unified scheduling, leader election and cost-bounded resource allocation Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Model: Unified scheduling, leader election and cost-bounded resource allocation.** One schedule engine runs recurring work with cron, interval and one-shot specs. Leader election makes singleton daemons run on one host. Per-process resource budgets use slices. Components get release-channel visibility. Types: `ScheduleSpec`, `ScheduleTick`, `DaemonLeadership`, `ResourceBudget`, `AllocationSlice`, `ReleaseChannel`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R751.751 Behavior: Unified scheduling, leader election and cost-bounded resource allocation Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Behavior: Unified scheduling, leader election and cost-bounded resource allocation.** Ticks are idempotent per schedule and window. Leadership uses the engine's fenced lease so a stale leader cannot act. Allocation slices never sum above the budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R751.752 Refusal: Unified scheduling, leader election and cost-bounded resource allocation Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Refusal: Unified scheduling, leader election and cost-bounded resource allocation.** The engine refuses a tick replayed after acknowledgement. It refuses a leader that acts with an expired fence. It refuses a slice sum above the budget. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R751.753 Hot-path proof: Unified scheduling, leader election and cost-bounded resource allocation Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Hot-path proof: Unified scheduling, leader election and cost-bounded resource allocation.** Criterion benchmark `schedule_tick` over 100k schedules. The p50 is under 3 ms and the p99 is under 9 ms. Memory stays under 24 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R700 Infrastructure inventory and capacity-bounded placement plans (rollup) Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Infrastructure inventory and capacity-bounded placement plans (rollup).** The engine collects host profiles into the graph. A placement plan assigns service specs to hosts within CPU, memory, storage and capability limits and minimizes movement. The plan is a proposal. It passes through the decision ladder. Implemented in eg-placement. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R700.1 Model Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Model.** `HostCapacity`, `ServiceSpec`, `ServicePlacement` and `PlacementPlan` in `crates/eg-placement`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R700.2 Behavior Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Behavior.** Placement is a bounded 0-1 program solved by the exact solver (R049) with a deterministic node budget (R011). | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R700.3 Wiring Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Wiring.** Extends R001 and R004; inventory arrives as observation-class facts. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R700.4 Refusal Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Refusal.** A service whose required capability no host declares abstains naming it. A plan exceeding any capacity is refused. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R700.5 Evidence Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Evidence.** The plan records the solver certificate. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-PLACEMENT-R700.6 Hot-path proof Definition — EG-PLACEMENT / EG-PLACEMENT — Placement, worker policy and analytics boundCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/placement/test_inventory_placement_served.py::test_capability_gap_abstains` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/placement_plan.rs` must show p50 under 12 ms and p99 under 80 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-PLACEMENT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT EG-CONTRACT — Public engine contract and reproducible clients | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R001 Strict typed Pydantic models for every method and nested type Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Strict typed Pydantic models for every method and nested type.** The Python client exposes generated, strict Pydantic models (extra=forbid) for the request and result of every method. This includes every nested type. The client rejects an unexpected field. Downstream consumers migrate to these generated models instead of hand-written equivalents. | Verified by a typed round trip over every callable method's request and result fixtures. One case injects an unknown nested field and confirms the client rejects it. | requirement | EG-CONTRACT | SPECIFIED | 6cd6c7ea0c87 72c7dfa478ba a1bb9fb9503e tests/test_generated_models.py:105 tests/test_generated_models.py:122 tests/test_generated_models.py:69 |
| EG-CONTRACT-R002 Served Agent Library tests cover pack import and Decide Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Served Agent Library tests cover pack import and Decide.** The installed Python client SHALL run a served Agent Library journey against a real engine and authorization boundary. The journey publishes, reads, and imports a pack. It then issues Decide. Child R002.1 covers typed Decide request and tenant refusal. Child R002.2 covers authorized Decide and served pack import in the same harness. Child R002.3 covers installed-wheel imports without the source tree. The parent lands when every child lands. | A hosted test starts a disposable engine. It runs authorized and denied Decide through the installed wheel. It confirms no client imports from the source tree. | requirement | EG-CONTRACT | VERIFIED | 37a29ee3fe0e 4f364b55e0dc 52f2f3e347a3 c047e6602b42 tests/test_decide_auth_boundary.py:100 tests/test_decide_auth_boundary.py:145 tests/test_decide_auth_boundary.py:81 tests/test_installed_wheel_decision_client_boundary.py:60 |
| EG-CONTRACT-R002.1 Served Decide tenant auth-boundary refusal Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Served Decide tenant auth-boundary refusal.** A served Python test, against the disposable engine the suite's session fixture starts, proves `Decide` refuses a request whose `tenant_id` does not match the verified session's own tenant (`ACCESS_DENIED: Decide tenant must match the verified request tenant`, `src/server/handlers/decide/stat_decide.rs::serve`), through the generated sender (`epistemic_graph.decision_client.DecisionClient`), not an in-process check. | `tests/test_decide_auth_boundary.py::test_decide_refuses_a_request_tenant_that_does_not_match_the_verified_session` passes against the live engine. | requirement | EG-CONTRACT | VERIFIED | 37a29ee3fe0e 4f364b55e0dc 52f2f3e347a3 c047e6602b42 tests/test_decide_auth_boundary.py:81 |
| EG-CONTRACT-R002.2 Served Decide authorized-tenant path and pack-import journey Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Served Decide authorized-tenant path and pack-import journey.** A served Python test proves a tenant-matched `Decide` request passes the same tenant check R002.1 refuses on (it then fails later, on an unpublished feature-schema pin, never on `ACCESS_DENIED`), and a second test runs the served Agent Library pack journey -- bind an importer, publish a pack through the Blob CAS, import it, then read its status back -- against the same live engine, reusing `tests/test_connector_pack_planted.py`'s served helpers rather than duplicating them. | `tests/test_decide_auth_boundary.py::test_decide_passes_the_tenant_check_for_a_matching_request_tenant` and `::test_served_pack_publish_import_and_status_journey` pass against the live engine. | requirement | EG-CONTRACT | VERIFIED | 37a29ee3fe0e 4f364b55e0dc 52f2f3e347a3 tests/test_decide_auth_boundary.py:100 tests/test_decide_auth_boundary.py:145 |
| EG-CONTRACT-R002.3 Installed-wheel / no-source-tree-import check for the Decide and pack-import client surface Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Installed-wheel / no-source-tree-import check for the Decide and pack-import client surface.** The release workflow's folded-wheel gate installs `epistemic-graph` into a clean throwaway venv (`.gates-wheel-venv`, the same job EG-CONTRACT-R015's wheel-contract check and the NE-249/BUG-PE-002 numeric/engine kernel boundary checks already run in) and proves `epistemic_graph.decision_client`, `epistemic_graph.connector_pack` and `epistemic_graph.client` -- the modules EG-CONTRACT-R002.1/.2's served tests import -- resolve from that installed wheel, not this checkout's source tree, following the same mktemp-cwd shadowing-avoidance discipline as those existing steps. | `tests/test_installed_wheel_decision_client_boundary.py` passes as a release-workflow gates-job step run against the installed wheel from a scratch directory. | requirement | EG-CONTRACT | VERIFIED | 37a29ee3fe0e 52f2f3e347a3 tests/test_installed_wheel_decision_client_boundary.py:60 |
| EG-CONTRACT-R003 Privacy scan covers relocated graph-backends documentation Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Privacy scan covers relocated graph-backends documentation.** The documentation privacy suite SHALL scan docs/architecture/graph-backends.md. It SHALL apply the private-network-address, DNS, home-path, and host-alias checks used for other public docs. This preserves privacy coverage after relocation. | tests/test_documentation_privacy.py SHALL include the file in PUBLIC_SURFACES. Planted private-network and path fixtures SHALL fail. | requirement | EG-CONTRACT | VERIFIED | 82e1e970c83a 86532dc7e65a f2398cefb06c tests/test_documentation_privacy.py:67 |
| EG-CONTRACT-R004 Go and JS clients sign bodies through the shared codec Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Go and JS clients sign bodies through the shared codec.** The Go and JavaScript clients canonicalize and sign the wire request body using the embedded engine codec rather than an independent reimplementation, so the two languages cannot diverge from the Rust signing semantics the way the Python sender's mis-signing defect class did. | Verified by replaying every fixture in contract/fixtures/method_body_vectors.json in each client's test suite and confirming identical signed-body bytes across languages. | requirement | EG-CONTRACT | VERIFIED | 6cd6c7ea0c87 a1bb9fb9503e clients/go/vectors_test.go:123 clients/js/vectors.test.mjs:36 |
| EG-CONTRACT-R005 One generated model per wire shape, with typed SPARQL decode Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**One generated model per wire shape, with typed SPARQL decode.** Hand-written DTO modules such as agent_component and connector_pack re-export types from epistemic_graph/generated/models.py instead of defining competing classes, so each wire shape has exactly one model, and GraphComputeEngine.sparql exposes a typed decode_* result as the first consumer path exercising this convergence. | Verified by a typed round trip confirming one generated class per wire shape, including the SPARQL decode path. Genuine uint8-array schemas accept strict JSON octet arrays and legacy Python bytes. JSON serialization preserves arrays, while Python serialization preserves bytes. Malformed octets and lengths are refused. | requirement | EG-CONTRACT | VERIFIED | 37a29ee3fe0e 6cd6c7ea0c87 72c7dfa478ba 924601ce5495 e2b2f1cfa8ee crates/eg-capabilities/src/contract/python/surfaces/tests.rs:121 tests/test_generated_models.py:123 tests/test_generated_union_variants.py:25 tests/test_generated_union_variants.py:27 |
| EG-CONTRACT-R006 Deterministic, size-budgeted WASM codec artifact Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Deterministic, size-budgeted WASM codec artifact.** The embedded method-codec WASM artifact is produced from source using a pinned binaryen wasm-opt version. The optimized bytes are identical across build environments. Its measured size is tracked against a declared budget. Continued reduction of unused decode paths in eg-types lowers it. | scripts/build_method_codec_wasm.py --check compares normalized bytes from two independent builds. It asserts the measured artifact size against the declared budget. | requirement | EG-CONTRACT | SPECIFIED | 2b681e1a159c 6cd6c7ea0c87 |
| EG-CONTRACT-R006.1 Fresh canonical codec export with provenance Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Fresh canonical codec export with provenance.** The existing canonical builder MAY export verified fresh WASM and a source/tree, toolchain, recipe and digest receipt before checking committed copies. Failed builds MUST NOT export cached bytes. CI MUST require a step-scoped fresh-export signal before upload. This child does not qualify reproducibility, size budgets or cross-language client behavior. | `tests/test_build_method_codec_wasm.py` covers export success, failed builds, invalid modules, provenance failures and upload gating while preserving freshness-check failure. | requirement | EG-CONTRACT | VERIFIED | 2b8dd458b459 79c49c6fc412 7e09becc533e a32000c55c4e b6d6bdedcd35 tests/test_build_method_codec_wasm.py:248 tests/test_build_method_codec_wasm.py:276 tests/test_build_method_codec_wasm.py:297 tests/test_build_method_codec_wasm.py:305 tests/test_build_method_codec_wasm.py:315 |
| EG-CONTRACT-R006.2 Complete canonical WASM qualification Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Complete canonical WASM qualification.** Preserve the full R006 reproducibility and measured-size obligations and EG-T-05/EG-T-06 cross-language acceptance. Export-only tests do not satisfy this row. | Attach two independent canonical-build digests and measured size against the declared budget. Include freshness checks for both committed copies and exact-revision Go/JS vector replay evidence. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R007 Dispatch decomposition test is current and runs in CI Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Dispatch decomposition test is current and runs in CI.** The dispatch decomposition test passes against the current dispatch structure, with its function-count pin updated and justified, and it executes as part of the hosted release workflow rather than only a manually invoked hook. | Verified by a mutation test that introduces a stale dispatch target and confirms the gate rejects it when run as part of the hosted release workflow. | requirement | EG-CONTRACT | VERIFIED | 43137cbf0f6b 6cd6c7ea0c87 tests/test_dispatch_decomposition.py:37 tests/test_dispatch_decomposition.py:53 |
| EG-CONTRACT-R008 Repo-parity check validates the resolved checkout Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Repo-parity check validates the resolved checkout.** scripts/check_five_repo_parity.py takes the repository root as an explicit argument. It fails when the resolved directory differs from the requested one. It cannot silently compare against an unintended checkout. | A negative test points the script at a mismatched directory. The test confirms the script fails closed. | requirement | EG-CONTRACT | VERIFIED | 1e48414f9e58 72c7dfa478ba 8baee8a94894 fb6841592a83 scripts/tests/test_check_five_repo_parity.py:10 scripts/tests/test_repo_root_parity.py:10 scripts/tests/test_repo_root_parity.py:21 scripts/tests/test_repo_root_parity.py:31 |
| EG-CONTRACT-R008.1 Typed resolved-checkout parity contract (producer-first split of R008) Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Typed resolved-checkout parity contract (producer-first split of R008).** A pure, typed function resolves a requested repository root and an actual checkout path. It raises a dedicated error the moment they diverge. It is the type-level contract ahead of the real scripts/check_five_repo_parity.py CLI (`R008.2`). | A negative test points the function at two distinct resolved directories and asserts it raises. Positive cases cover an identical path and a symlinked checkout of the same repo. | requirement | EG-CONTRACT | VERIFIED | 1e48414f9e58 72c7dfa478ba 8baee8a94894 fb6841592a83 scripts/tests/test_repo_root_parity.py:10 scripts/tests/test_repo_root_parity.py:21 scripts/tests/test_repo_root_parity.py:31 |
| EG-CONTRACT-R008.2 check_five_repo_parity.py CLI wires in the typed parity contract Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**check_five_repo_parity.py CLI wires in the typed parity contract.** scripts/check_five_repo_parity.py takes the repository root as an explicit CLI argument. It calls the R008.1 contract and fails closed when the resolved checkout does not match the one requested. | A negative test points the script at a mismatched directory. The test confirms the script fails closed. | requirement | EG-CONTRACT | VERIFIED | 72c7dfa478ba 8baee8a94894 fb6841592a83 scripts/tests/test_check_five_repo_parity.py:10 |
| EG-CONTRACT-R009 CI runs the full root Python test suite Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**CI runs the full root Python test suite.** The `ci.yml` workflow compiles the numeric kernel and engine binary. It then runs the complete root Python test suite under tests/ with parallel execution and a per-test timeout. It also runs the crate and duplication census tests. Client, contract and connector-pack regressions cannot reach the default branch unexecuted. The pre-merge gate replica runs the identical suite. | Verified by confirming that the pytest run in `ci.yml` covers the full root suite against the compiled artifacts. The pre-merge gate replica executes the same suite. | requirement | EG-CONTRACT | VERIFIED | 26a77bc6a6c4 29021f36eeee 2f4f3a17a5b5 5c5b8c630a52 8baee8a94894 tests/test_release_python_suite_contract.py:104 tests/test_release_python_suite_contract.py:121 tests/test_release_python_suite_contract.py:132 tests/test_release_python_suite_contract.py:360 tests/test_release_python_suite_contract.py:379 |
| EG-CONTRACT-R010 Complexity gate scores exhaustive matches by arm body, not count Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Complexity gate scores exhaustive matches by arm body, not count.** The complexity gate scores an exhaustive match over an enum by the complexity of each arm's body rather than the number of arms, so adding an arm with trivial logic does not fail the gate while an arm with nested branching still does. | Verified by two gate fixtures: adding a trivial-body arm to an exhaustive match passes, and adding a nested-branching arm still fails. | requirement | EG-CONTRACT | VERIFIED | 72c7dfa478ba 8baee8a94894 d37f675e56da tests/test_check_complexity_staged.py:416 tests/test_check_complexity_staged.py:430 |
| EG-CONTRACT-R011 Parallel fan-out for the land gate across build hosts Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Parallel fan-out for the land gate across build hosts.** The land gate's default execution fans work out in parallel across independent host groups with a persistent warm target per group, produces one merged summary, and reserves headroom on each gate host, reducing total wall-clock time compared to running the full gate serially on a single host. | Verified by the fan-out adapter test suite passing in full and its merged summary matching the per-group results it combines. | requirement | EG-CONTRACT | VERIFIED | a3e3d9924822 tests/test_check_fanout_host_groups.py:118 tests/test_check_fanout_host_groups.py:25 tests/test_check_fanout_host_groups.py:48 tests/test_check_fanout_host_groups.py:75 tests/test_check_fanout_host_groups.py:92 |
| EG-CONTRACT-R011.1 Fan-out host-group manifest is structurally valid before any gate work is dispatched Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Fan-out host-group manifest is structurally valid before any gate work is dispatched.** The land gate's host-group manifest (one warm target per group, a declared headroom-reservation fraction per gate host, and no host assigned to more than one group) is validated by a standalone checker before fan-out dispatch, so a malformed or overlapping manifest fails closed instead of silently serializing or double-booking a host. | Verified by scripts/check_fanout_host_groups.py rejecting a manifest with an overlapping host assignment or a missing headroom reservation, and accepting a disjoint, fully-specified manifest. | requirement | EG-CONTRACT | VERIFIED | a3e3d9924822 tests/test_check_fanout_host_groups.py:118 tests/test_check_fanout_host_groups.py:25 tests/test_check_fanout_host_groups.py:48 tests/test_check_fanout_host_groups.py:75 tests/test_check_fanout_host_groups.py:92 |
| EG-CONTRACT-R012 Complexity scanner resolves modules declared in inline mod blocks Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Complexity scanner resolves modules declared in inline mod blocks.** The complexity scanner for the KISS census resolves a module declared with mod x; inside an inline mod {} block. It does not abort. The gate pins a patched scanner until the upstream fix is released. | Verified by the complexity census completing without aborting on source containing an inline mod block with a nested module declaration. | requirement | EG-CONTRACT | VERIFIED | 78e5f2103219 8baee8a94894 tests/test_kiss_fork.py:54 |
| EG-CONTRACT-R013 KISS config keys avoid a silently dropped section Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**KISS config keys avoid a silently dropped section.** The repository KISS config at .config/kiss.toml SHALL use current key names. It SHALL place renamed orphan detection under its new section. Unknown keys SHALL NOT drop the global section or inflate advisory counts. Derive thresholds deliberately. Do not add a blanket rebaseline. | The complexity census returns to its expected low baseline after migration. No blanket rebaseline file is introduced. | requirement | EG-CONTRACT | VERIFIED | 72c7dfa478ba 78e5f2103219 b8aac182d679 tests/test_kiss_config_keys.py:19 |
| EG-CONTRACT-R014 Generated error catalog has stable auth-mismatch codes Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Generated error catalog has stable auth-mismatch codes.** Generate contract/errors.json from Rust ErrorCode declarations. Include code, class, retryable flag, and HTTP status hint. Include stable AUTH_TENANT_MISMATCH, AUTH_AUDIENCE_MISMATCH, and AUTH_POLICY_VERSION_MISMATCH codes. Each method error_set SHALL cover every error it can produce. | Regenerate contract/errors.json and compare bytes. Negative tests confirm each auth mismatch returns its declared code. | requirement | EG-CONTRACT | VERIFIED | 15acf1a959e5 19d0663aaf5c 2a4982e949a3 2f8fb1af4fac 394f82a01e83 crates/eg-capabilities/src/contract/errors.rs:494 crates/eg-capabilities/src/error_routing.rs:376 crates/eg-types/src/governed_change/tests.rs:183 src/server/auth.rs:2053 src/server/transport/tests.rs:145 |
| EG-CONTRACT-R014.1 Authentication refusals name a safe cause class Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Authentication refusals name a safe cause class.** Every transport that verifies a request context, including QoS admission, returns the same typed refusal. A wrong audience returns AUTH_AUDIENCE_MISMATCH and names the deployment's expected audience. A signature that does not verify returns AUTH_BAD_SIGNATURE. A timestamp outside the clock-skew window returns AUTH_EXPIRED. A principal that is not the verified identity subject returns AUTH_UNKNOWN_PRINCIPAL. Each class is a fixed engine sentence with no secret, nonce or request value. Only a bad signature is decided before the signature verifies. Any other failure stays the generic AUTHENTICATION_REQUIRED refusal. | Unit tests confirm each class returns its declared code, and that other failures stay redacted. A QoS-admission test confirms a wrong-audience context returns AUTH_AUDIENCE_MISMATCH with the expected audience. The catalog lists each code. | requirement | EG-CONTRACT | VERIFIED | 2f8fb1af4fac 789efa66dea1 896e0af67310 ef81c8ba3a08 src/server/auth.rs:2053 src/server/transport/tests.rs:145 |
| EG-CONTRACT-R015 Wheel ships the method, error and scope contract with callability flags Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Wheel ships the method, error and scope contract with callability flags.** The Python wheel packages epistemic_graph/contract/{methods,errors,scopes}.json and their schemas as installed data, and each method entry in methods.json exposes an is_wire_callable flag so a consumer can discover which methods are actually callable without importing server internals. | Verified by installing the packaged wheel in a clean virtual environment outside the checkout and confirming the loader returns the same digest and is_wire_callable values as the source revision. | requirement | EG-CONTRACT | VERIFIED | 26a77bc6a6c4 37a29ee3fe0e 5738b6093ea7 5b9a62ad05e9 tests/test_ontology_package.py:14 tests/test_wheel_contract_surface.py:475 |
| EG-CONTRACT-R015.1 Wheel ships the core ontology, shapes and catalog Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Wheel ships the core ontology, shapes and catalog.** The `epistemic-graph` wheel packages every `crates/eg-core/ontology/*.ttl` file under `epistemic_graph/ontology/`. That set holds the modules, the SHACL shapes and `catalog-v1.ttl`. Git holds one copy. The build backend folds the source files into the wheel with `scripts/inject_ontology.py`. The build fails unless the packaged set equals the source set by name and bytes. The module `epistemic_graph.ontology` reads the files through `importlib.resources`. It exposes `files()`, `read()`, `names()`, `shape_names()`, `catalog()`, `catalog_order()` and `module_files()`. `catalog_order()` returns module IRIs in `owl:imports` order. A consumer needs no source tree. | Unpacking the built wheel lists every source `.ttl` file under `epistemic_graph/ontology/` with identical bytes. The API returns the same set. `tests/test_ontology_package.py` binds this row. | requirement | EG-CONTRACT | VERIFIED | 5b9a62ad05e9 tests/test_ontology_package.py:14 |
| EG-CONTRACT-R016 Consumer-profile allowlist covers all generated PolicyEvolution senders Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Consumer-profile allowlist covers all generated PolicyEvolution senders.** The static consumer-profile audit's allowlist includes every generated PolicyEvolution typed operation sender that the Rust typed-adapter registry and contract publish. A correctly published sender is not flagged as unaudited. | Verified by tests.test_generated_client_contract passing for all declared PolicyEvolution senders. | requirement | EG-CONTRACT | VERIFIED | ad14dd57f95b f2398cefb06c tests/test_generated_client_contract.py:234 |
| EG-CONTRACT-R017 Dispatch census pins cover the current compiler-declared modules Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Dispatch census pins cover the current compiler-declared modules.** The dispatch decomposition census pins a tracked source file list plus function, control-flow, test and assertion fingerprints. They include the current compiler-declared elevation, policy-evolution and telemetry dispatch modules. Its ownership checks run instead of failing on stale pins. Its existing known-bad mutation proofs still catch the defects they were written for. | The dispatch decomposition test suite passes against the current module set. Its mutation-proof tests still fail on a planted defect. | requirement | EG-CONTRACT | VERIFIED | 43137cbf0f6b b8aac182d679 tests/test_dispatch_decomposition.py:36 |
| EG-CONTRACT-R018 Release feature matrix includes the motif Cargo feature Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Release feature matrix includes the motif Cargo feature.** The release workflow's crates job enumerates the eg-numeric motif feature alongside the other Python-exposed features, so it is compiled and tested instead of silently missing from the supported feature matrix. | Verified by the crates release gate running with motif included and the Python CI replica's feature-matrix consistency check passing. | requirement | EG-CONTRACT | VERIFIED | 43200ff368b9 b8aac182d679 cfd03dda1ef7 d556e4d0895e tests/test_release_feature_matrix.py:266 tests/test_release_feature_matrix.py:87 |
| EG-CONTRACT-R019 Dispatch reachability gate follows the current FOREIGN paths Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Dispatch reachability gate follows the current FOREIGN paths.** The static dispatch-reachability check follows FOREIGN method dispatch through exec/dispatch.rs and the bound-registry refusal through federation_opt/run.rs, matching the actual served code paths. A correct fail-closed refusal is not reported as a reachability failure. | The reachability gate passes against the current file layout. A mutation test confirms a pass-through regression in either file still fails it. | requirement | EG-CONTRACT | VERIFIED | a8cfd0978c58 b8aac182d679 tests/test_current_only_architecture.py:68 |
| EG-CONTRACT-R020 Topology test names avoid version-number suffixes Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Topology test names avoid version-number suffixes.** Test and component names describe what they verify rather than carrying a numeric version suffix such as _v1. The topology schema test is named for the schema concept it covers, with its original test body preserved. | Verified by the naming-convention check passing for the renamed test and the test itself continuing to pass unchanged. | requirement | EG-CONTRACT | VERIFIED | 40b49253d3b9 f2398cefb06c tests/test_no_version_suffixes.py:185 |
| EG-CONTRACT-R021 Failed-connect test checks its own teardown, not process counts Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Failed-connect test checks its own teardown, not process counts.** The failed-connection test asserts that the event loop, thread and selector that the dial created are closed. It does not compare process-wide file-descriptor and thread counts. Unrelated concurrent test activity then cannot make a correctly closed connection appear to leak. | Verified by the connection-lifecycle test suite passing when run concurrently with unrelated tests that change process-wide resource counts. | requirement | EG-CONTRACT | VERIFIED | 1bd79a8991ea 72c7dfa478ba tests/test_sync_client_lifecycle.py:107 |
| EG-CONTRACT-R022 Zero new duplicate-code pairs across the combined source tree Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Zero new duplicate-code pairs across the combined source tree.** The jscpd scan finds newly introduced duplicate-code pairs across the combined source tree. The author removes each pair by consolidating the shared implementation into one owned location. The author adds no scanner suppressions or baseline exceptions. | Verified by running the duplication gate against origin/main. It reports zero new pairs. The change adds no suppression comments or baseline file changes. | requirement | EG-CONTRACT | VERIFIED | a3e3d9924822 tests/test_check_duplication_no_suppression.py:27 tests/test_check_duplication_no_suppression.py:42 |
| EG-CONTRACT-R023 Pre-commit hooks pass clean without bypass flags Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Pre-commit hooks pass clean without bypass flags.** Tracked WASM assets stay within the pre-commit size limit, Dupehound review pins reflect the current duplicate-ownership state, every test file has a recognized owner, and the privacy scan has no outstanding findings, so the full configured pre-commit suite passes without a skip or bypass flag. | Verified by running pre-commit run --config .config/pre-commit.yaml --all-files to completion with exit code zero and no hooks skipped. | requirement | EG-CONTRACT | VERIFIED | 2598a0697e5a 85ce2ac73a96 a3e3d9924822 tests/test_check_registry_test_ownership_completeness.py:24 tests/test_check_registry_test_ownership_completeness.py:31 |
| EG-CONTRACT-R023.1 Every tracked test file has a recognized component-registry owner Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Every tracked test file has a recognized component-registry owner.** scripts/check_registry_test_ownership.py's completeness check, run against this repository's current component-registry.yml and tracked tests/ tree, finds zero unowned test files, so the pre-commit suite's test-ownership hook cannot fail on an unclaimed file. | Verified by scripts/check_registry_test_ownership.py reporting zero unowned paths against the current registry and tracked tests/ tree. | requirement | EG-CONTRACT | VERIFIED | 2598a0697e5a 85ce2ac73a96 a3e3d9924822 tests/test_check_registry_test_ownership_completeness.py:24 tests/test_check_registry_test_ownership_completeness.py:31 |
| EG-CONTRACT-R024 Pre-commit and codespell configuration finalized and locked Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Pre-commit and codespell configuration finalized and locked.** The repository's .config/pre-commit.yaml and .config/codespell.ignore reflect the final merged configuration, with release runtime dependency installation and all config-consuming gates pointing at them. | Verified by the configuration validation, lock-consistency, YAML/AST and public-surface checks all passing with no diff against the committed configuration. | requirement | EG-CONTRACT | LANDED | c65a2566a170 |
| EG-CONTRACT-R025 UDS bind-error test uses a short, environment-independent path Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**UDS bind-error test uses a short, environment-independent path.** The Unix domain socket bind-error test constructs a short socket path that does not depend on the ambient temporary-directory path length, so the test exercises the intended bind-error behavior instead of failing on the socket path length limit under a long build directory. | Verified by src/server/transport/tests.rs::uds_setup_propagates_bind_errors_without_entering_accept_loop passing regardless of the ambient temporary-directory path length. | requirement | EG-CONTRACT | VERIFIED | b43f33569dd4 src/server/transport/tests.rs:371 |
| EG-CONTRACT-R026 Combined quality-gate script runs all staged scanners together Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Combined quality-gate script runs all staged scanners together.** A single script runs the staged CCCC, KISS and Dupehound checks plus a jscpd scan of the current changes and the privacy scan together, giving one combined pass or fail result for the full quality-gate set. | Verified by running the combined quality-gate script on a clean tree and confirming it exits zero only when every included scanner passes. | requirement | EG-CONTRACT | LANDED | a1bb9fb9503e |
| EG-CONTRACT-R027 Exhaustive dispatch matches pass the complexity gate via extraction Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Exhaustive dispatch matches pass the complexity gate via extraction.** Dispatch functions that exhaustively match over an enum keep their exhaustive match with no catch-all arm, while each arm's body is extracted into its own function to reduce measured complexity, so the complexity classifier itself does not need a special case for exhaustive matches. | Verified by the complexity gate reporting zero actionable findings for the affected dispatch functions while the existing functional test suite continues to exercise each one. | requirement | EG-CONTRACT | LANDED | b43f33569dd4 |
| EG-CONTRACT-R028 SQLite-format and speech-recognition differential tests run in CI Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**SQLite-format and speech-recognition differential tests run in CI.** The eg-sqlite-format differential test and the eg-asr-whisper test execute as part of a CI job, rather than existing in the tree without any job invoking them. | Verified by the release-qualification test matrix showing both test targets executed with a recorded pass result. | requirement | EG-CONTRACT | VERIFIED | 7798ab372b1e 9ed0560ea093 tests/test_release_python_suite_contract.py:768 |
| EG-CONTRACT-R029 Build runner keeps TMPDIR short enough for Unix socket paths Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Build runner keeps TMPDIR short enough for Unix socket paths.** The automated build runner sets TMPDIR to a short, fixed-length directory rather than a long per-run path, so a tool that places a Unix domain socket under it, such as a compiler cache server or a native dependency's cmake step, does not fail against the 108-byte sun_path limit. | Verified by the build runner's TMPDIR length staying within the socket-path budget regardless of the run's identifying name length, using the same test class as the UDS bind-error fix. | requirement | EG-CONTRACT | VERIFIED | 2a0d6eae0918 4342dc5bc1c6 tests/test_push_gate_evidence.py:256 |
| EG-CONTRACT-R030 Unconstrained build step is not CPU-affinity restricted Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Unconstrained build step is not CPU-affinity restricted.** The constrained-parallelism contract gate's first step, which compiles before timing begins, runs with full CPU availability rather than inheriting the CPU-affinity restriction that applies only to the gate's constrained execution step, so compiling dependencies does not consume the time budget intended for the constrained run; the constrained step's time bound is not relaxed to compensate. | Verified by the gate log showing full CPU availability during the unconstrained build step and the constrained step completing within its declared time bound. | requirement | EG-CONTRACT | LANDED | a1bb9fb9503e |
| EG-CONTRACT-R031 Complexity, duplication and architecture censuses pass at zero backlog Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Complexity, duplication and architecture censuses pass at zero backlog.** The CCCC tracked-tree complexity census reports zero actionable backlog, and the jscpd and Dupehound advisory censuses, the Rust dependency advisory gate, the architecture gates and the documentation contract check all pass on the same tree, with clippy and formatting also clean. | Verified by the complexity census's require-zero mode exiting zero and an independent run reproducing a clean clippy -D warnings and formatting result. | requirement | EG-CONTRACT | SPECIFIED | 2b1bcdda23e6 924601ce5495 a0da67babeae be0f1acb05c6 cd7bf0364ebd tests/test_ci_change_scope.py:215 |
| EG-CONTRACT-R031.1 Lint runner provisions the manifest-selected formatter Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Lint runner provisions the manifest-selected formatter.** Install the repository toolchain and rustfmt unconditionally before pre-commit and the explicit formatting step. | `tests/test_ci_change_scope.py::test_lint_installs_manifest_rustfmt_before_all_formatting_steps` checks manifest-based installation and ordering. | requirement | EG-CONTRACT | VERIFIED | 733e1766936b tests/test_ci_change_scope.py:216 |
| EG-CONTRACT-R031.2 Complete zero-backlog quality-gate acceptance Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Complete zero-backlog quality-gate acceptance.** The full complexity, duplication, dependency, architecture and documentation censuses plus independent clippy and formatting checks pass on the same tree. Formatter setup coverage alone does not satisfy this requirement. | Publish the complete same-tree hosted census and independent clippy/formatting evidence before binding this acceptance child. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R032 Write-classifier functions compile cleanly under the slim profile Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Write-classifier functions compile cleanly under the slim profile.** src/server/access/write_classification.rs's requires_write_native_surface, requires_write_query_surface, requires_write_mining_surface and requires_write_learning_surface compile without an unused-parameter warning under the slim server feature profile, through a structural fix to what each classifier returns or whether it compiles in under that profile, rather than by suppressing the warning on the parameter. | Verified by the slim-server clippy profile passing with -D warnings. | requirement | EG-CONTRACT | VERIFIED | 5bf5b719de7e 9ed0560ea093 tests/test_release_feature_matrix.py:329 |
| EG-CONTRACT-R033 Wire acceptance stays aligned with classifier and dispatch support Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Wire acceptance stays aligned with classifier and dispatch support.** crates/eg-capabilities's Cargo.toml enables an eg-types wire method feature for a server build only when the corresponding facade feature that gates its classifier and dispatch arms is also enabled, so the wire cannot accept a method that the write classifier or dispatcher is not compiled to handle under a given feature profile; the affected query-language classifiers fail closed when their feature is absent. | Verified by compiling each supported feature profile and confirming every wire-callable method under that profile has a matching classifier and dispatch arm, with no unused-parameter warnings. | requirement | EG-CONTRACT | LANDED | 5bf5b719de7e |
| EG-CONTRACT-R034 Complexity test derives its residual from the dispatch arm count Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Complexity test derives its residual from the dispatch arm count.** test_complexity_terms_keeps_accepted_dispatch_visible_and_zero_gate_passes computes its expected complexity residual from the compiler-visible arm count of dispatch_kind instead of a fixed value, so the fixture stays a meaningful positive residual as the exhaustive match grows, while still asserting the dispatch stays exhaustive and visible to the gate. | Verified by the test passing with a residual value computed from source and remaining nonzero after arms are added to dispatch_kind. | requirement | EG-CONTRACT | VERIFIED | cba884075803 tests/test_scanner_wrappers.py:428 |
| EG-CONTRACT-R035 Release workflow executes end to end with all declared targets Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Release workflow executes end to end with all declared targets.** The release workflow's gates job runs to completion as a whole, including its eg-compute solve test step, and an audit confirms every test target declared in the workflow is the one actually executed, closing any gap between declared and executed coverage such as source that no entry point ever compiles. | Verified by a completed end-to-end run of the release workflow's gates job and a coverage audit matching declared test invocations to executed ones. | requirement | EG-CONTRACT | VERIFIED | 0000ded7b740 16c35404ef56 4342dc5bc1c6 4d1920f636e7 66e652687765 tests/test_ci_change_scope.py:497 tests/test_ci_change_scope.py:846 tests/test_release_gates_test_target_coverage.py:62 |
| EG-CONTRACT-R036 Pinned-reference gate anchors each layer to its own admission step Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Pinned-reference gate anchors each layer to its own admission step.** scripts/check_pinned_reference_resolution.py matches each layer's entry points using a word-boundary anchor scoped to that layer's own admission step, instead of a substring match that lets one layer satisfy the check using another layer's entry points, so a removed library- or template-pin resolver is detected as missing. | Verified by tests/test_pinned_reference_resolution.py planting a library-resolver removal and a template-resolver removal and confirming the gate fails on each. | requirement | EG-CONTRACT | VERIFIED | b43f33569dd4 f2398cefb06c tests/test_pinned_reference_resolution.py:169 tests/test_pinned_reference_resolution.py:180 tests/test_pinned_reference_resolution.py:99 |
| EG-CONTRACT-R037 Clippy is warning-free across every release profile Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Clippy is warning-free across every release profile.** Running clippy with -D warnings against every supported release feature profile produces zero warnings, not only the default profile. | Verified by running clippy -D warnings for each declared release feature profile in the release workflow's feature matrix. | requirement | EG-CONTRACT | VERIFIED | 04a134298236 4342dc5bc1c6 cbad9fe59fba tests/test_release_feature_matrix.py:219 |
| EG-CONTRACT-R038 Contract receipt freshness is checked before merge Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Contract receipt freshness is checked before merge.** The contract receipt is regenerated and checked for staleness whenever source that affects it changes, including a new SCHEMA_VERSION occurrence or a change to the Python client, so a drifted receipt digest cannot reach the default branch even when the regenerated catalogs and schemas are otherwise byte-identical to what was already committed. | Verified by a blocking review check that regenerates the receipt and fails on any digest difference from the committed one. | requirement | EG-CONTRACT | LANDED | 2688cddd2f7f |
| EG-CONTRACT-R039 Duplication gate runs against the full combined diff, not per-change Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Duplication gate runs against the full combined diff, not per-change.** The duplication (jscpd) gate runs against the full accumulated change set compared to origin/main, matching what the release workflow checks, so a duplicate pair split across separate incremental changes against their own earlier state cannot escape detection; shared logic extracted during a handler decomposition, such as the sqlite file and key-value dispatch handlers, is factored into one common helper rather than duplicated. | Verified by running the duplication gate over the complete combined tree against origin/main and confirming zero new duplicate pairs. | requirement | EG-CONTRACT | LANDED | 57a12eb06632 |
| EG-CONTRACT-R040 Privacy scanner excludes its own documented example patterns Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Privacy scanner excludes its own documented example patterns.** scripts/check_tracked_privacy.py's credential-pattern documentation does not itself trigger a false credential-history finding, and its entropy-candidate detection does not flag ordinary identifiers and constants as secrets, while a genuinely planted secret still fails the scan. | Verified by check_tracked_privacy.py --self-check catching a planted secret, and a live scan of the tracked history returning zero findings. | requirement | EG-CONTRACT | VERIFIED | 137b6e3a7898 c27abf3e6425 tests/test_documentation_privacy.py:128 tests/test_documentation_privacy.py:144 |
| EG-CONTRACT-R041 Privacy gate detects host paths across the tracked tree Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Privacy gate detects host paths across the tracked tree.** scripts/check_tracked_privacy.py detects a host-path pattern anywhere in tracked source, including architecture/component-registry.yml, scripts/eg_coverage_report.sh, tests/test_check_complexity_staged.py, and .cargo/config.toml, and architecture/component-registry.yml cites only evidence files that are actually present in the repository. | A planted host-path literal in documentation or source fails scripts/check_tracked_privacy.py, and a live scan of the tracked tree returns zero findings. | requirement | EG-CONTRACT | VERIFIED | 2a0d6eae0918 4342dc5bc1c6 tests/test_documentation_privacy.py:100 tests/test_documentation_privacy.py:87 |
| EG-CONTRACT-R042 Quantum hardware macro feature-gated to match its consumers Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Quantum hardware macro feature-gated to match its consumers.** In crates/eg-quantum-hardware/src/registry.rs, the impl_hardware_backend macro, its re-export, and the HardwareResult alias are compiled under a feature gate matching their actual consumers (the ibm, braket, and azure provider adapters), the same pattern used for EG-CONTRACT-R033, so a default build excluding quantum-hardware features does not misreport them as dead code while a build with any of those features keeps all three adapters compiling. | clippy run with no quantum-hardware feature enabled reports no dead-code warning for these symbols, and the crate's provider test suite passes with ibm, braket, and azure each enabled. | requirement | EG-CONTRACT | VERIFIED | 5bf5b719de7e 9ed0560ea093 tests/test_quantum_hardware_provider_feature_gates.py:44 |
| EG-CONTRACT-R043 Test fixtures carry no credential-shaped literals Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Test fixtures carry no credential-shaped literals.** Fixtures needing PostgreSQL connection strings SHALL use non-credential-shaped literals. The full-range secret-history scan SHALL find zero credential hits before acceptance. | The full commit-range secret-history scan reports zero credential hits. | requirement | EG-CONTRACT | VERIFIED | 5dfcc96174bf 5f7fda0efcec a5a05406fe38 e63a9e5ff1f2 tests/test_secret_history_full_range.py:106 |
| EG-CONTRACT-R044 Contract gate discovers Method variants structurally Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Contract gate discovers Method variants structurally.** The contract-registry test discovers every Method variant by reading the mod method_<N> declarations in the protocol module's mod.rs rather than pattern-matching a literal enum block, so it keeps working when Method is assembled from multiple macro-generated files, and it fails when a variant and its descriptor diverge in either direction. | A mutation test confirms the gate fails when a variant is added without a descriptor and when a descriptor is added without a variant, and passes once either is reverted to match. | requirement | EG-CONTRACT | VERIFIED | acc9d32155b3 f2398cefb06c tests/test_contract_method_reachability.py:52 tests/test_contract_method_reachability.py:80 |
| EG-CONTRACT-R045 Method enum size pinned and proven stable Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Method enum size pinned and proven stable.** A compile-time size assertion pins size_of::<Method>() to its measured value, and adding new boxed Method variants does not increase that size because each new variant holds a boxed payload rather than an inline large payload. | A static assertion test fails if size_of::<Method>() changes from its pinned value, proven by comparing the measurement before and after the added variants. | requirement | EG-CONTRACT | VERIFIED | a1bb9fb9503e f2398cefb06c crates/eg-types/tests/contract_wave.rs:255 |
| EG-CONTRACT-R046 Slim-server build compiles with broker feature disabled Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Slim-server build compiles with broker feature disabled.** Compiling epistemic-graph with --no-default-features --features server succeeds cleanly: the match over Method in src/server/mutation_batch/canonical.rs is cfg-scoped so broker-only variants are excluded from, or handled in, its arms whenever the broker feature is disabled. | The slim-server release check compiles that profile with --no-default-features --features server and exits zero. | requirement | EG-CONTRACT | VERIFIED | 4342dc5bc1c6 5bf5b719de7e tests/test_release_feature_matrix.py:308 |
| EG-CONTRACT-R047 Main publishes a rolling engine wheel for consumer CI Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Main publishes a rolling engine wheel for consumer CI.** Each code push to main builds the folded Linux x86_64 wheel. The wheel replaces the assets of the `engine-main` GitHub prerelease. The release targets the source commit and carries a SHA256SUMS file. Consumer CI installs this wheel because the wheel exceeds the PyPI size limit. | The release workflow `engine-main-wheel` job smoke-tests the wheel and publishes it; `gh release download engine-main -p '*.whl'` returns that wheel. | requirement | EG-CONTRACT | LANDED | 9084e9343bf4 |
| EG-CONTRACT-R048 Generated work-claim and evidence DTOs refuse coerced, empty and duplicate inputs Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Generated work-claim and evidence DTOs refuse coerced, empty and duplicate inputs.** `ClaimWorkItemRequest` refuses a blank `tenant_ref`, a zero `lease_ms`, a numeric string `now_ms` and a `max_tenant_in_flight` outside 1..4096. `EvidenceBundle` refuses a blank `bundle_id`, a non-boolean `resolved` and duplicate `policy_exclusions`. The Rust schema source declares each constraint. The generator emits it. | `tests/test_generated_dto_strictness.py` raises `ValidationError` for each of the eight AU PR #22 probe inputs. `gen_contract --check` reproduces the models. | requirement | EG-CONTRACT | VERIFIED | 37a29ee3fe0e 677e430cb3bc a5b4a1f1f638 tests/test_generated_dto_strictness.py:42 tests/test_generated_dto_strictness.py:58 tests/test_generated_dto_strictness.py:74 |
| EG-CONTRACT-R049 The Python client retries an idempotent read once on a dropped connection Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**The Python client retries an idempotent read once on a dropped connection.** `epistemic_graph/client.py`'s `cypher_read` transparently retries exactly once when its connection is dropped mid-call, since a read is idempotent and safe to replay. A non-idempotent write method never retries on a dropped connection and instead surfaces the error to the caller. | A test injects a closed connection on `cypher_read` and asserts the call still succeeds via the transparent retry. A corresponding negative test on a write method asserts no retry occurs and the dropped-connection error propagates. | requirement | EG-CONTRACT | VERIFIED | 6bfd47cbcebc tests/test_cypher_read_retry.py:35 tests/test_cypher_read_retry.py:42 tests/test_cypher_read_retry.py:50 |
| EG-CONTRACT-R050 Generated client ingests OTLP logs Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Generated client ingests OTLP logs.** The generated client exposes an OTLP log ingestion method with strict DTO bounds. Unblocks AU-SEMANTIC-R019.3.1 and R019.3.2. | A client test ingests a log batch and a malformed batch raises `ValidationError`. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R051 Generated client ingests RunTrace Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Generated client ingests RunTrace.** The generated client exposes a RunTrace ingestion method that refuses a blank trace id. Unblocks AU-SEMANTIC-R019.3.3 and R019.3.4. | A client test ingests a RunTrace and asserts the blank-id refusal. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R051.1 Client ingest carries harness fields Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Client ingest carries harness fields.** The generated client RunTrace ingestion method must accept `terminationReason`, the six counters, `costUsd`, `runModel`, `runTaskClass` and `appliedHarnessConfig`. It must refuse a termination reason outside the five values before sending. Vocabulary: `EG-ORCH-VOCAB-R009`. Touches the generated client under `epistemic_graph/`. | A client test ingests an overflow trace and asserts the refusal of an unknown termination reason. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R052 Current architecture documentation (rollup) Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Current architecture documentation (rollup).** The contract must describe existing module owners, dependency direction, shared contracts, and artifact boundaries. Children R052.1–R052.4 define separate documentation units. They must preserve all existing release acceptance requirements. | EG-T-12.1–EG-T-12.4 review the source-linked map in `plan.md`. Documentation alone gives no runtime proof. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R052.1 Module ownership model Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Module ownership model.** `plan.md` must group manifest-listed crates by responsibility and derive membership from `Cargo.toml`. It must distinguish declared dependencies, intended ownership, and implemented enforcement. | EG-T-12.1 compares the map with manifests and the architecture-check configuration. Missing members and unsupported enforcement claims fail review. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R052.2 Build, package, and deployment behavior Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Build, package, and deployment behavior.** `plan.md` must separate Cargo features, wheel composition, Python extras, and runtime activation. `docs/architecture/tiers.md` must describe the server-specific extension boundary. | EG-T-12.2 checks both wheel recipes, default features, and extras against source. Divergent recipes must remain explicit. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R052.3 Shared-contract wiring Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Shared-contract wiring.** `plan.md` must trace identity, provenance, transaction, and query contracts to existing owners and call sites. Direct native operations must remain distinct from planned queries. | EG-T-12.3 checks referenced symbols and owning requirements. Replacing an owner or claiming universal planner traversal fails review. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R052.4 Runtime evidence and refusal Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Runtime evidence and refusal.** `test-spec.md` must define evidence for the real entry points documented by R052.3. `plan.md` must mark missing coverage without inferring implementation absence. | EG-T-12.4 rejects documentation, feature declarations, or generated status as execution proof. Existing EG-C-07/08 and EG-T-10 acceptance remains mandatory. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R001.1 Generated types throughout the AU lifecycle Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Generated types throughout the AU lifecycle.** EG SHALL export strict generated request, result, identity, and decision models. The export SHALL include the complete nested type closure. The manifest SHALL include contract revision, schema digest, and exported type identifiers. The pinned generated schema SHALL govern construction, deserialization, and serialization. Validation SHALL reject unknown nested fields, invalid enums, incompatible revisions, and invalid scalar types. Validation SHALL refuse before dispatch or persistence and return the field path. AU owns AgentLifecycleState and its transition rules. The AU state composes EG-generated types with HarnessRequest, phase, tool requests/results, and RunOutcome. EG SHALL NOT define another AU lifecycle state machine. EG SHALL NOT allow an unvalidated dictionary to replace an admitted value. Rehydration SHALL validate the persisted schema revision and each nested generated value before another step. Production wiring: Extend the EG contract generator and generated-model manifest. AU HarnessRequest and run_agent SHALL consume those exports and proposed AU AgentLifecycleState. Tests SHALL cross generated-client and AU execution/persistence boundaries. Owner link: `EG-CONTRACT-R001` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/public-engine-contract-and-release/requirements.md:5`. Owner link: `AU-HARNESS-R007` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/harness-evolution/requirements.md:12`. Owner link: `AU-HARNESS-R008` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/harness-evolution/requirements.md:13`. Draft dependency `AU-HARNESS-R007.40` remains `draft_unmerged` at `50c313ab01871ff7e10aee2a9d0254fa55d71f07`. It is not a merged producer or implementation receipt. Its path is `specs/harness-evolution/requirements.md`. Explicit hold: AU-HARNESS-R007.40 remains unmerged. AU owns lifecycle state, transitions, persistence, and consumer integration. EG exports alone cannot close AU:109. Owner-review proposal: A schema/type manifest is a proposed export contract. It does not prove an implemented manifest. Original source record `AU:109`, SHA-256 `c0d92285a141dcaac6817bcac25ffa438517afeba50be716211751f3a37a31c2`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run lifecycle_generated_types_survive_run_and_restart through the generated client and real AU run_agent. Transition through tool request/result to RunOutcome. Persist, restart, and resume with the same typed values. Unknown nested fields, wrong scalar types, stale schema revisions, and malformed persisted values SHALL refuse before the next step. AU separately refuses illegal phase transitions. Read persisted/resumed values independently and compare every field. A generated-model unit round trip alone does not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R001.2 Canonical blueprint disk round trip Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Canonical blueprint disk round trip.** EG SHALL bind each exported prompt blueprint to blueprint/schema revision and generated-model revision. It SHALL also bind semantic digest and canonical-byte digest. The versioned JSON profile SHALL use UTF-8 without a BOM and sorted object keys. It SHALL use two-space indentation, LF line endings, and one final newline. It SHALL include declared default/null fields and preserve array order. It SHALL reject NaN and Infinity. Parsing SHALL reject unknown fields and scalar coercion. Schema-defined numbers and Unicode scalar values SHALL survive without rounding or normalization. Export, SDK disk write, disk read, strict validation, and re-export SHALL preserve typed values and canonical bytes. A mismatch SHALL report the first differing JSON pointer/value or byte offset. A mismatch SHALL fail acceptance. EG owns blueprint semantics and validation. SDK and GraphOS governed source-effect contracts own filesystem effects. Production wiring: Use EG-TYPED-PACKS-R094.2/.3/.5/.7 for served admin export/import and durable persistence. Use SDK-GOVERNED-WRITEBACK-R004.5-.12 and ARBORA-FLEET-R003.4-.10 for filesystem effects. Reuse those contracts. EG adds no filesystem writer. Owner link: `EG-CONTRACT-R001` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/public-engine-contract-and-release/requirements.md:5`. Owner link: `EG-TYPED-PACKS-R094.2` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/typed-packs-and-catalog/requirements.md:149`. Owner link: `EG-TYPED-PACKS-R094.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/typed-packs-and-catalog/requirements.md:150`. Owner link: `EG-TYPED-PACKS-R094.5` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/typed-packs-and-catalog/requirements.md:152`. Owner link: `EG-TYPED-PACKS-R094.7` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/typed-packs-and-catalog/requirements.md:154`. Owner link: `AU-CONTROL-R025` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:30`. Draft dependency `AU-CONTROL-R025.40` remains `draft_unmerged` at `50c313ab01871ff7e10aee2a9d0254fa55d71f07`. It is not a merged producer or implementation receipt. Its path is `specs/agent-control-plane/requirements.md`. Explicit hold: AU-CONTROL-R025.40 remains unmerged. The formatter must pin an exact number encoder/profile version. Do not claim arbitrary JSON parsers preserve numeric spelling. Owner-review proposal: The formatting profile matches an AU draft proposal. It is a proposed cross-owner contract, not an existing receipt. Original source record `AU:121`, SHA-256 `98b7ad1186ec2a385b334ffa0ad1b28888157ed6b51c6ed4172eeb7b7ef6768e`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run blueprint_canonical_disk_roundtrip_has_no_difference with served R094 export and governed SDK disk write/read. Import and re-export after restart. Include nested defaults, nulls, ordered arrays, Unicode, and schema-boundary numeric values. Compare exact canonical bytes and schema-typed values. Lost fields, unknowns, coerced numbers, changed array order, and changed final newline SHALL fail. Capture source-effect receipt. A serializer-only test does not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R053 Split distribution: one server executable, an executable-free wheel (rollup) Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Split distribution: one server executable, an executable-free wheel (rollup).** The engine ships as one executable, `epistemic-graph-server`, in its own package `epistemic-graph-server`. The public `epistemic-graph` wheel carries no executables, so it fits the PyPI per-file limit. Children R053.1–R053.13 define separate units. They preserve R015 and R047. | R053.1–R053.8 are verified by their own rows. Documentation alone gives no proof. | requirement | EG-CONTRACT | SPECIFIED | No recorded commit/test evidence |
| EG-CONTRACT-R053.1 One executable with subcommands Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**One executable with subcommands.** `epistemic-graph-server restore`, `migrate-shards`, `epistemic-graph-rf019-observe` and `lake-fixture-export` run the former separate tools and exit. With no subcommand the process serves, so existing invocations keep working. `nemesis` stays a separate harness binary. | A test reads `Cargo.toml` and refuses any `[[bin]]` other than `epistemic-graph-server` and `nemesis`. A test confirms each subcommand name is dispatched in `src/offline_tools.rs` and `src/main.rs` calls it before argument parsing. | requirement | EG-CONTRACT | SPECIFIED | tests/test_server_split.py:23 |
| EG-CONTRACT-R053.2 The wheel carries no executables Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**The wheel carries no executables.** `build_backend.py` removes every `*.data/scripts/*` member and regenerates RECORD. The wheel carries the `engine` and `numeric` extension modules, Python sources and the contract. The wheel gate refuses any executable member. | The build-backend test composes a wheel from a skeleton that carries a server binary and finds no script member and a valid RECORD. The wheel-completeness test refuses a wheel carrying the server binary. | requirement | EG-CONTRACT | SPECIFIED | tests/test_build_backend.py:137 tests/test_check_wheel_completeness.py:215 |
| EG-CONTRACT-R053.3 The `server` extra pins the server package in lockstep Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**The `server` extra pins the server package in lockstep.** `[project.optional-dependencies] server` is `epistemic-graph-server==<version>`, and `.config/bumpversion.cfg` moves it with the engine version. | A test compares the extra with the `Cargo.toml` package version and with the bump configuration. | requirement | EG-CONTRACT | SPECIFIED | tests/test_server_split.py:38 |
| EG-CONTRACT-R053.4 Server binary lookup names the install hint Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Server binary lookup names the install hint.** Code that runs the server from the installed package resolves `epistemic_graph_server.binary_path()` when importable, then `shutil.which("epistemic-graph-server")`, else raises `ServerBinaryNotFoundError` naming `pip install "epistemic-graph[server]"`. | A unit test covers the three outcomes with the package absent, present and on PATH. | requirement | EG-CONTRACT | SPECIFIED | tests/test_server_split.py:49 |
| EG-CONTRACT-R053.5 The `release-server` profile sizes the standalone server Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**The `release-server` profile sizes the standalone server.** `[profile.release-server]` inherits `release` with opt-level `s`, fat LTO, one codegen unit, `panic = "unwind"` and strip. | A test parses `Cargo.toml` and compares each profile key. The PR records the measured binary and wheel size. | requirement | EG-CONTRACT | SPECIFIED | tests/test_server_split.py:66 |
| EG-CONTRACT-R053.6 Callers of the old binary names use the subcommands Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Callers of the old binary names use the subcommands.** Documentation, scripts, tests and CI refer to `epistemic-graph-server <subcommand>`, never to the retired executables. | A test refuses the retired names as commands in `docs/`, `scripts/` and `tests/`. | requirement | EG-CONTRACT | SPECIFIED | tests/test_server_split.py:79 |
| EG-CONTRACT-R053.7 A tag publishes only a commit main CI already passed Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**A tag publishes only a commit main CI already passed.** `ci.yml` runs every test, gate, feature build and benchmark on pull requests and main pushes. A newer push cancels the older run for the same PR or ref. `release.yml` runs on `v*` tags and manual dispatch only. Its `guard` job refuses to proceed unless `ci.yml` concluded `success` on main for the tagged commit. The dispatch input `force_untested` (default false) overrides the guard and the run log records the override. The tag pipeline then builds, checks and publishes only. | A test reads both workflows. It confirms the triggers, the guard query and refusal, that every build job needs the guard, and that `release.yml` holds no gate job. | requirement | EG-CONTRACT | SPECIFIED | tests/test_release_full_wheel_contract.py:750 |
| EG-CONTRACT-R053.8 The public wheel compiles only the extension modules; each platform publishes independently Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**The public wheel compiles only the extension modules; each platform publishes independently.** `[tool.maturin]` builds the `eg-pyengine` crate (`manifest-path`, no `bindings = "bin"`), so the wheel base is the `epistemic_graph.engine` extension plus the Python package, and `build_backend.py` and `.github/actions/folded-wheel` fold in `epistemic_graph.numeric`. No server crate or bin target compiles in any wheel path. The strip step stays as a safety net and the completeness check still refuses executables. In `release.yml` each build leg, the Linux x86_64 job and the sdist job upload their own artifact to PyPI with `twine upload --skip-existing` right after their completeness and smoke checks, behind `guard`; a final job only verifies that every expected file reached PyPI. The compile cache uses `Swatinem/rust-cache` with `shared-key: eg-wheel-<target>`, saved only by the `ci.yml` main-push `wheel-cache` job and restored on tag builds. | A test reads `pyproject.toml`, `build_backend.py`, the folded-wheel action and both workflows. It confirms the manifest path and absent bin bindings, one numeric component build, the per-leg publish steps and their order, no single publish-all job, and the cache key and save condition. | requirement | EG-CONTRACT | VERIFIED | d969ffcfaaad tests/test_wheel_extensions_only.py:23 tests/test_wheel_extensions_only.py:41 tests/test_wheel_extensions_only.py:63 tests/test_wheel_extensions_only.py:90 |
| EG-CONTRACT-R053.9 The server wheel builds and publishes from this repository Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**The server wheel builds and publishes from this repository.** `packaging/epistemic-graph-server/pyproject.toml` declares maturin `bindings = "bin"` over the root manifest's `epistemic-graph-server` binary with the `full` and `ast-extended` features. `release.yml` job `build-server` builds it with `--profile release-server` natively on linux x86_64 (`ubuntu-latest`) and linux aarch64 (`ubuntu-24.04-arm`), smoke-tests `epistemic-graph-server --help` and `binary_path()`, and uploads each wheel with `twine upload --skip-existing` right after its own smoke test, behind `guard`. The compile cache is `Swatinem/rust-cache` with `shared-key: egs-<arch>`, saved only by the `ci.yml` main-push `server-wheel-cache` job. `verify-pypi` checks the server files too. The x86_64 leg also builds the package's one sdist from the same version-pinned source (pipelines `PIPE-RELEASE-R008`). An isolated `pip wheel` rebuild of that sdist must yield a working `epistemic-graph-server --help` before the leg uploads the sdist with `twine upload --skip-existing`. `verify-pypi` requires and verifies that sdist with the server wheels. `[tool.maturin]` lists every path crate as an sdist `include`. Each entry covers the full crate tree. maturin drops path crates that only unselected optional features reach. Examples are `eg-asr-whisper` and `eg-tts-piper`. `cargo metadata` still loads their manifests, so the isolated rebuild needs them. The list is the path-dependency closure of the root manifest plus the workspace members. maturin rejects `..` in include patterns. So `packaging/epistemic-graph-server/crates` is a symlink to the workspace `crates` directory. The patterns are relative to it. | A test reads the package `pyproject.toml`, the build action and both workflows. It confirms the bin bindings and manifest path, the two native legs, the smoke steps, the per-leg upload behind `guard`, the cache key and save condition, the sdist build, rebuild proof and upload order, and the server files and sdist in `verify-pypi`. It also confirms that every transitive path crate and workspace member is an sdist include. The PR records the measured wheel size. | requirement | EG-CONTRACT | VERIFIED | baf9a680a4c4 dede203bdd50 tests/test_server_package.py:190 tests/test_server_package.py:246 tests/test_server_package.py:34 tests/test_server_package.py:47 tests/test_server_package.py:88 |
| EG-CONTRACT-R053.10 `binary_path()` locates the installed executable Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**`binary_path()` locates the installed executable.** `epistemic_graph_server.binary_path()` returns the executable in the interpreter scripts directory, else on `PATH`, else raises `BinaryNotFoundError`, a `FileNotFoundError` subclass whose message names the `pip install` command. The package carries exactly one executable. | `packaging/epistemic-graph-server/tests/test_binary_path.py` covers the scripts directory, the `PATH` fallback and the typed error. The release smoke step counts one script member. | requirement | EG-CONTRACT | SPECIFIED | tests/test_server_package.py:107 |
| EG-CONTRACT-R053.11 The server image is built from the server wheel Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**The server image is built from the server wheel.** `docker/Dockerfile` installs the per-architecture server wheel staged in `docker/wheels` and copies only the binary to a slim runtime with a non-root user, ports 9100 and 9101 on loopback by default, and a TCP health check. It refuses a non-numeric `EGS_VERSION`. `release.yml` job `server-image` pushes one image per architecture by digest and job `server-manifest` creates the `linux/amd64` plus `linux/arm64` tags `<version>` and `latest` under the `epistemic-graph-server` image name. | A test reads the Dockerfile and the two jobs. It confirms the runtime stage, the version refusal, the push by digest and the `imagetools create` manifest. | requirement | EG-CONTRACT | SPECIFIED | tests/test_server_package.py:117 |
| EG-CONTRACT-R053.12 The server version moves with the engine and a tagged version can be packaged later Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**The server version moves with the engine and a tagged version can be packaged later.** `.config/bumpversion.cfg` covers the package `pyproject.toml`, its `__version__` and the Dockerfile `EGS_VERSION`. A `workflow_dispatch` input `source_ref` (a `v<version>` tag) with `packages=server` builds the server package from that tag's source and publishes it. The build pins the package version to the source `Cargo.toml` version and refuses a tag that differs. `guard` still requires a successful `ci.yml` run on the commit that tag names. `guard` refuses `source_ref` with `packages=all`. | A test compares the package version fields with `Cargo.toml` and the bump configuration, and reads `release.yml` for the inputs, the guard resolution and the refusal. | requirement | EG-CONTRACT | SPECIFIED | tests/test_server_package.py:139 tests/test_server_package.py:157 |
| EG-CONTRACT-R006.3 Export fresh typed contracts for parity repair Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Export fresh typed contracts for parity repair.** Hosted CI may export canonical generator output after parity fails. The export names the source commit and tree, toolchain, build command, recipe hashes and every artifact hash. Only generated contract paths may be uploaded. Failed generation, dirty source, symlinks and mismatched hashes refuse export. The original parity failure remains blocking. | `test_export_canonical_contract.py` covers bounded paths, provenance, failed generation, hash refusal and unchanged blocking workflow semantics. Native execution and full release qualification remain separate. | requirement | EG-CONTRACT | VERIFIED | 2a1515f6e252 2b8dd458b459 7e09becc533e 82c10dffe69e 8b5cbc59e851 tests/test_export_canonical_contract.py:11 |
| EG-CONTRACT-R053.13 Retain the validated wheel for installed acceptance Definition — EG-CONTRACT / EG-CONTRACT — Public engine contract and reproducible clientsCanonical requirement and verification source**Retain the validated wheel for installed acceptance.** CI exports the exact folded wheel only after its completeness, privacy and installed-wheel tests pass. A pre-install digest must match the exported wheel. The bounded archive includes source commit/tree, build-recipe hashes and all file hashes. Missing, ambiguous, symlinked or stale artifacts and source mismatches refuse export. Native validation uses Ubuntu 24.04 and separate target/compiler cache namespaces, not a moving libc baseline. This artifact is not a package release. | `tests/test_ci_change_scope.py` verifies validation ordering, success-only upload, bounded paths, artifact hashes and fail-closed packaging. | requirement | EG-CONTRACT | VERIFIED | 42376299456f 701e8e498e07 88b8c1a73156 b286edc1b3bf be072c1cf996 tests/test_ci_change_scope.py:649 tests/test_ci_change_scope.py:693 tests/test_ci_change_scope.py:822 |
| EG-REPO-INGEST EG-REPO-INGEST — Repository index and native ingestion | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R001 Reconcile mode re-admits stranded semantic intents Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Reconcile mode re-admits stranded semantic intents.** SourceIngest's reconcile mode (admit_sql_source_dirty_reconcile) re-admits semantic intents that were stranded when their originating topic was retired, rather than leaving them permanently unprocessed. | An integration test retires a topic with pending stranded intents, runs a reconcile-mode SourceIngest pass, and confirms the stranded intents are re-admitted and committed. | requirement | EG-REPO-INGEST | LANDED | 06a13bef2738 ac5638477288 |
| EG-REPO-INGEST-R002 SourceIngest is sole owner of migrated ingestion capabilities Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**SourceIngest is sole owner of migrated ingestion capabilities.** EG's SourceIngest is the sole implementation of the ingestion and derivation capabilities previously named envelope_ingest, change_envelope, evidence_spine, semantic_event_model, object_centric_derivation, process_conformance, embedding_admission, gpu_slot_scheduler, promotion, supersession, dead_letter, hydration_manifest, skill_workflow_ingest, and governed_documentation, each committed as part of its typed observation and receipt contract. | A consumer test confirms each listed capability is reachable only through SourceIngest and that no duplicate writer for the same capability remains in EG. | requirement | EG-REPO-INGEST | SPECIFIED | 06a13bef2738 f17f47ab300f |
| EG-REPO-INGEST-R003 EG is sole home for remaining migrated ingestion modules (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for remaining migrated ingestion modules (rollup).** Split into one child per migrating legacy-module root: `EG-REPO-INGEST-R003.1`–`EG-REPO-INGEST-R003.11`. This parent is satisfied only when every child below is satisfied. | See each child requirement's own verification. | requirement | EG-REPO-INGEST | LANDED | 0554e82ae743 06a13bef2738 72c7dfa478ba 77fa741ee191 a17a6c5ded2f |
| EG-REPO-INGEST-R003.1 EG is sole home for migrated standardization processing (excluding drift detection) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated standardization processing (excluding drift detection).** EG is the sole implementation for the ingestion-adjacent standardization processing (excluding drift detection) capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated standardization processing (excluding drift detection) capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | 06a13bef2738 72c7dfa478ba ae0f93b6bf70 e72ee15e11bb |
| EG-REPO-INGEST-R003.2 EG owns the migrated infrastructure processing implementation Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG owns the migrated infrastructure processing implementation.** EG SHALL implement the capability that migrates from its legacy module. Consumers reach it through EG typed interface, not a duplicate implementation. | A consumer test calls the capability through EG interface only. It confirms the retiring source module no longer duplicates the computation. | requirement | EG-REPO-INGEST | LANDED | 06a13bef2738 72c7dfa478ba f70de8c33b4f |
| EG-REPO-INGEST-R003.3 EG is sole home for migrated quantum processing Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated quantum processing.** EG is the sole implementation for the ingestion-adjacent quantum processing capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated quantum processing capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | a17a6c5ded2f |
| EG-REPO-INGEST-R003.4 EG is sole home for migrated security processing Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated security processing.** EG is the sole implementation for the ingestion-adjacent security processing capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated security processing capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | a17a6c5ded2f |
| EG-REPO-INGEST-R003.5 EG is sole home for migrated enterprise protocol handling Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated enterprise protocol handling.** EG is the sole implementation of the ingestion-adjacent enterprise protocol handling capability. The capability migrates out of its legacy module. Callers reach it through EG's own typed interface, not a duplicate. | A consumer test confirms the migrated enterprise protocol handling capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | a17a6c5ded2f |
| EG-REPO-INGEST-R003.6 EG is sole home for migrated ecosystem concept extraction Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated ecosystem concept extraction.** EG is the sole implementation for the ingestion-adjacent ecosystem concept extraction capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated ecosystem concept extraction capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | 06a13bef2738 72c7dfa478ba f70de8c33b4f |
| EG-REPO-INGEST-R003.7 EG is sole home for migrated trace-ontology observability Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated trace-ontology observability.** EG is the sole implementation for the ingestion-adjacent trace-ontology observability capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated trace-ontology observability capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | 0554e82ae743 72c7dfa478ba fb19bf6ab789 |
| EG-REPO-INGEST-R003.8 EG is sole home for migrated self-ingestion observability Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated self-ingestion observability.** EG is the sole implementation for the ingestion-adjacent self-ingestion observability capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated self-ingestion observability capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | 77fa741ee191 |
| EG-REPO-INGEST-R003.9 EG is sole home for migrated audit-logging observability Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated audit-logging observability.** EG is the sole implementation for the ingestion-adjacent audit-logging observability capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated audit-logging observability capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | 77fa741ee191 |
| EG-REPO-INGEST-R003.10 EG is sole home for migrated relational-authority governance Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated relational-authority governance.** EG is the sole implementation for the ingestion-adjacent relational-authority governance capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated relational-authority governance capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | 77fa741ee191 |
| EG-REPO-INGEST-R003.11 EG is sole home for migrated placement-mining research Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**EG is sole home for migrated placement-mining research.** EG is the sole implementation for the ingestion-adjacent placement-mining research capability migrating out of its legacy module, reachable through EG's own typed interface rather than a duplicate implementation. | A consumer test confirms the migrated placement-mining research capability is callable only through its EG interface and that the retiring source module no longer performs the same computation. | requirement | EG-REPO-INGEST | LANDED | 0554e82ae743 72c7dfa478ba ae0f93b6bf70 fb19bf6ab789 fd9e20bc998d |
| EG-REPO-INGEST-R004 Derived series maintained incrementally with lineage Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Derived series maintained incrementally with lineage.** EG's timeseries handlers support a SeriesDefine{name, expr, sources} mutation that creates a derived series incrementally maintained from each source's prior append history; a revision replay only appends new series values, never mutates past ones, and the graph records DerivedSeries derivedFrom Series lineage together with the defining expression's digest. Row-level security on a derived series is the most restrictive policy among its sources, a cyclic source definition is refused, and maintenance work is bounded by an explicit budget. | An integration test defines a derived series, appends to its sources, confirms incremental maintenance matches full recomputation, and negative tests confirm a cyclic definition is refused and an over-budget maintenance run is bounded. | requirement | EG-REPO-INGEST | VERIFIED | 0554e82ae743 2b8c0364ebb7 crates/eg-tsdb/src/derive/maintain_tests.rs:45 src/server/handlers/timeseries/derived_tests.rs:159 src/server/handlers/timeseries/derived_tests.rs:206 |
| EG-REPO-INGEST-R005 Replay-protection nonces commit in batches for throughput Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Replay-protection nonces commit in batches for throughput.** src/server/request_replay.rs SHALL batch or group-commit replay-protection nonces. Alternatively, it may use a bounded memory window backed by a durable epoch. Per-request durable commit overhead SHALL NOT dominate served-request latency. Replay protection remains intact. | A benchmark compares served throughput before/after at matching concurrency. A replay-attack negative test continues to pass. | requirement | EG-REPO-INGEST | VERIFIED | 0374378eb9db 7d1bf0006b94 src/server/request_replay.rs:418 src/server/request_replay.rs:428 src/server/request_replay.rs:486 |
| EG-REPO-INGEST-R006 Native ingestion commits fast; heavy enrichment deferred Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Native ingestion commits fast; heavy enrichment deferred.** Indexing a repository or other source completes natively within seconds: parsing, symbol resolution, and statistical analysis run inside EG as batched durable commits, while classical ML, embeddings, and LLM-based enrichment never block the commit and are instead enqueued as durable, budgeted work items with an admission verdict, drained by background workers, plus bounded on-demand enrichment when a query needs it. | An end-to-end benchmark against real public repositories records commit latency for the native stages and confirms the deferred-enrichment work items are admitted, enqueued, and completed asynchronously without blocking the index commit. | requirement | EG-REPO-INGEST | SPECIFIED | 0554e82ae743 6bb88b0a90cc |
| EG-REPO-INGEST-R007 Large ingestion batches refuse atomically with a stable code Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Large ingestion batches refuse atomically with a stable code.** SourceIngest refuses an over-limit batch atomically with a stable REPOSITORY_BATCH_TOO_LARGE-class error code before any graph mutation, and a large-batch regression test exercises this refusal path. | A regression test submits a batch past the configured limit and confirms the atomic refusal, the stable error code, and that no partial graph mutation occurred. | requirement | EG-REPO-INGEST | VERIFIED | 0554e82ae743 33c5c6459154 src/server/handlers/repository_index_tests.rs:228 |
| EG-REPO-INGEST-R008 Oversized batches return a stable retry code Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Oversized batches return a stable retry code.** When a repository batch exceeds the 64 MiB write-byte ceiling, EG SHALL refuse it. Return stable REPOSITORY_BATCH_TOO_LARGE code and bounded detail. This lets connector SDK halve and resend the batch. It avoids a generic internal error. | Submit a batch above the 64 MiB ceiling. Confirm stable error code and successful halve-and-resend retry. | requirement | EG-REPO-INGEST | LANDED | 504e3109b2b0 72c7dfa478ba |
| EG-REPO-INGEST-R009 Repository hydration links into the specification bridge Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Repository hydration links into the specification bridge.** EG's repository hydration maps indexed repository entities into the semantic bridge that links them to their source, test, specification, and release relationships, so a query can follow from a hydrated code entity to its governing specification without a duplicate graph writer. | An integration test hydrates a sample repository and confirms its entities are reachable through the documented source-to-specification relationship chain. | requirement | EG-REPO-INGEST | LANDED | 1bb3ca5fed33 1f5ba9350abb |
| EG-REPO-INGEST-R009.1 Edge identity is the `(source, target, relation_type)` triple Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Edge identity is the `(source, target, relation_type)` triple.** EG's `eg-core` graph treats an edge's identity as the `(source_id, target_id, relation_type)` triple rather than the bare `(source_id, target_id)` pair, so multiple relation types between the same two endpoints coexist as distinct addressable edges instead of silently colliding. An untyped legacy edge migrates deterministically onto this scheme by reading its stored blob's `type`/`label` field as `relation_type`, falling back to `related_to` when neither is present; a collision between two untyped edges that migrate to the same triple is resolved by a deterministic collapse rule (keep one, emit a collision receipt) rather than by dropping either silently. | A collision test adds two untyped edges between the same pair that migrate onto the same `relation_type`, confirms the deterministic collapse and its collision receipt, and a typed-edge test confirms distinct relation types between the same pair are independently addressable, retrievable and removable. | requirement | EG-REPO-INGEST | VERIFIED | 1bb3ca5fed33 1f5ba9350abb crates/eg-core/src/graph/core_edge_queries.rs:271 |
| EG-REPO-INGEST-R009.2 Semantic-bridge projection of the nine relations onto typed triples Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Semantic-bridge projection of the nine relations onto typed triples.** The semantic bridge's nine relations project onto the `(source, target, relation_type)` triple scheme from `EG-REPO-INGEST-R009.1` — each relation is stored and queried as its own typed edge between the same two endpoints, never collapsed into a shared untyped edge. | An integration test projects a sample hydration carrying multiple semantic-bridge relations between the same two entities and confirms each relation is independently retrievable by its own `relation_type`. | requirement | EG-REPO-INGEST | LANDED | 1f5ba9350abb |
| EG-REPO-INGEST-R010 Tree-sitter grammar coverage expands to 18 more languages Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Tree-sitter grammar coverage expands to 18 more languages.** EG's native parser (parser/tree_sitter.rs) adds tree-sitter grammar support for Swift, Kotlin, Objective-C, Zig, Julia, Elixir, Groovy, PowerShell, Fortran, Pascal, Verilog, CUDA, HTML, CSS, JSON, Terraform/HCL, and DreamMaker, alongside its existing C, C++, C#, Go, Rust, Python, JavaScript, TypeScript, React, Java, Scala, Ruby, PHP, Lua, Bash, and SQL support; DreamMaker, lacking a maintained tree-sitter grammar, uses a custom extractor. | A grammar-expansion test suite parses a representative fixture for each newly added language and confirms a successful parse outcome for each. | requirement | EG-REPO-INGEST | LANDED | 2a0d6eae0918 |
| EG-REPO-INGEST-R011 Ingestion community detection uses pure Leiden Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Ingestion community detection uses pure Leiden.** Use pure Leiden partitioning through the shared graph_algos/leiden.rs driver. Wire it through algorithms.rs and features.py. Do not use a Louvain/Leiden hybrid. This avoids trusting badly connected or disconnected communities as valid modules. | A test confirms the ingestion path calls Leiden refinement. No committed community in the test graph is internally disconnected. | requirement | EG-REPO-INGEST | VERIFIED | 69411a23a248 b5fe3c140c21 crates/eg-compute/src/algorithms/tests.rs:133 |
| EG-REPO-INGEST-R002.1 Compile a skill document into a typed plan Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Compile a skill document into a typed plan.** SourceIngest skill_workflow_ingest SHALL compile procedural steps in a pinned SKILL.md into typed TaskPlan. It SHALL NOT require a separate workflow file. Each step SHALL bind a unique step ID, source span, instruction digest, capability ID, typed inputs/outputs, and dependencies. The compiler SHALL resolve capabilities and bindings before it emits a plan. It SHALL order independent steps by source order. It SHALL refuse missing/duplicate IDs, unresolved dependencies/capabilities, cycles, unsupported types, or missing spans. The receipt SHALL bind skill-directory reference, document revision/digest, grammar revision, and plan revision/digest. The receipt SHALL also bind tool and type digests. The graph SHALL store the directory reference and compilation provenance, not a document copy. A changed document or capability/type digest SHALL invalidate the binding before execution. Unstructured prose SHALL NOT silently become a plan step. Production wiring: Attach compilation to existing SourceIngest skill_workflow_ingest. Proposed AU-CONTROL-R037.30 binds through graph_orchestrate, gap/plan selection, and `execute_workflow`. Do not add a parallel document executor. Owner link: `EG-REPO-INGEST-R002` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:6`. Owner link: `AU-HARNESS-R022.2` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/harness-evolution/requirements.md:111`. Owner link: `AU-CONTROL-R037.3` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:59`. Owner link: `AU-CONTROL-R037.5` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-control-plane/requirements.md:61`. Draft dependency `AU-CONTROL-R037.30` remains `draft_unmerged` at `50c313ab01871ff7e10aee2a9d0254fa55d71f07`. It is not a merged producer or implementation receipt. Its path is `specs/agent-control-plane/requirements.md`. Explicit hold: Owners must publish the versioned SKILL.md procedural grammar. Owners must publish authoritative capability/type lookup. AU-CONTROL-R037.30 remains unmerged. The SourceIngest capability name alone does not prove document compilation. Owner-review proposal: Step fields, source-order tie breaking, and compilation receipt are proposed details. No Markdown grammar is claimed as already selected. Original source record `AU:23`, SHA-256 `3f7e133169a76ce2680ec667c28ea2c5543354ed8874d258c432e65346f2e529`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Exercise `skill_document_alone_compiles_and_executes` with a skill directory containing SKILL.md and permitted assets. Provide no separate workflow file. Invoke real SourceIngest and fetch the plan through AU graph_orchestrate. Call `execute_workflow`. Inspect independently observed step effects and data bindings. Mutate the document between compilation and invocation. Refuse before the affected step. Test duplicate IDs, cycles, unknown capabilities, wrong binding types, and missing spans. Confirm the graph stores directory reference/receipt, not copied document text. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R006.1 Measure the daily paper target and admit bounded maintenance Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Measure the daily paper target and admit bounded maintenance.** EG SHALL count distinct canonical paper IDs completed through every required ingestion stage. Count them in half-open rolling UTC window [window_end - 86400 seconds, window_end). The target SHALL be 2000 completed papers per window. Stage receipts SHALL record stage/revision, attempted IDs, distinct completed IDs, duplicate count, elapsed time, and source/commit evidence. Retries SHALL NOT increase the completed-paper count. A partial or stale window SHALL remain unknown and SHALL NOT be compared as a full day. Below target, the committed decision SHALL name count, shortfall, and stage-bottleneck evidence. The decision SHALL assess safe maintenance candidates before allocating remaining declared budget across identified goals. A purge candidate SHALL be terminal, unleased, and non-authoritative. It SHALL retain durable source and decision receipts. Active work, authoritative records, and the last source copy SHALL be ineligible. Each action SHALL carry owner authorization, expected revision, cost ceiling, and admission verdict. Missing authority or policy inputs SHALL refuse before effects. Production wiring: Read stage/work-item receipts from native SourceIngest and deferred work under R006. EG decides shortfall and per-goal allocation. AU observes the result. GraphOS performs admitted maintenance. Keep operation ID and producer/export binding as owner dependencies. Owner link: `EG-REPO-INGEST-R006` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:21`. Owner link: `AU-RETIRE-R005` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/au-engine-duplicate-retirement/requirements.md:14`. No draft consumer dependency is assigned. Explicit hold: The reviewed source does not select the required stage set or window-freshness policy. It also omits per-goal allocation objective/tie-break and the GraphOS maintenance operation/authorization contract. Do not invent IDs, budget defaults, or a purge executor. Owner-review proposal: Distinct end-to-end completions and the exact window define a proposed throughput oracle. Stage telemetry remains separate from the completed-paper numerator. Original source record `AU:70`, SHA-256 `902f964dd909186f3a31d1f8a84d146b715446e64dfeec62480c8151baa06996`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run paper_shortfall_drives_admitted_maintenance through real 24-hour stage completion and durable work queues. Include duplicate attempts, failures, and boundary timestamps. Independently count 1999 then 2000 unique completions. Confirm trigger/no-trigger decisions. Inspect goal allocations and their aggregate budget bound. Use actual GraphOS maintenance route and read its result receipt. Active leases, changed revisions, last source copy, missing authorization, and stale telemetry SHALL prevent purge. An incomplete window is unknown. Queue-only/planner-only fixtures do not pass. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R006.2 Apply importance resistance in the deferred re-embed worker Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Apply importance resistance in the deferred re-embed worker.** After a successful sync commit, EG SHALL queue a durable re-embed job. The job SHALL bind committed source revision, embedding space/model revision, old-vector digest, and importance-policy revision. The worker SHALL form an importance-regularized candidate outside the routing loop. Proposed profile squared_l2_anchor_v1 uses objective `L(z)=sum((z_i-p_i)^2)+lambda*sum(w_i*(z_i-o_i)^2)`. Here p is the proposed vector and o is the old vector. Each coordinate weight SHALL be finite and nonnegative. Lambda SHALL be finite and strictly positive. The coordinate result is `(p_i+lambda*w_i*o_i)/(1+lambda*w_i)`. Vectors and weights SHALL share one declared dimension and coordinate system. The profile SHALL NOT silently rescale or normalize the result. Missing/stale importance evidence or incompatible spaces SHALL refuse promotion. Nonfinite values or superseded source/vector revisions SHALL refuse before promotion. The candidate SHALL remain shadow data until the existing recall gate passes. A failed gate SHALL retain the prior active version. Query routing SHALL NOT perform consolidation or its embedding/model calls. Production wiring: Queue through EG-FEDERATED-QUERY-R077.3. Gate promotion through EG-UNIFIED-DATA-PLANE-R040.2/.3 before EmbeddingVersionStore::tag_batch. Read the embedding binding in the existing worker path. R040.3 records that the production tag caller must be created. EG-FEDERATED-QUERY-R040.3 is not this gate. Owner link: `EG-REPO-INGEST-R006` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:21`. Owner link: `AU-CONTEXT-R002` at `agent-utilities@50c313ab01871ff7e10aee2a9d0254fa55d71f07:specs/agent-context-and-finance/requirements.md:6`. Owner link: `EG-FEDERATED-QUERY-R077.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/federated-query-and-reasoning/requirements.md:95`. Owner link: `EG-UNIFIED-DATA-PLANE-R040.2` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/unified-data-plane/requirements.md:153`. Owner link: `EG-UNIFIED-DATA-PLANE-R040.3` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/unified-data-plane/requirements.md:154`. No draft consumer dependency is assigned. Explicit hold: The source does not identify the authoritative per-coordinate importance producer or revisioned export. The compatible embedding-space policy is also unbound. The squared-L2 profile remains an owner-review proposal. Do not claim the source specified or implemented this math. Owner-review proposal: squared_l2_anchor_v1 is a precise proposed penalty, not a paper-derived claim. A different owner-selected profile must publish an exact objective and monotonic resistance oracle. Generic importance weighting is insufficient. Original source record `AU:92`, SHA-256 `771acc731a6e25746641adf30cde9ec91f4eb56edd6597f2d308a42947a3abb3`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. The generated status has no receipt arrays. No implementation or served receipt is claimed. | Exercise sync_importance_penalty_is_async_and_gate_bound through real sync and deferred worker. Compare equal proposed coordinate displacements at low/high importance. Higher importance produces less displacement. Compare exact candidate math, provenance, idempotent jobs, and existing gate before tag_batch. Stale jobs, absent importance evidence, or failed recall probes leave active binding unchanged. Instrument served routing. Prove zero consolidation/embedding calls while pending and after completion. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R006.3 Serve revision-bound structured code maps Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Serve revision-bound structured code maps.** The existing UnifiedQuery surface SHALL accept a typed code-map query. The query SHALL include tenant, repository identity, and current source revision. It SHALL identify behavior text or a symbol, requested relation kinds, and bounded page limits. The result SHALL bind map generation, source-inventory revision/digest, query digest, and authorization scope. It SHALL include module/symbol IDs, language, path, source span, and source revision. It SHALL expose typed contains, calls, and depends_on edges. Behavior matches SHALL resolve to indexed entities and cited spans. Unsupported or unresolved relations SHALL be marked incomplete, not invented. Authorization SHALL precede results, counts, and cursors. Each page SHALL compare map binding with authoritative current repository revision. A changed or unknown revision SHALL refuse as stale before serving data. This rule also covers unchanged symbols from older generations. Each cursor SHALL bind the same map, query, and authorization revisions. Production wiring: Produce maps through native IndexRepository/SourceIngest. Serve them through Method::UnifiedQuery and its existing execution path. Add a typed code-map query/result mode there. Do not add a separate search service or treat LLM answers as authoritative code-map evidence. Owner link: `EG-REPO-INGEST-R006` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:21`. Owner link: `EG-REPO-INGEST-R009` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:24`. Owner link: `EG-FEDERATED-QUERY-R017` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/federated-query-and-reasoning/requirements.md:21`. No draft consumer dependency is assigned. Producer binding: The proposed typed authority/admission contract in plan.md is normative for this row. Configuration must be admitted before use; no deployed authority is claimed. Any historical query must be explicit. It cannot satisfy the current-map guarantee. Owner-review proposal: Request/result carrier and cursor bindings are proposed query additions. They are not current implemented API claims. Original source record `EG:54`, SHA-256 `e69e6fa3a5c26ae763809d600cb7d264d028b9ce0d80f8ca6141e1a40cf0638e`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Run current_code_map_locates_behavior_and_refuses_old_generation through served indexing and generated UnifiedQuery. Query behavior and a symbol. Independently inspect modules, symbols, call/dependency edges, and source spans. Change one source file so one indexed symbol behavior/span changes while another remains unchanged. Until a complete new map generation publishes, queries for either symbol and the old cursor SHALL refuse against the stale map. Reindex. Query both symbols. The changed symbol SHALL expose its current source revision and span. The unchanged symbol SHALL retain its logical ID. It SHALL bind to the new map generation and current revision. Inspect changed, deleted, and renamed entities against current files. Test unauthorized tenants, changed authorization, bounded pagination, and unresolved relations. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R006.4 Bound incremental indexing and declare semantic-type support Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Bound incremental indexing and declare semantic-type support.** IndexRepository SHALL apply authorized added/modified/deleted/renamed file deltas against exact base and target revisions. A mismatched base SHALL refuse before index mutation. Unchanged files SHALL reuse parse/index artifacts. The target generation SHALL omit entities/edges for deleted files and rebind renamed ones. Each job SHALL receive positive max_working_bytes within its host grant. It SHALL account all job-owned parser/index buffers and worker allocations. The job SHALL reserve each allocation before use. It SHALL backpressure or refuse before exceeding the grant. Existing per-batch atomic refusal remains required. Only a complete target generation may become the current code map. Completion, cancellation, and failure SHALL release job buffers, handles, and workers. The shared engine SHALL remain usable. Optional semantic typing SHALL use a versioned language/parser/resolver support table. Unsupported semantic mode SHALL refuse or return explicitly requested syntax-only output. Grammar availability SHALL NOT imply semantic-type support. Production wiring: Attach deltas to SourceIngest/IndexRepository and SDK-SOURCE-INGEST-R004. Retain R007 batch admission and native/deferred separation under R006. Extend existing parser/index workers and owner resource accounting. Owner link: `EG-REPO-INGEST-R006` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:21`. Owner link: `EG-REPO-INGEST-R007` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:22`. Owner link: `EG-REPO-INGEST-R010` at `epistemic-graph@e1db3f4359e659dc07fb0e0ba5e021bed40c9f26:specs/repository-index-and-ingestion/requirements.md:27`. Owner link: `SDK-SOURCE-INGEST-R004` at `agent-connector-sdk@5babc4cc48ad73928468b243842f219f51e2cca1:specs/SDK-SOURCE-INGEST/requirements.md:8`. No draft consumer dependency is assigned. Explicit hold: The owner must publish the initial semantic-language/resolver matrix and exact host resource-grant binding. Do not substitute grammar counts or an arbitrary language list. Resource evidence must include native parser/worker allocations, not only language-runtime heap counters. Owner-review proposal: The limit covers job-owned working memory. The host accounts shared engine memory separately. This is not a whole-process RSS limit. The initial semantic-language roster remains a source-decision hold. Original source record `EG:55`, SHA-256 `340c1817f2a52dc6da4c9c13d93d215debbeb9fefd8b84b8d2400b86541d4d81`. Exact original fields, including any private path, remain in the private source map. Status remains SPECIFIED. `landed_in` and `verified_by` are empty. No implementation or served receipt is claimed. | Exercise incremental_index_respects_memory_and_releases_resources through actual indexing. Exercise add/modify/delete/rename delta. Count parser calls and independently inspect the target map. Instrument allocator/workers. Peak job-owned bytes SHALL stay within the grant. Reject an over-limit reservation before allocation. No partial map becomes current. The prior map remains usable after failure. On success, cancellation, and parser failure, release job allocations/handles to baseline. Submit a subsequent job. Test every advertised semantic table row and reject unsupported modes. Planned acceptance only. No test, served readback, receipt, implementation, or closure is claimed. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R002.100 Require independent readback before ingestion success Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Require independent readback before ingestion success.** Extend the existing SourceIngest result-persistence contract. Each write receipt SHALL bind run ID, tenant, query digest, ordered result IDs/content digests, graph revision, and source provenance. After writing, the consumer SHALL issue a separately authorized read-only query. It SHALL bind its principal/grant revision and selector to the receipt. It SHALL compare every expected result ID, digest, and revision. A run SHALL report success only after a matching readback receipt. Missing, partial, stale, denied, or mismatched readback SHALL return typed non-success. EG SHALL NOT add a second graph writer. Producer/consumer: EG owns durable graph read/write. AU owns execution-success reporting. Reuse SourceIngest and existing query authorization. Preserve existing coverage: `EG-REPO-INGEST-R002`; `EG-DURABLE-KERNEL-R002`. Source record `AU:118` SHA-256 `e8ad0c2417b7fa6ce53c46899f1adf8e925977becd0bd1813db6b62d3786af11`. Explicit open AU prerequisite: No exact reviewed AU companion requirement binds execution success to this EG receipt. Leave the AU consumer ID unassigned. Treat consumer evidence as missing; do not infer an ID. Status remains SPECIFIED; implementation and served evidence remain pending. Planned served acceptance: persist a multi-result search through the served path. Read it through a separately authorized query and compare every result ID, digest, and revision. Independently read back the durable result records and both persisted receipts: the write receipt and readback receipt. Confirm the write receipt binds run, tenant, query digest, ordered result IDs/digests, graph revision, and source provenance. Confirm readback binds principal/grant revision, selector, and returned result IDs/digests/revisions. Report success only after all values match. Refuse denied, partial, stale, or mismatched data or receipts; keep success unset. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R002.101 Bind graph-loaded workflow execution to durable hydration readback Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Bind graph-loaded workflow execution to durable hydration readback.** Bind the graph-loaded workflow ID and revision. Bind the committed EG plan/decision digest and AU execution run/output digests. Bind the SourceIngest write receipt, resulting graph revision, and separately authorized readback receipt. The acceptance path SHALL use the real AU `graph_orchestrate` → `find_workflow_gaps`/`fill_workflow_gaps` → `execute_workflow` consumer. It SHALL use EG graph load/decision and SourceIngest. A separate authorized graph query SHALL read back hydrated content. Its digest SHALL match before the gate reports success. Fake engines/catalogs and generic handoff receipts do not satisfy this contract. Missing/stale workflows, execution mismatches, write failures, or denied/partial readback SHALL return non-success. Producer/consumer boundary: EG owns workflow graph load/decision and durable SourceIngest. AU owns graph orchestration/execution. SDK owns the source-effect runner. Pipelines owns the gate; it does not add a runtime orchestrator. Explicit open AU prerequisite: No exact reviewed AU companion requirement binds AU success to this EG hydration readback. Leave the AU consumer ID unassigned. Treat execution-success evidence as missing. Pipelines gate coverage does not establish the AU consumer. Preserve existing coverage: `EG-REPO-INGEST-R002`. Source record `PIPE:10` SHA-256 `e0c431512565acb1a8ae00e09b63ec6fb7c8f9e81ef9c786a0fd7b26b2239455`. Status remains SPECIFIED; implementation and served evidence remain pending. Planned served acceptance: Run the real graph-loaded workflow through AU. Perform hydration. Read the result through a separate authorized query. Before success, compare exact workflow revision, run, output, and graph revision bindings. Refuse stale workflows, plan mismatch, hydration-digest mismatch, and denied/partial readback. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R002.102 Successive batches to one stream chain one content version Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Successive batches to one stream chain one content version.** Every SourceIngest batch to a stream advances one content-version object. That object is keyed by the stream's live-set marker identity (tenant, connector and stream), not by the per-batch receipt id. A batch chains from the digest stored under that object. A stream with no stored version chains from none, including a stream whose earlier batches were committed under per-batch ids. A second delta batch to the same stream, with an advanced checkpoint, commits. It never meets the `STALE_CONTENT_VERSION` refusal for a missing prior version. A batch whose stated previous digest no longer matches the stored one is still refused with `STALE_CONTENT_VERSION`. | Served test `a_second_batch_to_the_same_stream_chains_its_content_version` in `src/server/handlers/admin/connector_pack/tests/scale.rs`. It ingests two delta batches to one stream and asserts both commit. It asserts the stream's stored content version holds the second batch digest, chained from the first. | requirement | EG-REPO-INGEST | VERIFIED | 2a47417c6cfc src/server/handlers/admin/connector_pack/tests/scale.rs:278 |
| EG-REPO-INGEST-R600 Code enrichment turns parsed repositories into typed code, test and feature facts (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Code enrichment turns parsed repositories into typed code, test and feature facts (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R600.1 Model Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model.** `crates/eg-enrich/src/code.rs` defines CodeEntity, TestEntity, EnrichmentEdge{rung}, PatternHit, Feature. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R600.2 Behavior Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior.** Enrichment consumes the parser's structural facts. It emits typed entities and rung-ranked edges. A lower rung never overwrites a higher one. It also emits design-pattern hits per class and function. It emits feature clusters from call-graph communities. It emits a test-quality verdict from fixed metric thresholds. Queries answer which tests need work, how a symbol works and which code uses a pattern. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R600.3 Wiring Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring.** SourceIngest calls `enrich_repository` after the fast commit and before the deferred semantic stages, reusing the community detector of EG-REPO-INGEST-R011. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R600.4 Refusal Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal.** The engine refuses and counts an edge that overwrites a higher-rung edge. It never applies it. The stable code is `ENRICH_RUNG_CONFLICT`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R600.5 Evidence Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence.** Per run: entities, edges by rung, patterns, features and tests flagged. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R600.6 Hot-path proof Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof.** The enrich_repository call over a 200k-symbol fixture is linear in edges. It has p50 under 2 s, p99 under 5 s and peak memory under 512 MiB. The benchmark is `benches/r600_repository_index_and_ingestion.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R601 Commit history becomes a graph of commits, authors, files and change coupling (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Commit history becomes a graph of commits, authors, files and change coupling (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R601.1 Model Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model.** `crates/eg-enrich/src/history.rs` defines CommitRecord, FileChange, ChurnAggregate, CouplingEdge{support, confidence}. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R601.2 Behavior Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior.** A repository's commits, authors and per-file changes become nodes and edges once per commit digest. Churn aggregates per file and per author. Two files that change together above a support and confidence floor receive a coupling edge. Re-runs add only unseen commits. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R601.3 Wiring Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring.** The repository hydration path of EG-REPO-INGEST-R009 calls `ingest_history` with the commit-digest set already stored. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R601.4 Refusal Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal.** A history above the configured commit bound is truncated at a commit boundary and reported, never half-applied. The stable code is `HISTORY_BOUND_EXCEEDED`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R601.5 Evidence Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence.** Per run: commits added, commits skipped, coupling edges written. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R601.6 Hot-path proof Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof.** ingest_history of 100k commits: linear, p50 under 3 s, p99 under 8 s, coupling pass memory bounded by the file-pair cap. The benchmark is `benches/r601_repository_index_and_ingestion.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R602 Infrastructure definitions, HTTP routes and business capabilities link to the service that owns the code (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Infrastructure definitions, HTTP routes and business capabilities link to the service that owns the code (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R602.1 Model Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model.** `crates/eg-enrich/src/links.rs` defines IacResource, HttpRoute, ServiceLink, CapabilityRealization. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R602.2 Behavior Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior.** Infrastructure-as-code files yield resource nodes, HTTP route declarations yield route nodes, and both link to the owning service node. Code features resolve to business capabilities by lexical and vector evidence with a score floor. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R602.3 Wiring Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring.** Called from `enrich_repository` of EG-REPO-INGEST-R600 after feature discovery. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R602.4 Refusal Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal.** Two services tie for one resource: no link is written and the tie is returned for review. The stable code is `LINK_AMBIGUOUS_SERVICE`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R602.5 Evidence Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence.** Per run: resources, routes, links written, ambiguous ties. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R602.6 Hot-path proof Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof.** link pass over 50k routes: p50 under 400 ms, p99 under 1.2 s. The benchmark is `benches/r602_repository_index_and_ingestion.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R603 Structural fingerprints keep incremental re-indexing to real structural change (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Structural fingerprints keep incremental re-indexing to real structural change (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R603.1 Model Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model.** `crates/eg-enrich/src/fingerprint.rs` defines StructuralFingerprint, ChangeLevel{None, Cosmetic, Structural}, BlastRadius, CodeMap. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R603.2 Behavior Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior.** Each file has a content hash and a structure hash over signatures. Equal content is None, equal structure is Cosmetic, otherwise Structural. Only Structural files re-enter enrichment. Blast radius counts symbol usages with definition lines excluded and flags low-usage symbols. A code map is a hierarchical outline of nodes and edges. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R603.3 Wiring Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring.** SourceIngest reads the stored fingerprint before enrichment and skips None and Cosmetic files. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R603.4 Refusal Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal.** A file that fails to parse is classed Structural so it is never silently skipped. The stable code is `FINGERPRINT_UNPARSEABLE`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R603.5 Evidence Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence.** Per run: files by level and symbols flagged low-usage. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R603.6 Hot-path proof Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof.** fingerprint of 10k files: p50 under 300 ms, p99 under 900 ms; blast radius of one symbol over 100k files under 150 ms. The benchmark is `benches/r603_repository_index_and_ingestion.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec gate. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R800 Agent-session transcript sources and scheduled feed intake (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Agent-session transcript sources and scheduled feed intake (rollup).** `crates/eg-document` ingests agent-session transcripts (line-delimited JSON from the supported coding-agent formats). It also ingests scheduled feed and file-change sources, and the research and world-model intake pipelines. Each is a declared source with checkpoints. Every transcript turn and feed item becomes a provenance-bearing record. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R800.1 Model Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model.** `TranscriptTurn{session_id, ordinal, role, content_digest, tool_calls, ts}` and `SourceCheckpoint` reuse; one declarative parser table maps each transcript dialect to the same turn record. | Planned: `crates/eg-document/tests/transcript_sources.rs::dialects_map_to_one_turn_record`. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R800.2 Behavior Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior.** Parsing streams line by line in O(bytes) with bounded line length. Checkpoints are the last ordinal and file digest. A changed prefix restarts the session from the first differing ordinal. | Planned: `crates/eg-document/tests/transcript_sources.rs::changed_prefix_restarts_from_first_difference`. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R800.3 Wiring Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring.** Intake runs as an `eg-jobs` scheduled source under the placement and worker policy. File-change triggers coalesce within a declared window. The window uses the engine clock. | Planned: `crates/eg-document/tests/transcript_sources.rs::overlong_line_is_quarantined`. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R800.4 Refusal Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal.** The engine quarantines four inputs with a typed reason. The first is a line over the length bound. The second is an unknown dialect. The third is a role outside the closed set. The fourth is a session whose prefix digest changed without a restart marker. A quarantine does not advance the checkpoint. | Planned: `crates/eg-document/tests/transcript_sources.rs::unknown_role_is_refused`. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R800.5 Evidence Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence.** Evidence is the quarantine count, the per-session digest and a replay that yields an identical turn sequence. | Planned: `crates/eg-document/tests/transcript_sources.rs::replay_is_identical`. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R800.6 Hot-path proof Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof.** Hot-path proof: a Criterion benchmark ingests a 1 GiB transcript set. Throughput stays above 200 MiB per second. The per-line p99 stays under 20 microseconds. Memory stays under 64 MiB. | Planned: `crates/eg-document/tests/transcript_sources.rs::ingest_bench_within_budget`. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R650 Baseline hydration, delta manifests and big-repository planning (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Baseline hydration, delta manifests and big-repository planning (rollup).** After the first start, EG hydrates an empty store from the configured prompt library, skill library and workspace repositories. A durable delta manifest lets it skip unchanged content. It splits very large repositories into parallel structural work items. It classifies non-source files and tracks coverage of expected sources. The Rust home is `crates/eg-durable/src/hydration.rs`. Satisfied only when children `EG-REPO-INGEST-R650.1`-`EG-REPO-INGEST-R650.6` are satisfied. | See each child. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R650.1 Model Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model.** Add `BaselinePlan`, `DeltaManifest{(graph,category,uri)->content_hash}`, `RepoSplitPlan`, `FileClass`, `CoverageReport`, `StagedStage{Fetch,Parse,Enrich,Write,Reason}` in `crates/eg-durable/src/hydration.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R650.2 Behavior Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior.** Plan baseline work items with a cap per scope. Split by directory weight to balance work in O(files). Classify files by extension and magic bytes. Commit the manifest in the same transaction as the content, so a crash neither loses nor repeats work. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R650.3 Wiring Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring.** Scheduled by `eg-jobs` at engine boot; results land through SourceIngest per `EG-REPO-INGEST-R002`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R650.4 Refusal Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal.** EG refuses a scope over the cap. It refuses a manifest write without its content commit. It refuses a plan for an unreachable source. Each refusal has a stable code. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R650.5 Evidence Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence.** Record plan digest, split weights, skipped and changed counts and coverage per source class. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R650.6 Hot-path proof Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof.** Benchmark `baseline_plan_and_delta` (50k files, 5% changed): p50 10 ms, p99 60 ms, peak memory 48 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-durable baseline_plan_and_delta` against the stored baseline. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R651 External graph, event and package ingestion adapters (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**External graph, event and package ingestion adapters (rollup).** EG ingests registered external property graphs and GraphQL document sources through discovery and mapping proposals. It maps change-data-capture envelopes. It projects object-centric event logs and their exchange format. It extracts research references. It harvests skills and prompts exposed by fleet children and classifies skills. It auto-extends the graph when a package is installed. The Rust home is `crates/eg-durable/src/adapters.rs`. Satisfied only when children `EG-REPO-INGEST-R651.1`-`EG-REPO-INGEST-R651.6` are satisfied. | See each child. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R651.1 Model Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model.** Add `ExternalGraphProfile`, `MappingProposal`, `CdcEnvelopeMap`, `EventLogProjection`, `OcelDocument`, `ReferenceLink`, `HarvestedSkill`, `PackageInstallEvent` in `crates/eg-durable/src/adapters.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R651.2 Behavior Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior.** Discover a source schema with a bounded read-only probe. Propose a mapping that the owner approves. Map CDC envelopes to ChangeEnvelope one to one. Project events to case traces in O(events). Derive directly-follows and object states incrementally. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R651.3 Wiring Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring.** Each adapter produces ChangeEnvelope batches into SourceIngest; durable configuration holds only references to credentials. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R651.4 Refusal Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal.** EG refuses a discovery probe past its row or time cap. It refuses a mapping applied without approval. It refuses an envelope with an unknown source. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R651.5 Evidence Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence.** Record probe bounds, proposal digest, envelope-to-fact counts and projection hashes. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R651.6 Hot-path proof Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof.** Benchmark `cdc_envelope_map_batch` (10k envelopes): p50 1.5 ms, p99 9 ms, peak memory 24 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-durable cdc_envelope_map_batch` against the stored baseline. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R652 Document chunking, section trees and processed-document records (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Document chunking, section trees and processed-document records (rollup).** EG turns a document into chunks with stable spans, a verified section tree, extracted links and a processed-document record. Retrieval can then address any passage. The Rust home is `crates/eg-document/src/processing.rs`. Satisfied only when children `EG-REPO-INGEST-R652.1`-`EG-REPO-INGEST-R652.6` are satisfied. | See each child. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R652.1 Model Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model.** Add `ChunkingConfig`, `ChunkSpan`, `SectionNode`, `ProcessedDocument`, `SectionTreeCheck` in `crates/eg-document/src/processing.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R652.2 Behavior Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior.** Chunk with sentence-aware windows and overlap in O(n). Build the section tree from headings or page structure. Confirm that spans nest and cover the text. Extract links with their anchors. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R652.3 Wiring Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring.** Called by SourceIngest document path; the tree feeds `EG-FEDERATED-QUERY-R653`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R652.4 Refusal Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal.** EG refuses a document over the size ceiling. It refuses a tree that breaks the nesting rule. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R652.5 Evidence Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence.** Record chunk count, span coverage and tree verification result. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R652.6 Hot-path proof Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof.** Benchmark `document_chunk_tree` (1 MiB markdown): p50 3 ms, p99 15 ms, peak memory 2x document size. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-document document_chunk_tree` against the stored baseline. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R002.650 Model: Hot-path contract for the migrated ingestion capabilities Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model: Hot-path contract for the migrated ingestion capabilities.** Pin the Rust types for the capabilities R002 names. They are `ChangeEnvelope` and `EnvelopeReceipt` (`eg-durable`), `EvidenceArtifact`/`Fragment` with a stable fragment address (content digest plus span), `SemanticEvent` with object-centric, temporal and proposal variants, `EmbeddingAdmission{class,verdict}`, `GpuSlotLease`, `PromotionRequest`/`PromotionVerdict`, `Supersession`, `DeadLetterItem`, `HydrationManifest` (signed) and `GovernedDocumentationProjection`. Every type is serde-stable and covered by the contract digest. | A contract test lists each type in `contract/methods.json` and fails if a field changes without a digest bump. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R002.651 Behavior: Hot-path contract for the migrated ingestion capabilities Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior: Hot-path contract for the migrated ingestion capabilities.** Commit an envelope atomically in one redb transaction in O(records), with idempotent replay by envelope ID. Classify embedding admission deterministically from content class. Arbitrate GPU slots with a fenced single-holder lease. Advance a claim promotion only through the validator. Write a supersession edge in the same transaction. Park a failing item in the dead-letter table and drain it by explicit request. Mine process conformance as token-replay fitness on the directly-follows footprint. | Property tests replay each envelope twice and assert identical state. A conformance test asserts fitness 1.0 for a conforming trace. It asserts fitness below 1.0 for a deviating one. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R002.652 Wiring: Hot-path contract for the migrated ingestion capabilities Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring: Hot-path contract for the migrated ingestion capabilities.** SourceIngest handlers in `src/server` serve every capability. The process-mining projections read the committed events. The OCEL exchange imports and exports the same store. It is never a second event store. | A wiring test shows a served handler calls each capability. It also shows that the OCEL round trip preserves object and event counts. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R002.653 Refusal: Hot-path contract for the migrated ingestion capabilities Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal: Hot-path contract for the migrated ingestion capabilities.** Refuse an envelope with no source identity. Refuse a promotion without validator evidence. Refuse a supersession of an unknown fact. Refuse a lease request while a live lease exists. Refuse a manifest whose signature does not verify. Each refusal has a stable code and mutates nothing. | A refusal test per case asserts the code and that the store digest is unchanged. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R002.654 Evidence: Hot-path contract for the migrated ingestion capabilities Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence: Hot-path contract for the migrated ingestion capabilities.** Record envelope ID, record count and receipt digest. Record admission verdict inputs and lease epoch. Record promotion verdict inputs, supersession pair, dead-letter reason and manifest digest. | A served-path test reads each record back through a separately authorized query. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R002.655 Hot-path proof: Hot-path contract for the migrated ingestion capabilities Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof: Hot-path contract for the migrated ingestion capabilities.** Benchmark `change_envelope_commit` at p50 1 ms and p99 6 ms for 1000 records. Peak memory stays under 24 MiB with 8 concurrent writers. Benchmark `dead_letter_drain` at p99 2 ms. The CI bench gate fails on a 10% regression. | `cargo bench -p eg-durable change_envelope_commit` against the stored baseline. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R700 Periodic code-health sweep finds dead pathways (rollup) Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Periodic code-health sweep finds dead pathways (rollup).** A bounded, model-free sweep runs over indexed repositories. It reports unreachable symbols and dead pathways from the code graph. It files them as findings on a schedule. Implemented in eg-repo-index. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R700.1 Model Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Model.** `CodeHealthFinding { repo, symbol, kind, evidence }` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R700.2 Behavior Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Behavior.** Reachability is a graph traversal from declared entry points, O(symbols + references), bounded by a per-repo time budget. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R700.3 Wiring Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Wiring.** Runs from the indexing pipeline after a branch-aware index (typed-packs R069). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R700.4 Refusal Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Refusal.** A repository without declared entry points reports `unknown`, never `dead`. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R700.5 Evidence Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Evidence.** Each finding lists the entry points that were tried. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-REPO-INGEST-R700.6 Hot-path proof Definition — EG-REPO-INGEST / EG-REPO-INGEST — Repository index and native ingestionCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/repo_index/test_code_health_served.py::test_no_entry_points_reports_unknown` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/code_health.rs` must show p50 under 30 ms and p99 under 200 ms with peak memory under 128 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-REPO-INGEST | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH EG-SRC-AUTH — Source authority: the ontology says which connected source answers a concept | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R001 Authority vocabulary (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Authority vocabulary (rollup).** A `vg:SourceAuthority` row states source, concept, optional facet, rank, scope, freshness, contract kind and materialisation policy. LANDED only when every child is. | Every child is LANDED. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R001.1 Add class `vg:SourceAuthority` with `vg:authoritativeSource`, `vg:authorityFor`, `vg:authorityRank` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Add class `vg:SourceAuthority` with `vg:authoritativeSource`, `vg:authorityFor`, `vg:authorityRank`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. Names match `EG-CQ-XSRC-R001.1`. | Test `the_authority_terms_are_in_the_core_vocabulary` in `src/server/graph_schema/virtual_graph_tests.rs` loads the core source and finds the class and three properties. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R001.2 Add `vg:authorityFacet` and `vg:authorityMapping` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Add `vg:authorityFacet` and `vg:authorityMapping`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_authority_facet_and_mapping_terms_exist`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R001.3 Add `vg:scopeTenant`, `vg:scopePartition`, `vg:freshnessMaxAgeSeconds` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Add `vg:scopeTenant`, `vg:scopePartition`, `vg:freshnessMaxAgeSeconds`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_authority_scope_and_freshness_terms_exist`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R001.4 Add `vg:authorityContract` and `vg:allowFallback` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Add `vg:authorityContract` and `vg:allowFallback`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_authority_contract_and_fallback_terms_exist`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R001.5 Add `vg:materialisation` and `vg:materialisationReason` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Add `vg:materialisation` and `vg:materialisationReason`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_materialisation_terms_exist`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R001.6 Add `vg:foreignSourceName` on `vg:SourceConnection`; widen the domain of `vg:approved` to `vg:SourceAuthority` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Add `vg:foreignSourceName` on `vg:SourceConnection`; widen the domain of `vg:approved` to `vg:SourceAuthority`.** Touches `crates/eg-core/ontology/virtual_graph-v1.ttl`. | Same test file, `the_foreign_source_name_and_widened_approved_exist`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R002 Authority shapes (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Authority shapes (rollup).** SHACL refuses malformed and contradictory rows. | Every child is LANDED. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R002.1 Shape: required cardinalities and node kinds Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Shape: required cardinalities and node kinds** (source, concept, mapping exactly one; rank positive integer; contract in the five values). Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixture test in `src/server/graph_schema/virtual_graph_tests.rs`: a valid row passes; one fixture per missing property fails with its message. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R002.2 Shape: mapping belongs to the named source and maps the named class Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Shape: mapping belongs to the named source and maps the named class.** Two `sh:sparql` constraints (`OPTIONAL ... FILTER(!BOUND)`). Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixtures: mapping from another source fails; mapping of another class fails. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R002.3 Shape: a facet must be projected by the mapping Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Shape: a facet must be projected by the mapping.** Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixture: facet absent from the mapping's predicate-field pairs fails. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R002.4 Shape: contract kind agrees with the connection's source kind Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Shape: contract kind agrees with the connection's source kind.** Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixture: `api` row on an `mcp` connection fails; `virtual-graph` on `sql` passes. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R002.5 Shape: accelerated materialisation needs reason, freshness bound and connection capability `copy` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Shape: accelerated materialisation needs reason, freshness bound and connection capability `copy`.** Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixtures: missing reason, missing freshness, missing `copy` each fail; `virtual` with none passes. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R002.6 Shape: equal-rank claims by different sources on one (class, facet, scope) are refused inside one graph Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Shape: equal-rank claims by different sources on one (class, facet, scope) are refused inside one graph.** Touches `crates/eg-core/ontology/virtual_graph-v1.shapes.ttl`. | Fixture: two sources, same rank, fails; different ranks passes. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R003 Who may assert authority (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Who may assert authority (rollup).** Operator approval only; connectors propose. Reuses the governed two-person change and `AttachApproved`. | Every child is LANDED. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R003.1 Declare kind `governed.source-authority` with approver scope `governance:approve-source-authority` in `GOVERNED_KINDS` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Declare kind `governed.source-authority` with approver scope `governance:approve-source-authority` in `GOVERNED_KINDS`.** Touches `crates/eg-types/src/governed_change.rs`. Depends on the generated scope registry (`EG-IDENTITY-R004`, owner epistemic-graph identity). | Unit test `source_authority_kind_has_exact_scopes` asserts `kind_scopes`; scope-registry generation test lists the new scope as class `approver`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R003.2 Attach refuses `vg:approved true` inside a `Pack` or `Ingestion` origin schema source Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Attach refuses `vg:approved true` inside a `Pack` or `Ingestion` origin schema source.** Touches `crates/eg-core/src/graph/schema_sources.rs` (attach validation). | Test attaches a pack source with an approved mapping and an approved authority row. Both refused with a typed code. The same text under `Operator` origin attaches. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R003.3 `AttachApproved` accepts an authority candidate. The approval lease binds its digest Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**`AttachApproved` accepts an authority candidate. The approval lease binds its digest.** Touches `src/server/graph_schema/approved.rs`. Depends on `R003.1`. | Test: approval for digest X attaches X. A changed byte is refused with `ApprovalMismatch`. An approver equal to the proposer is refused. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R003.4 Planner derives effectiveness from origin, not from the flag Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Planner derives effectiveness from origin, not from the flag.** Add `fn row_is_effective(origin, row)` in `crates/eg-rdf/src/source_selection.rs`. Depends on `R003.2`. | Unit test: a row with the flag true under `Pack` origin is not effective; under `Approved` origin it is. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R003.5 Proposed rows are listed, never selected Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Proposed rows are listed, never selected.** Add `not_used` entries with reason `Proposed`. Touches `crates/eg-rdf/src/source_selection.rs`. | Unit test: a proposed rank-1 row beside an approved rank-2 row selects rank 2 and lists the proposal. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R004 Selection reads authority (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Selection reads authority (rollup).** `select_sources` names the winner and alternates per class or facet. Cross-repo join point with `EG-FEDERATED-QUERY-R072`. | Every child is LANDED. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R004.1 Add `AuthorityRow` and `with_authority` to `CoverageFixture`; replace the silent `insert` overwrite by a list per class Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Add `AuthorityRow` and `with_authority` to `CoverageFixture`; replace the silent `insert` overwrite by a list per class.** Touches `crates/eg-rdf/src/source_selection.rs`. Depends on `EG-FEDERATED-QUERY-R072.1`. | Unit test: two mappings on one class are both kept (the old behaviour kept only the last). | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R004.2 `Premise::Authority` with row, source, class, facet, rank, scope, origin, generation Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**`Premise::Authority` with row, source, class, facet, rank, scope, origin, generation.** Touches `crates/eg-rdf/src/source_selection.rs`. | Unit test: a covered class carries the authority premise. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R004.3 `Covered` gains `alternates`; order candidates by rank Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**`Covered` gains `alternates`; order candidates by rank.** Touches `crates/eg-rdf/src/source_selection.rs`. | Two-source fixture: rank 1 chosen, rank 2 listed as alternate. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R004.4 Superclass authority is inherited; a subclass row overrides it Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Superclass authority is inherited; a subclass row overrides it.** Touches `crates/eg-rdf/src/source_selection.rs`. Same rule as `EG-CQ-XSRC-R001.3`. | Fixture: `:Incident` inherits from `:ApplicationEvent`; adding an `:Incident` row overrides. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R004.5 Live read: parse authority rows from the composed graph schema sources Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Live read: parse authority rows from the composed graph schema sources.** Touches `crates/eg-rdf/src/source_selection.rs` and `crates/eg-core/src/graph/schema_sources.rs`. Owner of the join: `federated-query-and-reasoning` (the live ontology search child of `EG-FEDERATED-QUERY-R072`). | Integration test: attach the vocabulary plus two rows as schema sources and `select_sources` returns the same verdicts as the fixture. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R004.6 Build the `ConnectedSources` view from the owner-scoped foreign catalog Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Build the `ConnectedSources` view from the owner-scoped foreign catalog.** Touches `crates/eg-plan/src/federation.rs`. Uses `vg:foreignSourceName` (`R001.6`). | Test: a source registered under another principal is absent from the view (`EG-FEDERATED-QUERY-R013` refusal kept). | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R004.7 Facet-aware selection: a question reading property `p` uses the facet row for `p` before the class row Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Facet-aware selection: a question reading property `p` uses the facet row for `p` before the class row.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture: `:Host` identity from a CMDB, `:Host` `temperature` facet from a hardware connector; each property selects its own source. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R005 Tie-breaking (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Tie-breaking (rollup).** A total, documented order; an unresolvable tie abstains. | Every child is LANDED. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R005.1 Order: facet over class over nearest superclass Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Order: facet over class over nearest superclass.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture covering each pair. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R005.2 Scope specificity: matching tenant and partition beat unscoped Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Scope specificity: matching tenant and partition beat unscoped.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture: tenant-scoped row beats an unscoped lower rank number. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R005.3 Equal everything, different sources: `Abstained::Ambiguous` listing both rows; never choose by name Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Equal everything, different sources: `Abstained::Ambiguous` listing both rows; never choose by name.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture across two schema sources; swapping their names leaves the verdict unchanged. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R005.4 `Premise::Tiebreak { winner, loser, rule }` records the deciding step Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**`Premise::Tiebreak { winner, loser, rule }` records the deciding step.** Touches `crates/eg-rdf/src/source_selection.rs`. | Unit test per rule. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R006 Typed abstention (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Typed abstention (rollup).** An unconnected, unapproved, stale, mismatched or ambiguous authority yields a typed verdict or a declared fallback. | Every child is LANDED. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R006.1 Add `CoverageResult::Abstained { class, facet, reason, source, premises }` and the reason enum `Unconnected | UnapprovedMapping | Stale | ContractMismatch | Ambiguous` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Add `CoverageResult::Abstained { class, facet, reason, source, premises }` and the reason enum `Unconnected | UnapprovedMapping | Stale | ContractMismatch | Ambiguous`.** Touches `crates/eg-rdf/src/source_selection.rs` and its callers. | Unit test builds one verdict per reason. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R006.2 Unconnected rank-1 authority abstains naming source and concept Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Unconnected rank-1 authority abstains naming source and concept.** Touches `crates/eg-rdf/src/source_selection.rs`. Satisfies the `.3` children of `EG-CQ-ORCH-R001` to `R007`. | Test: the authority names a source absent from the catalog; the verdict names both; other classes still report. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R006.3 `allowFallback` tries the next ordered alternate and records `FallbackFrom` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**`allowFallback` tries the next ordered alternate and records `FallbackFrom`.** Touches `crates/eg-rdf/src/source_selection.rs`. | Test: with the flag the rank-2 source answers; without it the verdict abstains. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R006.4 Freshness: a stale copy falls back to live; stale and no live route abstains `Stale` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Freshness: a stale copy falls back to live; stale and no live route abstains `Stale`.** Touches `crates/eg-rdf/src/source_selection.rs`; reads `AccelerationPolicy::resolve_mode` in `crates/eg-types/src/metadata_acceleration.rs`. | Test: watermark older than `freshnessMaxAgeSeconds` gives live mode or `Stale`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R006.5 No authority row: one approved mapping serves with `Premise::Implicit`; several abstain `Ambiguous` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**No authority row: one approved mapping serves with `Premise::Implicit`; several abstain `Ambiguous`.** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture for each case. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R007 Audit trail (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Audit trail (rollup).** Every answer carries "sources used and why" from the premises. | Every child is LANDED. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R007.1 Add `AuthorityAudit` and `AuditEntry` types Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Add `AuthorityAudit` and `AuditEntry` types.** Touches `crates/eg-types/src/authority_audit.rs` (new) and registers it in the contract schema. | Serde round-trip test and contract-schema snapshot. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R007.2 Build the audit from verdicts and premises only Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Build the audit from verdicts and premises only.** Add `fn audit_from(verdicts)` in `crates/eg-rdf/src/source_selection.rs`. | Test: the audit entries equal the premises of the verdicts, none added. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R007.3 Audit lists `not_used` rows with reason (including `Proposed`) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Audit lists `not_used` rows with reason (including `Proposed`).** Touches `crates/eg-rdf/src/source_selection.rs`. | Fixture with a proposed row and a stale row. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R007.4 Wire the audit into the cross-source report's `sources_used` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Wire the audit into the cross-source report's `sources_used`.** Touches `crates/eg-types/src/supply_chain_report.rs` (owner `EG-CQ-XSRC-R006.1`). Depends on `R007.1` and `EG-CQ-XSRC-R006.1`. | Report test: `sources_used` equals the audit entries. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R007.5 Print the block in the served intent tool Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Print the block in the served intent tool.** Owning repository: graph-os. Depends on `R007.1`. | graph-os test asserts the block is present in the tool result. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R008 Materialisation policy (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Materialisation policy (rollup).** Virtual by default; a copy needs a reason. | Every child is LANDED. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R008.1 Selection reports `mode: live` for a `virtual` row and refuses a copy route for it Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Selection reports `mode: live` for a `virtual` row and refuses a copy route for it.** Touches `crates/eg-rdf/src/source_selection.rs`. | Test: a virtual row never resolves to a copy mode. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R008.2 An `accelerated` row resolves through `AccelerationPolicy` and carries its reason into the audit Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**An `accelerated` row resolves through `AccelerationPolicy` and carries its reason into the audit.** Touches `crates/eg-rdf/src/source_selection.rs`. | Test: the audit entry shows mode `accelerated` and the stored reason. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R009 Consumers and acceptance (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Consumers and acceptance (rollup).** The competency specs state their authority rows against this vocabulary. | Every child is LANDED. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R009.1 Fixture: ServiceNow rank 1 and PagerDuty rank 2 for `:Incident` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Fixture: ServiceNow rank 1 and PagerDuty rank 2 for `:Incident`.** Files: `crates/eg-rdf/tests/source_authority_fixture.rs`. | Fixture parses, passes the shapes, selects rank 1. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R009.2 Decisive test: swapping two ranks changes `sources_used` with equal query text Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Decisive test: swapping two ranks changes `sources_used` with equal query text.** Same file. Satisfies `EG-CQ-XSRC-R007.4`. | The test asserts both audits and equal query text. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R009.3 Re-point `EG-CQ-XSRC-R001.1` and `R001.2` to this spec and mark them delivered by `R001.*` and `R002.*` Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Re-point `EG-CQ-XSRC-R001.1` and `R001.2` to this spec and mark them delivered by `R001.*` and `R002.*`.** Touches `specs/cross-source-competency/requirements.md` and `tasks.md` (coordinate with that spec's owner). | `spec-decomposition` hook prints clean; no term is defined in two specs. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R010 Source trust role and live-truth preference (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Source trust role and live-truth preference (rollup).** The platform tracks one trust role per data source: `live_truth`, `historical_context` or `inspiration`. When sources conflict on one concept, source selection must prefer live truth. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R010.1 Model Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Model.** Add `vg:sourceRole` on `vg:SourceConnection` in `crates/eg-core/ontology/virtual_graph-v1.ttl`, with closed values `live_truth`, `historical_context` and `inspiration`. Add `SourceRole` in `crates/eg-rdf/src/source_selection.rs`. The authority rank at `source_selection.rs:172` (`select_sources`) orders sources but does not grade their trust. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::source_role_round_trips`. | The vocabulary test finds the term. A serde round trip rejects an unknown role. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R010.2 Behavior Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Behavior.** Add `role_order` in `source_selection.rs`. The default order is `live_truth`, then `historical_context`, then `inspiration`. It is a named replaceable default. On a conflict for one class, facet and scope, the higher role wins before rank applies. `EG-SRC-AUTH-R005.1` documents the later tie-break steps. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::live_truth_beats_historical_on_conflict`. | Two sources with different roles select the live-truth source whatever their rank. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R010.3 Wiring Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Wiring.** `role_order` attaches in `select_sources` at `crates/eg-rdf/src/source_selection.rs:172`. No production caller of `select_sources` exists today; every call is in its own tests. This row creates the call site in `crates/eg-plan/src/federation.rs`, where `EG-SRC-AUTH-R004.6` builds the `ConnectedSources` view for the served federated query. Proving test: `crates/eg-plan/src/federation.rs::tests::plan_applies_source_role`. | The federated plan builder calls `select_sources` with roles loaded from the schema sources. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R010.4 Refusal Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Refusal.** A question that needs current state must not be answered from an `inspiration` source. Selection must return `Abstained` with reason `RoleInsufficient` naming the class and the source. This extends the reason enum of `EG-SRC-AUTH-R006.1`. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::inspiration_only_abstains_role_insufficient`. | The verdict names class and source and no answer is produced. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R010.5 Evidence Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Evidence.** Add `Premise::Role{source, role, preferred_over}` beside `Premise` at `crates/eg-rdf/src/source_selection.rs:26`. The audit of `EG-SRC-AUTH-R007` must list the preferred and the displaced source with their roles. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::role_premise_names_both_sources`. | The audit entry names both roles and the rule that decided. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R010.6 Hot-path proof Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Hot-path proof.** The entry point is the served cross-source report operation. The test attaches two sources that conflict on one concept: one `live_truth`, one `historical_context`. The test passes through the wired call site in `federation.rs`. It observes that `sources_used` names the live source and lists the other as displaced. Proving test: `tests/federated/test_source_role_served.py::test_live_truth_wins_conflict`. | The report names the live source and the displaced one. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R011 Untrusted taint mark on content that enters a run (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Untrusted taint mark on content that enters a run (rollup).** EG marks content that enters a run as untrusted and stores the mark as a fact. The harness carries the mark with the content. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R011.1 Model Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Model.** Add `vg:trustMark` on content nodes in `crates/eg-core/ontology/virtual_graph-v1.ttl`, with closed values `trusted` and `untrusted`. Add `TrustMark` in `crates/eg-rdf/src/source_selection.rs` beside `SourceRole` of `EG-SRC-AUTH-R010.1`. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::trust_mark_round_trips`. | A serde round trip rejects an unknown mark. The vocabulary test finds the term. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R011.2 Behavior Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Behavior.** Add `mark_for_origin(origin, role) -> TrustMark`. The default marks content from a tool result, a retrieved document or an upload as `untrusted`. Content from a `live_truth` source with an approved mapping is `trusted`. Derived content is `untrusted` when any input is `untrusted`. Each rule is a named replaceable default. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::derived_content_inherits_untrusted`. | A derived node with one untrusted input is untrusted. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R011.3 Wiring Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Wiring.** `mark_for_origin` attaches in `select_sources` at `crates/eg-rdf/src/source_selection.rs:172` for source content, and in the `AddNode` arm at `src/server/handlers/graph_ops/gateway_graph.rs:62` for content written by a run. No production caller of `select_sources` exists today, and `EG-SRC-AUTH-R010.3` creates that call site. This row adds the `AddNode` call. Proving test: `src/server/handlers/graph_ops/gateway_graph.rs::tests::add_node_stamps_trust_mark`. | A node written from a tool result reads back as untrusted. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R011.4 Refusal Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Refusal.** A write that lowers a mark from `untrusted` to `trusted` must be refused with `TRUST_MARK_DOWNGRADE_REFUSED` unless it carries an operator approval identifier. The refusal names the node and the missing approval. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::downgrade_without_approval_refused`. | The mark stays untrusted and the code names the node. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R011.5 Evidence Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Evidence.** Each stored mark must carry `:markedBy` (the rule name) and `:markedAtGeneration`. A read of the content must return the mark with it. Proving test: `crates/eg-rdf/src/source_selection.rs::tests::mark_carries_rule_and_generation`. | The read shows the rule name and the generation. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R011.6 Hot-path proof Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Hot-path proof.** The entry point is the served graph write operation, the `AddNode` wire method. The test writes a node from a tool result, reads it back, then tries a downgrade. The call passes through `src/server/handlers/graph_ops/gateway_graph.rs:62`. It observes `untrusted` on the read and the typed refusal. Proving test: `tests/federated/test_trust_mark_served.py::test_tool_result_is_untrusted_and_sticky`. | The read shows untrusted and the downgrade is refused. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R800 Concept id allocation, lineage and relational authority registry (rollup) Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Concept id allocation, lineage and relational authority registry (rollup).** `crates/eg-core` allocates hierarchical concept ids. It records lineage between superseded and successor concepts. It holds the relational-authority table that names the sole writer of each domain term. This extends R094, so every repository consumes one allocator. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R800.1 Model Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Model.** `ConceptId{path:[u32;D]}`, `Reservation{id, owner, expires}` and `AuthorityEntry{term, owner_repo}` in `crates/eg-types/src/concept.rs`. | Planned: `crates/eg-core/tests/concept_registry.rs::out_of_range_id_is_refused`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R800.2 Behavior Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Behavior.** Allocation is a compare-and-set on the parent's next-child counter, O(depth). Lineage is a DAG with cycle detection in O(edges touched). Authority lookup is a hash probe. | Planned: `crates/eg-core/tests/concept_registry.rs::expired_reservation_is_refused`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R800.3 Wiring Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Wiring.** The allocator is a served method behind an admin scope. The authority gates described in this spec read the registry. | Planned: `crates/eg-core/tests/concept_registry.rs::lineage_cycle_is_refused`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R800.4 Refusal Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Refusal.** The engine refuses four inputs. The first is an id outside the parent's range. The second is a reservation past expiry. The third is a lineage edge that creates a cycle. The fourth is a second owner for a term. The refusal names the existing owner. | Planned: `crates/eg-core/tests/concept_registry.rs::second_owner_is_refused`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R800.5 Evidence Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Evidence.** Evidence is the allocation audit line and a reproducible dump of the registry digest. | Planned: `crates/eg-core/tests/concept_registry.rs::registry_digest_is_reproducible`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SRC-AUTH-R800.6 Hot-path proof Definition — EG-SRC-AUTH / EG-SRC-AUTH — Source authority: the ontology says which connected source answers a conceptCanonical requirement and verification source**Hot-path proof.** Hot-path proof: a Criterion benchmark allocates 100000 ids under 8 concurrent writers. The p50 stays under 20 microseconds. The p99 stays under 200 microseconds. No id repeats. | Planned: `crates/eg-core/tests/concept_registry.rs::concurrent_allocation_bench_has_no_duplicates`. | requirement | EG-SRC-AUTH | SPECIFIED | No recorded commit/test evidence |
| EG-SCM EG-SCM — Source changesets as the source of truth | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R001 Content-addressed blob store Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Content-addressed blob store.** Model: each file version is a sealed blob record. The record is keyed by its SHA-256 digest. Identical bytes store once. The blob is compressed. A read takes a digest and returns the bytes. Behavior: a second write of the same bytes returns the same digest. It adds no new storage. A changeset path points to a blob by digest only. Wiring: compose the existing content-addressed chunk store (`src/server/blob/store.rs`) and its bounded streaming facade (`src/server/blob/stream.rs`). Reuse the sealed create-only record guard of EG-DURABLE-KERNEL-R057. Refusal: the store refuses an overwrite of an existing digest. It refuses an unreadable digest with a typed error. Evidence: identical bytes return one digest. A digest readback equals the original bytes. | `tests/test_scm_blob.py::test_blob_stored_once_and_read_by_digest` stores two identical versions. It reads the blob back by digest. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R002 Changeset record Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Changeset record.** Model: a changeset is `Changeset{id, repo, parents, author_principal, message, changed_paths, created_at, gate_verdicts}`. `changed_paths` is a list of `{path, op, old_blob, new_blob, mode}`. The op is add, modify, delete, or rename. The record stores only the paths that changed against the first parent. It costs O(change), never O(repository). Behavior: an append to a branch chain adds one record. A changeset with a parent names the parent head. The append is atomic with the branch head advance. Wiring: add the record type to `crates/eg-types` as `source_changeset.rs`. Append through the branch commit path of EG-BRANCH-MERGE-R002. Refusal: the engine refuses a changeset with an empty path list. It refuses a parent not on the target branch chain. It refuses a digest the blob store cannot read. Every refusal leaves the chain unchanged. Evidence: a two-path changeset stores exactly two path entries. The chain readback returns the record unchanged. | `tests/test_scm_changeset.py::test_changeset_stores_only_changed_paths` writes a three-file repository state. It changes two files. It asserts one changeset with two path entries. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R002.1 Structured trailers on a changeset Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Structured trailers on a changeset.** The changeset record must carry `trailers{spec_ids, fixes, withdraw, withdraw_reason}` as typed fields in `crates/eg-types/src/source_changeset.rs`. The git import of R010 parses the `Spec:`, `Fixes:` and `Spec-Withdraw:` trailers into these fields. The git export writes them back unchanged. EG-SDLC-R001 and EG-SDLC-R005 read these fields. | `tests/test_scm_changeset.py::test_trailers_round_trip_through_git` imports a commit with three trailer kinds and exports it with an identical commit id. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R003 Lock-free acceptance Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Lock-free acceptance.** Model: concurrent changesets on one branch are judged by their path sets. Disjoint path sets are accepted in parallel. Overlapping path sets trigger a server-side decision. Behavior: two writers on disjoint paths both land. No global lock gates either write. On overlap, the server rebases the late changeset on the new head. The rebase uses a file-level three-way merge at line granularity. It reuses the merge pass of EG-BRANCH-MERGE-R004. A clean rebase lands as the new head. An unclean overlap is refused with the stable `SOURCE_CONFLICT{paths}` code. The refusal lists every conflicting path. Wiring: compose the version-checked write path of EG-DURABLE-KERNEL-R084. Reuse the branch chain append of EG-BRANCH-MERGE-R002. Refusal: the engine refuses a changeset whose base left the branch chain. The refusal names the stale base. It never rebases silently. Evidence: two disjoint writers both land. Two overlapping writers land one and conflict the other. | `tests/test_scm_accept.py::test_disjoint_writers_land_and_overlap_rebases_or_conflicts` drives two concurrent writers on disjoint paths. It drives two on one shared path. It asserts one landing plus one typed conflict. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R004 Tree materialization by query Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Tree materialization by query.** Model: a tree is `Tree(repo, rev, prefix, depth)`. It returns entries of `{path, blob_digest, mode}`. The tree is computed from the changeset chain. Periodic snapshot checkpoints bound the replay length. Behavior: a subtree read at any revision returns the entries at that revision. The read costs O(subtree), never O(history). A prefix read returns only that prefix. A depth bound limits the walk. Wiring: add the tree query to `crates/eg-compute` as `source_tree.rs`. Reuse the snapshot checkpoint path of EG-DURABLE-KERNEL-R023. Refusal: the engine refuses a revision not on the repository chain. It refuses a cross-tenant tree read. Both refusals are typed. Evidence: a tree read at revision N equals the full replay of changesets up to N. The checkpoint path returns the same entries. | `tests/test_scm_tree.py::test_tree_at_revision_matches_full_replay` builds a ten-revision chain. It reads a subtree at each revision. It asserts equality against a full replay. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R005 Derived history indexes Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Derived history indexes.** Model: four derived indexes serve history. Path history lists the changesets that touched a path. Blame maps each line to its last changeset. Ancestry skip lists accelerate merge-base and ancestor queries. Change coupling pairs files that change together. Behavior: each index updates incrementally as changesets land. A revision replay appends and never rewrites. Every index carries a version and a rebuild recipe. A rebuild from the changeset chain reproduces the index byte-for-byte. Wiring: add `crates/eg-compute/src/source_history.rs`. Reuse the incremental derived-series machinery of EG-REPO-INGEST-R004. Reuse the commit and change-coupling graph of EG-REPO-INGEST-R601. Refusal: the engine refuses an index read at a version past the index head. It refuses a cross-tenant history read. Evidence: incremental index state equals a from-scratch rebuild. A rebuild after corruption restores identical entries. | `tests/test_scm_history.py::test_incremental_indexes_equal_rebuild` applies a changeset sequence incrementally. It rebuilds the same indexes from scratch. It asserts byte-identical output. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R006 Code graph stays live with changesets Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Code graph stays live with changesets.** Model: an accepted changeset is an input to the code graph. Only structurally changed files re-enter the pipeline. Behavior: the engine re-parses each structurally changed file. It updates fingerprints per EG-REPO-INGEST-R603. It updates symbols and tests per EG-REPO-INGEST-R600. It recomputes Leiden communities per EG-REPO-INGEST-R011. The community pass runs on the affected subgraph only. `code_context` and UQL answer from the new state as soon as the changeset lands. Wiring: attach to the incremental indexing boundary of EG-REPO-INGEST-R006.4. Reuse the existing enrichment and community-detector callers. Refusal: the engine refuses an indexing job whose base revision does not match. It follows the existing incremental-index refusal. Evidence: a one-file change updates only that file symbols. A structural no-op change updates nothing. | `tests/test_scm_code_graph.py::test_one_file_change_updates_only_its_symbols` lands a one-file changeset. It asserts the symbol graph updates for that file only. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R007 Path-scoped access control Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Path-scoped access control.** Model: a permission binds a path prefix, a principal, and a tenant. The permission carries separate read and write bits. Behavior: a read resolves the most specific prefix grant. A write requires a write grant on the path. The grant applies to tree, blob, changeset, and derived-index reads alike. Wiring: extend the universal read-RLS gate of EG-DURABLE-KERNEL-R029 with a path-prefix predicate. Reuse the existing tenant and principal resolution. Refusal: the engine refuses a read under a prefix with no read grant. It refuses a write with no write grant. It refuses a grant on a path outside the tenant scope. Evidence: a prefix grant filters reads to the prefix. A write outside the prefix is refused with a typed code. | `tests/test_scm_path_access.py::test_prefix_grant_filters_reads_and_refuses_writes` grants a prefix to one principal. It reads inside and outside the prefix. It attempts a write outside the prefix. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R008 Gate verdicts are records Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Gate verdicts are records.** Model: a gate run records a verdict against a changeset. The record is `GateVerdict{changeset, gate_id, input_digest, verdict, evidence_digest, duration}`. The input digest binds the exact tree the gate read. Behavior: a landing policy reads the verdicts before it lands a changeset. A failed verdict blocks the landing. A verdict is sealed once written. Wiring: reuse the typed verdict model of EG-DURABLE-KERNEL-R089.1. Store the verdict under the sealed create-only guard of EG-DURABLE-KERNEL-R057. Refusal: the engine refuses a verdict whose input digest does not match the changeset tree. It refuses an overwrite of a sealed verdict. Evidence: verdict records read back byte-identically. A mismatched digest is refused. | `tests/test_scm_gate_verdict.py::test_verdict_records_are_sealed_and_read_back` records a pass verdict and a fail verdict. It reads both back. It attempts an overwrite and asserts the refusal. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R009 Bisect and revert decisions Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Bisect and revert decisions.** Model: a failed post-landing gate opens a bisect. The bisect walks the changeset chain from the failure back to the last good verdict. It uses recorded verdicts and on-demand gate runs. Behavior: the bisect identifies the culprit changeset. The engine then records a decision. The decision is a changeset revert or a fix-forward task. The decision record carries the evidence that produced it. Wiring: reuse the deterministic replay of committed decision records (EG-DECISION-ENGINE-R007). Store the decision with the existing decision-record authority. Refusal: the engine refuses a bisect whose chain lacks verdict coverage. It refuses a revert that later changesets depend on. Evidence: a bisect over a seeded chain names the seeded culprit. The recorded decision replays byte-identically. | `tests/test_scm_bisect.py::test_bisect_finds_culprit_and_replays_decision` seeds a failing change mid-chain. It bisects. It replays the recorded decision. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R010 Git import and export fidelity Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Git import and export fidelity.** Model: a changeset maps one-to-one to a git commit. The export re-creates the commit with the same tree hash. An external git commit imports as a changeset. Behavior: an export of the full chain produces a git history. The history matches the changeset order and messages. A git import of that history reproduces the changeset chain. The round trip is lossless on commit ids and tree ids. Wiring: add `crates/eg-compute/src/source_git_objects.rs`. It builds git objects from the tree entries. Refusal: the engine refuses an export whose tree read fails mid-stream. It refuses an import whose commit graph is malformed. Evidence: export then import preserves every commit id and tree id. | `tests/test_scm_git_round_trip.py::test_export_import_preserves_commit_and_tree_ids` exports a chain of twenty changesets. It imports the archive. It asserts identical commit and tree ids. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R011 Simulation harness Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Simulation harness.** Model: a hermetic simulation drives the accept path under stress. The simulation owns its clock and its failure injection. Behavior: the harness simulates concurrent writers with overlapping paths. It simulates a server rebase on a dirty base. It simulates a crash mid-accept and a full replay. It simulates export round trips at random intervals. It fuzzes changeset sequences against the same invariants. Wiring: add `tests/simulation/source_changesets.rs`. Drive the real accept, rebase, and tree paths. Refusal: the harness refuses a fuzz seed that fails to seed. A refused seed records no state. Evidence: every invariant holds across the full simulation matrix. A seeded regression fails the harness. | `tests/simulation/source_changesets.rs::simulate_concurrent_accept_crash_and_replay` drives concurrent accepts with crash and replay. It asserts chain invariants after every step. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R012 Agent-only principals and run provenance Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Agent-only principals and run provenance.** Model: an agent principal binds to a run. The binding is the RunTrace id of the run that produced the changeset. The changeset also records the agent identity. Behavior: an agent changeset carries both ids on acceptance. A human principal may omit the run trace id. The record is queryable by run, by agent, and by changeset. Wiring: attach to the changeset accept path of EG-SCM-R002. Reuse the RunTrace record authority already served by the engine. Refusal: the engine refuses an agent changeset with no run trace id. The refusal is typed. Evidence: an agent changeset reads back with its run trace id. A principal without a run id is refused. | `tests/test_scm_provenance.py::test_changeset_links_to_run_trace` submits an agent changeset with a run trace id. It reads the binding back. It submits one without and asserts the refusal. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R013 Graph-native code edits (rollup) Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Graph-native code edits (rollup).** An agent must edit code as graph entities. It names a symbol and the new text. The engine projects the edit to file bytes and one changeset. A re-parse must confirm the round trip before the changeset lands. Children `.1` to `.7` deliver it. | See each child. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R013.1 Model Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Model.** Add `SymbolEdit{repo, branch, base_rev, ops, message, run_trace_id}` in `crates/eg-types/src/source_symbol_edit.rs`. Each op is `{kind, symbol_id, anchor_span_digest, new_text}`. `kind` is a closed set: `replace_symbol`, `replace_body`, `insert_before`, `insert_after`, `delete`. | `crates/eg-types/tests/source_symbol_edit.rs::edit_round_trips_and_kinds_are_closed` round-trips an edit and refuses an unknown kind. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R013.2 Projection Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Projection.** Add `project_symbol_edit` in `crates/eg-compute/src/source_symbol_edit.rs`. It resolves each symbol at `base_rev` to its path, blob digest and byte span. It applies the ops of one file in descending span order. Bytes outside the edited spans stay identical. It writes each new file version through R001 and builds one changeset of R002. | `crates/eg-compute/tests/source_symbol_edit.rs::bytes_outside_spans_are_unchanged` edits one function and compares every other byte. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R013.3 Round-trip check Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Round-trip check.** The engine re-parses each changed file with `parse_file` at `crates/eg-compute/src/parser/tree_sitter.rs:249`. The edited symbol must resolve with its qualified name and kind, unless the op is `delete`. Each untouched symbol must keep its structure hash of EG-REPO-INGEST-R603. An inserted symbol must be present. | `crates/eg-compute/tests/source_symbol_edit.rs::reparse_confirms_edit_and_untouched_symbols` applies each op kind and checks the re-parse. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R013.4 Wiring Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Wiring.** Add the served method `SubmitSymbolEdit` beside `SubmitChangeset`. It calls `project_symbol_edit`, then the R003 accept path. The R006 re-index and the EG-SDLC-R001 derivation run on accept. arbora serves it as `source.edit_symbol` through `ARBORA-OPS-R848.4`. | `tests/test_scm_symbol_edit_served.py::test_symbol_edit_lands_and_reindexes` edits one symbol and reads the new `code_context` answer. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R013.5 Refusal Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Refusal.** A span digest that differs from the symbol at `base_rev` must refuse with `EDIT_BASE_STALE`. Overlapping ops in one file must refuse with `EDIT_OPS_OVERLAP`. A file that fails to re-parse must refuse with `EDIT_UNPARSEABLE`. A round-trip mismatch must refuse with `EDIT_ROUNDTRIP_MISMATCH{path, symbol}`. A refusal lands nothing. | `tests/test_scm_symbol_edit_served.py::test_symbol_edit_refusals` asserts each code and an unchanged branch head. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R013.6 Evidence Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Evidence.** The changeset records the `SymbolEdit` digest. Each op records the old and new span digests and the re-parse verdict. A readback must equal the written record. | `tests/test_scm_symbol_edit_served.py::test_symbol_edit_evidence_reads_back` compares every field. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SCM-R013.7 Hot-path proof Definition — EG-SCM / EG-SCM — Source changesets as the source of truthCanonical requirement and verification source**Hot-path proof.** The entry point is the served `SubmitSymbolEdit`. The benchmark `benches/source_symbol_edit.rs` edits one symbol in a 5,000-line file, including the re-parse. The p99 stays under 30 ms. Peak memory stays under 32 MiB. | `cargo bench --bench source_symbol_edit` fails on a 10 percent regression. | requirement | EG-SCM | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabulary | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R001 Physical and commercial supply chain terms (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Physical and commercial supply chain terms (rollup).** Supplier, item, asset and host chain. Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R001.1 Shared supplier and item vocabulary (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Shared supplier and item vocabulary (rollup).** Preserve the original declarations and native entailment acceptance across R001.1.1–R001.1.2. | Every child is LANDED. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R001.1.1 Declare shared supplier and item terms Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Declare shared supplier and item terms.** New `crates/eg-core/ontology/supply_chain-v1.ttl` declares `kg:Supplier rdfs:subClassOf kg:Vendor`, `kg:SupplyChainItem` and `kg:suppliesItem` with supplier domain and item range. Reuse the ERPNext IRIs and do not redeclare `kg:suppliedBy`. | Native production parser loads the exact file. Tests assert class declarations, subclass triples, labels, property domain/range and absence of a `suppliedBy` redeclaration. | requirement | EG-SUPPLY-VOCAB | VERIFIED | ee2a3497659c crates/eg-rdf/tests/supply_chain_declarations.rs:14 crates/eg-rdf/tests/supply_chain_declarations.rs:46 crates/eg-rdf/tests/supply_chain_declarations.rs:64 |
| EG-SUPPLY-VOCAB-R001.1.2 Install shared terms in the core catalog and prove native entailment Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Install shared terms in the core catalog and prove native entailment.** Register `supply_chain-v1.ttl` in `GraphSchemaSources`. Preserve existing catalog and procurement semantics. Depends on R001.1.1. | Actual default catalog loads and validates the file. Native reasoner proves Supplier entails Vendor and suppliesItem domain/range types. A Vendor alone does not entail Supplier. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R001.2 Add `:realizedByAsset` and `:assetHost` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:realizedByAsset` and `:assetHost`.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `kg:realizedByAsset` (item to `kg:AssetInstance`) and `kg:assetHost` (asset to `infra:Host`). Depends on `R001.1`. | Test lists both with domain and range. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R001.3 Add `:suppliesService` with the physical chain axiom Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:suppliesService` with the physical chain axiom.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `kg:suppliesService` (supplier to `infra:Service`) with `infra:serviceRunsOn` (Service to Host, subproperty of infra:runsOn, mapped only from independently typed Service records) and `owl:propertyChainAxiom (suppliesItem realizedByAsset assetHost [inverseOf infra:serviceRunsOn])`. Depends on `R001.2`. | Reasoner fixture infers `suppliesService` from a four-edge service path. A container-only or pod-only runsOn path neither infers suppliesService nor retypes its endpoint as Service. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R001.4 SHACL shapes for supplier and item Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**SHACL shapes for supplier and item.** `crates/eg-core/ontology/supply_chain-v1.shapes.ttl`: `SupplierShape` and `SupplyChainItemShape`, each requiring a label. Depends on `R001.1`. | Fixtures accept valid and refuse nameless supplier and item. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R002 Software supply chain terms (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Software supply chain terms (rollup).** Component, version, image, workload, vulnerability. Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R002.1 Add `:SoftwareComponent`, `:ComponentVersion`, `:versionOf` and `:versionString` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:SoftwareComponent`, `:ComponentVersion`, `:versionOf` and `:versionString`.** `crates/eg-core/ontology/supply_chain-v1.ttl`. | Test lists the terms; a version without `versionOf` is refused by R002.6. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R002.2 Declare `infra:ContainerImage` a `kg:SoftwareComponent` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Declare `infra:ContainerImage` a `kg:SoftwareComponent`.** One `rdfs:subClassOf` triple in `crates/eg-core/ontology/infrastructure-v1.ttl`. Depends on `R002.1`. | Reasoner fixture: an image entails `SoftwareComponent`. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R002.3 Add `:containsComponent` and `:publishedBy` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:containsComponent` and `:publishedBy`.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `containsComponent` (image to version), `publishedBy` (component to `kg:Supplier`). Depends on `R002.1`, `R001.1`. | Test lists both with domain and range. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R002.4 Add `:usesImage` and `:deployedAs` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:usesImage` and `:deployedAs`.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `kg:usesImage` (same IRI as `container.ttl:83`, domain `infra:Container` or `infra:Workload`) and `kg:deployedAs` (`infra:Service` to `infra:Workload`). | Test lists both; IRI equals the container-manager ontology IRI. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R002.5 Add `:usesComponent` with the runtime chain axiom Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:usesComponent` with the runtime chain axiom.** `crates/eg-core/ontology/supply_chain-v1.ttl`: `kg:usesComponent` with `owl:propertyChainAxiom (deployedAs usesImage containsComponent)`. Depends on `R002.3`, `R002.4`. | Reasoner fixture infers `usesComponent` from service, workload, image, version. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R002.6 Add `:Vulnerability` with `:cveId`, `:severity`, `:fixedInVersion`, `:affectsComponent` and `:hasVulnerability` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:Vulnerability` with `:cveId`, `:severity`, `:fixedInVersion`, `:affectsComponent` and `:hasVulnerability`.** `crates/eg-core/ontology/supply_chain-v1.ttl`; `hasVulnerability` keeps the dockerhub IRI. Leave `trm-v1.ttl` `vulnerabilityCount` unchanged. Depends on `R002.1`. | Test lists the terms; `vulnerabilityCount` still present. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R002.7 SHACL shapes for component version, vulnerability and `usesComponent` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**SHACL shapes for component version, vulnerability and `usesComponent`.** `crates/eg-core/ontology/supply_chain-v1.shapes.ttl`: `ComponentVersionShape`, `VulnerabilityShape` (severity `sh:in`), `UsesComponentShape`. Depends on `R002.5`, `R002.6`. | Fixtures refuse versionless component, bad severity, `usesComponent` from a non-service. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003 Commercial and capability terms (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Commercial and capability terms (rollup).** Customer, contract, covered service, affected service, capability link. Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.1 Add `:Customer` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:Customer`.** New `crates/eg-core/ontology/commercial-v1.ttl`: `kg:Customer rdfs:subClassOf kg:Organization, kg:BusinessActor` (same IRI as `erpnext.ttl`). | Test lists the class; `Customer` entails `Organization`. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.2 Add `:CustomerContract`, `:contractCustomer`, `:coversService`, `:contractStatus` and `:contractEnd` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:CustomerContract`, `:contractCustomer`, `:coversService`, `:contractStatus` and `:contractEnd`.** `crates/eg-core/ontology/commercial-v1.ttl`. Depends on `R003.1`. | Test lists the terms with domain and range. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.3 Add `:affectsService` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:affectsService`.** `crates/eg-core/ontology/commercial-v1.ttl`: `kg:affectsService` from `kg:Incident` or `kg:Change` to `infra:Service`. Reuses `kg:Change` (`archimate-v1.ttl:33`); no `:ChangeRequest` is added. | Test asserts no `ChangeRequest` class exists and `affectsService` has the declared domain. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.4 Add `:supportsCapability` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:supportsCapability`.** `crates/eg-core/ontology/commercial-v1.ttl`: `infra:Service` to `kg:BusinessCapability` (decision D1). Do not reuse `kg:supports`. | Test lists the term; a fixture using `kg:supports` is not accepted by the shape in R003.5. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.5 SHACL shapes for contract and capability link Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**SHACL shapes for contract and capability link.** `crates/eg-core/ontology/commercial-v1.shapes.ttl`: `CustomerContractShape` (one customer, at least one covered service) and `SupportsCapabilityShape`. Depends on `R003.2`, `R003.4`. | Fixtures refuse a contract with no customer, no service, and a capability link from a non-service. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.6 Record the amendment to `EG-CQ-XSRC-R008.3.1` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Record the amendment to `EG-CQ-XSRC-R008.3.1`.** Note in `specs/cross-source-competency/plan.md` Decisions that `:ChangeRequest` is replaced by `kg:Change` and `:suppliedBy` by `kg:suppliesItem`. Touches another spec's text, so it lands after both PRs. | `spec-decomposition` clean; the note names this spec. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.7 Declare party links on `kg:Organization` (no `:Party` class) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Declare party links on `kg:Organization` (no `:Party` class).** `kg:Organization` (`core-foundation-v1.ttl:660`) already serves as the super-class, so no `:Party` class is added. `crates/eg-core/ontology/commercial-v1.ttl` must declare `kg:Supplier rdfs:subClassOf kg:Organization` beside `kg:Customer` (R003.1) if `kg:Vendor` does not entail it. Depends on `R003.1`. | Test asserts both `Customer` and `Supplier` entail `Organization` and no `:Party` class exists. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.8 Add `:PurchaseOrder` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:PurchaseOrder`.** `crates/eg-core/ontology/commercial-v1.ttl`: `kg:PurchaseOrder` with `kg:suppliesItem` lines. `R005.3` names it, but `grep -rn PurchaseOrder crates/eg-core/ontology` finds no declaration. | Test lists the class; the grep finds exactly one declaration. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.9 Add `:PurchaseInvoice` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:PurchaseInvoice`.** `crates/eg-core/ontology/commercial-v1.ttl`: `kg:PurchaseInvoice` and `kg:invoiceSupplier` to `kg:Supplier`. Depends on `R003.8`. | Test lists the class and property with domain and range. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.10 Add `:Opportunity` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:Opportunity`.** `crates/eg-core/ontology/commercial-v1.ttl`: `kg:Opportunity` with `kg:opportunityCustomer` to `kg:Customer`. Depends on `R003.1`. | Test lists the class and property with domain and range. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.11 Reuse `:Person` for `:Contact` and declare the link Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Reuse `:Person` for `:Contact` and declare the link.** `:Person` exists (`core-foundation-v1.ttl:671`) and no `:Contact` term exists. `crates/eg-core/ontology/commercial-v1.ttl` must add `kg:contactOf` from `kg:Person` to `kg:Customer` and no `:Contact` class. Depends on `R003.1`. | Test lists `contactOf` with domain and range; no `Contact` class exists. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.12 Add `:lastActivityAt` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `:lastActivityAt`.** `crates/eg-core/ontology/commercial-v1.ttl`: datatype property `kg:lastActivityAt`, domain `kg:Customer`, range `xsd:dateTime`. The shapes file `commercial-v1.shapes.ttl` should refuse a non-dateTime value. Depends on `R003.1`. | Test lists the property; a fixture with a plain string is refused. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.13 Register the commercial module Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Register the commercial module.** Create or reuse `crates/eg-core/ontology/commercial-v1.ttl` with its ontology header, core imports and canonical prefix block. Register `commercial` v1 once in `crates/eg-core/src/graph/schema_sources.rs`; regenerate `catalog-v1.ttl`. Reuse the R003.1 module. Do not create `commerce-v1.ttl`. | `commercial_vocabulary::commercial_module_loads`: Load through CoreSpec; assert module and catalog registration. Reject a missing or duplicate registration. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.14 Register the commercial shapes companion Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Register the commercial shapes companion.** Create or reuse `crates/eg-core/ontology/commercial-v1.shapes.ttl`. Wire its existing CoreSpec shapes field in `crates/eg-core/src/graph/schema_sources.rs`. Preserve R003.5 shapes. Depends on EG-SUPPLY-VOCAB-R003.13. | `commercial_vocabulary::commercial_shapes_load`: Load the registered companion and existing contract/capability shapes. Reject missing registration or overwritten existing shapes. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.15 Preserve canonical commercial namespaces Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Preserve canonical commercial namespaces.** In `crates/eg-core/ontology/commercial-v1.ttl`, use `http://knuckles.team/kg#` and import shared terms. Reuse Supplier, Customer and core classes. Do not add a CommerceFile class or narrow shared suppliedBy/ownedBy domains. Depends on EG-SUPPLY-VOCAB-R003.13. | `commercial_vocabulary::commercial_shared_namespace`: Check exact IRIs; reject duplicate incompatible declarations and accidental domain narrowing. Existing supplier and customer fixtures remain valid. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.16 Declare the Opportunity date property Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Declare the Opportunity date property.** In `crates/eg-core/ontology/commercial-v1.ttl`, declare or reuse `kg:closeDate` with xsd:dateTime range. Do not narrow an existing shared property domain. Depends on EG-SUPPLY-VOCAB-R003.15. | `commercial_vocabulary::commercial_close_date_declared`: Assert canonical property IRI, datatype-property type and dateTime range. Reject an incompatible existing declaration before adding a shape. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R003.17 Restore the Opportunity date constraint Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Restore the Opportunity date constraint.** In `crates/eg-core/ontology/commercial-v1.shapes.ttl`, require kg:closeDate with minCount 1 and xsd:dateTime datatype on kg:Opportunity. Preserve existing shapes and shared property domains. Depends on EG-SUPPLY-VOCAB-R003.10, EG-SUPPLY-VOCAB-R003.14 and EG-SUPPLY-VOCAB-R003.16. | `commercial_vocabulary::commercial_opportunity_date_shape`: Load the registered shape. Accept a valid dated opportunity; reject missing closeDate and an invalid date datatype. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R004 Host limit terms (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Host limit terms (rollup).** Normalized reading and limit rows. Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R004.1 Add `infra:HostLimit`, `:limitOf`, `:limitKind`, `:readingValue`, `:limitValue`, `:limitUnit` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add `infra:HostLimit`, `:limitOf`, `:limitKind`, `:readingValue`, `:limitValue`, `:limitUnit`.** `crates/eg-core/ontology/infrastructure-v1.ttl`. No stored `OverLimit` class. | Test lists the terms; no `OverLimit` class. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R004.2 SHACL shape for `HostLimit` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**SHACL shape for `HostLimit`.** `crates/eg-core/ontology/infrastructure-v1.shapes.ttl` (new if absent): one `limitOf`, one `limitKind` in `{temperature, disk, memory, cpu}`, one reading, one limit. Depends on `R004.1`. | Fixtures refuse a missing limit and an unknown kind. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R004.3 Declared-threshold fixture for capacity limits Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Declared-threshold fixture for capacity limits.** `crates/eg-core/tests/fixtures/host_limit_thresholds.ttl`: declared limits for disk, memory and cpu (decision D6). Depends on `R004.1`. | Fixture passes `HostLimitShape`. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005 Virtual mappings: procurement, commercial, change and capability sources (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Virtual mappings: procurement, commercial, change and capability sources (rollup).** One `vg:VirtualMapping` fixture per source concept. Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005.1 Mapping fixture: erpnext `Supplier` to `kg:Supplier` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: erpnext `Supplier` to `kg:Supplier`.** `crates/eg-core/tests/fixtures/vm_erpnext_supplier.ttl` using access contract `supplierAccess`; key `name`, label field `supplier_name`. | Fixture passes `vg:VirtualMapping` shape; maps the class. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005.2 Mapping fixture: erpnext `Item` and `Purchase Order` to `kg:SupplyChainItem` and `kg:suppliesItem` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: erpnext `Item` and `Purchase Order` to `kg:SupplyChainItem` and `kg:suppliesItem`.** `crates/eg-core/tests/fixtures/vm_erpnext_item_po.ttl`; the PO line items need `get_document` per order (decision D2). | Fixture passes the shape; the lines field is declared as a child fetch. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005.3 Resolve erpnext manifest classes (cross-repo: agent-packages `erpnext-agent`) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Resolve erpnext manifest classes (cross-repo: agent-packages `erpnext-agent`).** In `erpnext-agent/connector_manifest.yml` set `Supplier`, `Item`, `PurchaseOrder`, `Customer` `ontology_class` to the eg-core classes via the generator, not by hand (manifest is machine-generated). | Connector manifest gate passes; no `UNRESOLVED` for the four. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005.4 Mapping fixture: leanix `Provider` to `kg:Supplier` (rank 2) and `supports` to `kg:supportsCapability` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: leanix `Provider` to `kg:Supplier` (rank 2) and `supports` to `kg:supportsCapability`.** `crates/eg-core/tests/fixtures/vm_leanix.ttl` using `leanix_source_factsheets`. | Fixture passes the shape. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005.5 Mapping fixture: servicenow `Incident`, `Change` and CI relation to `kg:affectsService` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: servicenow `Incident`, `Change` and CI relation to `kg:affectsService`.** `crates/eg-core/tests/fixtures/vm_servicenow.ttl` using `get_change_request_ci` and `get_cmdb_instances`. | Fixture passes the shape. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005.6 Mapping fixture: salesforce `Account` to `kg:Customer` and `Contract` to `kg:CustomerContract` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: salesforce `Account` to `kg:Customer` and `Contract` to `kg:CustomerContract`.** `crates/eg-core/tests/fixtures/vm_salesforce.ttl` via `salesforce_soql`; `Contract` is read by SOQL, not by a declared connector class. | Fixture passes the shape. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005.7 Add the Salesforce `Contract` class and access contract (cross-repo: agent-packages `salesforce-agent`) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add the Salesforce `Contract` class and access contract (cross-repo: agent-packages `salesforce-agent`).** `salesforce_agent/ontology/` declares `Contract` and an SOQL access contract; the connector ontology has none today. | Connector ontology certification passes. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005.8 Mapping fixture: twenty `Company` to `kg:Customer` (rank 2) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: twenty `Company` to `kg:Customer` (rank 2).** `crates/eg-core/tests/fixtures/vm_twenty.ttl`. Twenty has no contract object, so no contract mapping is declared (decision D4). | Fixture passes the shape; a contract query against twenty only yields a typed abstention. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R005.9 Record the `coversService` source (BLOCKED, owner: operator plus salesforce-agent) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Record the `coversService` source (BLOCKED, owner: operator plus salesforce-agent).** Name the custom field or curated link that carries contract to service. Until then the row is a BLOCKED register entry `tasks.md` note, and the report abstains `Uncovered`. | The blocked-register test (R008.3) lists `coversService` with reason. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R006 Virtual mappings: software, runtime and host sources (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Virtual mappings: software, runtime and host sources (rollup).** Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R006.1 Add the container-manager access contract (cross-repo: agent-packages `container-manager-mcp`) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add the container-manager access contract (cross-repo: agent-packages `container-manager-mcp`).** Add `ac:AccessContract` rows for pods, containers and images under `container_manager_mcp/ontology/` using `cm_k8s_workloads list_pods`, container `list_containers`, `cm_image_operations list_images`. None exists today. | Connector ontology certification passes. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R006.2 Add the uptime-kuma access contract (cross-repo: agent-packages `uptime-kuma-agent`) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Add the uptime-kuma access contract (cross-repo: agent-packages `uptime-kuma-agent`).** Access contract for `UptimeMonitor` (`uptime_kuma_monitors get_monitors`) and `HeartbeatStat` (`uptime_kuma_status get_heartbeats`). | Connector ontology certification passes. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R006.3 Mapping fixture: container-manager workload and image to `kg:deployedAs` and `kg:usesImage` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: container-manager workload and image to `kg:deployedAs` and `kg:usesImage`.** `crates/eg-core/tests/fixtures/vm_container_manager.ttl`. | Fixture passes the shape. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R006.4 Mapping fixture: uptime monitor to service health Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: uptime monitor to service health.** `crates/eg-core/tests/fixtures/vm_uptime.ttl`; monitor resolves to `infra:Service` by the URL host key. | Fixture passes the shape. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R006.5 Mapping fixture: dockerhub image, SBOM and Scout CVEs to `containsComponent` and `Vulnerability` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: dockerhub image, SBOM and Scout CVEs to `containsComponent` and `Vulnerability`.** `crates/eg-core/tests/fixtures/vm_dockerhub.ttl` using `hub_scout` actions `sbom`, `cves`. | Fixture passes the shape. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R006.6 Mapping fixture: gitlab `dependencies` and github Dependabot alerts (rank 2) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: gitlab `dependencies` and github Dependabot alerts (rank 2).** `crates/eg-core/tests/fixtures/vm_gitlab_github.ttl` using `gitlab_vulnerabilities` and `github_dependabot`. | Fixture passes the shape. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R006.7 Mapping fixture: fan-manager and systems-manager to `infra:HostLimit` Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Mapping fixture: fan-manager and systems-manager to `infra:HostLimit`.** `crates/eg-core/tests/fixtures/vm_host_limits.ttl`: `TemperatureReading.celsius` with `FanControlPolicy.maxTemperature`; `capacityBytes` and `freeBytes` with the declared thresholds of `R004.3`. | Fixture passes the shape; a `HostLimit` row has both values. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R007 Entity resolution blocking keys (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Entity resolution blocking keys (rollup).** Cites `EG-UNIFIED-DATA-PLANE-R030`; adds only keys. Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R007.1 Blocking-key fixture for supplier, service, host, image and customer Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Blocking-key fixture for supplier, service, host, image and customer.** `crates/eg-core/tests/fixtures/supply_chain_blocking_keys.ttl` holds the table in plan.md. | Fixture parses; each concept lists at least two keys. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R007.2 Test: a digest key is exact; a name-only key is a proposal Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Test: a digest key is exact; a name-only key is a proposal.** `crates/eg-core/tests/` test over the fixture and `EntityLinkProposal::assert_same_as` (`R030.1`). Depends on `R007.1`. | Name-only match refused until approved; digest match still needs approval. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R008 Impact traversal and acceptance (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Impact traversal and acceptance (rollup).** Rollup: LANDED only once every child is. | Every child is LANDED. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R008.1 Class-only impact query fixture Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Class-only impact query fixture.** `crates/eg-core/tests/fixtures/supply_chain_impact.rq` from plan.md: parses and uses only classes of this vocabulary and `infra:Service`. | Query parses; no connector name appears. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R008.2 Recorded-response fixture: one row per source concept Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Recorded-response fixture: one row per source concept.** `crates/eg-core/tests/fixtures/supply_chain_recorded/` with one recorded response per connector operation in plan.md D4. | Fixture set covers every row of the D4 table that is not marked not available. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R008.3 Blocked-register test Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Blocked-register test.** The test reads the D4 table. It asserts each concept has an authority row or a typed abstention reason (twenty contracts, `coversService`). | No concept is silently uncovered. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R009 Ecosystem packages carry transitive dependency and risk (rollup) Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Ecosystem packages carry transitive dependency and risk (rollup).** Ecosystem packages are ontology classes with transitive dependency. A finding in one package reaches every dependent package. Children .1-.6. | Rollup closes when children .1-.6 pass. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R009.1 Model Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Model.** Add `:EcosystemPackage` and the property `:affectsPackage` to `crates/eg-core/ontology/supply_chain-v1.ttl`. Package dependency reuses `:dependsOn`, declared transitive in `crates/eg-core/ontology/software-v1.ttl:53`. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::package_class_and_dependency_declared`. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R009.2 Behavior Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Behavior.** Add `propagate_package_risk(graph, package, finding) -> Vec<PackageImpact>` in `crates/eg-core/src/ecosystem.rs`. Each rule is a named, replaceable default: follow `:dependsOn` in reverse to a depth of 8 and keep the worst severity per dependent. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::finding_reaches_transitive_dependents`. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R009.3 Wiring Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Wiring.** Call `propagate_package_risk` from `handle_impact` at `src/server/handlers/mining/impact.rs:264` when the request names a package. The server dispatches that handler in production. The package branch creates the call site. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::served_impact_lists_dependents`. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R009.4 Refusal Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Refusal.** `propagate_package_risk` must return the typed refusal `PackageRefusal::UnknownPackage` for a package absent from the graph. It must not return an empty impact list. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::unknown_package_is_refused`. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R009.5 Evidence Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Evidence.** Each `PackageImpact` must carry the dependency path from the changed package to the dependent. A reader replays why a dependent is affected. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::impact_carries_dependency_path`. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-SUPPLY-VOCAB-R009.6 Hot-path proof Definition — EG-SUPPLY-VOCAB / EG-SUPPLY-VOCAB — Supply-chain and service-impact vocabularyCanonical requirement and verification source**Hot-path proof.** Entry point: the served impact operation naming one package of a fixture dependency chain. The test passes through `impact.rs:264` and observes every transitive dependent with its path and severity. Owner: epistemic-graph. | `crates/eg-core/tests/ecosystem_dependency.rs::served_impact_over_dependency_chain`. | requirement | EG-SUPPLY-VOCAB | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS EG-TYPED-PACKS — Typed packs and catalog authority | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001 Connector pack contract types and golden digest vectors Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Connector pack contract types and golden digest vectors.** Rollup: every child below is required; the original acceptance remains mandatory. EG defines typed ConnectorPackIndex, entry, section, annotation, ConnectorPackOp, and AgentComponent.Content operations. EG computes framed SHA-256 digests from golden vectors in `contract/fixtures/connector_pack_digest_vectors.json`. Generated clients share this wire contract. | Contract and unit tests compare fixture digest output with published golden vectors byte-for-byte. | requirement | EG-TYPED-PACKS | SPECIFIED | b43f33569dd4 d116b7dbfd27 tests/test_connector_pack_client.py:137 |
| EG-TYPED-PACKS-R001.1 Original pack index and entry types Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original pack index and entry types.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-types/src/connector_pack/index.rs`. Refusal: No prompt result substitutes for this proof. Evidence: Round-trip every original index and entry field. | Proposed test: `tests/test_connector_pack_contract.py::test_pack_index_entry_contract`. Round-trip every original index and entry field. Unknown kinds and malformed index fields refuse. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001.2 Original section and annotation types Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original section and annotation types.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-types/src/connector_pack/annotations.rs`. Refusal: No prompt result substitutes for this proof. Evidence: Round-trip every section and annotation field without changing existing semantics. | Proposed test: `tests/test_connector_pack_contract.py::test_pack_section_annotation_contract`. Round-trip every section and annotation field without changing existing semantics. Invalid section bounds and malformed typed annotations refuse. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001.3 Original pack and content operations Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original pack and content operations.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-types/src/connector_pack/ops.rs`. Refusal: No prompt result substitutes for this proof. Evidence: Preserve ConnectorPackOp and AgentComponent.Content operation and result shapes. | Proposed test: `tests/test_connector_pack_contract.py::test_pack_content_operation_contract`. Preserve ConnectorPackOp and AgentComponent.Content operation and result shapes. Missing operations and incompatible result shapes fail qualification. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001.4 Original framed digest vectors Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original framed digest vectors.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-types/src/connector_pack/digest.rs`. Refusal: No prompt result substitutes for this proof. Evidence: Every published connector_pack_digest_vectors.json sample matches byte-for-byte. | Proposed test: `tests/test_connector_pack_contract.py::test_original_framed_digest_vectors`. Every published connector_pack_digest_vectors.json sample matches byte-for-byte. Changing a framed input or expected digest fails. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001.5 All generated clients share the pack contract Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**All generated clients share the pack contract.** Model: The original R001 contract remains mandatory. Behavior: Qualify this original obligation independently of prompt support. Wiring: Reuse `crates/eg-capabilities/src/bin/gen_contract.rs`. Refusal: No prompt result substitutes for this proof. Evidence: The complete generated-client inventory shares the original wire shapes and golden bytes. | Proposed test: `tests/test_connector_pack_contract.py::test_all_clients_share_pack_contract`. The complete generated-client inventory shares the original wire shapes and golden bytes. A stale client, omitted client or changed field fails. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001.6 Versioned prompt graph identity Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Versioned prompt graph identity.** Model: A SystemPrompt component pins tenant, component ID, entry revision, schema revision, body digest and provenance. Behavior: Represent the blueprint as a native graph entity with links to its schema and engine-owned body. Wiring: Extend `crates/eg-types/src/agent_component.rs` and its existing component types. Refusal: Unsupported versions, invalid IDs and missing required pins refuse. Evidence: A typed object round-trips all identity and revision fields. | Proposed test: `crates/eg-types/src/agent_component.rs::tests::prompt_blueprint_identity`. A typed object round-trips all identity and revision fields. Changing a schema or body pin cannot preserve the old definition identity. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001.7 Prompt payload validation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Prompt payload validation.** Model: The bounded blueprint profile in plan.md declares core fields and preserved extension values. Behavior: Validate the full object against its exact supported schema before publication or rendering. Wiring: Extend `crates/eg-types/src/agent_component/facts.rs` and reuse the bounded JSON admission authority. Refusal: Malformed fields, duplicate keys, unsupported schema rules and exceeded limits refuse. Evidence: Nested valid objects retain every admitted field and extension value. | Proposed test: `crates/eg-types/src/agent_component/facts.rs::tests::prompt_blueprint_schema_refusals`. Nested valid objects retain every admitted field and extension value. Missing task, wrong field types, nonfinite numbers and oversized objects refuse. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001.8 Deterministic runtime rendering Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Deterministic runtime rendering.** Model: The input binds one validated prompt revision and one validated variable object. Behavior: Resolve only declared variables and serialize the resulting typed object using the versioned rendering policy. Wiring: Intended source: `crates/eg-compute/src/assemble/prompt.rs`; reuse the existing compute crate. Refusal: Missing variables, unknown variables, unresolved pins and exceeded output bounds refuse. Evidence: Repeated identical inputs produce the same bytes and render digest. | Proposed test: `crates/eg-compute/src/assemble/prompt.rs::tests::prompt_render_vectors`. Repeated identical inputs produce the same bytes and render digest. A changed variable changes the result; invalid input produces no render result. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001.9 Generated prompt operation contract Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Generated prompt operation contract.** Model: Typed prompt admission, render and blueprint envelopes extend the existing component operation family. Behavior: Generate descriptors, method/result shapes and client projections from Rust authority. Wiring: Use `crates/eg-types/src/agent_component.rs` and `crates/eg-capabilities/src/bin/gen_contract.rs`. Refusal: Unsupported operation/schema versions and stale generated projections fail. Evidence: Generated clients encode and decode every declared request, result and typed refusal. | Proposed test: `tests/test_prompt_blueprint_contract.py::test_generated_prompt_contract`. Generated clients encode and decode every declared request, result and typed refusal. Missing render provenance or an untyped fallback fails. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002 Engine-owned body storage with guarded refcounts and reconciliation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Engine-owned body storage with guarded refcounts and reconciliation.** Rollup: every child below is required; the original acceptance remains mandatory. EG stores engine-owned component bodies in content-addressed storage. SHA-256 keys identify each body. Guarded holder-row refcounts track liveness. AgentComponent.Content serves verified bytes. A reconciler reclaims unheld bodies after the grace window. | Integration tests cover holder counts for unchanged, revised, and withdrawn components. A fault test covers orphan reclamation after the grace window. | requirement | EG-TYPED-PACKS | SPECIFIED | 022736782512 023b482a38d3 dcc5d53c04f9 f6bd64b35e00 src/server/handlers/admin/connector_pack/tests/admin.rs:242 |
| EG-TYPED-PACKS-R002.1 Original engine body staging Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original engine body staging.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/blob/engine_bodies.rs`. Refusal: No prompt-only test closes this original obligation. Evidence: Staged bytes use their verified SHA-256 address. | Proposed test: `tests/test_connector_pack_storage.py::test_body_staging`. Staged bytes use their verified SHA-256 address. A digest mismatch refuses; staging alone exposes no component. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.2 Original unchanged holder transition Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original unchanged holder transition.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/persistence/connector_pack/`. Refusal: No prompt-only test closes this original obligation. Evidence: An unchanged import keeps exact holder/refcount values. | Proposed test: `tests/test_connector_pack_storage.py::test_unchanged_holder`. An unchanged import keeps exact holder/refcount values. Repeated identical import cannot increment or decrement a holder. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.3 Original revised holder transition Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original revised holder transition.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/persistence/connector_pack/`. Refusal: No prompt-only test closes this original obligation. Evidence: A revised component binds its new body and preserves historical revision holders. | Proposed test: `tests/test_connector_pack_storage.py::test_revised_holder`. A revised component binds its new body and preserves historical revision holders. A changed revision cannot orphan a body held by history. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.4 Original withdrawn holder transition Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original withdrawn holder transition.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/persistence/connector_pack/`. Refusal: No prompt-only test closes this original obligation. Evidence: A withdrawn component retains body access through a valid historical pin. | Proposed test: `tests/test_connector_pack_storage.py::test_withdrawn_holder`. A withdrawn component retains body access through a valid historical pin. Withdrawal cannot reclaim a held historical body. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.5 Original orphan grace and fault recovery Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original orphan grace and fault recovery.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/handlers/admin/connector_pack/reconcile.rs:112`. Refusal: No prompt-only test closes this original obligation. Evidence: A fault before owner commit leaves an orphan reclaimed only after its grace window. | Proposed test: `tests/test_connector_pack_storage.py::test_orphan_grace_fault`. A fault before owner commit leaves an orphan reclaimed only after its grace window. An unexpired orphan or held body survives reconciliation and restart. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.6 Original verified body serving Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original verified body serving.** Model: Original engine bodies and holder rows remain the authority. Behavior: Qualify this original storage transition and its refusal independently. Wiring: Reuse `src/server/handlers/admin/component_content.rs:55`. Refusal: No prompt-only test closes this original obligation. Evidence: AgentComponent.Content returns the exact body of its pinned component revision. | Proposed test: `tests/test_connector_pack_storage.py::test_verified_body_read`. AgentComponent.Content returns the exact body of its pinned component revision. Corrupt bytes and denied tenants refuse without leaking body data. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.7 Native prompt body persistence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Native prompt body persistence.** Model: A native prompt publication binds a validated body, schema and expected component head. Behavior: Stage the body, then commit revision, head, holder and receipt through the existing admitted owner write. Wiring: Extend `src/server/persistence/agent_component/write.rs:39`; reuse `src/server/blob/engine_bodies.rs`. Refusal: Invalid schema, denied scope or stale head leaves committed owner state unchanged. Evidence: A successful write has one revision and live holder with its exact body digest. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_owner_commit`. A successful write has one revision and live holder with its exact body digest. A fault before owner commit leaves only an unreferenced body subject to the existing grace rule. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.8 Prompt graph projection Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Prompt graph projection.** Model: A graph entity names the exact committed prompt identity, schema pin and body pin. Behavior: Project through existing owner events and graph admission; expose readiness before graph consumers use the revision. Wiring: Reuse `src/server/connector_pack_projection.rs` machinery with explicit native-component support as a prerequisite. Refusal: Stale events, denied graph writes and incomplete projection cannot expose a newer ready revision. Evidence: Independent graph queries read the exact prompt revision and dependency links. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_graph_projection`. Independent graph queries read the exact prompt revision and dependency links. Replaying an old event cannot regress the visible revision. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.9 Served prompt rendering Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Served prompt rendering.** Model: The authenticated request pins tenant, prompt revision, schema and variable input. Behavior: Read verified body bytes, validate, render and return a provenance-bound result through the generated public operation. Wiring: Extend `src/server/handlers/admin/agent.rs:142`; reuse `src/server/handlers/admin/component_content.rs:55` and R001.8. Refusal: Invalid schema, changed pins, denied tenants and unavailable producers return typed refusals. Evidence: A real generated-client request reaches the renderer and returns the pinned revision and expected bytes. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_render_route`. A real generated-client request reaches the renderer and returns the pinned revision and expected bytes. Invalid requests leave graph, body holders, head and render-result publication unchanged. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.10 Refusal before model dispatch Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal before model dispatch.** Model: A render receipt binds prompt, schema, variables, bytes, revisions and request scope. Behavior: The production consumer must validate that receipt before any model transport call. Wiring: R002.9 supplies the engine result; the named AU dispatch consumer is an explicit prerequisite recorded in plan.md. The source-effect contracts referenced by R094.7 do not satisfy that separate dispatch prerequisite. Refusal: Invalid, stale, substituted or wrong-scope prompt objects cause zero model dispatches. Evidence: A valid served journey renders the pinned version and causes one observed model request. | Proposed test: `tests/test_prompt_blueprints_served.py::test_invalid_prompt_prevents_dispatch`. A valid served journey renders the pinned version and causes one observed model request. Each invalid case yields a typed refusal and zero requests at the real model transport boundary. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R002.11 Durable prompt restart proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Durable prompt restart proof.** Model: The fixture pins graph, component, body, schema and source identities. Behavior: Publish through the authenticated public operation, restart the server, then read through a second client. Wiring: Exercise `src/server/handlers/admin/agent.rs:142`, `src/server/persistence/agent_component/write.rs:39` and the existing content route. Refusal: A denied second tenant receives neither prompt metadata nor body bytes. Evidence: Current and historical revisions, graph links and verified body bytes survive restart. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_restart_readback`. Current and historical revisions, graph links and verified body bytes survive restart. A refused stale update leaves the previous durable head intact. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R003 Import boundary enforces archive integrity, importer binding and G1-G21 Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Import boundary enforces archive integrity, importer binding and G1-G21.** EG's ConnectorPack.Import handler verifies archive length and digest. It checks the submitted request against the bound importer. It applies validation rules G1 through G21 from architecture.md. It keeps ConnectorPack and the agent-layer write methods LocalOnly until a separately specified clustered writer exists. | Integration and negative tests exercise the Import boundary across each G1-G21 refusal path and an importer-binding mismatch. They confirm zero catalog mutation on any rejection. | requirement | EG-TYPED-PACKS | VERIFIED | 022736782512 209d6806510e db863f1e2afd f6bd64b35e00 src/server/handlers/admin/connector_pack/tests/admin.rs:441 |
| EG-TYPED-PACKS-R004 Python ConnectorPackClient with a deterministic import key Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Python ConnectorPackClient with a deterministic import key.** The epistemic_graph Python package provides ConnectorPackClient. The client computes deterministic import idempotency keys independent of request IDs. Retries after lost replies reuse the exact key and avoid duplicate imports. | Unit tests confirm transport-loss retries reuse the same generated key. They confirm the client uses generated wire types for status, content, and import results. | requirement | EG-TYPED-PACKS | VERIFIED | b43f33569dd4 d116b7dbfd27 tests/test_connector_pack_client.py:257 tests/test_connector_pack_client.py:367 |
| EG-TYPED-PACKS-R005 Acceptance suite for pack mutation, crash, authorization and tenancy Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Acceptance suite for pack mutation, crash, authorization and tenancy.** EG's test suite includes a planted-invalid-input mutation test for each validation rule, crash and retry tests over the Import atomic commit path, content-model, authorization, tenancy and clustered-mode tests, and at least one end-to-end connector fixture exercising import through to a served read. | The mapped test suite in test-spec.md passes, combining mutation, crash/retry, tenancy and end-to-end fixture coverage. | requirement | EG-TYPED-PACKS | VERIFIED | a1bb9fb9503e f6bd64b35e00 src/server/handlers/admin/connector_pack/tests/admin.rs:543 |
| EG-TYPED-PACKS-R006 Outbox-driven pack projection with a visibility readiness gate Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Outbox-driven pack projection with a visibility readiness gate.** An Agent Library outbox consumer projects the current committed pack head into its reserved graph. It attaches the schema source. It marks records visible through compare-and-swap. Typed catalog and component reads exclude records that fail this gate. Admins can invoke Reproject for failed or stale projections. Reproject preserves later work. | Integration tests cover projection commit order and the visibility compare-and-swap. They test read filtering and forced Reproject after a simulated failure. | requirement | EG-TYPED-PACKS | VERIFIED | a1bb9fb9503e f6bd64b35e00 src/server/handlers/admin/connector_pack/tests/outbox.rs:181 |
| EG-TYPED-PACKS-R007 Admin-controlled pack importer binding and entry retirement Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Admin-controlled pack importer binding and entry retirement.** EG's Bind, Unbind, and Retire operations require admin:connector-pack. Bind and Unbind change the authorized importer. Retire permanently retires a pack entry. Later imports that reintroduce retired entries refuse with stable RETIRED_ENTRY_RETURNED. | Authorization and negative tests confirm Bind, Unbind, and Retire require admin:connector-pack. Reintroducing a retired entry returns RETIRED_ENTRY_RETURNED without changing the head. | requirement | EG-TYPED-PACKS | VERIFIED | 022736782512 209d6806510e a1bb9fb9503e f6bd64b35e00 src/server/handlers/admin/connector_pack/tests/admin.rs:322 |
| EG-TYPED-PACKS-R008 Blob content-addressed store garbage-collection hardening Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Blob content-addressed store garbage-collection hardening.** EG's blob store reseeds cursor identifiers safely. It computes an accurate live set during garbage collection. It expires abandoned uploads. It enforces a grace period before it reclaims unreferenced bodies. It applies holder-row refcount updates idempotently, so repeated writes never over- or under-count references. | The blob store test suite covers grace-period reclamation, garbage-collection live-set correctness, cursor reseeding and idempotent holder-refcount updates. | requirement | EG-TYPED-PACKS | VERIFIED | b43f33569dd4 f6bd64b35e00 src/server/blob/store/tests.rs:344 |
| EG-TYPED-PACKS-R009 Projection readiness gates reader visibility Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Projection readiness gates reader visibility.** Readers see a pack record only after graph projection completes and visibility is marked. A committed catalog write alone does not grant visibility. | Integration tests confirm committed-but-unprojected records stay out of catalog and component reads until visibility is marked. | requirement | EG-TYPED-PACKS | VERIFIED | a7fb03fc503f db863f1e2afd src/server/handlers/admin/connector_pack/tests/outbox.rs:127 |
| EG-TYPED-PACKS-R010 Import is a single atomic operation, not a staged protocol Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Import is a single atomic operation, not a staged protocol.** ConnectorPack import validates, stages and commits a pack through one Import operation. EG does not expose separate Prepare, Commit or Abort steps for pack admission. | Contract tests confirm ConnectorPackOp exposes only the single Import method for pack admission, with no prepare, commit or abort variants. | requirement | EG-TYPED-PACKS | VERIFIED | a7fb03fc503f bcbbe51307d8 crates/eg-types/src/connector_pack/ops.rs:249 |
| EG-TYPED-PACKS-R011 Incompatible Agent Library storage is refused, not upgraded Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Incompatible Agent Library storage is refused, not upgraded.** When EG finds an existing Agent Library store in a format it does not recognize, it refuses to open it with a named AGENT_LIBRARY_FORMAT_UPGRADE_REQUIRED error instead of reading or migrating it, and no version performs an automatic offline upgrade of that layout. | A negative test opens an incompatible store and asserts the exact AGENT_LIBRARY_FORMAT_UPGRADE_REQUIRED refusal with no partial read or write. | requirement | EG-TYPED-PACKS | VERIFIED | 9bc78efe95b3 a7fb03fc503f src/server/persistence/store_upgrade/tests.rs:424 |
| EG-TYPED-PACKS-R012 Pack and agent-layer write methods are local-only in clustered mode Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Pack and agent-layer write methods are local-only in clustered mode.** ConnectorPack and its four agent-layer write methods are LocalOnly. They refuse clustered execution until a clustered writer is separately specified. A method-inventory test enumerates this exact set. | An inventory test asserts the exact LocalOnly method set. A clustered-mode integration test confirms every listed method refuses. | requirement | EG-TYPED-PACKS | VERIFIED | 321e6ae98be4 d116b7dbfd27 src/server/mutation.rs:2396 |
| EG-TYPED-PACKS-R013 Capability IRI validation distinguishes native errors from claims Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Capability IRI validation distinguishes native errors from claims.** EG rejects capability or modality IRIs that misuse the native eg: namespace. It accepts well-formed foreign absolute IRIs as recorded claims, not verified native facts. Govern native vocabulary extensions. | Validation tests cover mistyped native IRI refusal, foreign IRI acceptance as a claim, and malformed IRI refusal. | requirement | EG-TYPED-PACKS | VERIFIED | a7fb03fc503f db863f1e2afd src/server/handlers/admin/connector_pack/import/annotations.rs:198 |
| EG-TYPED-PACKS-R014 Absent entries become reversible Withdrawn, not retired Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Absent entries become reversible Withdrawn, not retired.** When a reimported pack omits a previously published entry, EG sets that component's lifecycle to Withdrawn. A later import of the same entry restores it. EG does not retire it permanently. | An integration test removes then restores an entry across two imports. It asserts the entry becomes Withdrawn and later republishes under the same ID. | requirement | EG-TYPED-PACKS | VERIFIED | a7fb03fc503f ac5638477288 src/server/handlers/admin/connector_pack/tests/content_model.rs:549 |
| EG-TYPED-PACKS-R015 Importer authority is admin-bound, with environment value as bootstrap only Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Importer authority is admin-bound, with environment value as bootstrap only.** Pack-import source authorization uses an admin-bound importer identity. An environment-configured importer applies only as the initial bootstrap default, before an administrator binds an importer. | A test confirms the environment importer applies only before admin Bind. A later binding supersedes that default. | requirement | EG-TYPED-PACKS | VERIFIED | a7fb03fc503f db863f1e2afd src/server/handlers/admin/connector_pack/tests/admin.rs:47 |
| EG-TYPED-PACKS-R016 Server pin follows declared contract, not package version Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Server pin follows declared contract, not package version.** The server-entry pin binds declared contract version, server name, and instructions. Package version is provenance only. It never determines pin equality or compatibility. | A unit test confirms package-only version changes preserve pin equality. Changing contract version, name, or instructions produces a new pin. | requirement | EG-TYPED-PACKS | VERIFIED | 8aca452dd012 daa948722eca crates/eg-types/src/agent_component.rs:1298 |
| EG-TYPED-PACKS-R017 Release scope excludes an offline Agent Library upgrade path Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Release scope excludes an offline Agent Library upgrade path.** This capability covers the full design in this specification. Offline upgrade of an incompatible Agent Library store remains out of scope. | Review success criteria and test-spec mapping to confirm no offline-upgrade test is required for acceptance. | requirement | EG-TYPED-PACKS | VERIFIED | 34b9f502483d crates/eg-storage/src/owner/agent_library_upgrade/tests.rs:107 |
| EG-TYPED-PACKS-R018 Body reads use AgentComponent.Content, not a pack-specific method Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Body reads use AgentComponent.Content, not a pack-specific method.** Verified component body bytes are read exclusively through the existing AgentComponent.Content method. EG does not expose a separate ConnectorPack-specific body-read operation. | A contract inventory test confirms ConnectorPackOp has no body-read variant and that AgentComponent.Content serves pack-sourced body bytes. | requirement | EG-TYPED-PACKS | VERIFIED | 71533e899d52 crates/eg-types/src/connector_pack/ops.rs:275 src/server/handlers/admin/connector_pack/tests/admin.rs:241 |
| EG-TYPED-PACKS-R019 Only SKILL.md is imported as skill content Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Only SKILL.md is imported as skill content.** Import admits only SKILL.md as skill content. Supporting files require a separate bounded contract and remain unimported. | A validation test confirms supporting-file references do not fail import. It confirms those files are not stored as body content. | requirement | EG-TYPED-PACKS | VERIFIED | 0893c1c9cef2 a1bb9fb9503e src/server/handlers/admin/connector_pack/tests/content_model.rs:656 |
| EG-TYPED-PACKS-R020 A tenant-profile administrative capability defect is out of EG scope Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**A tenant-profile administrative capability defect is out of EG scope.** Tenant-profile defects granting administrative graph capability belong to the tenant-profile dependency. EG pack/catalog code makes no corresponding change. | Review confirms pack-write paths do not depend on this fix. The owning dependency tests prove its correctness. | requirement | EG-TYPED-PACKS | VERIFIED | 08a2b1958cc3 tests/test_connector_pack_planted.py:216 |
| EG-TYPED-PACKS-R021 Cross-cutting import-safety defects are release-gate obligations Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Cross-cutting import-safety defects are release-gate obligations.** Cross-system pack-import safety defects must pass this release gate. The tenant-profile administrative capability fix is the sole exception; its repository owns its gate. | The test-spec release mapping includes a regression test for each cross-cutting import-safety defect before acceptance. | requirement | EG-TYPED-PACKS | VERIFIED | 96a4c42888e7 f121d03dab8c tests/test_connector_pack_planted.py:217 |
| EG-TYPED-PACKS-R022 Pack index well-formedness validation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Pack index well-formedness validation.** EG validates that a ConnectorPackIndex declares a supported schema version and a valid connector name, lists entries sorted by unique URI, uses only the closed set of entry kinds, matches each entry's declared URI scheme, and contains exactly one server entry, refusing otherwise with MALFORMED_INDEX or UNKNOWN_ENTRY_KIND. | Negative tests plant each malformed-index condition and assert the matching MALFORMED_INDEX or UNKNOWN_ENTRY_KIND refusal with zero catalog mutation. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:218 |
| EG-TYPED-PACKS-R023 Pack size bounds across index, entries, archive and body Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Pack size bounds across index, entries, archive and body.** EG enforces size bounds on every pack component: index at most 1 MiB, at most 1024 entries, at most 64 references or list items, archive at most 16 MiB, body at most 2 MiB, schema at most 1 MiB, import record at most 4 MiB, and batch size within the kernel budget, refusing any violation with PACK_TOO_LARGE. | A mutation test plants an oversized value for each bound and asserts the PACK_TOO_LARGE refusal. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:219 |
| EG-TYPED-PACKS-R024 Archive presence, length and digest integrity Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Archive presence, length and digest integrity.** EG requires the pack archive to be present and checks its declared length and SHA-256 against the received bytes, refusing with ARCHIVE_MISSING when absent or ARCHIVE_DIGEST_MISMATCH when the hash does not match. | Negative tests submit a missing archive and a tampered archive and assert the respective ARCHIVE_MISSING and ARCHIVE_DIGEST_MISMATCH refusals. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:220 |
| EG-TYPED-PACKS-R025 Archive section layout and offset correctness Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Archive section layout and offset correctness.** EG validates that every archive section's offset and length use checked arithmetic, cover the uncompressed archive exactly once with no overlap, and that the archive itself is stored uncompressed, refusing a malformed layout with MALFORMED_SECTIONS. | A mutation test plants overlapping, out-of-bounds and compressed-archive section layouts and asserts the MALFORMED_SECTIONS refusal. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:221 |
| EG-TYPED-PACKS-R026 Section, entry and pack digest recomputation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Section, entry and pack digest recomputation.** EG recomputes section SHA-256, every entry_digest, and pack_digest from received bytes. It refuses mismatches with PACK_DIGEST_MISMATCH. | Golden-vector and mutation tests confirm recomputed digests match published vectors. A one-byte tamper produces PACK_DIGEST_MISMATCH. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:222 |
| EG-TYPED-PACKS-R027 Text body UTF-8 validity without a byte-order mark Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Text body UTF-8 validity without a byte-order mark.** Every text-typed body must be valid UTF-8 without a byte-order mark. EG refuses violations with MALFORMED_BODY. | A negative test submits invalid UTF-8 and a leading byte-order mark. Both cases must return MALFORMED_BODY. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:223 |
| EG-TYPED-PACKS-R028 Bounded JSON body and schema validation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Bounded JSON body and schema validation.** EG parses every JSON-typed body and schema with a bounded parser that rejects excess depth, size overflow and duplicate keys, refuses NaN and Infinity values, and requires a tool's input schema to have an object-typed root, refusing a violation with MALFORMED_BODY. | A negative test submits excessive JSON depth, duplicate keys and a non-object tool schema root and asserts the MALFORMED_BODY refusal for each. | requirement | EG-TYPED-PACKS | VERIFIED | b43f33569dd4 d116b7dbfd27 tests/test_connector_pack_planted.py:224 |
| EG-TYPED-PACKS-R029 SKILL.md front-matter validation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**SKILL.md front-matter validation.** EG parses a skill entry's SKILL.md front matter against a restricted YAML subset that rejects anchor and alias expansion, and requires the declared name to match the entry name, refusing a violation with MALFORMED_BODY. | A negative test submits YAML anchors, aliases, and a mismatched name. It asserts MALFORMED_BODY for each case. | requirement | EG-TYPED-PACKS | VERIFIED | b43f33569dd4 d116b7dbfd27 tests/test_connector_pack_planted.py:225 |
| EG-TYPED-PACKS-R030 Tool entries require an input schema Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Tool entries require an input schema.** EG requires every tool entry to declare an input schema section, refusing an entry that omits one with MISSING_TOOL_SCHEMA. | A negative test submits a tool entry with no input schema section and asserts the MISSING_TOOL_SCHEMA refusal. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:226 |
| EG-TYPED-PACKS-R031 Empty description falls back to the entry name Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Empty description falls back to the entry name.** EG accepts an empty description and uses the entry name as its effective description. It records an EMPTY_DESCRIPTION warning instead of refusing import. | A test confirms import succeeds with the entry name applied. It also confirms the EMPTY_DESCRIPTION warning. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:227 |
| EG-TYPED-PACKS-R032 Capability, cost, latency and model annotation validation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Capability, cost, latency and model annotation validation.** EG validates capability/modality IRIs, costs, ISO currency, latency bounds, and model facts. Malformed IRIs yield UNKNOWN_CAPABILITY_IRI. Invalid cost, currency, latency, or model values yield INVALID_ANNOTATION or INVALID_FACTS. | A mutation test covers malformed IRI, invalid currency, out-of-bounds latency, and invalid model facts. Each case must return its matching refusal. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:228 |
| EG-TYPED-PACKS-R033 Bounded Turtle parsing for ontology and shapes Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Bounded Turtle parsing for ontology and shapes.** EG parses ontology and shapes Turtle documents with a bounded parser enforcing at most 100000 triples and bounded IRI and literal sizes, rejects any use of @base or a relative IRI, and never fetches owl:imports over the network, refusing a violation with ONTOLOGY_INVALID or SHAPES_INVALID. | A negative test submits oversized documents, @base declarations, and owl:imports references. It asserts the matching refusal without any network fetch. | requirement | EG-TYPED-PACKS | VERIFIED | b43f33569dd4 d116b7dbfd27 tests/test_connector_pack_planted.py:229 |
| EG-TYPED-PACKS-R034 Shape blank-node scoping and SPARQL-backed constraint rejection Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Shape blank-node scoping and SPARQL-backed constraint rejection.** EG scopes SHACL blank nodes independently per source file. It refuses shapes using sh:sparql or SERVICE constraints with SHAPES_INVALID. | A negative test covers cross-file blank-node references. Another covers sh:sparql SERVICE; both must return SHAPES_INVALID. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:230 |
| EG-TYPED-PACKS-R035 Step-bounded SHACL cross-validation against the ontology Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Step-bounded SHACL cross-validation against the ontology.** EG validates pack shapes against the composed ontology using step-bounded SHACL. Budget exhaustion yields VALIDATION_BUDGET_EXCEEDED. A genuine constraint violation yields SHACL_VIOLATION. | A test covers budget exhaustion and a genuine violation. It asserts VALIDATION_BUDGET_EXCEEDED and SHACL_VIOLATION, respectively. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:231 |
| EG-TYPED-PACKS-R036 Sibling reference resolution without cycles Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Sibling reference resolution without cycles.** EG resolves each entry reference only to a sibling of its declared kind. It rejects reference cycles with UNRESOLVED_REFERENCE or REFERENCE_CYCLE. | A negative test covers wrong-kind sibling references and cycles. Each case must return its matching refusal. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:232 |
| EG-TYPED-PACKS-R037 Server-stamped draft validation before commit Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Server-stamped draft validation before commit.** EG validates every AgentComponentDraft, including its server-stamped fields, through AgentComponentDraft::validate before it can be committed, refusing an invalid draft with INVALID_COMPONENT. | Unit tests exercise AgentComponentDraft::validate directly across valid and invalid field combinations, asserting INVALID_COMPONENT on failure. | requirement | EG-TYPED-PACKS | VERIFIED | b43f33569dd4 f41725ac0f6f crates/eg-types/src/agent_component.rs:1337 |
| EG-TYPED-PACKS-R038 Import requires a matching bound importer identity Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Import requires a matching bound importer identity.** EG compares the submitting principal with the target pack's configured or admin-bound importer. A mismatch yields IMPORTER_MISMATCH. | A negative test submits an unbound principal. It asserts IMPORTER_MISMATCH and no catalog mutation. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:233 |
| EG-TYPED-PACKS-R039 Mass-withdrawal guard requires an explicit admin override Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Mass-withdrawal guard requires an explicit admin override.** EG refuses imports that empty a pack or withdraw over half of Published members without explicit admin override. Refusal code is PACK_MASS_WITHDRAWAL. | A test omits over half of Published members without override and asserts PACK_MASS_WITHDRAWAL. The same import succeeds with override. | requirement | EG-TYPED-PACKS | VERIFIED | ac5638477288 b9e2f8389e6f c09b874a403e d116b7dbfd27 src/server/handlers/admin/connector_pack/tests/withdrawal.rs:174 tests/test_connector_pack_planted.py:234 |
| EG-TYPED-PACKS-R040 Validation stops at a bounded violation count Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Validation stops at a bounded violation count.** EG's validator stops collecting violations once it reaches 256 or exhausts its step budget, reporting in its response that the result was truncated, via VALIDATION_BUDGET_EXCEEDED. | A test submits a pack with far more than 256 violations and asserts the response is capped with a truncation indicator and VALIDATION_BUDGET_EXCEEDED. | requirement | EG-TYPED-PACKS | VERIFIED | d116b7dbfd27 db863f1e2afd tests/test_connector_pack_planted.py:235 |
| EG-TYPED-PACKS-R041 Write-time refusal codes for pack import conflicts Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Write-time refusal codes for pack import conflicts.** ConnectorPack.Import returns PACK_HEAD_CONFLICT when the expected head no longer matches, PACK_PLAN_STALE when the computed import plan was derived from a head that changed before commit, BODY_MISSING when a referenced body was not staged, and RESERVED_COMPONENT_ID when a caller attempts to directly write a pack-reserved component ID. None of these refusals changes the head, members, holders, or outbox. | Covered by the crash/retry and reserved-ID refusal cases that assert unchanged head, members, holders and outbox on every refusal. | requirement | EG-TYPED-PACKS | LANDED | b43f33569dd4 |
| EG-TYPED-PACKS-R042 Typed capability annotations: provides and requires_capabilities Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Typed capability annotations: provides and requires_capabilities.** Each pack entry carries a provides annotation listing native capability IRIs plus any foreign-namespace declared_capabilities claims, and a requires_capabilities annotation. A malformed native capability IRI is refused, while a foreign absolute IRI is accepted only as an unverified claim with a warning. | Covered by the capability-IRI validation cases asserting refusal of a malformed native IRI versus accepted foreign claim with warning. | requirement | EG-TYPED-PACKS | VERIFIED | 042cd2be6b01 481fa6ea2c55 795a1ea18fa6 a0743ba9b542 a1bb9fb9503e src/server/handlers/admin/connector_pack/import/capability_tests.rs:10 src/server/handlers/admin/connector_pack/import/capability_tests.rs:101 src/server/handlers/admin/connector_pack/import/capability_tests.rs:28 src/server/handlers/admin/connector_pack/import/capability_tests.rs:48 src/server/handlers/admin/connector_pack/import/capability_tests.rs:68 |
| EG-TYPED-PACKS-R042.1 Native capability annotation admission Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Native capability annotation admission.** Validate both typed capability lists. Refuse malformed native terms and invalid absolute schemes. Retain foreign terms only as declared claims with a warning. | Owner: `src/server/handlers/admin/connector_pack/import/annotations.rs::check_annotations` and `src/server/handlers/admin/connector_pack/import/desired.rs::DesiredBuilder::draft`. Tests: `src/server/handlers/admin/connector_pack/import/capability_tests.rs::both_capability_fields_refuse_relative_and_invalid_scheme_claims` and `foreign_terms_warn_and_stay_only_in_the_declared_partition`. The same test module covers native terms, typed lists, and JSON round trips. | requirement | EG-TYPED-PACKS | VERIFIED | 042cd2be6b01 src/server/handlers/admin/connector_pack/import/capability_tests.rs:10 src/server/handlers/admin/connector_pack/import/capability_tests.rs:101 src/server/handlers/admin/connector_pack/import/capability_tests.rs:28 src/server/handlers/admin/connector_pack/import/capability_tests.rs:48 src/server/handlers/admin/connector_pack/import/capability_tests.rs:68 |
| EG-TYPED-PACKS-R042.2 Served capability claim and refusal proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Served capability claim and refusal proof.** Import the capability annotations through signed dispatch and read persisted component claims. | Owner: `src/server/handlers/admin/connector_pack/import.rs::run_import` and `src/server/handlers/admin/connector_pack/import/desired.rs::DesiredBuilder::draft`. Native execution pending: `src/server/handlers/admin/connector_pack/tests/admin.rs::a_rejected_import_mutates_nothing_in_the_catalog` with G12 cases and bounded owner snapshots. The test `src/server/handlers/admin/connector_pack/tests/content_model.rs::capability_annotations_remain_declared_after_import` checks persisted claims for warning receipts and persisted native/declared fields. Refusals must preserve head, members, holders, records, body liveness, and outbox. | requirement | EG-TYPED-PACKS | VERIFIED | 481fa6ea2c55 795a1ea18fa6 a0743ba9b542 c764285d098c src/server/handlers/admin/connector_pack/tests/admin.rs:441 src/server/handlers/admin/connector_pack/tests/content_model.rs:599 |
| EG-TYPED-PACKS-R043 Modality annotations on pack entries Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Modality annotations on pack entries.** Each pack entry declares bounded modalities_in and modalities_out IRI lists. Lists record data modalities consumed and produced by tools, prompts, or skills. | Covered by typed annotation validation and digest-vector replay tests. Production owners are `crates/eg-types/src/connector_pack/annotations.rs`, `crates/eg-types/src/connector_pack/digest.rs`, and `src/server/handlers/admin/connector_pack/import/annotations.rs`. Proving tests are `src/server/handlers/admin/connector_pack/import/modality_tests.rs::modality_digest_replay_is_canonical_and_direction_sensitive` and the other R043 regressions in `test-spec.md`. PACK-09 acceptance remains required. | requirement | EG-TYPED-PACKS | VERIFIED | 7be444b032de 88931aa3dbef c08b8d0665e4 src/server/handlers/admin/connector_pack/import/modality_tests.rs:10 src/server/handlers/admin/connector_pack/import/modality_tests.rs:33 src/server/handlers/admin/connector_pack/import/modality_tests.rs:62 src/server/handlers/admin/connector_pack/import/modality_tests.rs:88 tests/test_connector_pack_client.py:457 |
| EG-TYPED-PACKS-R044 EG-computed tool schema digests Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**EG-computed tool schema digests.** EG computes input_schema_digest and output_schema_digest as SHA-256 over the exact received tool schema bytes, independent of any digest the connector SDK separately computes. | Covered by the digest-vector replay asserting a changed schema byte changes the digest while repackaging does not. | requirement | EG-TYPED-PACKS | VERIFIED | 7be444b032de src/server/handlers/admin/connector_pack/import/facts.rs:204 |
| EG-TYPED-PACKS-R045 MCP ToolAnnotations hints captured as pack facts Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**MCP ToolAnnotations hints captured as pack facts.** The importer captures each tool entry's MCP ToolAnnotations hints (readOnly, destructive, idempotent, openWorld). It stores them as typed facts on the pack entry's annotations. It never leaves them as untyped metadata. | Covered by annotation validation and digest-vector replay for pack entries. | requirement | EG-TYPED-PACKS | SPECIFIED | db863f1e2afd |
| EG-TYPED-PACKS-R045.1 Annotation type carries side effects, declarer and schema size Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Annotation type carries side effects, declarer and schema size.** `PackAnnotations` (`crates/eg-types/src/connector_pack/annotations.rs:46`) must gain `side_effects`, `declared_by` and `schema_tokens`, each with `#[serde(default)]`. `side_effects` is the closed set `none`, `workspace_write`, `external_write`, `network`. `declared_by` is `connector`, `mcp_hint` or `certified`. `schema_tokens` is `Option<u32>`. The SDK publishes these facts in `SDK-CONNECTOR-CONTROL-R045.1` to `.11`. | Test: `crates/eg-types/src/connector_pack/annotations.rs::tests::new_fields_roundtrip` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R045.2 Absent facts take safe defaults, never zero Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Absent facts take safe defaults, never zero.** An absent `read_only_hint` must read as `false`, absent `side_effects` as `external_write`, absent `declared_by` as `connector`, and absent `schema_tokens` as absent. A default method on `PackAnnotations` must expose these. No code path may turn an absent `schema_tokens` into 0. | Test: `crates/eg-types/src/connector_pack/annotations.rs::tests::absent_facts_take_safe_defaults` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R045.3 The annotation digest covers the new fields without moving old vectors Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The annotation digest covers the new fields without moving old vectors.** `annotations_digest` (`crates/eg-types/src/connector_pack/digest.rs:135`) must hash the three fields only when present. An entry without them must keep its existing golden digest vector. | Test: `crates/eg-types/src/connector_pack/digest.rs::tests::absent_new_fields_keep_golden_vectors` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R045.4 Admission refuses an unknown side-effect or declarer value Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Admission refuses an unknown side-effect or declarer value.** `check_annotations` (`src/server/handlers/admin/connector_pack/import/annotations.rs:34`) must refuse an unknown `side_effects` or `declared_by` value, or a `schema_tokens` of 0, with a typed annotation refusal naming the field. | Test: `src/server/handlers/admin/connector_pack/import/annotations.rs::tests::unknown_side_effect_is_refused` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R045.5 Admission records an unproven read-only claim Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Admission records an unproven read-only claim.** `tool_facts` (`src/server/handlers/admin/connector_pack/import/facts.rs:21`) must copy the three fields into `AgentComponentFacts::Tool` (`crates/eg-types/src/agent_component/facts.rs:198`). When `read_only_hint` is true and `declared_by` is `mcp_hint`, the stored fact must mark the claim unproven. The `effect` mapping at `facts.rs:25` must then yield `ToolEffect::Write`. | Test: `src/server/handlers/admin/connector_pack/import/facts.rs::tests::mcp_hint_read_only_is_unproven` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R045.6 The tool-subset path abstains for a tool with no size Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The tool-subset path abstains for a tool with no size.** `token_cost` (`src/server/handlers/decide/stat_tool_subset.rs:91`) now returns 0 for an undeclared cost, which treats the tool as free. It must return no value instead. `request_body` (`stat_tool_subset.rs:99`) must read each candidate's `schema_tokens` as its `token_cost` and must abstain on the `tool_subset` part for any candidate without one. It must not assume a size. This feeds `EG-DECISION-ENGINE-R045.2` and `EG-DECISION-ENGINE-R128.9`. | Test: `src/server/handlers/decide/stat_tests/tool_subset_tests.rs::missing_schema_tokens_abstains` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R045.7 No decision premise treats an unproven read-only claim as certified Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**No decision premise treats an unproven read-only claim as certified.** The `HarnessConfig` handler (`EG-DECISION-ENGINE-R128.8`) and the capability rules (`crates/eg-rdf/src/rules/capability.rs:384`) must treat `read_only` as certified only when `declared_by` is `certified` or `connector`. A premise built from an `mcp_hint` claim must carry the label unproven. | Test: `src/server/handlers/decide/stat_tests/harness_config_tests.rs::mcp_hint_read_only_premise_is_unproven` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R045.8 The generated contract and Python client carry the new fields Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The generated contract and Python client carry the new fields.** `gen_contract --check` (`crates/eg-capabilities/Cargo.toml:102`) must pass after regeneration. The Python `PackAnnotations` model (`crates/eg-capabilities/src/contract/python/surfaces.rs:12`) must expose the three fields, so the SDK can import them. | Test: `crates/eg-capabilities/src/contract/python/surfaces/tests.rs::pack_annotations_expose_harness_tool_facts` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R045.9 End-to-end proof: a two-tool pack yields a budget-respecting subset Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**End-to-end proof: a two-tool pack yields a budget-respecting subset.** A served test must import a pack with two tools of known `schema_tokens` through the import path. It must then call `Decide` with `HarnessConfig` (`EG-DECISION-ENGINE-R128`) and a budget that fits one tool. The answer's tool subset must stay within that budget. A tool with no `schema_tokens` must produce an abstention. | Test: `tests/harness_config_tool_facts_served.rs::two_tool_pack_subset_respects_budget` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R046 Cost annotation on pack entries Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Cost annotation on pack entries.** A pack entry may declare a cost annotation naming its currency and per-call, per-input-token and per-output-token cost in micros. An invalid currency or cost value is refused. | Covered by the invalid-cost-value validation case. | requirement | EG-TYPED-PACKS | VERIFIED | 347ce471e2c9 db863f1e2afd src/server/handlers/admin/connector_pack/import/annotations.rs:256 |
| EG-TYPED-PACKS-R047 Latency annotation on pack entries Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Latency annotation on pack entries.** A pack entry may declare a latency annotation giving its stated p50 and p95 response times. An out-of-bounds latency value is refused. | Covered by the invalid-latency-value validation case. | requirement | EG-TYPED-PACKS | VERIFIED | 347ce471e2c9 db863f1e2afd src/server/handlers/admin/connector_pack/import/annotations.rs:257 |
| EG-TYPED-PACKS-R048 ModelProfile cost, latency, modality and capability facts Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**ModelProfile cost, latency, modality and capability facts.** A model_profile pack entry carries provider, model identity, context window, maximum output tokens and supports_* capability facts alongside its cost, latency and modality annotations. | Covered by the model-fact validation cases and the digest-vector replay for pack entries. | requirement | EG-TYPED-PACKS | SPECIFIED | db863f1e2afd |
| EG-TYPED-PACKS-R048.1 Context window is a named model fact Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Context window is a named model fact.** `crates/eg-types/src/agent_component/facts.rs` already carries `context_window_tokens` on `ModelProfile`. EG must expose it as `contextWindowTokens` in the ontology projection and the Python DTO. The pack validator must reject a value of 0. | Test: `crates/eg-types/src/agent_component/facts.rs::tests::context_window_zero_is_refused` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R048.2 A measured fact cites the evaluation run that produced it Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**A measured fact cites the evaluation run that produced it.** `facts.rs` must define `MeasuredFact<T>` holding a `value` and an `evaluation_run_ref: ObservationRef`, reusing the `ObservationRef` type that `latency_observed_ref` uses. A measured fact without a run reference must fail validation. | Test: `crates/eg-types/src/agent_component/facts.rs::tests::measured_fact_requires_run_ref` | requirement | EG-TYPED-PACKS | VERIFIED | a565bdb085f2 crates/eg-types/src/agent_component/facts.rs:514 |
| EG-TYPED-PACKS-R048.3 Shell proficiency is a measured model fact Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Shell proficiency is a measured model fact.** `facts.rs` must define `ShellProficiency` (`low`, `medium`, `high`) and add `shell_proficiency: Option<MeasuredFact<ShellProficiency>>` to `ModelProfile` with `#[serde(default)]`. The ontology projection must name it `shellProficiency`. An absent value must leave the existing digest vectors unchanged. | Test: `crates/eg-types/src/agent_component.rs::tests::absent_shell_proficiency_keeps_digest` | requirement | EG-TYPED-PACKS | VERIFIED | 3a23459ceec7 crates/eg-rdf/src/rules/capability/tests.rs:234 crates/eg-types/src/agent_component.rs:1459 crates/eg-types/src/agent_component.rs:1510 crates/eg-types/src/agent_component.rs:1549 |
| EG-TYPED-PACKS-R048.4 Stopping behaviour is a measured model fact Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Stopping behaviour is a measured model fact.** `facts.rs` must define `StoppingBehaviour` (`stops_early`, `balanced`, `over_verifies`) and add `stopping_behaviour: Option<MeasuredFact<StoppingBehaviour>>` to `ModelProfile` with `#[serde(default)]`. The ontology projection must name it `stoppingBehaviour`. The digest function at `agent_component.rs:748` must hash both measured facts when present. | Test: `crates/eg-types/src/agent_component.rs::tests::measured_model_facts_change_digest` | requirement | EG-TYPED-PACKS | VERIFIED | 3a23459ceec7 crates/eg-rdf/src/rules/capability/tests.rs:235 crates/eg-types/src/agent_component.rs:1460 crates/eg-types/src/agent_component.rs:1511 crates/eg-types/src/agent_component.rs:1550 |
| EG-TYPED-PACKS-R048.5 Pack import round-trips the new model facts Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Pack import round-trips the new model facts.** A signed pack entry carrying `contextWindowTokens`, `shellProficiency` and `stoppingBehaviour` must import and read back unchanged. An entry with an unknown enum value must be refused with a typed error. | Test: `tests/typed_packs/test_model_harness_facts.py::test_model_profile_round_trip` | requirement | EG-TYPED-PACKS | VERIFIED | 03fd1d10476f 20f92260b576 35c16b482e05 4d345c857f13 6be6da12f970 crates/eg-types/src/connector_pack/digest.rs:302 tests/typed_packs/test_model_harness_facts.py:36 |
| EG-TYPED-PACKS-R049 contract_pin is carried as an opaque SDK claim Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**contract_pin is carried as an opaque SDK claim.** EG stores and returns the connector SDK's contract_pin value as a carried claim attribute on the server pin without independently recomputing or verifying the SDK's own schema normalization. | Covered by the server-pin digest vectors confirming EG treats the pin as declared rather than recomputed. | requirement | EG-TYPED-PACKS | VERIFIED | 0b9445099b24 db863f1e2afd crates/eg-types/src/connector_pack/digest.rs:348 |
| EG-TYPED-PACKS-R050 Per-entry contract_version replaces package-version pinning Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Per-entry contract_version replaces package-version pinning.** Each server pin binds the entry's declared contract_version, name and instructions. The connector's package version is carried as provenance only and never determines pin compatibility. | Covered by the import test case showing a contract-version change cascades pins while a package-only version change does not. | requirement | EG-TYPED-PACKS | VERIFIED | 347ce471e2c9 db863f1e2afd src/server/handlers/admin/connector_pack/tests/content_model.rs:103 src/server/handlers/admin/connector_pack/tests/content_model.rs:265 |
| EG-TYPED-PACKS-R051 Composable per-graph schema source sets Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Composable per-graph schema source sets.** A graph owns a bounded ordered map of named GraphSchemaSource entries, each carrying its own shapes and ontology bytes, origin and revision. The composed digest and policy are derived from the union, and conflict and consistency rules govern attach, detach and pack projection. | Covered by the schema-source composition and conflict-rule test cases. | requirement | EG-TYPED-PACKS | LANDED | f17f47ab300f |
| EG-TYPED-PACKS-R052 No pack-specific stand-in for pending schema authority Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**No pack-specific stand-in for pending schema authority.** A capability that depends on a general typed schema or ontology authority that does not yet exist is not shipped as a pack-specific placeholder; it is delivered only once the general authority exists. | Covered by the generated-type parity and migration check required before any duplicate type is removed. | requirement | EG-TYPED-PACKS | VERIFIED | 3eb80ef31218 src/server/handlers/admin/connector_pack/tests/outbox.rs:68 |
| EG-TYPED-PACKS-R053 Visible-staleness snapshot for non-pack schema attach Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Visible-staleness snapshot for non-pack schema attach.** Attaching a pack's schema to a graph other than its reserved projection graph copies a static snapshot whose staleness is visible to readers. Automatic following of later pack updates into that graph is not performed until a separately specified durable target-list design exists. | Covered by the static-attachment staleness-reporting test case. | requirement | EG-TYPED-PACKS | LANDED | f17f47ab300f |
| EG-TYPED-PACKS-R054 One topic per Agent Library outbox consumer Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**One topic per Agent Library outbox consumer.** Each Agent Library outbox consumer subscribes to exactly one topic; a projection consumer never mixes multiple unrelated topics in a way that would require skipping an acknowledgment. | Covered by the outbox crash and redelivery test cases asserting idempotent, topic-scoped redelivery. | requirement | EG-TYPED-PACKS | VERIFIED | 3eb80ef31218 ceec54145720 crates/eg-transaction/src/tests/outbox.rs:1466 |
| EG-TYPED-PACKS-R055 Outbox retry never collateral dead-letters unrelated events Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Outbox retry never collateral dead-letters unrelated events.** Retry failed outbox events a bounded number of times (for example, 16). Then dead-letter each failed event alone. Treat failure as durable, visible data-loss risk, not a stall. Healthy unrelated events never dead-letter with it. | Covered by stale/failed-event tests that assert later events are not collateral-dead-lettered. | requirement | EG-TYPED-PACKS | VERIFIED | 3eb80ef31218 7704b8d7294f crates/eg-transaction/src/tests/outbox.rs:2262 |
| EG-TYPED-PACKS-R056 Owner-layout refusal happens at the manifest read Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Owner-layout refusal happens at the manifest read.** An incompatible Agent Library owner-file layout is refused by a named error at the manifest read, through OwnerManifest validation, not later during any table-level scan. | Covered by the incompatible-layout refusal case exercised alongside the owner-transaction crash and recovery tests. | requirement | EG-TYPED-PACKS | LANDED | a1bb9fb9503e |
| EG-TYPED-PACKS-R057 Ontology withdrawal removes a whole source, not per-triple Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Ontology withdrawal removes a whole source, not per-triple.** Because the composed TBox is a derived cache and not stored authority, withdrawing a source's ontology contribution is performed by detaching that named GraphSchemaSource under the schema conflict rules, not by tracking provenance on individual triples. | Covered by the attach-detach-attach composition test cases. | requirement | EG-TYPED-PACKS | VERIFIED | f17f47ab300f src/server/graph_schema/compiled_tests.rs:93 |
| EG-TYPED-PACKS-R058 One shared derivation-step budget bounds EL+/RL reasoning Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**One shared derivation-step budget bounds EL+/RL reasoning.** A single bounded derivation-step budget for EL+ and RL classification is enforced once in the shared RDF reasoning component and reused by both pack ontology validation and graph schema source composition, so admission never invokes exponential tableau reasoning. | Covered by the derivation-budget-exhaustion case and the step-bounded classification test case. | requirement | EG-TYPED-PACKS | LANDED | 0d5be273ab86 80c865971ea8 |
| EG-TYPED-PACKS-R059 Schema attach validates only newly introduced data Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Schema attach validates only newly introduced data.** IcvConfigure and GraphSchema.Attach validate the staged schema document and the writes it introduces. They never retroactively scan or revalidate data already present in the graph. | Covered by the attach-without-retroactive-scan assertion in the schema composition tests. | requirement | EG-TYPED-PACKS | LANDED | 2c04520d740f |
| EG-TYPED-PACKS-R060 Manifest-read refusal precedes dependent import paths Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Manifest-read refusal precedes dependent import paths.** The engine refuses to read a manifest with an incompatible owner layout. That refusal exists before any import path relies on it. | Covered by the same incompatible-layout refusal evidence relied on by the owner-transaction recovery tests. | requirement | EG-TYPED-PACKS | LANDED | 08a2b1958cc3 |
| EG-TYPED-PACKS-R061 Bounded schema source catalog: 32 sources, 8 MiB Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Bounded schema source catalog: 32 sources, 8 MiB.** Graph schema composition admits at most 32 named sources per graph. Their combined dynamic schema size stays at or under 8 MiB. That bound covers the largest pack's snapshot staging cost. | Covered by the source-count and byte-bound overflow refusal test case. | requirement | EG-TYPED-PACKS | LANDED | b43f33569dd4 |
| EG-TYPED-PACKS-R062 GraphSchema replicates through the existing GraphState route Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**GraphSchema replicates through the existing GraphState route.** Graph schema state replicates through the existing GraphState catalog record type rather than introducing a new sealed payload variant. | Covered by the composed-schema read and replication test cases. | requirement | EG-TYPED-PACKS | LANDED | f17f47ab300f |
| EG-TYPED-PACKS-R063 Agent-layer row types affected by a schema bump are enumerated Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Agent-layer row types affected by a schema bump are enumerated.** Before any shared schema version is bumped, the specific agent-layer record types it changes are explicitly enumerated rather than assumed. | Covered by the generated-contract fixpoint and committed-artifact comparison test. | requirement | EG-TYPED-PACKS | LANDED | 08a2b1958cc3 |
| EG-TYPED-PACKS-R064 Output-schema digest recorded on tool pins Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Output-schema digest recorded on tool pins.** A tool's server pin carries an output_schema_digest alongside its input-schema digest, computed by EG over the exact received schema bytes. | Covered by the digest-vector replay test for pack entries. | requirement | EG-TYPED-PACKS | VERIFIED | 7be444b032de src/server/handlers/admin/connector_pack/import/facts.rs:205 |
| EG-TYPED-PACKS-R065 EG does not recompute the SDK's contract-pin normalization Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**EG does not recompute the SDK's contract-pin normalization.** EG does not independently validate or recompute the connector SDK's normalized contract-pin schema. EG only carries the pin as a declared claim, and that normalization is proved by the SDK's own conformance suite. | Covered by the server-pin claim-handling assertions in the digest and import replay tests. | requirement | EG-TYPED-PACKS | LANDED | db863f1e2afd |
| EG-TYPED-PACKS-R066 OWL/rule classification over model and capability facts Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**OWL/rule classification over model and capability facts.** ModelProfile and capability metadata are classified using the same bounded OWL and rule-based reasoning used for pack ontology validation, within the shared derivation-step budget. | Covered by the bounded ontology-consistency and classification test cases. | requirement | EG-TYPED-PACKS | SPECIFIED | f50555aa6421 |
| EG-TYPED-PACKS-R066.1 SHACL shapes validate the measured model facts Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**SHACL shapes validate the measured model facts.** A new shapes file `crates/eg-core/ontology/harness-v1.shapes.ttl` must require `shellProficiency` and `stoppingBehaviour` to be one of their enum values. It must require an `evaluationRun` link whenever a value is present. It must require `contextWindowTokens` to be at least 1. | Test: `crates/eg-core/tests/harness_shapes.rs::model_fact_shapes_reject_missing_run` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R066.2 The task class carries a shell-centric fact Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The task class carries a shell-centric fact.** `crates/eg-core/ontology/swarm_topology-v1.ttl` must declare the boolean property `swarm:shellCentric` on `swarm:TaskShape` (line 80 area owns `swarm:DecomposableTask`). The matching shape in `swarm_topology-v1.shapes.ttl` must require a boolean datatype and at most one value. | Test: `crates/eg-shacl/tests/swarm_topology_shapes.rs::shell_centric_must_be_boolean` | requirement | EG-TYPED-PACKS | VERIFIED | fa0de58b4e2e crates/eg-shacl/tests/swarm_topology_shapes.rs:17 crates/eg-shacl/tests/swarm_topology_shapes.rs:30 crates/eg-shacl/tests/swarm_topology_shapes.rs:47 |
| EG-TYPED-PACKS-R066.3 The shell-centric fact is inherited by task subclasses Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The shell-centric fact is inherited by task subclasses.** A task class with no own `swarm:shellCentric` value must read the value of its nearest ancestor through `agent_ontology::broader_chain`. When no ancestor states it, the reader must return an absent value, never `false`. | Test: `crates/eg-core/tests/swarm_topology_shapes.rs::shell_centric_inherits_or_is_absent` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R067 Coordinated contract regeneration for new library methods Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Coordinated contract regeneration for new library methods.** A feature that adds library API methods regenerates the shared wire, client and receipt artifacts. It commits them in the same change. It never lands library code ahead of its contract. | Covered by the generated-contract fixpoint and committed-artifact comparison test. | requirement | EG-TYPED-PACKS | LANDED | 339e26cbbbca |
| EG-TYPED-PACKS-R068 Contract regeneration packages the complete generated set Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Contract regeneration packages the complete generated set.** Regenerating the pack contract produces and commits the complete generated artifact set together, including the contract directory, the generated client package, the generated capabilities documentation, and the Rust catalog digest and method catalog files, so the committed catalog digest can never drift from the committed receipt digest while a byte-size-only comparison would miss a content-only change. | Covered by a committed-artifact content comparison that checks bytes and digests rather than file size alone. | requirement | EG-TYPED-PACKS | VERIFIED | a1bb9fb9503e crates/eg-capabilities/src/catalog.rs:82 |
| EG-TYPED-PACKS-R069 Branch-aware, blob-deduplicated repository indexing Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Branch-aware, blob-deduplicated repository indexing.** EG indexes all repository branches using Blob nodes keyed by content SHA. FileVersion nodes bind paths to blobs, and Branch edges point to each FileVersion. Indexing parses each unique blob once, even when many branches share it. | Covered by a repository-ingestion test proving each unique blob is parsed once across branches that share history. | requirement | EG-TYPED-PACKS | SPECIFIED | a1bb9fb9503e |
| EG-TYPED-PACKS-R070 Committed contract artifacts match generated content, not size Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Committed contract artifacts match generated content, not size.** The committed contract receipt files and the Rust catalog digest file must match what the current registry generates byte-for-byte. A same-size, different-content drift between them is treated as a failure, not ignored. | Proven by crates/eg-capabilities/tests/contract_generated.rs::committed_contract_artifacts_match_the_registry. | requirement | EG-TYPED-PACKS | VERIFIED | be0f1acb05c6 crates/eg-capabilities/tests/contract_generated.rs:25 |
| EG-TYPED-PACKS-R071 Generated core ontology corpus as GraphSchema authority Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Generated core ontology corpus as GraphSchema authority.** EG's first schema corpus is generated from typed Rust authority as versioned core module artifacts outside the 32-source dynamic quota, preserves its existing published ontology IRI vocabulary, covers root and core terms plus capability, enterprise and ArchiMate terms and governed shapes, and is checked with combined EL+/RL and tableau reasoning. | Covered by the codegen/check parity and ontology-consistency test cases. | requirement | EG-TYPED-PACKS | SPECIFIED | 86787edc8a87 90f5578ae2f4 |
| EG-TYPED-PACKS-R071.1 Versioned core vocabulary crosswalks (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Versioned core vocabulary crosswalks (rollup).** Extend R071 authority with explicit Schema.org mappings for person, event and document metadata. RDF/OWL semantics and upper-ontology disjointness remain authoritative in EG. Children `.1` through `.6` define this contract. | All six children require served acceptance. Existing alignment comments alone do not establish delivery. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R071.1.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `VocabularyCrosswalk` beside `DomainClass` in `crates/eg-types/src/domain_pack.rs`. Carry source and target absolute class IRIs, relation, source revision, target vocabulary revision, origin and content digest. Relations are closed: `SeeAlso`, `SkosExactMatch`, `SkosCloseMatch`, `SkosBroadMatch`, `SkosNarrowMatch`. Store approved target declarations and their categories with the vocabulary revision. | Round-trip all fields. Reject unknown relations, malformed IRIs, absent revisions and empty origins. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R071.1.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Use the exact source/target/relation fixtures in the test specification for EG Person, Event and Document. Their declared relation is `SeeAlso`; Document includes physical documents and must not become `SkosExactMatch` to DigitalDocument. `SkosBroadMatch` means the target is broader than the source. `SkosNarrowMatch` means the target is narrower. Choose each relation explicitly in typed authority. References never imply `owl:sameAs`, class equivalence or new subclass assertions. Preserve continuant, process and temporal-region separation. Use named limits: 4096 source classes, 16384 mappings and 2048 bytes per IRI. | Deterministic fixtures cover all three classes, duplicate input and every bound. Verify exact tuples against pinned source and target declarations. Assert broad/narrow direction with asymmetric fixtures. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R071.1.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Extend `VocabularyModule::to_turtle` at `crates/eg-core/src/ontology_codegen.rs:45` to emit declared crosswalks. Reuse schema composition in `src/server/graph_schema.rs::apply_pack_source` before activation. Extend `OntologyInspection` and `src/server/handlers/rdf/inspect.rs::handle_ontology_inspect` to return crosswalks from composed sources. The production caller is `Method::OntologyInspect` in `src/server/handlers/rdf/dispatch.rs:314`. These crosswalk call sites remain to be implemented. | Generator parity and real served inspection must resolve identical records and composed digests. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R071.1.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** Resolve every source IRI as a class in the pinned source revision and selected source scope before activation. Return `CROSSWALK_SOURCE_UNKNOWN` for an unresolved class, including a property IRI. Return `CROSSWALK_SOURCE_OUT_OF_SCOPE` for a known class outside the authorized selected source set. Include the source IRI, requested revision and scope. Reject unresolved targets, conflicting relations and mappings incompatible with approved target categories before activation. Return `CROSSWALK_TARGET_UNKNOWN`, `CROSSWALK_CONFLICT`, `CROSSWALK_CATEGORY_CONFLICT` or `CROSSWALK_LIMIT_EXCEEDED`, with the offending IRI. Existing schema consistency and disjointness checks still run. Never fetch or silently adopt external definitions during import. | Unknown and out-of-scope sources must refuse even when their target is valid. A Person-to-Event mapping and a conflicting duplicate leave the active schema digest unchanged. Exceeding any bound refuses without truncation. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R071.1.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Return source and target IRIs, relation, both vocabulary revisions, origin, crosswalk digest and committed schema digest. Distinguish inline inspection from committed-source inspection. Bind report evidence to the inspected tenant, graph and source set. | Independent readback matches the committed mapping records and digest. Inline inspection cannot claim activation. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R071.1.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** Entry point: authenticated `ConnectorPack.Import`, followed by schema attachment and served `OntologyInspect` over composed sources. `tests/test_ontology_crosswalk_served.py::test_core_metadata_crosswalks` imports person, event and document fixtures using the real client and server. Query committed classes through `GraphSchemaClasses` and inspect mappings separately. | Assert the exact golden tuples and committed digest, including the declared relation and endpoint direction. Refuse unknown and out-of-scope sources. Submit category conflicts and disjointness violations, then independently read the unchanged prior state. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R072 EG/SDK typed fleet-catalog authority, not SQL tables Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**EG/SDK typed fleet-catalog authority, not SQL tables.** ServerRegistry is the sole liveness authority for fleet servers, and ConnectorPack and AgentComponent are the sole content and lifecycle authority. The connector SDK pulls, builds and imports packs, and GraphOS joins typed reads for serving, with no SQL shadow catalog or independent content authority elsewhere. | Covered by the fleet-catalog join and distinct-authority assertions in the end-to-end connector test. | requirement | EG-TYPED-PACKS | SPECIFIED | 2a0d6eae0918 90f5578ae2f4 |
| EG-TYPED-PACKS-R073 Raise the core schema source bound to 64 and split world_model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Raise the core schema source bound to 64 and split world_model.** The core schema source bound, the in-process maximum and the wire contract's maximum source count, is raised from 32 to 64 as one coordinated contract change, and the world_model schema module is split into separate life, environment and nutrition modules with their shapes moved into their own document. | Covered by the raised source-count bound test case and the contract-regeneration check. | requirement | EG-TYPED-PACKS | VERIFIED | 90f5578ae2f4 a4c80c2b6f90 src/server/graph_schema/world_model_tests.rs:106 src/server/graph_schema/world_model_tests.rs:248 |
| EG-TYPED-PACKS-R074 Least-privilege, per-pack projection grant with recorded failure Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Least-privilege, per-pack projection grant with recorded failure.** The projection worker writes each pack's reserved graph under a least-privilege grant scoped to that outbox row rather than a broad per-graph check that can deny it. Any write failure is recorded as a durable failed outbox status and surfaced for dead-letter and retry rather than only logged. | Covered by the graph-grant-denial and durable-failed-status test cases. | requirement | EG-TYPED-PACKS | LANDED | 90f5578ae2f4 d76ac1402723 |
| EG-TYPED-PACKS-R075 Landing gate runs the full integration test suite Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Landing gate runs the full integration test suite.** The release gate runs the complete Rust test suite, including integration binaries such as admission-saga result contracts and transaction recovery. It does not run unit tests only. These cases are gated before merge. | The full-suite gate requires a complete nextest run, including integration binaries, with zero omissions. | requirement | EG-TYPED-PACKS | LANDED | 90f5578ae2f4 b43f33569dd4 |
| EG-TYPED-PACKS-R076 Signal-killed test binaries are detected and rerun in isolation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Signal-killed test binaries are detected and rerun in isolation.** If a test binary is killed by a signal partway through a run, the gate detects the signal death and reruns that binary under per-test process isolation so every test receives a pass or fail verdict instead of being silently skipped. A durability test pair that depends on sibling-test process state is diagnosed and isolated so it does not depend on run order. | Covered by the full-suite gate requirement to account for every test when a binary dies by signal. | requirement | EG-TYPED-PACKS | LANDED | 90f5578ae2f4 a1bb9fb9503e |
| EG-TYPED-PACKS-R077 GraphSchemaClasses exposes canonical class and property names Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**GraphSchemaClasses exposes canonical class and property names.** EG exposes a GraphSchemaClasses read returning the committed composed graph schema's classes and properties together with its composition digest, so a consumer can verify a referenced class name against the canonical schema. | Covered by the GraphSchemaClasses comparison test case. | requirement | EG-TYPED-PACKS | VERIFIED | 2068ec01a667 90f5578ae2f4 src/server/graph_schema/terms.rs:201 src/server/graph_schema/terms.rs:231 |
| EG-TYPED-PACKS-R078 Proven retrieval plan templates keyed by task class and digest Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Proven retrieval plan templates keyed by task class and digest.** EG records RetrievalPath entries as proven plan templates keyed by task class and the composed graph schema digest, exposing them as candidates to EG-DECISION-ENGINE-R029 along with topology-to-skill edges used to assemble a plan. | Covered by a retrieval-plan-candidate test asserting the recorded template is keyed by task class and schema digest. | requirement | EG-TYPED-PACKS | LANDED | 90f5578ae2f4 e429630278b8 |
| EG-TYPED-PACKS-R079 Typed OHLCV bar-series contract Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Typed OHLCV bar-series contract.** EG defines a typed OHLCV bar-series contract covering bar rollup, trading-calendar alignment, finalized-versus-provisional bar status, and bar revision handling. | Covered by a bar-series contract test asserting rollup, calendar alignment, provisional-to-finalized transition and revision replay. | requirement | EG-TYPED-PACKS | LANDED | 532418b7e55b 90f5578ae2f4 |
| EG-TYPED-PACKS-R080 Exhaustive OpKind/PredKind printer and parser contract Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Exhaustive OpKind/PredKind printer and parser contract.** A single macro generates each OpKind and PredKind enum together with its complete variant list. A walk prints, parses and canonicalizes every variant against an empty builder-only allowlist, backed by a 512-case property round-trip test and a fuzz target asserting the same round trip. | Covered by the printer/parser round-trip, property and fuzz test cases. | requirement | EG-TYPED-PACKS | LANDED | 1b4fc2558151 90f5578ae2f4 |
| EG-TYPED-PACKS-R081 Ontology object model migrated into EG's kg/ontology package Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Ontology object model migrated into EG's kg/ontology package.** The epistemic-graph kg/ontology package owns the core ontology object model migrated out of agent-utilities: object_set, property_types, derived_properties, links, the functions, edits, and indexing modules, classification_claims, permissioning, document_processing, schema_graph, ops_causal_crosswalk, repository_provenance, style_lint, and the generic object-path and object-collection utilities. The sync_conflict and leanix_metamodel modules remain outside this package as connector-SDK concerns. | A focused unit-test run over the migrated kg/ontology modules passes with no behavior regression against the prior agent-utilities implementation. | requirement | EG-TYPED-PACKS | LANDED | 64b30a5187f3 90f5578ae2f4 |
| EG-TYPED-PACKS-R082 EG-generated types replace hand-written graph-schema DTOs Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**EG-generated types replace hand-written graph-schema DTOs.** epistemic-graph's generated contract types replace agent-utilities' hand-written DTOs for models/knowledge_graph, models/schema_definition, models/evidence_bundle, models/knowledge_pack, models/codemap, models/graph, models/knowledge_base, and the schema_pack and schema_packs modules. The kg/domain_packs module migrates to the same generated types once AU-SEMANTIC-R005 removes its separate pack_loader path. | Unit tests comparing callers against the EG-generated types confirm behavioral parity for each migrated model module. | requirement | EG-TYPED-PACKS | LANDED | 08a2b1958cc3 90f5578ae2f4 |
| EG-TYPED-PACKS-R083 Schema-drift SHACL rendering and contract store move into EG Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Schema-drift SHACL rendering and contract store move into EG.** EG owns schema-drift SHACL rendering, contract_store, and activation modules, replacing the prior agent-utilities implementation. The connector-SDK sync runner invokes EG's drift gate between drain and apply. EG covers detection, shaping, classification, and reporting. The SDK does not render SHACL. | Integration tests drive connector-SDK sync through drain and apply. They assert EG's drift gate and SHACL rendering run as dependencies. No SHACL generation remains in agent-utilities. | requirement | EG-TYPED-PACKS | LANDED | 90f5578ae2f4 97e9074f0467 |
| EG-TYPED-PACKS-R084 Request deadlines propagate into long-running pack operations Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Request deadlines propagate into long-running pack operations.** A pack import, classification, or derivation observes the client's request deadline and cancellation signal and releases the tenant's pack lock on cancellation rather than continuing to hold it once the deadline has passed, so later pack operations for that tenant are not blocked behind abandoned work. | An integration test cancels an in-flight import at its deadline and asserts the next bind for the same tenant proceeds without waiting on the abandoned lock. | requirement | EG-TYPED-PACKS | VERIFIED | 147959ad6f13 90f5578ae2f4 src/server/handlers/admin/connector_pack/tests/ontology.rs:87 |
| EG-TYPED-PACKS-R085 Identity domain operations with Argon2id and redacted views Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Identity domain operations with Argon2id and redacted views.** A family of identity operations covering user, credential, session, token, MFA, API key, role, group, identity-provider, link, audit, and throttle actions is implemented in crates/eg-types/src/identity/ and dispatched through src/server/dispatch/router/identity_store.rs and crates/eg-capabilities/src/domains/security.rs. Credential verification uses argon2id inside EG, pgwire views expose identity data redacted, and the kernel exposes an identity catalog supporting DDL export and import. | Unit and integration tests exercise each identity operation, assert redaction in the pgwire view, and confirm the identity catalog's DDL export and import round-trip. | requirement | EG-TYPED-PACKS | SPECIFIED | 0035f9fac382 90f5578ae2f4 |
| EG-TYPED-PACKS-R085.1 Durable session record projection Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Durable session record projection.** Existing Resolve adds optional session_record with opaque stored reference, creation-bound deployment tenant, principal, idle/absolute expiry and nullable MFA timestamp. Legacy/unbound and API-key resolutions omit it. Credential validation, pending-MFA behavior and authority remain unchanged; Arbora owns admission. | Native persistence/replay and post-touch tests, omitted legacy/API-key metadata, unchanged refusal tests, and caller-stamp replacement. No served admission qualification is claimed. | requirement | EG-TYPED-PACKS | SPECIFIED | crates/eg-core/src/isolation/identity_store_tests.rs:463 crates/eg-core/src/isolation/identity_store_tests/session_evidence.rs:5 crates/eg-types/src/identity/tests/session_evidence.rs:128 crates/eg-types/src/identity/tests/session_evidence.rs:142 crates/eg-types/src/identity/tests/session_evidence.rs:34 |
| EG-TYPED-PACKS-R085.3 Served session-liveness check by opaque session reference Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Served session-liveness check by opaque session reference.** A served identity operation takes the opaque session reference from `EG-TYPED-PACKS-R085.1`. It returns exactly one of `live`, `revoked` or `expired`. It judges from stored expiry and revocation state. It never takes, returns or logs the raw token. A reference outside the caller's deployment tenant gets the typed refusal for an unknown reference. API-key and external-identity callers with no session get a defined `not_session_bound` answer. That answer differs from `revoked` and `expired`. The check never touches the session. It does not extend idle expiry. Arbora consumes this check in `ARBORA-IDENTITY-R029.6`. | A live session answers `live`. After revoke and revoke_all it answers `revoked`. After idle and absolute expiry under a fake clock it answers `expired`. API-key and external-identity callers answer `not_session_bound`. Unknown and cross-tenant references get refused. The wire carries no token text. Idle expiry stays unchanged. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R085.2 Remaining identity-domain qualification Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Remaining identity-domain qualification.** Preserve the parent R085 acceptance beyond the narrow durable session projection: exercise every existing identity operation, redacted pgwire views, and identity catalogue DDL export/import round trips. The R085.1 storage fixtures do not qualify served authentication, host admission or browser lifecycle; those remain Arbora integration obligations. | Execute the parent operation, pgwire-redaction and catalogue round-trip suites against the qualifying implementation; retain explicit pending status until that evidence exists. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R085.7 Rollup through R085.7.1–R085.7.3 Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Rollup through R085.7.1–R085.7.3.** **Original session reference inspection.** Resolve an exact stored opaque reference through the existing identity store. Require the stamped owner, matching tenant, active principal and live completed session. Return durable facts without touching expiry or issuing credentials. Refuse ambiguous references and delegated callers. | Native owner/refusal and durable reopen tests. Contract generation and native execution remain pending until qualified. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R085.4 Rollup through R085.4.1–R085.4.3 Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Rollup through R085.4.1–R085.4.3.** **Idle session renewal uses global authority CAS.** Inspect returns facts and the global identity/RBAC revision from one snapshot. Renewal requires that exact revision at the existing durable commit boundary. Require the same owner, tenant and scopes, with an active principal and live completed session. Capture effective scopes at session creation. Renewal scopes must remain within that original ceiling; missing legacy evidence refuses. Extend idle expiry only within the unchanged absolute expiry. Refuse stale revisions, scope changes and expired or revoked sessions. No credential or approval is renewed. | Native durable CAS/reopen tests cover stale revisions, scope mismatch, expiry and revocation without resurrection. Native execution and generated contract qualification remain pending. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R086 Planted derivation-budget and malformed-path cases are refused Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Planted derivation-budget and malformed-path cases are refused.** A connector pack import that would require an unbounded derivation budget completes within its declared budget or refuses with a typed error rather than timing out, and an import containing a malformed path is refused rather than imported. | Planted-fixture tests for the derivation-budget and malformed-path cases each assert the correct refusal or typed-error outcome. | requirement | EG-TYPED-PACKS | LANDED | 334a69c2e3de 90f5578ae2f4 |
| EG-TYPED-PACKS-R087 Stable error codes for auth-boundary refusals Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Stable error codes for auth-boundary refusals.** An authorization refusal raised in auth::claims::validate_deployment_binding for a tenant, audience, or policy-version mismatch returns a stable error code, such as AUTH_TENANT_MISMATCH, in Response.error, with the descriptive free-text message retained only as supplementary detail. | Unit tests assert each auth-boundary refusal path returns its documented stable error code rather than only a free-text message. | requirement | EG-TYPED-PACKS | LANDED | 48746fc0e5ac 90f5578ae2f4 |
| EG-TYPED-PACKS-R088 Embedded engine enforces graph-level access control Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Embedded engine enforces graph-level access control.** The in-process engine (crates/eg-pyengine, EmbeddedTransport) enforces the same graph-level read authority as the served engine, refusing GetNodeProperties for another principal with ACCESS_DENIED instead of returning data filtered only per caller property, or explicitly refuses multi-principal use. Embedded transport methods beyond CreateGraph, AddNode, GetNodeProperties, HasNode, and NodeCount are added through one table-driven result-contract mapping so parity with the served engine holds by construction. | tests/parity/test_parity_graph_ops.py::test_get_node_properties_rls_isolation and related parity tests assert embedded and served access-control behavior match. | requirement | EG-TYPED-PACKS | VERIFIED | 88499bb6424b 90f5578ae2f4 tests/parity/test_parity_graph_ops.py:74 |
| EG-TYPED-PACKS-R089 Blob-layout table for pack body holder rows Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Blob-layout table for pack body holder rows.** The owner storage layout includes a connector_pack_body_holders table, defined in crates/eg-storage/src/owner/registry.rs as part of OwnerLayout::Blob, to hold pack body holder rows. | crates/eg-storage/src/owner/tests.rs::owner_layout_registry_has_frozen_cardinality pins the OwnerLayout::Blob table count so an untracked addition or removal fails the test. | requirement | EG-TYPED-PACKS | VERIFIED | 90f5578ae2f4 b43f33569dd4 crates/eg-storage/src/owner/tests.rs:18 |
| EG-TYPED-PACKS-R090 Canonical ontology and SHACL artifacts generated from Rust Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Canonical ontology and SHACL artifacts generated from Rust.** The canonical ontology and SHACL shape artifacts are generated deterministically from the typed Rust vocabulary, which owns the core ontology and shape corpus as the single source of truth, and regeneration reproduces identical output across runs. Rollup: delivered by its child requirements, in order. | A regeneration test re-emits the ontology and SHACL artifacts from the Rust vocabulary and diffs them against the checked-in output for byte equality. | requirement | EG-TYPED-PACKS | LANDED | 080677a31fdd 90f5578ae2f4 |
| EG-TYPED-PACKS-R090.1 A typed-vocabulary-to-Turtle generator reproduces checked-in output byte-for-byte Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**A typed-vocabulary-to-Turtle generator reproduces checked-in output byte-for-byte.** One typed Rust vocabulary module declares its classes and properties in a fixed order and renders canonical Turtle text; regenerating from the same declaration twice, and against the checked-in fixture, is byte-identical. This proves the generation mechanism before the existing `crates/eg-core/ontology/*.ttl` corpus migrates onto it in later child requirements. | A unit test regenerates the module's Turtle twice and against a checked-in fixture and asserts byte equality, plus a negative test confirming a changed module does not match the fixture. | requirement | EG-TYPED-PACKS | LANDED | 080677a31fdd |
| EG-TYPED-PACKS-R091 Food composition and nutrient reference types Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Food composition and nutrient reference types.** USDA FoodData Central and FoodOn source data map into FoodTerm, FoodCompositionRecord, and NutrientAmount records, with FDC nutrient identifiers mapped through a ChEBI crosswalk table, and DRI, EFSA, and NRC reference tables map into NutrientReferenceIntake records. | Unit tests validate the FDC-to-ChEBI nutrient mapping and confirm imported records conform to the FoodTerm, FoodCompositionRecord, NutrientAmount, and NutrientReferenceIntake schemas. | requirement | EG-TYPED-PACKS | LANDED | 90f5578ae2f4 a1bb9fb9503e |
| EG-TYPED-PACKS-R092 Python client idempotency key excludes the request ID Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Python client idempotency key excludes the request ID.** The Python client's default idempotency key for a connector pack import is derived from the connector, content digest, and expected head, and excludes the request ID, so a retried request after a transport loss reuses the identical import operation key rather than generating a new one. | tests/test_connector_pack_client.py::test_transport_loss_retry_reuses_the_exact_import_operation_key asserts a retried import reuses the identical idempotency key after simulated transport loss. | requirement | EG-TYPED-PACKS | VERIFIED | 90f5578ae2f4 b43f33569dd4 f097533e52c8 tests/test_connector_pack_client.py:366 tests/test_connector_pack_client.py:411 |
| EG-TYPED-PACKS-R093 Turtle parser blank-node identities do not collide Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Turtle parser blank-node identities do not collide.** Each Turtle parse produces blank-node identities scoped to that parse, so unioning the results of independently parsed graphs introduces no blank-node identity collision. | Blank-node isolation tests covering the reproject path assert no identity collision when independently parsed graphs are unioned. | requirement | EG-TYPED-PACKS | VERIFIED | 481fa6ea2c55 90f5578ae2f4 a60419de4cf7 c764285d098c f17f47ab300f crates/eg-rdf/src/mapping/parsing.rs:172 src/server/handlers/admin/connector_pack/tests/outbox.rs:181 |
| EG-TYPED-PACKS-R093.1 Public Turtle parse identity locality Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Public Turtle parse identity locality.** Bounded and unbounded public Turtle parses allocate independent blank-node identities while retaining within-document references. Existing catalogue composition preserves explicit source labels before applying its own namespace. | Bound native parser tests union repeated labels from independent parses, include anonymous nodes, verify repeated references, and retain bounded refusal behavior. | requirement | EG-TYPED-PACKS | VERIFIED | a60419de4cf7 crates/eg-rdf/src/mapping/parsing.rs:172 |
| EG-TYPED-PACKS-R093.2 Reproject-path blank-node isolation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Reproject-path blank-node isolation.** Verify independently parsed connector-pack members through the served reproject path, preserving deterministic catalogue identity and eliminating cross-member blank-node collisions. | Execute a served reproject regression that unions reused member labels and verifies isolated identities and repeatable composed digests. | requirement | EG-TYPED-PACKS | VERIFIED | 481fa6ea2c55 c764285d098c src/server/handlers/admin/connector_pack/tests/outbox.rs:181 |
| EG-TYPED-PACKS-R094 AgentComponent.content serves pack body bytes directly Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**AgentComponent.content serves pack body bytes directly.** Rollup: every child below is required; the original acceptance remains mandatory. AgentComponent.content returns verified body bytes for a Stable, Python-visible method rather than a METHOD_NOT_YET_SERVED refusal once pack-body content serving is implemented. Because the reachability gate only permits a refusal-only arm for an Internal or no-consumer method, this method's compliance is not mechanically enforced and must be verified directly. | An integration test calls AgentComponent.content on the Stable method and asserts it returns verified body bytes rather than METHOD_NOT_YET_SERVED. | requirement | EG-TYPED-PACKS | SPECIFIED | 90f5578ae2f4 a1bb9fb9503e |
| EG-TYPED-PACKS-R094.1 Original Stable content route Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Original Stable content route.** Model: The existing Python-visible AgentComponent.Content method remains Stable. Behavior: Return verified pack body bytes through the real method. Wiring: Exercise `src/server/handlers/admin/component_content.rs:55` from authenticated public dispatch. Refusal: METHOD_NOT_YET_SERVED is not a successful result for this method. Evidence: A generated Python client reads exact verified pack body bytes. | Proposed test: `tests/test_connector_pack_content.py::test_stable_content_returns_body`. A generated Python client reads exact verified pack body bytes. A refusal-only dispatch arm fails this acceptance. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R094.2 Pinned native blueprint export Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Pinned native blueprint export.** Model: The export envelope carries identity, exact revision, schema, complete payload, provenance and body digest. Behavior: Read one pinned version and export every admitted field without a second prompt authority. Wiring: Extend `src/server/handlers/admin/agent.rs:142` and reuse the verified content reader. Refusal: Mixed-revision reads, unresolved pins and denied scope refuse. Evidence: Export preserves nested extension values, nulls, arrays and exact numeric values. | Proposed test: `tests/test_prompt_blueprints_served.py::test_lossless_blueprint_export`. Export preserves nested extension values, nulls, arrays and exact numeric values. An omitted field, changed revision or lost numeric precision fails. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R094.3 Modified native blueprint import Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Modified native blueprint import.** Model: A modified envelope names the same component identity and exact expected base revision. Behavior: Validate and persist a new revision through R002.7 after the existing publication policy admits it. Wiring: Extend `src/server/handlers/admin/agent.rs:142` and `src/server/persistence/agent_component/write.rs:39`. Refusal: Stale bases, malformed envelopes, changed identity and denied tenants refuse without mutation. Evidence: Changing one field creates one new revision and preserves every other field. | Proposed test: `tests/test_prompt_blueprints_served.py::test_modified_blueprint_import`. Changing one field creates one new revision and preserves every other field. Concurrent writers cannot overwrite a newer head; reserved pack identities require pack admission. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R094.4 Blueprint retry identity Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Blueprint retry identity.** Model: The operation identity binds tenant, component, base revision and submitted content digest. Behavior: A lost-reply retry returns the same receipt; unchanged content follows the existing no-op contract. Wiring: Reuse `src/server/persistence/agent_component/write.rs:39` and existing owner replay. Refusal: Reusing the operation identity with different content refuses. Evidence: Replay produces no extra revision, holder or outbox event. | Proposed test: `tests/test_prompt_blueprints_served.py::test_blueprint_retry_identity`. Replay produces no extra revision, holder or outbox event. A conflicting retry preserves the prior committed result. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R094.5 Served lossless round trip Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Served lossless round trip.** Model: The fixture includes nested values, extensions, nulls, Unicode and exact numbers. Behavior: Export, modify, reimport, restart and independently read the native blueprint. Wiring: Exercise the generated public operations through `src/server/handlers/admin/agent.rs:142` and verified content serving. Refusal: Any field loss, silent schema migration or unauthorized mutation fails. Evidence: The new revision contains the one intended change and all unchanged values. | Proposed test: `tests/test_prompt_blueprints_served.py::test_blueprint_roundtrip_restart`. The new revision contains the one intended change and all unchanged values. Stale import and denied-tenant cases preserve both historical and current readback. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R094.6 Optimization proposals carry no authority Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Optimization proposals carry no authority.** Model: A proposal pins the source revision, proposed payload digest and comparison evidence. Behavior: Store or export a proposal without treating it as publication authority or a repository write grant. Wiring: Extend `crates/eg-types/src/agent_component.rs`; consume existing policy admission in `src/server/handlers/admin/agent.rs:142`. Refusal: A proposal cannot supply its own approval, actor scope or permission. Evidence: Authorized graph adoption uses the normal publication boundary and records the source revision. | Proposed test: `tests/test_prompt_blueprints_served.py::test_prompt_proposal_has_no_authority`. Authorized graph adoption uses the normal publication boundary and records the source revision. A proposal alone causes no active-head change, model dispatch or external write. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R094.7 Approved repository-source effect dependency Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Approved repository-source effect dependency.** Model: The external effect binds repository, path, base revision, payload digest, approved actor and receipt. Behavior: Retain SDK execution and GraphOS authorization as prerequisites; never implement a filesystem writer inside EG. Wiring: R094.2 supplies the export. Consume SDK-GOVERNED-WRITEBACK-R004.5 through R004.12 and ARBORA-FLEET-R003.4 through R003.10; plan.md pins both merged definitions. Refusal: Missing approval, stale source base, path escape and unbound receipts prevent an external effect. Evidence: A real authorized producer journey writes only the approved source and returns a bound receipt. | Proposed test: `tests/test_prompt_blueprints_served.py::test_approved_source_effect_dependency`. A real authorized producer journey writes only the approved source and returns a bound receipt. Absent producers leave this acceptance unfulfilled; graph persistence cannot substitute. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R095 GraphSchema attach exposes snapshot staleness Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**GraphSchema attach exposes snapshot staleness.** Attaching a graph schema to another graph produces a snapshot, and the schema's staleness relative to its source is visible to readers rather than silently assumed current. | A contract test attaches a graph schema, mutates the source, and asserts the staleness indicator reflects the divergence. | requirement | EG-TYPED-PACKS | LANDED | 90f5578ae2f4 f4744679fab0 |
| EG-TYPED-PACKS-R096 Connector-pack reprojection with bounded, isolated aggregates Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Connector-pack reprojection with bounded, isolated aggregates.** handlers/admin/connector_pack/reproject.rs and the persistence/connector_pack, persistence/connector_pack/commit, and persistence/connector_pack/projection modules reproject a connector pack's committed head with bounded per-document aggregates and blank-node isolation across reprojected documents, and a reprojection survives a restart without losing a prior commit or looping. | Restart-replay and no-loop tests covering the reproject and persistence modules assert bounded aggregation, blank-node isolation, and idempotent recovery after restart. | requirement | EG-TYPED-PACKS | LANDED | 90f5578ae2f4 d76ac1402723 |
| EG-TYPED-PACKS-R097 Domain vocabularies ship as typed domain packs Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Domain vocabularies ship as typed domain packs.** Human-resources, legal, medical and government domain vocabularies — classes, enumerations, properties and their alignment to upper ontologies — are published as typed, versioned domain packs through the pack import boundary, so any agent or connector reads one governed definition from the engine instead of carrying its own model classes. Agent Utilities' `domains/hr`, `domains/law`, `domains/medical`, `domains/government` and `models/domains` modules are the source material and are deleted there once the packs are published and their callers read the packs. Rollup: delivered by its child requirements, one per domain plus the cutover. | Pack validation and import tests pass for each domain pack, a round-trip test shows the published classes and enumerations match the source declarations, and a caller census shows no remaining import of the retired model modules. | requirement | EG-TYPED-PACKS | SPECIFIED | 6a1a0e46d99f 90f5578ae2f4 |
| EG-TYPED-PACKS-R097.1 HR domain vocabulary ships as a typed domain pack Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**HR domain vocabulary ships as a typed domain pack.** The human-resources domain vocabulary — classes, enumerations, properties and alignment to an upper ontology — is modeled as one typed, versioned `DomainPack`, drawn from `crates/eg-core/ontology/hr-v1.ttl`. The pack validates its own internal consistency (no empty, duplicate or dangling-reference declarations) before any later wiring through the pack import boundary. | A validation test proves a well-formed HR pack passes and each malformed case (no classes, duplicate class, dangling property domain) is refused, and a round-trip test shows the published classes and enumerations match the source declarations. | requirement | EG-TYPED-PACKS | LANDED | 6a1a0e46d99f |
| EG-TYPED-PACKS-R097.2 Domain crosswalks and exact unmapped-class reports (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Domain crosswalks and exact unmapped-class reports (rollup).** Extend R097 with medical, technology and labor crosswalks to SKOS and Schema.org. Reuse R071.1 records and keep ontology authority inside EG. Children `.1` through `.6` define this contract. | All six children require served acceptance. Domain model validation alone does not close this rollup. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R097.2.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Extend `DomainPack` with versioned crosswalks and `CrosswalkCoverage{declared,mapped,unmapped,source_digest}`. Each unmapped item carries its class IRI and `NoDeclaredMapping` reason. Add `Technology` to `DomainPackKind`; labor uses existing `Hr`, and medical uses existing `Medical`. Preserve the existing HR model and its validation. | Round-trip the three domain fixtures. Unknown domain kinds and coverage entries outside the declared class set refuse. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R097.2.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Compute coverage over every class declared by the selected pack revision. A class is mapped only when it has a validated declared crosswalk. Return the exact sorted set difference as unmapped classes. Missing mappings never infer equivalence or import external authority. Reuse R071.1 bounds and typed vocabulary generation. | Medical, software/technology and HR/labor fixtures each include mapped and unmapped classes. Reordering input preserves coverage and generated bytes. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R097.2.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Extend `validate_and_commit` in `src/server/handlers/admin/connector_pack/import.rs:45` before publishing a pack head. Its production caller is `serve_import` in `src/server/handlers/admin/connector_pack.rs:132`. Validate crosswalks again at `src/server/graph_schema.rs::apply_pack_source` before activating schema. Extend the existing served `OntologyInspect` result with revision-bound coverage. The domain-to-import crosswalk path does not exist today; this row creates the call site. | A signed domain pack reaches import, schema attachment and inspection. Reports must match the imported revision, not a separate helper fixture. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R097.2.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** Missing mappings produce explicit unmapped results and never count as full coverage. Invalid mappings use R071.1 typed refusals and block pack publication or schema activation. Source resolution uses the selected pack revision, not the global class catalog. Unknown or out-of-scope sources never become unmapped entries. Reject stale vocabulary revisions and caller-forged origin or coverage with `CROSSWALK_REVISION_MISMATCH` or `CROSSWALK_EVIDENCE_INVALID`. | Refused imports preserve pack heads, receipts and active schema digests. An unmapped class stays declared and appears once in coverage. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R097.2.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Bind coverage to tenant, graph, pack digest, pack revision, target vocabulary revision and committed schema digest. Return exact mapped and unmapped class sets with reasons and declared totals. Source connectors only supply candidate data; EG validates and records authority. | Independent pack-status and schema reads agree with coverage. A caller cannot substitute a report from another tenant or revision. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R097.2.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** Entry point: authenticated `ConnectorPack.Import`, schema attachment, `OntologyInspect` and `GraphSchemaClasses` through the generated client. `tests/test_ontology_crosswalk_served.py::test_domain_coverage_and_refusals` loads medical, technology and labor fixtures. It exercises unmapped results, unknown and out-of-scope source classes, conflicting mappings, stale revisions, category violations and restart readback. | The real server returns exact coverage and declared mappings. Independent reads prove rejected imports cannot change committed state. No helper-only result establishes acceptance. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R098 Ontology inspection method and inline data triples for validation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Ontology inspection method and inline data triples for validation.** The engine serves a read-only OntologyInspect method that parses caller-supplied or composed schema sources and returns a typed inspection report of the classes, properties and shapes they declare, and ShaclValidate accepts data triples supplied inline in the request so a caller can validate triples it holds without first writing them to a graph. Both are part of the generated wire contract and available from the Python client. | Handler tests cover inline, composed and source-filtered inspection and a malformed-source refusal; a validation test proves inline data triples are validated without any graph write; the read-classification partition test includes the new method; a Python client test calls both through the generated sender. | requirement | EG-TYPED-PACKS | LANDED | 90f5578ae2f4 cc6536f05e17 |
| EG-TYPED-PACKS-R099 Best-matching prototype by cosine similarity in the numeric kernel Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Best-matching prototype by cosine similarity in the numeric kernel.** The in-process numeric extension exposes best_cosine_prototype(query, prototypes), returning nothing when no prototype has a strictly positive cosine with the query and otherwise the index of the first prototype with the maximum positive cosine together with that score. Empty and zero vectors yield no match, a prototype whose length differs from the query is refused with a shape error unless it is all zero, non-finite inputs follow the numeric kernel's existing policy, and the binding enforces the kernel's aggregate input bounds. It is an in-process function, not an engine wire method. | Rust unit tests cover first-wins positive maximum, empty, zero and negative cases and ragged shapes; installed-binding Python tests cover the same behaviours, the aggregate input limits and the call shape used by the downstream semantic client. | requirement | EG-TYPED-PACKS | VERIFIED | 157b4417eb24 3fe75684934d 90f5578ae2f4 crates/eg-numeric/src/prototype.rs:45 crates/eg-numeric/src/prototype.rs:60 crates/eg-numeric/src/prototype.rs:70 |
| EG-TYPED-PACKS-R100 Skill packages are rendered on demand from graph content (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Skill packages are rendered on demand from graph content (rollup).** The engine renders a skill package from the content and ontology references held in the graph, so the package tracks the latest ingest. Children .1-.6. | Rollup closes when children .1-.6 are verified. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `RenderedSkillPackage` in new file `crates/eg-types/src/fleet_catalog/rendered.rs`. It carries the skill uri, the content digest, the ontology references used and the graph revision it was rendered from. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::rendered_package_round_trip`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Add `render_skill_package(entry, graph) -> RenderedSkillPackage` in `src/server/dispatch/consensus/fleet_catalog/rendered.rs`. Each rule is a named, replaceable default: include the skill body, the ontology terms it references, and the code delta since the last render. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::render_reflects_latest_ingest`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Call `render_skill_package` from `skill_row` at `src/server/dispatch/consensus/fleet_catalog/project.rs:271`. The fleet catalog listing calls `skill_row` for every skill in production. The package is rendered on read and never cached. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::catalog_listing_renders_current_content`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** `render_skill_package` must return the typed refusal `RenderRefusal::DanglingOntologyRef` when a referenced term is absent from the graph. The row must stay listed without a package. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::dangling_reference_is_refused`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each rendered package must carry the graph revision and the content digest. A reader tells whether two renders came from the same revision. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::render_carries_revision_and_digest`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** Entry point: the fleet catalog list wire method. The test ingests a skill, lists it, changes the referenced code, ingests again and lists again. It must observe a new digest and revision on the second listing. Owner: epistemic-graph. | `crates/eg-capabilities/tests/skill_package_regeneration.rs::list_after_reingest_returns_new_digest`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.7 Exact rendered-package validation gate Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Exact rendered-package validation gate.** Extend the existing `render_skill_package`/fleet-catalog `skill_row` path: before a rendered candidate is exposed as publishable, bind a `RecordedRunValidationV1` to `{tenant_id, skill_iri, candidate_revision, package_content_digest, graph_revision, validation_policy_ref:{policy_iri, policy_revision}, run_set_complete, run_set_digest, run_refs:[{run_ref, package_content_digest, graph_revision, policy_revision, outcome, evidence_digest}], verdict, evaluator_ref}`. `run_refs` are unique and sorted by `run_ref`; `run_set_digest` hashes their canonical encoding. Every run must attest the same package digest/graph revision and policy revision; `run_set_complete` must be true. A missing, failed, stale, cross-tenant, partial, or mismatched receipt returns a typed refusal and no publishable package; preserve R100 dangling-reference behavior and do not duplicate the existing rendered package revision/digest. `skill_row` remains the existing projection/attach point; AU `record_outcome`/`SkillGraphPipeline` is the candidate source, while EG checks receipt binding. Preserve `AU-HARNESS-R022.2/.5/.6`, `AU-HARNESS-R004.1`, and `EG-TYPED-PACKS-R100.1/.5/.6`. Owner source hash: `96ff38761f9e21d52f608ba593c902aff4c93ca7b1ed13088ad39efd3e968a3a`. **Hold:** those AU rows do not define a recorded-run validation operation, exact receipt producer/fields, or the policy's pass criterion/run-set selection. AU must publish that producer contract before a positive publication path can be closed; absent receipt already refuses. This row remains SPECIFIED. | Planned acceptance: an exact-package passing receipt admits the catalog candidate; absent receipt and each digest/revision/policy/tenant mismatch, partial run set, or failing verdict suppresses the package with a typed refusal. Verify R100.4 dangling ontology behavior remains. The positive AU producer journey is held until its exact owner operation and validation rubric are defined; no runtime or served receipt is claimed. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R097.2.7 Directional external-schema import and complete unmapped-term report Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Directional external-schema import and complete unmapped-term report.** Extend `ConnectorPack.Import::validate_and_commit` before pack-head commit and `apply_pack_source` before schema activation for the external-to-platform direction. A pinned `ExternalTermMappingV1` binds `{source_schema_digest, source_revision, external_iri, external_kind, platform_iri, platform_kind, mapping_revision}`. The closed supported source kinds are `Class`, `ObjectProperty`, `DatatypeProperty`, `AnnotationProperty`, and `NamedIndividual`; an enumeration is represented by its class plus named individuals. The importer identity is server-stamped from the authorized `ConnectorPack.Import` request; only a declared mapping with kind-compatible platform target is adopted, and it preserves the original external IRI/kind as provenance. `ExternalOntologyCoverageV1` is `{source_schema_digest, source_revision, pack_revision, schema_revision, mapping_revision, platform_vocabulary_revision, terms, coverage_digest}`; `terms` are sorted `{external_iri, kind, result: Mapped{platform_iri, provenance_digest} | Unmapped{reason: NoDeclaredMapping}}` for every declared term; unmapped terms are reported and not added as platform terms, while a pack with partial coverage may still commit under existing R097.2 rules. Refuse malformed/duplicate terms, incompatible mappings, unknown kinds, forged or stale revisions, and mappings outside the pinned source schema before mutation. Serve full per-term coverage from existing `OntologyInspect`; independently read `GraphSchemaClasses` to verify adopted classes and that unmapped classes were not activated. This is directional ingestion; R071.1's EG-class-to-external-vocabulary links do not imply reverse normalization and remain unchanged. Preserve `EG-TYPED-PACKS-R051`, `EG-UNIFIED-DATA-PLANE-R005/R037`, `EG-TYPED-PACKS-R071.1.1-.6`, and `EG-TYPED-PACKS-R097.2.1-.6`. Owner source hash: `318723aee15c476039eca669a3230b206532c0c704b37efad5a7c49690bbb9c2`. This remains SPECIFIED. | Planned acceptance: import a pinned schema with mapped and unmapped instances of every supported kind; independently inspect the committed revision and verify exact sorted coverage, mapped target and source provenance, with unmapped terms absent from active schema. Refuse unsupported kind, duplicate IRI, kind mismatch, stale map/schema, out-of-scope source and forged report with no change to pack head or active schema. Reordered inputs produce identical coverage and digest. No runtime or served result is claimed. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.8 Lossless versioned workflow RDF export/import Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Lossless versioned workflow RDF export/import.** Define `WorkflowRdfDocumentV1` as `{workflow_iri, skill_iri, workflow_revision, workflow_version, stored_version_ref, graph_revision, ontology_revision, canonical_nquads, dataset_digest, serializer_id, serializer_version}` and expose `ExportWorkflowRdfV1(workflow_iri, requested_workflow_version, stored_version_ref) -> WorkflowRdfDocumentV1` plus `ImportWorkflowRdfV1(document) -> WorkflowImportReceiptV1{workflow_iri, committed_workflow_revision, graph_revision, dataset_digest, importer_id}` in the existing skill-package owner. Export serializes every workflow statement, named-graph identity, literal datatype/language and referenced ontology IRI as canonical N-Quads using the document-pinned serializer; `dataset_digest` is SHA-256 of those canonical UTF-8 bytes. Import validates that digest and graph isomorphism, then restores the exported dataset without dropping unknown workflow predicates. Attach the export to the existing R100 skill rendering/catalog path; import is admitted through the existing graph write boundary and returns the committed workflow revision. An export-time version check must refuse when the exported workflow version is not strictly newer than the stored workflow version. Preserve `EG-TYPED-PACKS-R051/R090/R100.1-.6`. Owner source hash: `620b1ae05d8e35696c7522f207672ef6f374525004d5488fe62fb4b27fc6cf5a`. **Hold:** reviewed evidence does not identify which persisted workflow/version record is the comparison baseline, the version ordering grammar, or the existing R100 consumer operation that imports these documents. Keep the export-time comparison requirement; do not move it to import. The row remains SPECIFIED pending that owner decision and exact attach-point link. | Planned acceptance: round-trip a workflow containing named graphs, typed and language-tagged literals, ontology references and an unknown workflow predicate; compare canonical dataset digest and graph isomorphism. Tampered digest, malformed RDF, unresolved references and unsupported serializer version refuse without graph mutation. At export, equal/older versions refuse and newer passes once the stored-version baseline/order is resolved. The version-baseline/consumer-link cases remain held; no implementation or receipt is claimed. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R069.100 Semantic fingerprint separates cosmetic from structural repository changes Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Semantic fingerprint separates cosmetic from structural repository changes.** Define `FingerprintIdentityV1` as repository id, branch/ref id, normalized path, commit/source revision, blob/raw digest, language id, parser implementation/version, normalization-policy revision and grammar digest. The versioned profile registry lists each supported language and trivia/comment forms removed from its canonical token stream; strings, literals, token order and all non-trivia tokens are preserved. Hash canonical tokens together with language/parser/profile versions. Unsupported languages use raw-content digest and are never classified as cosmetic. A full no-op is allowed only when the complete identity and profile revision match an already committed binding. Same bytes at a new branch, path or source revision are a new binding and must update source revision/provenance; parsed tokens may be reused only if language/parser/profile identity matches. Parser/profile revision changes force reparse and recompute before deciding graph mutation; always persist the new source binding even when semantics are unchanged. SDK transports raw revision/digest only; EG owns semantic classification. Producer/consumer boundary: RepositorySnapshotProvider -> SDK transport -> generated `IndexRepository` -> EG parser/index mutation; R079 embedding dedupe is not structural-mutation suppression. Preserve existing parent obligations `EG-TYPED-PACKS-R069`, `EG-REPO-INGEST-R006`, `SDK-SOURCE-INGEST-R004`. Source record AU:69 SHA-256 `8ca81dc16448fefc73440f2eb9ea07b2e433f7e38075563f86800071029846e9`; parent R069 remains unchanged. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_repository_fingerprint_identity_served.py::test_source_identity_profile_drives_mutation_decision`, `tests/typed_packs/test_repository_fingerprint_identity_served.py::test_unsupported_language_uses_raw_digest_only`. | Planned served acceptance: Same full identity/profile is idempotent. Same blob at a new branch or path creates the new source binding and provenance while reusing parse output only under identical parser/profile. A changed parser/profile reparses and re-fingerprints even when raw bytes match. Cosmetic-only change updates source revision/provenance without semantic graph mutation; structural change mutates semantic graph. Planned tests separately assert source-binding and semantic-graph revisions for each case; no implementation or runtime receipt is claimed. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.100 Lossless SKILL.md frontmatter and step editing round trip Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Lossless SKILL.md frontmatter and step editing round trip.** Define an edit representation bound to the original SKILL.md byte digest, source revision, frontmatter field spans, step spans, line endings and unknown/custom-field spans. Apply edits as bounded source-range patches; do not parse and reserialize the entire document. Preserve all untouched bytes, ordering, spacing, comments, line endings and unknown frontmatter fields; emit new content digest and source provenance. Continue to enforce R019 SKILL.md-only import and R029 restricted YAML validation. Producer/consumer boundary: EG owns skill parse/admission and R100 rendering; SDK owns source transport/edit write-back edge. No prompt blueprint or whole-document normalization path is substituted. Preserve existing parent obligations: `EG-TYPED-PACKS-R019; R029; R100.1-.6; SDK source-ingestion owner`. Source record `AU:90` SHA-256 `1b717c4a284896dbf8c7b4fb1f00ebba80fa6a75e930a020c5bc01706634f582`; parent `R100` remains unchanged. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_skill_lossless_edit_served.py::test_frontmatter_and_step_edits_preserve_unmodified_bytes`, `tests/typed_packs/test_skill_lossless_edit_served.py::test_stale_or_ambiguous_edit_refuses_before_write`. | Planned served acceptance: Served export/edit/reimport test changes one frontmatter value and one step while asserting all non-target byte ranges, custom fields, comments, spacing, ordering and CRLF/LF style are identical. Malformed anchors, overlapping patches, stale source digest and unknown edit spans refuse without write. Prompt-blueprint JSON roundtrip is not accepted as evidence. Owner-source review only; no runtime/test receipt is inferred. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R100.101 Skill consumer compatibility and declared-migration admission Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Skill consumer compatibility and declared-migration admission.** Define an admission record bound to prior/new skill content digests, consumer-declared input/output behavior contract revisions, observed consumer cohort, compatibility verdict, migration id/digest and admission revision. Compatibility is checked against consuming-code behavior, not package version equality, contract-pin equality, endpoint certification or dependency digest alone. A breaking change is refused before publication/invocation unless a declared migration is bound to the exact old/new digests and consumer contract and its migration receipt passes. Producer/consumer boundary: EG skill package read/admission -> GraphOS invoke certification and consumer code; GraphOS owns its invocation gate. Do not equate existing version/dependency pins with compatibility. Preserve existing parent obligations: `EG-TYPED-PACKS-R100.1-.6; ARBORA-FLEET-R034.7-.10`. Source record `AU:98` SHA-256 `531cb0ba1accd9e88833249fb253a9f5f7a3c1a911f653b3c9a5bfc42341f978`; parent `R100` remains unchanged. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_skill_compatibility_admission_served.py::test_breaking_upgrade_requires_exact_consumer_migration`, `tests/typed_packs/test_skill_compatibility_admission_served.py::test_changed_consumer_contract_invalidates_admission`. | Planned served acceptance: Serve compatible upgrade, breaking upgrade without migration (refused before effects), and breaking upgrade with exact declared migration. Changing a consumer contract, package digest or migration receipt invalidates admission. Keep historical package readable and read back the admitted new version only after validation. Owner-source review only; no runtime/test receipt is inferred. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R001.100 Versioned nested prompt/tool schemas with incremental compatibility Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Versioned nested prompt/tool schemas with incremental compatibility.** Extend existing ConnectorPack prompt and tool definition entries with explicit schema version, nested field schema, required/optional status and compatibility revision. Incremental evolution records base digest, changed paths and compatibility verdict; additive optional fields may be admitted only when consumer policy says compatible, while removed/changed required fields refuse before publication. Pack index/entry digest rules remain canonical. SDK owns tool execution/schema compatibility authority; EG records and serves the versioned declaration and does not authorize SDK calls. Producer/consumer boundary: EG ConnectorPack typed authority -> generated public pack APIs; SDK retains tool compatibility and execution authority. Preserve R001 index/entry/section/annotation and digest contract. Preserve existing parent obligations: `EG-TYPED-PACKS-R001.1-.5; SDK-CONNECTOR-CONTROL-R003; ARBORA-FLEET-R002.3-.6`. Source record `AU:52` SHA-256 `e03b25156a4f84d27c4afba63d0cd9e526b549b5905994a53664d193416d048c`; parent `R001` remains unchanged. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_connector_nested_schema_served.py::test_nested_schema_evolution_preserves_digest`, `tests/typed_packs/test_connector_nested_schema_served.py::test_incompatible_nested_schema_refuses_before_dispatch`. | Planned served acceptance: Round-trip nested schemas and version metadata through generated clients and canonical digest vectors. Test additive optional-field evolution, required-field removal, incompatible type change, stale base digest and unknown nested fields. Verify SDK authority remains separate and no tool dispatch occurs from pack admission. Owner-source review only; no runtime/test receipt is inferred. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R072.100 Workflow registration and invocation through typed registry Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Workflow registration and invocation through typed registry.** Extend the typed fleet catalog with workflow registration identity, version/content digest, owner/tenant scope, schema and lifecycle state. Registration is persisted through the existing SourceIngest authority; invocation resolves by registry id and exact admitted revision rather than a caller-supplied body. Unknown, withdrawn, stale or unauthorized workflow ids refuse before execution. Engine/client initialization remains lazy at the AU first-use boundary and is not performed at registration or process startup. Producer/consumer boundary: EG typed registry and SourceIngest R002 own durable registration; AU owns lazy client initialization/execution; preserve ARBORA-HOST-R022 workflow-store semantics. Preserve existing parent obligations: `EG-TYPED-PACKS-R072; EG-REPO-INGEST-R002; AU-CONTROL-R037.5; ARBORA-HOST-R022`. Source record `AU:97` SHA-256 `f73767d1a3fdba29a702254ed1db2c9904158b6136f6f4b38a3c9a0d3e4fcb03`; parent `R072` remains unchanged. Owner prerequisite: AU-CONTROL-R037.5 only fills a requirement gap; it does not define lazy initialization timing, the first-use operation, or the execution receipt. No exact AU companion requirement ID is identified. Keep that consumer as an explicit hold until its owner publishes the operation and receipt; no invocation evidence is claimed. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_workflow_registry_served.py::test_registration_is_lazy_and_invokes_exact_revision`, `tests/typed_packs/test_workflow_registry_served.py::test_unknown_withdrawn_or_stale_registry_id_refuses`. | Planned served acceptance: Served registry tests register/read a workflow, prove no eager AU engine initialization, prove one initialization on first invocation, invoke by registry id, and refuse unknown/withdrawn/stale ids with no run. Read back registry and invocation receipt independently. Owner-source review only; no runtime/test receipt is inferred. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R071.100 Canonical shared hierarchical concept paths across repositories Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Canonical shared hierarchical concept paths across repositories.** Define one versioned concept-path grammar and canonicalization rule shared by EG vocabulary producers, with stable segment identity, parent path and canonical concept IRI. Admission resolves the entire path against the pinned vocabulary revision and checks repository-wide uniqueness plus parent/child consistency. Duplicate aliases, a path that contradicts an existing parent/child relationship, or two IRIs for the same canonical path refuse with the conflicting ids; existing published ontology IRIs remain unchanged and are crosswalked rather than rewritten. Producer/consumer boundary: EG vocabulary validation owns canonical identity; repository producers submit proposed paths. Preserve existing published IRIs and federated query vocabulary. Preserve existing parent obligations: `EG-TYPED-PACKS-R071 existing generated ontology corpus; EG-DATAPLAT-VOCAB-R001.1/.4; EG-FEDERATED-QUERY-R011`. Source record `EG:8` SHA-256 `525e39d1d194ac8a820bbd741a1c261ceab0c7d564981c33c731c06c1eb641d8`; parent `R071` remains unchanged. Owner decision hold: the canonical segment grammar is not approved for separators/escaping, Unicode normalization, case, or whitespace. Keep admission SPECIFIED until the vocabulary owner publishes one versioned grammar shared by producers; preserve existing published IRIs. Planned proving tests (names only; not present or executed evidence): `tests/typed_packs/test_concept_path_admission_served.py::test_owner_approved_path_grammar_is_shared`, `tests/typed_packs/test_concept_path_admission_served.py::test_duplicate_or_conflicting_paths_refuse_without_iri_changes`. | Planned served acceptance: Cross-repository fixtures admit a new unique path and refuse duplicate canonical path, alias collision, incompatible parent assignment and stale vocabulary revision. Read back canonical path and unchanged published IRIs; retain R071 generated ontology authority and R001.4 digest vectors. Owner-source review only; no runtime/test receipt is inferred. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R101 Ingest mappings come from the connector's declaration and the pack ontology (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Ingest mappings come from the connector's declaration and the pack ontology (rollup).** Source ingestion reads schema mappings from the pack's `connector://resources` entry. It reads relations from the pack ontology's object properties. Children `.1` and `.2` define the vocabulary and shapes. Children `.9` to `.11` deliver resolution, the tenant key and the refusals. Children `.3` to `.8` are retired. | Rollup closes when every live child passes its proving test. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R101.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add the core schema source `crates/eg-core/ontology/connector_pack-v1.ttl` under namespace `http://knuckles.team/kg/connector-pack#` (prefix `cp:`). It imports `virtual_graph-v1`. It declares `cp:IngestContract` as a subclass of `vg:MetadataContract`, and `cp:SourceObject` as a subclass of `vg:VirtualMapping`. It declares `cp:FieldMapping` as a subclass of `vg:PredicateFieldPair`. It also declares `cp:KeyRule`, `cp:CursorPolicy`, `cp:AccessPolicy`, `cp:PrivacyClass` and `cp:ProvenanceRequirement`. The properties are `cp:contractOf`, `cp:contractVersion`, `cp:contractDigest`, `cp:hasSourceObject`, `cp:hasKeyRule`, `cp:hasCursorPolicy`, `cp:cursorKind`, `cp:hasAccessPolicy`, `cp:defaultAcl`, `cp:aclField`, `cp:tenantField`, `cp:readRole`, `cp:privacyClass`, `cp:requiresProvenance` and `cp:governedBy`. `cp:governedBy` links an ingested node to its contract. The catalog `catalog-v1.ttl` and the CoreSpec registry list the new module. Owner: epistemic-graph. | `crates/eg-core/tests/connector_pack_vocabulary.rs::contract_terms_resolve_with_domain_and_range`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R101.2 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `crates/eg-core/ontology/connector_pack-v1.shapes.ttl` with one node shape per contract class. A contract must name exactly one connector, one version and one digest. Each source object must name exactly one ontology class and one key rule. Each field mapping must name one source field and one predicate of the composed schema. `cp:cursorKind` must be one of `opaque`, `timestamp`, `commit`, `offset` or `page_token`. `cp:defaultAcl` must be one of `quarantine`, `inherit` or `public`. `cp:privacyClass` must be one of `public`, `internal`, `personal` or `secret`. Each provenance requirement must name at least one required field. Owner: epistemic-graph. | `crates/eg-shacl/tests/connector_pack_shapes.rs::each_contract_shape_accepts_valid_and_refuses_invalid`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R101.9 One tenant key for pack heads Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**One tenant key for pack heads.** `SourceIngest` must resolve the connector pack under the same tenant key that `ConnectorPack.Import` and `ConnectorPack.Status` use. All three call `persistence::connector_pack::pack_tenant_key`, which returns the verified `tenant_id`. `SourceIngest` never uses the opaque carrier tenant scope of its graph route for a pack lookup. Proving test: `src/server/handlers/admin/connector_pack/tests/scale.rs::an_imported_pack_maps_source_ingest_records_of_the_same_tenant`. | A served test imports a pack whose `connector://resources` declaration holds a `schema_mappings` entry through `ConnectorPack.Import`. It then submits one record under that mapping through `SourceIngest`, which must accept it. | requirement | EG-TYPED-PACKS | VERIFIED | ba925ecbb9b6 c4a73f6d5a74 src/server/handlers/admin/connector_pack/tests/scale.rs:93 |
| EG-TYPED-PACKS-R101.10 Mappings come from the connector's declaration Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Mappings come from the connector's declaration.** A connector on agent-connector-sdk 0.4.2 or later serves its data sources and record-type mappings as JSON at `connector://resources`. The pack holds that body as the `resource` entry with that URI. The entry carries a content schema, as every resource entry must. Import decodes its `schema_mappings` (record type to ontology class and field map) with a closed JSON decoder. A body that is not a JSON object, or holds an unknown mapping key, is refused with `MALFORMED_BODY`. Import reads relations from the pack ontology's `owl:ObjectProperty` declarations. The `rdfs:domain` local name is the source resource. The property local name is the relation. The `rdfs:range` local name is the target. A property without one named domain and one named range declares no relation. `SourceIngest` resolves `connector:<connector>#mappings/<type>` against the declared mappings. It resolves `connector:<connector>#relations/<resource>/<relation>` against the ontology relations. The bare `connector:<connector>` form names a declaration with one mapping. The engine accepts no other scheme. The entry kind set has no manifest kind, and the engine reads no YAML. Owner: epistemic-graph. | `src/server/handlers/admin/connector_pack/tests/scale.rs::the_selector_resolves_to_the_declared_class_and_field_map`; `src/server/handlers/admin/connector_pack/tests/scale.rs::relations_resolve_from_the_pack_ontology`; `src/server/persistence/connector_pack/declaration.rs::refuses_a_malformed_or_open_mapping`. | requirement | EG-TYPED-PACKS | VERIFIED | 1441a36e7b30 81059c6ca5db crates/eg-rdf/src/pack/tests.rs:186 crates/eg-types/src/connector_pack/index.rs:140 src/server/handlers/admin/connector_pack/tests/scale.rs:140 src/server/handlers/admin/connector_pack/tests/scale.rs:203 src/server/persistence/connector_pack/declaration.rs:101 |
| EG-TYPED-PACKS-R101.11 Undeclared mappings are refused by type Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Undeclared mappings are refused by type.** `SourceIngest` refuses a mapping reference with `UNKNOWN_MAPPING_REFERENCE` when its scheme is not `connector:`. It refuses the same way when the declaration does not name its record type. A pack with no `connector://resources` entry is refused with `CONNECTOR_SCHEMA_MAPPING_UNAVAILABLE`. A refusal commits no record, cursor or checkpoint. Owner: epistemic-graph. | `src/server/handlers/admin/connector_pack/tests/scale.rs::an_undeclared_type_is_refused_with_a_typed_error`. | requirement | EG-TYPED-PACKS | VERIFIED | 81059c6ca5db src/server/handlers/admin/connector_pack/tests/scale.rs:153 |
| EG-TYPED-PACKS-R102 Connector surface and domain relationships are native graph relationships (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Connector surface and domain relationships are native graph relationships (rollup).** Each pack states its connector, features, tools, prompts and skills as triples. These triples link the surface to domain classes. The engine projects them beside the ingest contract of `EG-TYPED-PACKS-R101`. Children `.1` to `.7` deliver it. | Rollup closes when every child `.1` to `.7` passes its proving test. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R102.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Extend `connector_pack-v1.ttl` with `cp:Connector`, `cp:Feature`, `cp:Tool`, `cp:Prompt` and `cp:Skill`. The properties are `cp:providesFeature`, `cp:realizedBy`, `cp:hasContract`, `cp:operatesOn`, `cp:produces`, `cp:executes`, `cp:appliesTo`, `cp:providesCapability` and `cp:componentId`. `cp:executes` links a tool to the domain method class it runs. `cp:appliesTo` links a skill or prompt to a domain class. Extend the shapes file: each tool has one component id and at least one `cp:operatesOn` or `cp:providesCapability`. Each feature has at least one `cp:realizedBy` member. Owner: epistemic-graph. | `crates/eg-shacl/tests/connector_pack_shapes.rs::surface_shapes_accept_valid_and_refuse_invalid`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R102.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Projection must write one node per published tool, prompt, skill and server member of the pack head. Each node carries the declared surface triples from the contract entry. The engine stamps `cp:componentId` and the entry revision. A withdrawn member keeps its node with `cp:lifecycle "withdrawn"`. A later import restores it, as `EG-TYPED-PACKS-R014` states. The projection is native Rust and runs inside the existing outbox consumer. Owner: epistemic-graph. | `src/server/connector_pack_projection/surface_tests.rs::surface_nodes_follow_pack_head`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R102.3 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** A pack ontology entry may extend core classes with subclass and property axioms. Import must refuse an entry that redeclares a core class IRI with conflicting axioms. The refusal code is `ONTOLOGY_CORE_CONFLICT`. A pack ontology must reuse a core class by IRI and must not copy it. Owner: epistemic-graph. | `src/server/handlers/admin/connector_pack/import/contract_tests.rs::core_class_redeclaration_is_refused`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R102.4 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Surface projection attaches in `project` (`src/server/connector_pack_projection.rs:220`) through `project_head` (`src/server/handlers/admin/connector_pack/reproject.rs:72`). Reads use the SPARQL handler (`src/server/handlers/rdf/sparql.rs:30`). Capability designation consumes the surface through `EG-DECISION-ENGINE-R172.12`. Owner: epistemic-graph. | `src/server/connector_pack_projection/surface_tests.rs::outbox_consumer_writes_surface_nodes`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R102.5 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** Import must refuse a surface triple that names a component absent from the pack with `UNRESOLVED_REFERENCE`. It must refuse a domain class absent from the composed schema with `CONTRACT_SHACL_VIOLATION`. It must refuse a surface claim about another connector with `IMPORTER_MISMATCH`. No refusal changes the head or the graph. Owner: epistemic-graph. | `src/server/handlers/admin/connector_pack/import/contract_tests.rs::surface_refusals_leave_state_unchanged`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R102.6 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each surface node must carry the pack digest and entry revision. Each SPARQL answer over the pack graph must return the graph revision it read. Owner: epistemic-graph. | `src/server/connector_pack_projection/surface_tests.rs::surface_nodes_carry_pack_digest`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R102.7 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method. The test imports a two-tool pack whose tools operate on one domain class. A served SPARQL query for tools on that class must return both component ids. After a reimport that withdraws one tool, the query must return one active tool. Owner: epistemic-graph. | `tests/typed_packs/test_connector_surface_rdf_served.py::test_surface_query_follows_pack_head`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R103 Served runtime ontology import, revision and withdrawal (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Served runtime ontology import, revision and withdrawal (rollup).** A connector imports its domain ontology at runtime through one served method. The engine validates it with SHACL, scopes it to the tenant and keys it by content digest. It supports revision and withdrawal. Children `.1` to `.6` deliver it. | Rollup closes when every child `.1` to `.6` passes its proving test. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R103.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Extend `GraphSchemaOp` (`crates/eg-types/src/graph_schema.rs:47`) with `ImportOntology` and `WithdrawOntology`. `ImportOntology` carries connector, ontology IRI, version, ontology Turtle, optional shapes Turtle, content digest and expected prior revision. `WithdrawOntology` carries connector, ontology IRI and expected revision. Add `ontology:` to `RESERVED_SCHEMA_SOURCE_PREFIXES`. The source key is `ontology:<connector>/<ontology IRI>`. The result returns the revision, the content digest and the composed digest. Owner: epistemic-graph. | `crates/eg-types/src/graph_schema.rs::tests::ontology_import_ops_round_trip`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R103.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Import must parse with the bounded Turtle parser (R033) and validate with step-bounded SHACL against the composed schema (R035). It must commit one tenant-scoped graph schema source revision. A request with the same digest as the current revision must return that revision and write nothing. A new digest must create the next revision and keep earlier revisions readable. Withdrawal must detach the source as a whole (R057). The code is native Rust. Owner: epistemic-graph. | `src/server/graph_schema/ontology_import_tests.rs::import_is_idempotent_by_digest_and_revises`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R103.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** `handle_gateway` (`src/server/graph_schema.rs:191`) must match `ImportOntology` and `WithdrawOntology` beside `AttachPack`. The gateway route reaches it at `src/server/handlers/graph_ops/gateway_graph_routes.rs:656`. The generated contract and Python client must expose both operations. Owner: epistemic-graph. | `src/server/graph_schema/ontology_import_tests.rs::gateway_routes_ontology_import`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R103.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** Import must refuse malformed Turtle with `ONTOLOGY_INVALID` and a shape violation with `SHACL_VIOLATION`. It must refuse a digest that does not match the body with `ONTOLOGY_DIGEST_MISMATCH`. It must refuse a stale expected revision with `ONTOLOGY_REVISION_CONFLICT`. It must refuse a conflicting core class redeclaration with `ONTOLOGY_CORE_CONFLICT`. It must refuse a caller who is not the bound importer with `IMPORTER_MISMATCH`. It must refuse a cross-tenant write with `TENANT_DENIED`. No refusal changes the composed schema. Owner: epistemic-graph. | `src/server/graph_schema/ontology_import_tests.rs::ontology_import_refusals_leave_schema_unchanged`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R103.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each revision must record connector, ontology IRI, version, content digest, importer principal and composed digest. `GraphSchemaClasses` (R077) must report the classes each revision adds. A reader can tell which revision declared a class. Owner: epistemic-graph. | `src/server/graph_schema/ontology_import_tests.rs::revision_records_digest_importer_and_classes`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R103.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served `GraphSchema` method with `ImportOntology`. The test imports a domain ontology, repeats the import with the same digest, then imports a revision. A served SPARQL query must see the new class after the revision. After `WithdrawOntology`, the query must not see it. A second tenant must never see the ontology. Owner: epistemic-graph. | `tests/typed_packs/test_runtime_ontology_import_served.py::test_import_revise_withdraw_end_to_end`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R104 Connect-time seed graph import, idempotent by content digest (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Connect-time seed graph import, idempotent by content digest (rollup).** A connector serves a seed graph beside its ontology pack. The seed graph holds instance identity, the object catalog and reference or index triples. It holds no bulk data. The engine validates the seed graph with SHACL and stores native relationships. A repeated digest writes nothing. A changed part re-imports alone. Runtime ontology import is `EG-TYPED-PACKS-R103`. Contract triples are `EG-TYPED-PACKS-R101`. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R104.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `SeedGraphImport{connector, instance_iri, pack_digest, parts, content_digest}` and `SeedPart{key, turtle, digest}` in `crates/eg-types/src/connector_pack/seed_graph.rs`. `parts` is a `BTreeMap<SeedPartKey, SeedPart>`. Closed `SeedPartKey` values are `identity`, `catalog` and `references`. Add `crates/eg-core/ontology/connector_seed-v1.ttl` and its shapes file under prefix `seed:`. Proving test: `crates/eg-types/src/connector_pack/seed_graph.rs::tests::seed_import_round_trips`. | A serde round trip keeps every field and rejects an unknown part key. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R104.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Import parses each part with the bounded Turtle parser of `EG-TYPED-PACKS-R033`. It validates each part against the composed schema with step-bounded SHACL. The part digest is SHA-256 over canonical N-Quads. An equal `content_digest` returns `unchanged`. A changed part replaces only its own triples in one commit. The limit is 50,000 triples and 8 MiB per seed graph. Engine time must stay under 200 ms per 10,000 triples. Proving test: `src/server/handlers/admin/connector_pack/seed_tests.rs::changed_part_reimports_alone`. | A second import with one changed part replaces that part and leaves the other two byte-identical. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R104.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** The seed body enters `run_import` at `src/server/handlers/admin/connector_pack/import.rs:63` beside the pack head. Projection commits through `project_head` at `src/server/handlers/admin/connector_pack/reproject.rs:72`. No production caller imports a seed graph today. Proving test: `src/server/handlers/admin/connector_pack/seed_tests.rs::served_import_projects_seed`. | A served import with a seed body reaches `project_head` and writes the seed triples. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R104.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** Import must refuse a seed graph over the limit with `SEED_TOO_LARGE`. It must refuse a predicate outside the identity, catalog and reference shapes with `SEED_BULK_DATA`. It must refuse a shape violation with `SEED_SHACL_VIOLATION` and name the focus node. It must refuse a wrong digest with `SEED_DIGEST_MISMATCH`. A refusal writes nothing. Proving test: `src/server/handlers/admin/connector_pack/seed_tests.rs::seed_refusals_write_nothing`. | Each case returns its code and the graph revision stays unchanged. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R104.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** `SeedImportReceipt` must carry connector, content digest, one outcome per part and the graph revision. Closed outcome values are `inserted`, `replaced` and `unchanged`. Each seed subject carries `seed:fromSeed` to its seed revision node. Proving test: `src/server/handlers/admin/connector_pack/seed_tests.rs::receipt_names_part_outcomes`. | A served SPARQL read finds the receipt and the `seed:fromSeed` link of one catalog object. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R104.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method with a seed body. The test imports a seed graph and repeats the same digest. It then changes the catalog part. A served SPARQL query must read the new catalog objects. Proving test: `tests/connector_pack/test_seed_graph_served.py::test_seed_idempotent_and_partial_reimport`. | The repeat returns `unchanged`, the change replaces only `catalog`, and the query sees the new objects. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R105 A connector ontology joins the parent graph on import Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**A connector ontology joins the parent graph on import.** This applies to ConnectorPack import and to `ImportOntology` of `EG-TYPED-PACKS-R103`. The engine must resolve each `ontology-import:<iri>` requirement against the parent catalog `http://knuckles.team/kg`. It must resolve each `owl:imports` the same way. It must record the import edge in the tenant schema. It must record each `rdfs:subClassOf` edge from a connector class to a parent class. A class query over a parent class then returns the connector subclasses. An orphan ontology imports no parent IRI. An orphan also includes a declared class with no subclass path to a parent class. The engine must refuse an orphan with `ONTOLOGY_ORPHAN`. The refusal names each unlinked class. A request marked `standalone` is admitted and flagged instead. `GraphSchemaClasses` of `EG-TYPED-PACKS-R077` reports the flag per class. The pack keeps its components under the fleet name of the connector. | A served test imports a linked connector ontology. It reads the connector class through a parent-class query. It imports an orphan and receives `ONTOLOGY_ORPHAN` with the unlinked classes. It imports the orphan as `standalone`. It reads the flag from `GraphSchemaClasses`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R105.1 Stage one: record the parent link and flag orphans Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Stage one: record the parent link and flag orphans.** ConnectorPack import resolves an `ontology-import:` requirement that names the parent catalog `http://knuckles.team/kg` or one of its modules. It reports no unresolved claim for it. A pack ontology may also `owl:imports` the parent catalog directly. The attached ontology keeps its `rdfs:subClassOf` edges in the composed tenant schema. The engine computes each declared class with no subclass path to a parent-catalog class. The `EPISTEMIC_GRAPH_ONTOLOGY_ORPHANS` switch selects `warn` or `refuse`, and `warn` is the default. Under `warn` the pack imports and the receipt carries one `ONTOLOGY_ORPHAN` warning that names the unlinked classes. Under `refuse` the import is rejected with `ONTOLOGY_ORPHAN`. | Unit tests cover the parent import policy, the orphan computation and the requirement resolution. A served import of a pack whose classes subclass a parent class carries no orphan warning. A served import with an orphan class imports and names that class in `ONTOLOGY_ORPHAN`. | requirement | EG-TYPED-PACKS | VERIFIED | 8e2634dd4ee7 crates/eg-rdf/src/pack/tests.rs:143 crates/eg-rdf/src/pack/tests.rs:158 src/server/handlers/admin/connector_pack/import/annotations.rs:232 src/server/handlers/admin/connector_pack/tests/ontology.rs:154 src/server/handlers/admin/connector_pack/tests/ontology.rs:161 |
| EG-TYPED-PACKS-R105.2 Stage two: the import edge, parent-class reads and enforcement Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Stage two: the import edge, parent-class reads and enforcement.** The engine records the resolved import as an `owl:imports` edge in the tenant schema. It does so even when the pack builder lifted the import into a requirement. A class query over a parent class returns the connector subclasses. `GraphSchemaClasses` reports the orphan flag per class, and a `standalone` request is admitted and flagged. When the fleet's connector vocabularies are linked, the default switches to `refuse`. | A served test reads a connector class through a parent-class query and reads the flag from `GraphSchemaClasses`. A served test confirms that the `refuse` default rejects an orphan and admits it as `standalone`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R105.3 The parent catalog declares the recurring connector concepts Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The parent catalog declares the recurring connector concepts.** A review of the connector fleet found 209 class roots with no fitting parent class. The parent catalog declares one vendor-neutral class for each recurring concept. Each class sits under an existing upper class. Each class has a label, a comment and `skos:altLabel` aliases taken from connector class names. `core-foundation-v1.ttl` declares `Collection` (under `bfo:0000031`), `Folder` and `ResourceGroup` (under `Collection`), `Category` (under `Concept`), and `Template`, `Message`, `Order` and `Metric` (under `bfo:0000031`). `software-v1.ttl` declares `Repository` (under `Collection`), `Branch` and `Release` (under `bfo:0000031`). `sdlc_lifecycle-v1.ttl` declares `Job` (under `bfo:0000015`) and `Runner` (under `bfo:0000004`). `company-v1.ttl` declares `Iteration` (under `bfo:0000015`) and `Milestone` (under `bfo:0000031`). `infrastructure-v1.ttl` declares `Namespace`, `Volume` and `Network` (under `bfo:0000004`). `supply_chain-v1.ttl` declares `Vulnerability` (under `bfo:0000031`). Its properties stay with `EG-SUPPLY-VOCAB-R002.6`. No class names a vendor or a product. No existing class changes parent. | `crates/eg-rdf/tests/connector_parent_classes.rs::recurring_connector_concepts_sit_under_their_upper_classes` loads the modules. It asserts each class, its label, its comment, one alias and its direct parent. It asserts the reasoner finds the catalog consistent with no unsatisfiable class. | requirement | EG-TYPED-PACKS | VERIFIED | 0b2f084f5f52 52dbb35d88bb 6048a5ca398c 9b4cb81fe847 e93c5f6ed76c crates/eg-rdf/tests/connector_parent_classes.rs:36 |
| EG-TYPED-PACKS-R105.4 The parent catalog holds a service-operations core aligned to the Open Group IT4IT data objects Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The parent catalog holds a service-operations core aligned to the Open Group IT4IT data objects.** The module `service_operations-v1.ttl` is the core source `core:service_operations@1`, and the catalog lists it. It holds the Detect to Correct and Service Model records that every service-management connector maps to. Work items: `Issue` and `Ticket` (`sdlc_lifecycle-v1.ttl`) sit under `WorkItem`. `Problem` and `Change` sit under `Ticket`, `ChangeRequest` under `Change`, and the existing `Incident` under `Ticket`. Configuration: `ConfigurationItem` sits under `AssetInstance`, which now sits under `bfo:0000004`. `Application`, `BusinessApplication`, `BusinessService` and `Server` sit under `ConfigurationItem`. `AssignmentGroup` sits under `Organization`. Technology: `TRMStandard` sits under `TechnologyStandard` and `TRMPhase` under `Concept`. Work: `Task` sits under `bfo:0000015` and `Prompt` under `bfo:0000031`. Each edge has a domain and a range. `affects` links Incident, Problem or Change to ConfigurationItem. `touches` links ChangeRequest to ConfigurationItem. `usesTechnology` links ConfigurationItem to TechnologyStandard. `hostedOn` links Application or BusinessService to Server. `relatedTo` is symmetric over Repository, WorkItem and Application. `systemPromptFor` links Prompt to Task. `canHandle` links Skill, Agent or Prompt to Task or Incident, and the adapter vocabulary's `appliesTo` keeps its own domain and range. The datatype property `state` has domain `WorkItem` and range `xsd:string`. `hasPhase` links TechnologyStandard to TRMPhase in the shared namespace, apart from the infrastructure module's own `hasPhase`. The existing `priority` (domain `Requirement`) becomes an `owl:unionOf` of `Requirement` and `WorkItem`, so the shared property stays unintersected. No class or property names a vendor or a product. No IRI has two different parents. | `crates/eg-rdf/tests/service_operations_classes.rs::service_operations_classes_exist_with_their_parents` and `::competency_question_edges_declare_domain_and_range` load the modules. They assert each class, its direct parent, the domain and range of each edge, and that the reasoner finds the union consistent with no unsatisfiable class. | requirement | EG-TYPED-PACKS | VERIFIED | 26446669b39b 67b5923b6f57 7b71f99332ea 867b42f93737 9e170f2e27fa crates/eg-rdf/tests/service_operations_classes.rs:112 crates/eg-rdf/tests/service_operations_classes.rs:71 |
| EG-TYPED-PACKS-R105.5 The competency-question paths are complete on the engine side Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The competency-question paths are complete on the engine side.** Every hop of the exit-criteria competency questions that the engine owns resolves in the composed ontology. That covers the edge, its domain and range, and the property on the class that carries it. The competency questions come from `connector-ontology-map graph-check` (`pipelines_hooks/hygiene/ontology_cqs.json`). Self-contained modules join the main component through the core classes they specialise. `swarm:TopologyTemplate` is a `Template`, and `vg:MetadataContract` is a `Document`. Three files carry no class: `catalog-v1.ttl` (import-only, no term by `EG-ORCH-VOCAB-R008.2`), `concepts-v1.ttl` (individuals of `GovernedConcept` only) and the code-generation fixture `codegen_selftest-v1.ttl`. Validator configuration skips them in the connectedness check, and the engine does not bridge them. Hops that name one system's own record types stay in that connector's pack. | `crates/eg-rdf/tests/service_operations_classes.rs::self_contained_modules_align_to_the_core` asserts the alignments. `connector-ontology-map graph-check --eg-extra-ref <branch>` reports every engine-owned competency-question hop as passing. | requirement | EG-TYPED-PACKS | VERIFIED | 67b5923b6f57 867b42f93737 9e170f2e27fa crates/eg-rdf/tests/service_operations_classes.rs:113 crates/eg-rdf/tests/service_operations_classes.rs:207 |
| EG-TYPED-PACKS-R751 Specialist registry, provider discovery, transactional install and capability contract (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Specialist registry, provider discovery, transactional install and capability contract (rollup).** Rust-native in `crates/eg-types/src/registry`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R751.750 Model: Specialist registry, provider discovery, transactional install and capability contract Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model: Specialist registry, provider discovery, transactional install and capability contract.** Specialist packages, services and plugins register as catalog nodes. Their provider assets are content-addressed. Install generations are immutable and carry a bounded marker. One capability contract unifies a skill resource and a tool. Frontend contribution descriptors complete the set. Types: `SpecialistPackage`, `ProviderAsset`, `GenerationMarker`, `CapabilityContract`, `FrontendContribution`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R751.751 Behavior: Specialist registry, provider discovery, transactional install and capability contract Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior: Specialist registry, provider discovery, transactional install and capability contract.** Install is transactional per provider root: a new generation becomes current by one atomic marker swap. Discovery reads the catalog, not the filesystem. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R751.752 Refusal: Specialist registry, provider discovery, transactional install and capability contract Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal: Specialist registry, provider discovery, transactional install and capability contract.** The engine refuses an asset whose digest differs from its marker. It refuses an unbounded marker. It refuses a contribution without a declared read model. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R751.753 Hot-path proof: Specialist registry, provider discovery, transactional install and capability contract Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof: Specialist registry, provider discovery, transactional install and capability contract.** Criterion benchmark `catalog_resolve` runs over 20k packages. The p50 is under 1.5 ms and the p99 is under 5 ms. Memory stays under 32 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R650 Property types, value types, links, interfaces and object sets (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Property types, value types, links, interfaces and object sets (rollup).** The typed model of the ontology covers property and value types with constraints and coercion. It covers link types with cardinality and junctions. It covers interfaces with link constraints and implementation reports. It also covers derived properties, object functions, object sets with filter, aggregation and pivot, and shortest object paths. The Rust home is `crates/eg-core/src/ontology/object_model.rs`. Satisfied only when children `EG-TYPED-PACKS-R650.1`-`EG-TYPED-PACKS-R650.6` are satisfied. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R650.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `PropertyType`, `ValueType{constraints}`, `LinkType{cardinality}`, `Interface`, `DerivedProperty{backing}`, `ObjectFunction`, `ObjectSet{kind,filters}`, `ObjectPath` in `crates/eg-core/src/ontology/object_model.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R650.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Coerce and validate values by constraint table. Check link cardinality at commit. Evaluate an interface implementation report in O(types). Compute derived properties lazily with a revision-keyed cache. Evaluate object sets as lazy plans. Find shortest paths by bidirectional search. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R650.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Compiled from packs by `ontology_codegen.rs` and enforced by `eg-shacl` at commit; served `ObjectSetQuery`. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R650.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** EG refuses a value that violates its constraint, a link beyond its cardinality and an interface left unimplemented. Each refusal names the violated rule. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R650.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Record rule IDs, offending values, plan digest and path hops. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R650.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** Benchmark `object_set_filter_aggregate` (1M objects, 3 filters): p50 2 ms, p99 10 ms, peak memory 32 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-core object_set_filter_aggregate` against the stored baseline. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R651 Governed edits, reverts, write-back and sync conflict resolution (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Governed edits, reverts, write-back and sync conflict resolution (rollup).** Every ontology edit lands in an append-only ledger and inverts exactly. It routes to its sink. It passes a per-field conflict check before any source write-back. Repository provenance, lifecycle of graph schemas, contextual enrichment, schema graphs and naming lint complete the surface. The Rust home is `crates/eg-core/src/ontology/edits.rs`. Satisfied only when children `EG-TYPED-PACKS-R651.1`-`EG-TYPED-PACKS-R651.6` are satisfied. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R651.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `Edit{type,object,before,after}`, `EditLedger`, `Inversion`, `WriteBackRoute`, `FieldConflict{policy}`, `NamingFinding` in `crates/eg-core/src/ontology/edits.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R651.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Append edits with a hash chain. Invert by swapping before and after. Revert an object by replaying inversions newest first. Resolve conflicts per field by declared policy and fail closed. Lint names against the naming convention in O(names). | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R651.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Ledger on the durable kernel; write-back through the source write path with an approval verdict from graph-os admission. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R651.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** EG refuses a write-back without a passing conflict check. It refuses a revert past a sealed edit. It refuses a schema attach that fails composition. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R651.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Record chain head, inversions, conflict decisions and lint findings. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R651.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** Benchmark `edit_append_and_revert` (10k edits, revert last 100): p50 60 us, p99 400 us, peak memory 2 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-core edit_append_and_revert` against the stored baseline. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R652 Markings, classification claims and restricted views (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Markings, classification claims and restricted views (rollup).** Markings classify objects, propagate along edges, and produce restricted views per actor clearance. Classification claims carry multiple categories with provenance and a promotion lifecycle. The Rust home is `crates/eg-core/src/isolation/markings.rs`. Satisfied only when children `EG-TYPED-PACKS-R652.1`-`EG-TYPED-PACKS-R652.6` are satisfied. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R652.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `Marking`, `MarkingStore`, `ActorClearance`, `RestrictedView`, `ClassificationClaim{categories,provenance,state}` in `crates/eg-core/src/isolation/markings.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R652.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Propagate markings by monotone closure in O(V+E). Redact on read by clearance. Promote a claim only through legal states with evidence. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R652.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Joins the row-visibility ladder in `eg-core::isolation`; admission of the actor stays with graph-os. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R652.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** A read without clearance returns the redacted view; a claim promoted without evidence is refused. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R652.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Record marking sets before and after propagation and the clearance used. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R652.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** Benchmark `marking_propagate_redact` (100k objects, 5 markings): p50 1.5 ms, p99 8 ms, peak memory 24 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-core marking_propagate_redact` against the stored baseline. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R700 Skill-graph packs validate against an open knowledge-bundle format (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Skill-graph packs validate against an open knowledge-bundle format (rollup).** The engine validates a skill-graph pack before import. It checks front matter, hashes, directory index and open knowledge-bundle conformance. It then imports the pack as pack entries. Propose-only skill candidates distilled from connector processes render as atomic or workflow skill documents on demand. Implemented in eg-packs. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R700.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** `SkillGraphManifest`, `ConformanceReport` and `SkillCandidate` in `crates/eg-packs`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R700.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Validation is a single pass with a violation cap (R040); hashes use SHA-256 over canonical text. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R700.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Import is the existing atomic pack import (R010); rendering is R100. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R700.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** A pack with a bad hash or missing index is refused with the failing path. A candidate is never published automatically. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R700.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** The conformance report lists every checked rule. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R700.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/packs/test_skill_graph_pack_served.py::test_bad_hash_refused_and_conformant_pack_imports` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/skill_graph_validate.rs` must show p50 under 4 ms and p99 under 25 ms with peak memory under 48 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R097.700 Domain pack manifest, mapping language, loader and promotion bridge: model and behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Domain pack manifest, mapping language, loader and promotion bridge: model and behavior.** A domain pack manifest declares typed mappings (columns, front matter, tables, headings, links, JSON fields) and evaluation cases. The engine evaluates the mapping to proposed entities and relationships. It loads packs from a registry with an integrity hash and previews a run. It sends facts only through the governed promotion path. Markdown is fragmented into the evidence spine's fragments. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R097.701 Domain pack manifest, mapping language, loader and promotion bridge: refusal, evidence and hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Domain pack manifest, mapping language, loader and promotion bridge: refusal, evidence and hot-path proof.** A mapping error, an integrity-hash mismatch or a class absent from the ontology is refused. Test `tests/packs/test_domain_pack_run_served.py::test_preview_then_run_promotes_only_through_envelope`; benchmark `benches/domain_pack_mapping.rs` p50 under 10 ms and p99 under 60 ms per 1,000 rows, memory under 64 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R710 Schema drift classification, containment, repair proposal and activation: model and behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Schema drift classification, containment, repair proposal and activation: model and behavior.** Extends `EG-TYPED-PACKS-R083`. The engine infers a record shape and digest per delivery. It classifies drift against the approved contract (compatible, widening, narrowing, rename, breaking). It applies the operator-declared evolution policy (default: quarantine). It proposes a repair verified on a shadow graph. It activates an approved candidate only after two-person approval (DK R027). The report is observation-class evidence. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-TYPED-PACKS | VERIFIED | 4e402b2ec8bf cfe7d38376a4 dc810128a66d crates/eg-types/src/graph_schema/drift.rs:645 crates/eg-types/src/graph_schema/drift.rs:681 crates/eg-types/src/graph_schema/drift.rs:712 crates/eg-types/src/graph_schema/drift.rs:752 crates/eg-types/src/graph_schema/drift.rs:776 |
| EG-TYPED-PACKS-R712 Schema drift classification, containment, repair proposal and activation: refusal, evidence and hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Schema drift classification, containment, repair proposal and activation: refusal, evidence and hot-path proof.** Extends `EG-TYPED-PACKS-R083`. A drifted delta is quarantined, never applied; an unapproved candidate is never activated. Test `tests/packs/test_schema_drift_served.py::test_breaking_drift_quarantines_and_activation_needs_approval`; benchmark `benches/schema_drift_classify.rs` p50 under 0.5 ms and p99 under 3 ms per 1,000-field contract, memory under 16 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-TYPED-PACKS | VERIFIED | 0305cbd4457e 912a39a98afe cfe7d38376a4 tests/packs/test_schema_drift_served.py:169 |
| EG-TYPED-PACKS-R711 Process, lifecycle, temporal and harness shape artifacts are generated: model and behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Process, lifecycle, temporal and harness shape artifacts are generated: model and behavior.** Extends `EG-TYPED-PACKS-R090`. The build generates the harness, process-intelligence, software-lifecycle and temporal shape files and the ontology lock from Rust definitions. It drift-checks them, like the other canonical artifacts. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R713 Process, lifecycle, temporal and harness shape artifacts are generated: refusal, evidence and hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Process, lifecycle, temporal and harness shape artifacts are generated: refusal, evidence and hot-path proof.** Extends `EG-TYPED-PACKS-R090`. A hand-edited artifact fails the freshness check. Test `crates/eg-types/tests/shape_artifacts_fresh.rs::generated_equals_committed`; benchmark `benches/shape_render.rs` p50 under 5 ms and p99 under 20 ms, memory under 16 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R714 Delivery-path wiring of drift classification Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Delivery-path wiring of drift classification.** Extends `EG-TYPED-PACKS-R710`. The engine record delivery path calls `graph_schema::drift::classify` for each delivery to a source with an approved contract. It uses the contract in force and the operator evolution policy. The delivery result carries the `DriftReport`. | Planned served test: `tests/packs/test_schema_drift_served.py::test_delivery_reports_drift_class` asserts the returned `DriftClass` and `DriftAction`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R715 Served quarantine of a drifted delivery Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Served quarantine of a drifted delivery.** Extends `EG-TYPED-PACKS-R712`. A delivery that `EG-TYPED-PACKS-R714` classifies as breaking is quarantined under the default policy. The engine applies no part of it. A later read of the target graph shows no delivered record. | Planned served test: `tests/packs/test_schema_drift_served.py::test_breaking_delivery_is_quarantined` asserts the quarantine action and an unchanged graph. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R800 Typed record models for packs, evidence bundles, manifests and goals (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Typed record models for packs, evidence bundles, manifests and goals (rollup).** `crates/eg-types` owns the strict, versioned record models that agent tooling exchanged as loose dictionaries. The models cover knowledge packs, schema packs, evidence bundles, execution manifests, goals, code maps, spec-driven task records and model profiles. Each has a digest and a published schema. Children `.1` through `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R800.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Each record is a `serde` struct with `deny_unknown_fields`, a `schema_version` and a canonical digest; evidence bundles carry ordered `EvidenceItem{claim, source_ref, class}` entries. | Planned: `crates/eg-types/tests/typed_records.rs::unknown_field_is_refused`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R800.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Encoding is canonical, so equal records have equal digests. Pack loading validates in one pass in O(n) over items. It rejects duplicates by id. | Planned: `crates/eg-types/tests/typed_records.rs::equal_records_have_equal_digests`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R800.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Records are written through the typed-pack importer already owned here. The generated client reads them. No consumer defines its own copy. | Planned: `crates/eg-types/tests/typed_records.rs::schema_downgrade_is_refused`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R800.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** The engine refuses four inputs with a typed error that names the field. They are an unknown field, a downgrade of `schema_version`, a duplicate id, and an evidence item without a source reference. | Planned: `crates/eg-types/tests/typed_records.rs::duplicate_id_is_refused`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R800.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Evidence is a golden digest file per record type and a published JSON schema checked by the contract freshness gate. | Planned: `crates/eg-types/tests/typed_records.rs::golden_digests_match`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R800.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** Hot-path proof: a Criterion benchmark decodes and validates a 10000-item pack. The p50 stays under 5 ms. The p99 stays under 15 ms. Peak memory stays under 2 times the encoded size. | Planned: `crates/eg-types/tests/typed_records.rs::pack_validation_bench_within_budget`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R801 Business glossary as SKOS concept schemes (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Business glossary as SKOS concept schemes (rollup).** The engine must hold business terms as SKOS concepts in versioned concept schemes. A term links to ontology classes, properties, datasets and columns. A term moves through a review lifecycle. Children `.1` to `.7` deliver it. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R801.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `GlossaryTerm{scheme, pref_label, alt_labels, definition, broader, related, status}` in `crates/eg-types/src/glossary.rs`. `status` is a closed set: `draft`, `in_review`, `approved`, `deprecated`. Map each field to `skos:` terms in `crates/eg-core/ontology/glossary-v1.ttl`. | `crates/eg-types/tests/glossary.rs::term_round_trips_and_maps_to_skos` round-trips a term and validates its SKOS shape. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R801.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** A term binds to an asset through `:definesAsset`. A label search matches preferred and alternative labels in every language tag. A deprecated term names its replacement. | `crates/eg-core/tests/glossary.rs::alt_label_search_finds_term` searches by a synonym. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R801.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** A glossary pack imports through the typed-pack importer of R103. A single term writes through the served `GlossaryTermPut`. arbora serves `glossary.*` through `ARBORA-OPS-R855`. | `tests/test_glossary_served.py::test_import_scheme_and_bind_term` imports a scheme and binds one term to a column. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R801.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** A `broader` cycle must refuse with `GLOSSARY_CYCLE`. Two approved terms with one preferred label in one scheme must refuse with `GLOSSARY_LABEL_TAKEN`. A move from `draft` to `approved` without review must refuse with `GLOSSARY_UNREVIEWED`. | `tests/test_glossary_served.py::test_glossary_refusals` asserts each code. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R801.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each status move records the actor and the R802 change request id. | `tests/test_glossary_served.py::test_status_history_reads_back` reads the history back. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R801.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/glossary_search.rs` searches 100,000 terms by label. The p99 stays under 5 ms. | `cargo bench --bench glossary_search` fails on a 10 percent regression. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R801.7 Proposed descriptions for terms and assets Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Proposed descriptions for terms and assets.** The engine must hold model-proposed descriptions for terms, tables and columns as `proposed` records. A proposal cites its inputs: samples digest, lineage, usage and similar assets. A proposal becomes the description only through an R802 change request. | `tests/test_glossary_served.py::test_proposed_description_needs_review` writes one proposal and approves it. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R802 Stewardship roles, change requests and certification (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Stewardship roles, change requests and certification (rollup).** The engine must hold stewardship roles per domain and asset. A change to a governed asset goes through a change request. A steward may certify an asset as trusted. Children `.1` to `.8` deliver it. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R802.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `StewardshipAssignment{scope, role, principal}` with `role` in `owner`, `steward`, `custodian`. Add `ChangeRequest{target, proposed_digest, state, reviewers}` and `Certification{asset, level, by, expires_at}` in `crates/eg-types/src/stewardship.rs`. | `crates/eg-types/tests/stewardship.rs::records_round_trip` round-trips the three records. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R802.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** A scope is a domain, a concept scheme or an asset. The most specific assignment wins. A change request moves `open` to `approved` or `rejected`, then `applied`. A certification expires after 365 days by default. | `crates/eg-core/tests/stewardship.rs::most_specific_assignment_wins` resolves a nested scope. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R802.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** R801 status moves and R805 contract changes open a change request. arbora admits the approval through `ARBORA-OPS-R855`. The decision reads the assignment to pick reviewers. | `tests/test_stewardship_served.py::test_change_request_flow` opens, approves and applies one request. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R802.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** An approval by a principal without the steward or owner role must refuse with `STEWARD_ROLE_MISSING`. An apply of a request whose target changed must refuse with `CHANGE_REQUEST_STALE`. | `tests/test_stewardship_served.py::test_stewardship_refusals` asserts both codes. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R802.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each request records the target digest before and after, each reviewer verdict and the applied batch receipt. | `tests/test_stewardship_served.py::test_request_evidence_reads_back` compares every field. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R802.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/stewardship_resolve.rs` resolves the reviewers of one asset over 100,000 assignments. The p99 stays under 1 ms. | `cargo bench --bench stewardship_resolve` fails on a 10 percent regression. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R802.7 Trust flags on assets Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Trust flags on assets.** A principal may set one trust flag per asset: `endorsement`, `warning` or `deprecation`, each with a reason. Catalog search of EG-UNIFIED-DATA-PLANE-R764 raises an endorsed asset and lowers a deprecated one. A warning or a deprecation notifies each principal whose stored query of EG-FEDERATED-QUERY-R708 reads the asset. | `tests/test_stewardship_served.py::test_deprecation_lowers_rank_and_notifies` deprecates one table and reads rank and notices. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R802.8 Critical data elements Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Critical data elements.** A steward may mark a term or a column as a critical data element. A critical element must have an owner, a steward and at least one active quality rule of EG-UNIFIED-DATA-PLANE-R762. A report lists each critical element that misses one of the three. | `tests/test_stewardship_served.py::test_critical_element_gaps_reported` marks two elements and reads the gap report. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R803 Sensitive data detection proposes classification claims (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Sensitive data detection proposes classification claims (rollup).** The engine must scan columns and documents for personal and sensitive data. Each detection becomes a classification claim of R652 in the proposed state. A steward promotes or rejects it. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R803.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `SensitiveDetector{id, category, method, threshold}` and `Detection{asset, detector, sample_hits, ratio}` in `crates/eg-types/src/sensitive_detect.rs`. `method` is a closed set: `pattern`, `checksum`, `dictionary`, `model`. | `crates/eg-types/tests/sensitive_detect.rs::records_round_trip` round-trips both records. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R803.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** A scan samples at most 10,000 values per column. A column whose hit ratio passes the threshold yields a proposed claim. The scan stores hit counts, never the matched values. | `crates/eg-core/tests/sensitive_detect.rs::scan_proposes_claim_without_values` scans a fixture with card and email columns. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R803.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** The R761 profiling job of EG-UNIFIED-DATA-PLANE calls the scan for each column. The document chunk path of EG-UNIFIED-DATA-PLANE-R651 calls it for each chunk. | `tests/test_sensitive_detect_served.py::test_profile_job_proposes_claims` profiles a fixture table and reads the claims. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R803.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** A detector with a threshold outside 0 to 1 must refuse with `DETECTOR_THRESHOLD_INVALID`. A claim promotion without a steward must refuse through R802. | `tests/test_sensitive_detect_served.py::test_detector_refusals` asserts the code. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R803.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each claim records the detector id, the sample size, the hit ratio and the scan time. | `tests/test_sensitive_detect_served.py::test_claim_evidence_reads_back` compares every field. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R803.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/sensitive_detect.rs` scans 10,000 values against 20 pattern detectors. The p99 stays under 15 ms. | `cargo bench --bench sensitive_detect` fails on a 10 percent regression. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R804 Ontology revision diff and change impact (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Ontology revision diff and change impact (rollup).** The engine must compare two ontology revisions of R103. Before activation, it reports the change impact on held data, shapes, mappings and stored queries. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R804.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `OntologyDiff{from_rev, to_rev, added, removed, changed, deprecated}` and `ChangeImpact{instances_invalid, shapes_broken, mappings_broken, queries_broken}` in `crates/eg-types/src/ontology_diff.rs`. | `crates/eg-types/tests/ontology_diff.rs::diff_round_trips` round-trips both records. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R804.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** The diff compares the canonical axiom sets of both revisions. The impact pass validates held instances against the new shapes on a shadow branch of EG-BRANCH-MERGE-R001. It counts broken R2RML mappings and stored queries of EG-FEDERATED-QUERY-R708. | `crates/eg-core/tests/ontology_diff.rs::removed_class_reports_impact` removes one class and counts the impact. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R804.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Add the served method `OntologyDiff`. `ImportOntology` of R103 attaches the impact to its revision record. A breaking impact opens an R802 change request. | `tests/test_ontology_diff_served.py::test_import_reports_impact` imports a breaking revision and reads the impact. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R804.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** A diff between revisions of two ontology IRIs must refuse with `ONTOLOGY_DIFF_IRI_MISMATCH`. | `tests/test_ontology_diff_served.py::test_diff_refusals` asserts the code. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R804.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** The impact names the first 100 broken instances, shapes, mappings and queries by id. | `tests/test_ontology_diff_served.py::test_impact_names_items` reads the item lists back. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R804.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/ontology_diff.rs` diffs two 5,000-axiom revisions. The p99 stays under 50 ms. | `cargo bench --bench ontology_diff` fails on a 10 percent regression. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R805 Data products and data contracts (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Data products and data contracts (rollup).** The engine must hold data products: owned, versioned sets of datasets, terms and access ports with a data contract. A contract states schema, quality and freshness promises. A consumer requests access through a governed request. Children `.1` to `.7` deliver it. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R805.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `DataProduct{id, owner, version, datasets, terms, ports}`, `DataContract{product, schema_digest, quality_rules, freshness_s}` and `AccessRequest{product, principal, purpose, state}` in `crates/eg-types/src/data_product.rs`. | `crates/eg-types/tests/data_product.rs::records_round_trip` round-trips the three records. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R805.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** A contract check compares the live schema digest, the R762 quality scores and the freshness with the promise. A breach records a contract violation. An approved request writes a grant of EG-IDENTITY-R023. | `crates/eg-core/tests/data_product.rs::breach_records_violation` breaks the freshness promise. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R805.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** The R762 quality job of EG-UNIFIED-DATA-PLANE calls the contract check after each score. arbora serves `product.*` and `access_request.*` through `ARBORA-OPS-R855`. | `tests/test_data_product_served.py::test_request_grants_access` requests, approves and reads a product dataset. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R805.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** An access request without a purpose must refuse with `ACCESS_PURPOSE_MISSING`. A product version change that breaks its contract schema must refuse with `CONTRACT_SCHEMA_BREAK` unless it raises the major version. | `tests/test_data_product_served.py::test_product_refusals` asserts both codes. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R805.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each violation records the promise, the observed value and the time. Each grant records the request id. | `tests/test_data_product_served.py::test_violation_evidence_reads_back` compares every field. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R805.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/data_contract_check.rs` checks 1,000 contracts. The p99 per contract stays under 1 ms. | `cargo bench --bench data_contract_check` fails on a 10 percent regression. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R805.7 Data product proposals Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Data product proposals.** The engine must propose a data product from a cluster of assets that the same principals query together. The proposal names datasets, terms and an owner candidate. It becomes a product only through an R802 change request. | `tests/test_data_product_served.py::test_usage_cluster_yields_product_proposal` loads usage and reads the proposal. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R106 Onboarding a connector populates the metadata catalog with its assets, owners, terms and lineage (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Onboarding a connector populates the metadata catalog with its assets, owners, terms and lineage (rollup).** EG is the metadata catalog for every connected source. Each tool, prompt, skill, data resource and field of a connector is an asset. arbora onboarding (`ARBORA-FLEET-R041.15`) is the one producer of the catalog nodes. EG holds the vocabulary, validates the nodes with SHACL and serves the queries. It extends `EG-TYPED-PACKS-R102`, which projects tools, prompts and skills. Each asset gets an owner and steward from `EG-TYPED-PACKS-R802`, glossary terms from `EG-TYPED-PACKS-R801`, and lineage edges from `EG-UNIFIED-DATA-PLANE-R702`. Usage and freshness signals come from `EG-UNIFIED-DATA-PLANE-R764` and `EG-UNIFIED-DATA-PLANE-R762`. The relevance function of `EG-TYPED-PACKS-R108.16` finds every asset from UQL and SPARQL, and every catalog question is a graph query over these nodes. This row adds no second catalog, glossary or lineage store. Children `.1` to `.7` deliver it. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R106.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Extend `crates/eg-core/ontology/connector_pack-v1.ttl` with `cp:Resource`, `cp:Field`, `cp:servesClass`, `cp:exposesResource` and `cp:hasField`. Reuse `cp:realizedBy` and `cp:providesCapability`. Add shapes in `connector_pack-v1.shapes.ttl`: a `cp:Resource` names one connector, one `cp:resourceKind` and one ontology class; a `cp:Field` names one ontology property. Add `cp:declaredOwner` for the pack owner. | `crates/eg-core/tests/connector_pack_surfaces.rs::resource_field_and_owner_shapes_validate`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R106.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** arbora onboarding writes one asset node per tool, prompt, skill, resource and field into the tenant graph. It sends them in one triple batch per onboarding pass, after the attested pack import. The batch replaces the connector's earlier catalog nodes. Each node has a class that is a subclass of `cat:Asset`. It links to its connector with `cp:ofConnector`. It links to the classes or properties it serves with `cp:servesClass`, and to its capability IRIs with the core `:providesCapability`. It links to its pack contract version with `cp:packVersion`. It assigns the pack's `cp:declaredOwner` as owner through a `StewardshipAssignment` node of `EG-TYPED-PACKS-R802.1`. That node links to the asset with `cat:assignedTo`, and it names the principal with `cat:principal` and the role with `cat:role`. A pack with no declared owner makes the importing principal the owner, and the asset carries `cat:flag "owner_missing"`. A SKOS glossary term that names the class binds to the asset through `:definesAsset` (`EG-TYPED-PACKS-R801.2`). So does the native capability term that the asset provides. Lineage from connector to operation to resource to field is a set of `LineageEdge` nodes of `EG-UNIFIED-DATA-PLANE-R702.1` with `cat:from`, `cat:to` and `cat:hop`. Each edge is also a direct `cat:lineageTo` edge, so a property path walks it. A class query over a parent class returns the connector assets. | `crates/eg-core/tests/connector_pack_surfaces.rs::every_asset_has_owner_term_lineage_and_class_link`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R106.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** EG has no asset projection of its own. The catalog nodes arrive through the served triple write of the arbora onboarding batch. The engine validates that batch against the catalog shapes before it commits. Reads are served UQL, served SPARQL (`src/server/handlers/rdf/sparql.rs:30`) and the NL query planner, which compiles a question to a graph query over these nodes. No EG projection path writes catalog nodes. No served catalog, lineage, glossary, stewardship or prompt-candidate read method exists. arbora's intent tools (`ask`, `find`) reach the catalog only through these queries. | `tests/typed_packs/test_connector_catalog_served.py::test_onboarding_batch_is_validated_and_found_by_catalog_search`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R106.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** Import refuses a `cp:servesClass` with `UNRESOLVED_REFERENCE` when the class is absent. The class must exist in the pack ontology or the parent graph. It refuses a resource with no connector with `RESOURCE_UNOWNED`. A pack with no `cp:declaredOwner` imports with the asset flagged `owner_missing`, and the critical-element report of `EG-TYPED-PACKS-R802.8` lists it. | `crates/eg-core/tests/connector_pack_surfaces.rs::unresolved_class_unowned_resource_and_missing_owner_are_reported`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R106.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each asset carries the pack digest, entry revision and graph revision. Usage counts, freshness age and quality score attach to the asset as the engine records them. `GraphSchemaClasses` of `EG-TYPED-PACKS-R077` reports the asset count per class. | `tests/typed_packs/test_connector_catalog_served.py::test_asset_carries_digest_usage_freshness_and_class_counts`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R106.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served triple write that carries an onboarding batch. The batch catalogs a pack that holds two tools, one skill, one prompt and two resources with fields. Served catalog search finds each asset with owner, glossary term and lineage. A SPARQL query on the parent class returns the assets of the connector subclasses. | `tests/typed_packs/test_connector_catalog_served.py::test_catalog_search_finds_assets_with_owner_term_and_lineage`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R106.7 Competency queries Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Competency queries.** Fixed queries answer the catalog questions from the graph alone, over the `EG-TYPED-PACKS-R106.6` fixture. Each runs through served SPARQL and through its UQL equivalent and returns the expected rows. "Owner of X" reads the `StewardshipAssignment` node with `cat:assignedTo` X. "Lineage of X" walks `cat:lineageTo+` into and out of X and reads `cat:hop` from each `LineageEdge`. "Glossary term for X" reads the terms with `:definesAsset` X and their `skos:prefLabel`. "Assets of a connector under a parent class" reads `?asset a/rdfs:subClassOf* cat:Asset ; cp:ofConnector ?connector`. The query strings are the test vectors in the test specification. | `tests/typed_packs/test_catalog_competency_queries.py::test_owner_lineage_term_and_class_queries_answer_from_the_graph`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R107 Each connector pack is a versioned contract and a re-import detects breaking changes (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Each connector pack is a versioned contract and a re-import detects breaking changes (rollup).** The ontology is the contract layer. A pack binds its resources and fields to ontology concepts by mappings. It also carries shapes that validate the data. Extends `EG-TYPED-PACKS-R105`. A pack release is a new contract version. Re-import reuses `OntologyDiff` of `EG-TYPED-PACKS-R804` and the schema-break rule of `EG-TYPED-PACKS-R805.4`. A breaking change opens a change request of `EG-TYPED-PACKS-R802`. A non-breaking change applies and supersedes the older version. A `standalone` ontology needs a governed grant. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R107.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `PackContractVersion{connector, version, contract_digest, ontology_digest, shapes_digest, supersedes}` and `StandaloneGrant{connector, ontology_iri, reason, owner, expires_at}` in `crates/eg-types/src/connector_pack.rs`. A breaking change is a removed or retyped class, property or field, a narrowed shape, or a removed mapping. | `crates/eg-types/tests/pack_contract.rs::version_and_grant_round_trip`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R107.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Import diffs the new contract against the current one with `OntologyDiff` and the mapping set. A non-breaking release applies and writes a `:supersedes` edge. A breaking release stays pending behind a change request and the older version keeps serving. Virtual-graph queries resolve through the active version only. Removed surfaces leave current queries and stay readable by revision. An expired standalone grant flags the ontology as an orphan. | `crates/eg-core/tests/pack_contract.rs::non_breaking_applies_breaking_waits_and_queries_use_active_version`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R107.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** The diff runs inside `run_import` (`src/server/handlers/admin/connector_pack/import.rs:63`) before `project_head` (`src/server/handlers/admin/connector_pack/reproject.rs:72`). The grant check runs in the ontology import path of `EG-TYPED-PACKS-R105`. The served read method `OrphanReport` lists standalone ontologies and orphan classes per tenant. | `tests/typed_packs/test_pack_contract_served.py::test_diff_runs_in_import_and_orphan_report_is_served`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R107.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** A `standalone` request with no grant refuses with `STANDALONE_NOT_GRANTED`. A grant with no reason or expiry refuses with `GRANT_INCOMPLETE`. A release that breaks the contract stays pending until a change request is approved. It returns `CONTRACT_BREAK_PENDING` with the first 100 broken items. A withdrawn class still named by a stored fact refuses with `CLASS_IN_USE`. | `crates/eg-core/tests/pack_contract.rs::ungranted_incomplete_breaking_and_in_use_refuse`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R107.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each import receipt carries the old and new contract digest. It also carries the breaking item count, the change request id and the grant id. `OrphanReport` names the owner and expiry of each exception. | `tests/typed_packs/test_pack_contract_served.py::test_receipt_carries_digests_break_count_request_and_grant`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R107.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served `ConnectorPack.Import` method. The test imports release 1, then a non-breaking release 2, then a release 3 that retypes one field. Release 2 serves at once. Release 3 waits and queries still use release 2. The test approves the request and release 3 serves. | `tests/typed_packs/test_pack_contract_served.py::test_breaking_release_waits_for_approval_then_serves`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108 The metadata catalog also governs agents, the business, workflows and knowledge graphs (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The metadata catalog also governs agents, the business, workflows and knowledge graphs (rollup).** Extends `EG-TYPED-PACKS-R106`. EG stores and governs metadata for four more asset families. They are Agent Library entries, company and business entities, workflows with their runs, and the knowledge graphs themselves. Each family reuses the owner, steward, glossary, lineage and usage rows that R106 reuses. Each asset links to a parent-ontology class. One catalog search and one query reach all families beside connector assets. Children `.1` to `.6` deliver the families. Children `.7` to `.16` deliver the capabilities for every family. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `crates/eg-core/ontology/catalog-v1.ttl` with four families, all as subclasses of one parent `cat:Asset`. Agent Library: `cat:AgentTemplateAsset`, `cat:A2AAgentAsset`, `cat:AgentVersion`, linked to capability, tool, skill, prompt and model profile. Business: `cat:OrgUnit`, `cat:Team`, `cat:Person`, `cat:Role`, `cat:BusinessDomain`, `cat:Product`, `cat:Service`. Workflow: `cat:WorkflowDefinition`, `cat:WorkflowRun`, `cat:WorkflowStep`. Graph: `cat:KnowledgeGraph` with ontology, contract, source, freshness and steward links. Add shapes: each asset names one owner. | `crates/eg-core/tests/catalog_assets.rs::four_families_validate_and_share_one_parent_asset_class`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** Projection catalogs entries that EG already holds, and it copies nothing. Agent Library entries come from `EG-ORCH-VOCAB-R003` and `EG-ORCH-VOCAB-R800`, with versions from `EG-ORCH-VOCAB-R801`. Org units, teams, people and roles come from the organization records of `EG-ORCH-VOCAB-R750`. Workflow definitions and runs come from `EG-CQ-ORCH-R700` and `EG-DECISION-ENGINE-R166`. Each graph registers with its ontology revisions, pack contracts of `EG-TYPED-PACKS-R107`, sources and freshness. Owners and stewards use `EG-TYPED-PACKS-R802`. Terms use `EG-TYPED-PACKS-R801`. Lineage uses `EG-UNIFIED-DATA-PLANE-R702`. Agent assembly (`EG-DECISION-ENGINE-R036`) and the questions of `EG-CQ-ORCH-R003` and `EG-CQ-ORCH-R006` read the same nodes. | `crates/eg-core/tests/catalog_assets.rs::existing_records_project_with_owner_term_and_lineage_without_copies`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** Projection attaches beside the connector projection in `project` (`src/server/connector_pack_projection.rs:228`). It also attaches in the catalog projector behind `EG-UNIFIED-DATA-PLANE-R764` search. Agent Library publish, workflow registration and graph creation each emit the catalog node through that projector. No family keeps its own index. | `tests/typed_packs/test_catalog_assets_served.py::test_publish_register_and_create_reach_the_one_projector`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** A catalog node whose class is not a subclass of `cat:Asset` refuses with `ASSET_CLASS_ORPHAN`. A node with no owner imports flagged `owner_missing` and appears in the critical-element report of `EG-TYPED-PACKS-R802.8`. A person node stores only fields the privacy markings of `EG-TYPED-PACKS-R652` allow, and a marked field refuses with `FIELD_MARKED`. | `crates/eg-core/tests/catalog_assets.rs::orphan_class_missing_owner_and_marked_field_are_handled`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each node carries its source record id, graph revision, owner, steward, last-change time and usage count. Version history of an agent or a graph reads from the supersession chain. | `tests/typed_packs/test_catalog_assets_served.py::test_node_carries_owner_steward_revision_usage_and_history`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The entry point is served catalog search and served UQL. The fixture publishes an agent template and registers a workflow with one run. It creates a team with a product. It creates a graph. One query by parent class returns all four families and a connector asset. One question lists the agents, tools and owners that serve a workflow step. | `tests/typed_packs/test_catalog_assets_served.py::test_one_query_returns_agents_business_workflows_graphs_and_connector_assets`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.7 Technical metadata from contracts Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Technical metadata from contracts.** EG stores metadata and business context only. Raw data stays in its source and is read at query time. The catalog harvests schemas, tables or collections, fields, data types and keys. It also harvests relationships, view definitions and indexes. It reads the pack contract (`SDK-CONNECTOR-CONTROL-R074`) and the source contracts (`EG-UNIFIED-DATA-PLANE-R003`). It stores no row and no software package. An unmapped field imports flagged `field_unmapped`. | `tests/typed_packs/test_catalog_capabilities_served.py::test_contract_harvest_stores_schema_keys_views_indexes_and_no_rows` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.8 Operational metadata from provenance Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Operational metadata from provenance.** The catalog records query history, access logs, execution frequency, last-updated time and user activity per asset. It reads them from query provenance, `RunTrace` and `ToolCall` records. It extends the usage counts of `EG-UNIFIED-DATA-PLANE-R764` and the source query logs of `EG-UNIFIED-DATA-PLANE-R764.7`. A top-queries view ranks by use. The log keeps the question digest, never the result rows. | `tests/typed_packs/test_catalog_capabilities_served.py::test_tool_call_and_query_provenance_feed_usage_frequency_and_top_queries` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.9 Sensitivity propagation and policy link Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Sensitivity propagation and policy link.** A sensitivity class of `EG-TYPED-PACKS-R803` flows along lineage edges. Each derived asset gets a proposed claim. A steward promotes or rejects it through `EG-TYPED-PACKS-R802`. Each asset names the access policy that governs it. The link reads the masking rules of `EG-FEDERATED-QUERY-R706` and the arbora admission policy. The catalog stores the link, not the policy body. | `tests/typed_packs/test_catalog_capabilities_served.py::test_sensitivity_propagates_downstream_as_proposal_and_asset_names_its_policy` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.10 End-to-end lineage across the platform Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**End-to-end lineage across the platform.** Lineage runs from source through connector operation, transformation and workflow. It ends at a dashboard, agent or model. It is column or field level where the source reports it (`EG-UNIFIED-DATA-PLANE-R763`). It extends the edges of `EG-UNIFIED-DATA-PLANE-R702`. A lineage query returns upstream and downstream assets for any asset, with the hop type on each edge. It is a SPARQL property path or a UQL variable-length match over `cat:lineageTo`, and it reads the hop type from the `LineageEdge` node. | `tests/typed_packs/test_catalog_capabilities_served.py::test_lineage_walks_source_operation_workflow_dashboard_agent_and_model` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.11 Metric and KPI definitions Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Metric and KPI definitions.** A `cat:Metric` holds a name, a domain, a formula and a unit. The formula names ontology properties and glossary terms of `EG-TYPED-PACKS-R801`. The engine evaluates the formula at query time over the virtual sources. A formula that names an unknown term refuses with `METRIC_TERM_UNRESOLVED`. | `tests/typed_packs/test_catalog_capabilities_served.py::test_metric_formula_binds_terms_and_unknown_term_refuses` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.12 Annotations: comments, tags, ratings and threads Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Annotations: comments, tags, ratings and threads.** Any asset takes descriptions, comments, tags, ratings and discussion threads. Each carries its author, time and revision. Endorsement, deprecation warnings and certification reuse `EG-TYPED-PACKS-R802.7` and `R802`. A proposed description follows `EG-TYPED-PACKS-R801.7`. A thread on a deleted asset stays readable by revision. | `tests/typed_packs/test_catalog_capabilities_served.py::test_annotations_attach_to_any_asset_and_trust_flags_reuse_the_steward_path` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.13 Curated articles and guides Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Curated articles and guides.** A `cat:Article` is a versioned document with an author and a status. It attaches to assets and to business domains. An article moves through the review lifecycle of `EG-TYPED-PACKS-R801.1`. Search finds it by text and by the asset it describes. | `tests/typed_packs/test_catalog_capabilities_served.py::test_article_attaches_to_asset_and_domain_and_is_found_by_text_and_by_asset` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.14 Dashboards, reports, saved queries and templates Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Dashboards, reports, saved queries and templates.** A dashboard or report is a catalog asset. It lists the assets it reads, its owner and its usage. The dashboards of the agent-webui register through a published descriptor. Saved queries use the stored queries of `EG-FEDERATED-QUERY-R708`. A reusable query template adds named parameters. The catalog stores the descriptor and the query text, not the data shown. | `tests/typed_packs/test_catalog_capabilities_served.py::test_dashboard_report_saved_query_and_template_register_with_reads_and_usage` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.15 AI and ML model assets Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**AI and ML model assets.** A `cat:ModelAsset` holds a registry reference, input and output schemas, training datasets and evaluation results. It links to its dataset lineage and to the model profile of `EG-ORCH-VOCAB-R005`. The engine stores references and metadata, never weights. | `tests/typed_packs/test_catalog_capabilities_served.py::test_model_asset_links_registry_ref_schemas_and_training_lineage_without_weights` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R108.16 One ranked index across all asset families, callable from queries Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**One ranked index across all asset families, callable from queries.** Ranked catalog search is a relevance function inside the query engine. It is not a served method. SPARQL calls it as `cat:relevance(?asset, "text")` in a `FILTER`, `BIND` or `ORDER BY`. UQL calls it as `search("text")` in a `MATCH` filter or order. It covers connector assets, Agent Library entries and business entities. It also covers workflows, graphs, metrics, articles, dashboards, queries and models. It extends the full-text index of `EG-UNIFIED-DATA-PLANE-R764`, and it adds no second index. The score sums name, glossary-label, concept and description matches. Rank boosts assets by usage and by endorsement, and it lowers deprecated assets. A query reads the rank components of each hit through `cat:rankComponents`. The NL query planner uses the function to resolve a business term to assets. arbora's `catalog.search` (`ARBORA-OPS-R855`) compiles to a query that calls it. | `tests/typed_packs/test_catalog_capabilities_served.py::test_one_search_ranks_all_families_with_usage_and_endorsement_boost` | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R109 The dashboard is a first-class catalog asset (rollup) Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**The dashboard is a first-class catalog asset (rollup).** Extends `EG-TYPED-PACKS-R108.14`. A person saves a dashboard document. It is a catalog asset. It has content, an owner and sharing grants. It has catalog links, search and soft delete. arbora saves it through `ARBORA-OPS-R861`. The agent-webui authors it in `WEBUI-DASH-R010` and `WEBUI-DASH-R012`. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R109.1 Model Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Model.** Add `cat:DashboardAsset` as a subclass of `cat:Asset`. It holds a versioned body of panels, queries, layout and parameters. It holds a revision that only increases. It names one owner principal and a list of grants. Each grant gives `view` or `edit` to a principal or a group. Links name the data sources and queries of each panel. They name the glossary terms and ontology concepts it shows. They also hold usage counts (views and last viewed). The body is stored, and the data shown is not. | `crates/eg-core/tests/dashboard_asset.rs::dashboard_asset_shape_validates_body_revision_owner_grants_and_links`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R109.2 Behavior Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Behavior.** A save carries the revision it read. The engine accepts the save only when that revision is the current one. It then stores the new body and raises the revision by one. Each save rebuilds the lineage links from the panels (`EG-UNIFIED-DATA-PLANE-R702`) and the term links (`EG-TYPED-PACKS-R801`). A view raises the usage count and sets the last-viewed time. A delete marks the asset as removed. The engine keeps it for a retention period. A restore inside that period brings it back. After the period the engine drops the body. The revision history stays. | `crates/eg-core/tests/dashboard_asset.rs::save_bumps_revision_rebuilds_links_and_delete_keeps_then_purges`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R109.3 Wiring Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Wiring.** The save, read, share and delete operations run through the one catalog projector beside `EG-TYPED-PACKS-R108.14`. arbora serves them as `ARBORA-OPS-R861`, and the agent-webui calls them as `WEBUI-DASH-R010` and `WEBUI-DASH-R012`. Every read and every write checks EG authority with the owner and grant rows of `EG-TYPED-PACKS-R802`. The asset enters catalog search (`EG-TYPED-PACKS-R108.16`) on save. It leaves the index on delete. | `tests/typed_packs/test_dashboard_asset_served.py::test_save_read_share_and_delete_reach_the_one_projector_with_authority_checks`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R109.4 Refusal Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Refusal.** A save with a stale revision refuses with `DASHBOARD_REVISION_CONFLICT`. The refusal names the current revision. It never overwrites. A read without a grant refuses with `DASHBOARD_NOT_GRANTED`. A write without an `edit` grant refuses the same way. Only the owner may change grants or delete. A body that names a panel with no query refuses with `DASHBOARD_BODY_INVALID`. A read of a purged asset refuses with `DASHBOARD_PURGED`. | `crates/eg-core/tests/dashboard_asset.rs::stale_revision_missing_grant_invalid_body_and_purged_asset_refuse`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R109.5 Evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Evidence.** Each save records its author, time, prior revision and new revision. Each grant change records who gave it and when. Each delete records the retention end. The revision history reads from the supersession chain. Usage reads from view records. | `tests/typed_packs/test_dashboard_asset_served.py::test_revision_grant_and_delete_history_and_usage_are_served`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R109.6 Hot-path proof Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Hot-path proof.** The entry point is the served save operation and served catalog search. The fixture saves a dashboard with two panels. It saves again with a stale revision and sees the conflict. It shares the dashboard to a group and reads as a member and as a stranger. It reads the lineage of a panel back to its data source. It finds the dashboard by search. It deletes it and sees it leave search but stay restorable. | `tests/typed_packs/test_dashboard_asset_served.py::test_dashboard_save_conflict_share_lineage_search_and_soft_delete`. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R085.5 Rollup through R085.5.1–R085.5.4 Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Rollup through R085.5.1–R085.5.4.** **Registered human approval keys.** Store broker-attested public Ed25519 keys for signed_approval, bound to the live native human session subject and deployment tenant. Exact revision CAS controls registration, rotation and revocation; lookup binds principal, tenant, key and purpose and conveys no caller authority. | Native lifecycle, persistence, expiry, authority and CAS refusal tests. Broker proof verification and served enrollment remain pending; fixture registration does not qualify them. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R085.6 Rollup through R085.6.1–R085.6.3 Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Rollup through R085.6.1–R085.6.3.** **Credential resolution can observe without refreshing.** Existing SessionTouch accepts optional refresh. Omitted or true retains existing Resolve behavior. False verifies the same credential and current session/principal state without changing last-seen or expiry. Resolve metadata reports no mutation for false. Revoke remains a mutation regardless of refresh. | Native tests cover legacy defaults, unchanged authority revision on observation, expiry and revocation refusals, and unconditional revocation. Generated bindings and native qualification remain pending. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R085.7.1 Pure reference inspection Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Pure reference inspection.** Existing identity store validates owner, tenant, completed live session and active principal. Inspection leaves state unchanged and refuses ambiguous references. | Run the reference inspection unit refusal tests. | requirement | EG-TYPED-PACKS | VERIFIED | 2b8dd458b459 b6d6bdedcd35 crates/eg-types/src/identity/tests/session_evidence.rs:168 crates/eg-types/src/identity/tests/session_evidence.rs:204 crates/eg-types/src/identity/tests/session_evidence.rs:334 |
| EG-TYPED-PACKS-R085.7.2 Durable reference snapshots Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Durable reference snapshots.** Inspection returns session facts and the global authority revision from one durable snapshot. Reopen and revocation preserve exact reference binding. | Run the core durable session evidence fixture; unit tests alone do not qualify this child. | requirement | EG-TYPED-PACKS | SPECIFIED | crates/eg-core/src/isolation/identity_store_tests/session_evidence.rs:6 |
| EG-TYPED-PACKS-R085.7.3 Reference contract and served qualification Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Reference contract and served qualification.** Generated request/result bindings expose reference inspection through the normal verified identity boundary. No reference becomes a credential. | Validate generated schemas and execute served owner/tenant/refusal acceptance; remain pending without that evidence. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R085.4.1 Pure renewal ceiling transitions Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Pure renewal ceiling transitions.** Renewal requires matching current scopes within the original creation-time ceiling. Missing legacy evidence refuses. Idle expiry stays within original absolute expiry. | Run ceiling, legacy, expansion-refusal and narrowing unit fixtures. | requirement | EG-TYPED-PACKS | VERIFIED | 2b8dd458b459 b6d6bdedcd35 crates/eg-types/src/identity/tests/session_evidence.rs:220 crates/eg-types/src/identity/tests/session_evidence.rs:335 crates/eg-types/src/identity/tests/session_evidence.rs:364 crates/eg-types/src/identity/tests/session_evidence.rs:385 crates/eg-types/src/identity/tests/session_evidence.rs:420 |
| EG-TYPED-PACKS-R085.4.2 Durable renewal CAS Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Durable renewal CAS.** Expected global authority revision and the renewal write share the existing durable CAS. A competing revocation cannot be overwritten; renewal survives reopen. | Run the core renewal fixture including RevokeBeforeSave; remain pending until native execution. | requirement | EG-TYPED-PACKS | SPECIFIED | crates/eg-core/src/isolation/identity_store_tests/session_evidence.rs:161 |
| EG-TYPED-PACKS-R085.4.3 Renewal contract and served qualification Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Renewal contract and served qualification.** Generated bindings and the served identity boundary preserve exact revision, owner, tenant and scope conditions. Renewal issues no credentials or approvals. | Execute generated-contract and served renewal acceptance. Unrelated authority changes must require fresh inspection. | requirement | EG-TYPED-PACKS | SPECIFIED | src/server/dispatch/identity_store/resolution_context/tests.rs:681 |
| EG-TYPED-PACKS-R085.5.1 Pure registered approval-key transitions Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Pure registered approval-key transitions.** Existing identity store implements bound key lifecycle, expiry, broker checks, rotation/revocation CAS and canonical registration bytes. | Run the eg-types approval-key tests; serialization fixtures do not qualify durable writes. | requirement | EG-TYPED-PACKS | VERIFIED | 2b8dd458b459 b6d6bdedcd35 crates/eg-types/src/identity/tests/approval_keys.rs:112 crates/eg-types/src/identity/tests/approval_keys.rs:150 crates/eg-types/src/identity/tests/approval_keys.rs:188 crates/eg-types/src/identity/tests/approval_keys.rs:219 crates/eg-types/src/identity/tests/approval_keys.rs:74 |
| EG-TYPED-PACKS-R085.5.2 Durable approval-key evidence Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Durable approval-key evidence.** Registered key facts, rotation and revocation persist through the native authority write path and durable reopen. | Run the core approval-key fixture and retain pending status without native results. | requirement | EG-TYPED-PACKS | SPECIFIED | crates/eg-core/src/isolation/identity_store_tests/approval_keys.rs:63 |
| EG-TYPED-PACKS-R085.5.3 Approval-key request stamping Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Approval-key request stamping.** The existing request boundary derives the approval-key binding and replaces untrusted caller stamp material. | Run the native server approval-key stamp test. This does not qualify broker proof verification or enrollment. | requirement | EG-TYPED-PACKS | SPECIFIED | src/server/dispatch/identity_store/tests/approval_keys.rs:4 |
| EG-TYPED-PACKS-R085.5.4 Approval-key served qualification Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Approval-key served qualification.** Generated schemas, broker proof verification and served enrollment meet the parent contract. No fixture authorizes live enrollment. | Execute generated-contract and served qualification; keep pending until owner evidence exists. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-TYPED-PACKS-R085.6.1 Pure credential observation Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Pure credential observation.** Refresh false preserves credential checks and returns resolution without a session touch. Omitted refresh retains legacy behavior and revoke always mutates. | Run observation, default refresh, revocation and authority unit tests. | requirement | EG-TYPED-PACKS | VERIFIED | 2b8dd458b459 b6d6bdedcd35 crates/eg-types/src/identity/tests/session_evidence.rs:279 crates/eg-types/src/identity/tests/session_evidence.rs:310 |
| EG-TYPED-PACKS-R085.6.2 Durable observation revision Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Durable observation revision.** Credential observation leaves the complete durable authority image and global revision unchanged. | Run the core observation fixture against the native durable store. | requirement | EG-TYPED-PACKS | SPECIFIED | crates/eg-core/src/isolation/identity_store_tests/session_evidence.rs:7 |
| EG-TYPED-PACKS-R085.6.3 Observation contract and served qualification Definition — EG-TYPED-PACKS / EG-TYPED-PACKS — Typed packs and catalog authorityCanonical requirement and verification source**Observation contract and served qualification.** Generated bindings preserve optional refresh and the served verifier issues the existing resolution without a touch when false. | Execute generated-route and served non-touch credential acceptance, including current-authority refusals. | requirement | EG-TYPED-PACKS | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE EG-UNIFIED-DATA-PLANE — Unified data plane | spec | None | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R001 Record attached-source and native-hosting architecture decisions Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Record attached-source and native-hosting architecture decisions.** EG documents, as approved architecture decision records, that attached third-party sources are the default integration path, that EG remains the single converged query engine, that native hosting is earned per application through a defined gate, the router's consistency contract, and the scope boundary of the pgrx companion. | Review of the merged architecture decision records confirms each decision is recorded and accepted. | requirement | EG-UNIFIED-DATA-PLANE | LANDED | 1f6d512ae013 3dd56fe53283 5a4a0b3d4936 7e14801e08c3 9a85c8a49fd4 |
| EG-UNIFIED-DATA-PLANE-R002 Unify attached-source registration into one owner-scoped registry (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Unify attached-source registration into one owner-scoped registry (rollup).** EG provides a single owner-scoped attached-source registry. It replaces the separate eg-plan ForeignSourceSpec::Sql, OBDA external_sources, and kernel mirror-target registrations. A dialect-adapter contract backs it and covers the driver, SQL rendering, catalog reader, change capture, and type map. Credentials are resolved only by secret reference, and registration verifies the outbound target before persistence. This row is a rollup, split by code root into `EG-UNIFIED-DATA-PLANE-R002.1`, `.2` and `.3`. It is LANDED only when all three children are LANDED. | Integration tests show SQL, OBDA, change capture, and mirror paths all resolve through the same registered source. Registration of an unverified or cross-owner endpoint fails closed. | requirement | EG-UNIFIED-DATA-PLANE | LANDED | 23ba8c7eab2a 3dd56fe53283 64f76c5b3209 9a7674d1bae5 b28c6e06c13a src/server/foreign_catalog.rs:402 src/server/foreign_catalog.rs:426 |
| EG-UNIFIED-DATA-PLANE-R002.1 Verify the outbound target before persisting a `ForeignSourceSpec::Sql` registration (producer path) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Verify the outbound target before persisting a `ForeignSourceSpec::Sql` registration (producer path).** `ForeignSourceCatalog::register` runs the existing SSRF-sensitive destination gate (`eg_plan::federation_ssrf::check_sql_dsn`) against a `Sql` spec's DSN before the entry is inserted, so a registration naming a disallowed address never reaches the catalog. Depends on none (producer; `check_sql_dsn` and the owner-scoped catalog already exist). | A unit test registers a `Sql` spec whose DSN names a disallowed destination and confirms the catalog holds no entry for it afterward; a spec naming an allowed destination still registers. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 23ba8c7eab2a 3dd56fe53283 b28c6e06c13a d603182af742 src/server/foreign_catalog.rs:403 src/server/foreign_catalog.rs:427 |
| EG-UNIFIED-DATA-PLANE-R002.2 Verify the outbound target before persisting an OBDA `external_sources` registration (consumer path) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Verify the outbound target before persisting an OBDA `external_sources` registration (consumer path).** The OBDA table-source handler (`src/server/handlers/rdf/obda.rs::register_table_sources`) runs the same destination gate against each `ObdaExternalSource`'s DSN before registering it into the `ObdaSourceRegistry`, so OBDA registration fails closed exactly like the SQL federation path. Depends on `EG-UNIFIED-DATA-PLANE-R002.1` (reuses its verification call). | A unit test feeds `register_table_sources` an entry whose DSN names a disallowed destination and confirms the registry holds no source for it afterward; a disallowed entry does not block registering the other, allowed entries in the same call. | requirement | EG-UNIFIED-DATA-PLANE | LANDED | 23ba8c7eab2a b28c6e06c13a |
| EG-UNIFIED-DATA-PLANE-R002.3 Verify the outbound target before persisting a kernel mirror-target registration (sink path) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Verify the outbound target before persisting a kernel mirror-target registration (sink path).** Once `EG-DURABLE-KERNEL-R024` lands a per-target mirror-sink registration (today `CdcHub` holds one process-global `ExternalCdcSink`, not a registry), that registration path runs the same destination gate before a mirror target is persisted. Depends on `EG-UNIFIED-DATA-PLANE-R002.1` and the same-repo `EG-DURABLE-KERNEL-R024` (status: BUILDING — the mirror-target registration concept does not exist yet, so this child has no code root to verify against today). | A unit test registers a mirror target whose destination is disallowed and confirms the sink registry holds no entry for it afterward. | requirement | EG-UNIFIED-DATA-PLANE | LANDED | 9a7674d1bae5 |
| EG-UNIFIED-DATA-PLANE-R003 Extract typed, hashed catalog graphs per dialect Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Extract typed, hashed catalog graphs per dialect.** Each dialect adapter's catalog reader extracts tables, columns, keys, foreign keys, indexes, views, enums, and JSON columns into a versioned, typed, hashed schema graph, and every catalog artifact has a named OBDA or schema_context consumer. Net-new (no catalog-graph type existed on main): split per the net-new rule. `.1` is the typed catalog-graph model and its hash. Rollup: LANDED only once every child is. | A golden test confirms repeated catalog reads against the same source produce a stable hash and ordering. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 37003f28164f 3dd56fe53283 8ef8d8e817b7 dc9533466828 crates/eg-types/src/attached_catalog.rs:117 crates/eg-types/src/attached_catalog.rs:145 crates/eg-types/src/attached_catalog.rs:159 crates/eg-types/src/attached_catalog.rs:173 |
| EG-UNIFIED-DATA-PLANE-R003.1 `AttachedCatalogGraph` is a versioned, typed catalog with a reorder-stable content hash, refusing an ambiguous duplicate table name Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`AttachedCatalogGraph` is a versioned, typed catalog with a reorder-stable content hash, refusing an ambiguous duplicate table name.** `crates/eg-types/src/attached_catalog.rs` hashes a catalog's tables and columns after sorting them, so two reads of the same unchanged catalog in a different discovery order hash identically, and refuses a catalog naming the same schema-qualified table twice. | Verified by unit tests: the hash is stable under table/column reordering, changes when the catalog changes, and a duplicated schema-qualified table name is refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 dc9533466828 crates/eg-types/src/attached_catalog.rs:117 crates/eg-types/src/attached_catalog.rs:145 crates/eg-types/src/attached_catalog.rs:159 crates/eg-types/src/attached_catalog.rs:173 |
| EG-UNIFIED-DATA-PLANE-R004 Infer schema structure deterministically from attached catalogs Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Infer schema structure deterministically from attached catalogs.** EG profiles attached-source columns and infers JSON shapes under a bounded, policy-gated sampling budget, discovers inclusion and functional dependencies with supporting evidence, and groups related tables using Leiden community detection with a fixed seed. Net-new (no sampling-budget type existed on main): split per the net-new rule. `.1` is the typed sampling-budget model. Rollup: LANDED only once every child is. | A deterministic test fixture produces identical dependency and grouping results across repeated runs. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 197081533292 3dd56fe53283 8ef8d8e817b7 crates/eg-types/src/schema_inference.rs:101 crates/eg-types/src/schema_inference.rs:65 crates/eg-types/src/schema_inference.rs:75 crates/eg-types/src/schema_inference.rs:88 |
| EG-UNIFIED-DATA-PLANE-R004.1 `ColumnSamplingBudget` is a bounded, policy-gated row/byte budget, refusing a zero or unbounded declaration Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`ColumnSamplingBudget` is a bounded, policy-gated row/byte budget, refusing a zero or unbounded declaration.** `crates/eg-types/src/schema_inference.rs` refuses a sampling budget declaring zero rows, zero bytes, or more rows than a fixed ceiling, so JSON-shape profiling can never run with an effectively unlimited budget. | Verified by unit tests: a budget within bounds validates, and a zero-row, zero-byte, or over-ceiling budget is each refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 8ef8d8e817b7 crates/eg-types/src/schema_inference.rs:101 crates/eg-types/src/schema_inference.rs:65 crates/eg-types/src/schema_inference.rs:75 crates/eg-types/src/schema_inference.rs:88 |
| EG-UNIFIED-DATA-PLANE-R005 Compile approved relational mappings to named R2RML virtual graphs Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Compile approved relational mappings to named R2RML virtual graphs.** EG proposes ontology mappings deterministically first, allows a model to suggest additional mappings as proposals only, and compiles approved mappings to R2RML stored as versioned, server-side named virtual graphs queryable by name from SPARQL, UQL, and REASON. Net-new (no mapping-approval type existed on main): split per the net-new rule. `.1` is the typed approval-state model. Rollup: LANDED only once every child is. | A test confirms an unapproved or model-only mapping cannot be queried, while an approved mapping answers a known query by name. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 197081533292 3dd56fe53283 545b68818f0b 79ba71d072a5 crates/eg-plan/src/virtual_graph_mapping.rs:80 crates/eg-plan/src/virtual_graph_mapping.rs:87 crates/eg-plan/src/virtual_graph_mapping.rs:96 |
| EG-UNIFIED-DATA-PLANE-R005.1 `VirtualGraphMapping` carries a typed approval state, refusing a query against a proposed or model-suggested mapping Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`VirtualGraphMapping` carries a typed approval state, refusing a query against a proposed or model-suggested mapping.** `crates/eg-plan/src/virtual_graph_mapping.rs` returns a mapping's queryable name only when its state is `Approved`. A `Proposed` or `ModelSuggested` mapping's query is refused with a typed error naming its actual state. | Verified by unit tests: an approved mapping's name is queryable, and a proposed or model-suggested mapping is each refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 197081533292 3dd56fe53283 crates/eg-plan/src/virtual_graph_mapping.rs:80 crates/eg-plan/src/virtual_graph_mapping.rs:87 crates/eg-plan/src/virtual_graph_mapping.rs:96 |
| EG-UNIFIED-DATA-PLANE-R006 Push down virtual-graph queries to source SQL Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Push down virtual-graph queries to source SQL.** EG renders joins across triples maps on the same source, aggregates, and ORDER BY/LIMIT into native source SQL using typed values rather than text casts, and shows any in-memory fallback explicitly in the query plan. Net-new (no pushdown-decision type existed on main): split per the net-new rule. `.1` is the typed decision/fallback model. Rollup: LANDED only once every child is. | A differential test compares pushed-down query results against the native source and confirms EXPLAIN reports the fallback reason when pushdown is not possible. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 545b68818f0b crates/eg-plan/src/pushdown_plan.rs:70 crates/eg-plan/src/pushdown_plan.rs:80 crates/eg-plan/src/pushdown_plan.rs:90 |
| EG-UNIFIED-DATA-PLANE-R006.1 `PushdownDecision` names an explicit fallback reason, refusing a decision that claims both success and a fallback Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`PushdownDecision` names an explicit fallback reason, refusing a decision that claims both success and a fallback.** `crates/eg-plan/src/pushdown_plan.rs` refuses a decision where `pushed_down` is true alongside a set `fallback_reason`, so EXPLAIN can never report a fallback reason for a fragment that actually pushed down. | Verified by unit tests: a pushed-down decision with no reason validates, a fallback decision validates, and a decision claiming both is refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 545b68818f0b crates/eg-plan/src/pushdown_plan.rs:70 crates/eg-plan/src/pushdown_plan.rs:80 crates/eg-plan/src/pushdown_plan.rs:90 |
| EG-UNIFIED-DATA-PLANE-R007 Federate attached tables as DataFusion table providers Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Federate attached tables as DataFusion table providers.** EG exposes attached tables as DataFusion TableProviders with dialect-aware sub-plan pushdown for projection, filter, limit, join, and aggregate operations, reusing the datafusion-table-providers and datafusion-federation crates where their license permits. Net-new (no pushdown-capability type existed on main): split per the net-new rule. `.1` is the typed capability model. Rollup: LANDED only once every child is. | An integration test compares a federated query plan and result against direct execution on the source for each supported pushdown operation. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 bff86f252aa4 e8695518196e crates/eg-plan/src/federation_capabilities.rs:106 crates/eg-plan/src/federation_capabilities.rs:71 crates/eg-plan/src/federation_capabilities.rs:85 crates/eg-plan/src/federation_capabilities.rs:92 |
| EG-UNIFIED-DATA-PLANE-R008 Normalize change capture into a durable, replayable framework Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Normalize change capture into a durable, replayable framework.** Each adapter emits ChangeEnvelope records into CdcHub, which persists a durable position per subscription, replays idempotently after restart, reports lag metrics with guardrails such as a WAL retention cap, and handles keyless tables explicitly. Catalog-drift detection re-runs schema intelligence and flags mappings that the drift breaks. No typed ChangeEnvelope model existed on main; split producer-first: `.1` is the typed model. Known blocker for the full row: depends on `EG-UNIFIED-DATA-PLANE-R002`, itself `BUILDING`. Rollup: LANDED only once every child is. | A fault-injection test stops and restarts capture mid-stream and confirms the replayed result matches a snapshot of the source, with drift detection flagging an affected mapping. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 343ebb9c7c6a 3dd56fe53283 64f76c5b3209 crates/eg-durable/src/change_envelope.rs:113 crates/eg-durable/src/change_envelope.rs:126 crates/eg-durable/src/change_envelope.rs:141 crates/eg-durable/src/change_envelope.rs:157 crates/eg-durable/src/change_envelope.rs:176 |
| EG-UNIFIED-DATA-PLANE-R008.1 `ChangeEnvelope`/`ChangeOp` are a typed change-capture record and a validated refusal rule, refusing a change with no durable position or a keyed table's update/delete with no key Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`ChangeEnvelope`/`ChangeOp` are a typed change-capture record and a validated refusal rule, refusing a change with no durable position or a keyed table's update/delete with no key.** `crates/eg-durable/src/change_envelope.rs` defines the `Insert`/`Update`/`Delete` op enum and the envelope's `source_position`/`table`/`op`/`key`/`table_is_keyless` fields, and `ChangeEnvelope::validate` refuses an empty `source_position` and refuses an `Update`/`Delete` with no `key` unless `table_is_keyless` is set. CdcHub, durable position storage, replay, lag metrics, the WAL retention cap, and catalog-drift detection are out of scope for this child. | Verified by unit tests: a keyed table's insert with no key validates, a keyed table's update with a key validates, an empty `source_position` is refused, a keyed table's update with no key is refused, and an explicitly keyless table's update with no key validates. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 64f76c5b3209 crates/eg-durable/src/change_envelope.rs:113 crates/eg-durable/src/change_envelope.rs:126 crates/eg-durable/src/change_envelope.rs:141 crates/eg-durable/src/change_envelope.rs:157 crates/eg-durable/src/change_envelope.rs:176 |
| EG-UNIFIED-DATA-PLANE-R007.1 `DialectPushdownCapabilities` declares a dialect's supported pushdown operations, refusing an unknown operation name Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`DialectPushdownCapabilities` declares a dialect's supported pushdown operations, refusing an unknown operation name.** `crates/eg-plan/src/federation_capabilities.rs` parses the five named operations (projection, filter, limit, join, aggregate) and refuses the whole capability declaration if any named operation is not one of them. | Verified by unit tests: all five names parse, an unknown name is refused, declaring all valid names succeeds, and one bad name among good ones refuses the whole declaration. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 e8695518196e crates/eg-plan/src/federation_capabilities.rs:106 crates/eg-plan/src/federation_capabilities.rs:71 crates/eg-plan/src/federation_capabilities.rs:85 crates/eg-plan/src/federation_capabilities.rs:92 |
| EG-UNIFIED-DATA-PLANE-R009 Drive consumers from change capture idempotently Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Drive consumers from change capture idempotently.** Change events update the graph through approved mappings, refresh vector and full-text indexes, and emit CEP and outbox events, all idempotent on the source position so a replayed event produces no duplicate effect. Net-new (no idempotent-consumer type existed on main): split per the net-new rule. `.1` is the typed checkpoint/idempotent-apply model. Rollup: LANDED only once every child is. | A replay test re-delivers the same change position and confirms each consumer's state is unchanged. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 79ba71d072a5 crates/eg-durable/src/idempotent_consumer.rs:60 crates/eg-durable/src/idempotent_consumer.rs:66 crates/eg-durable/src/idempotent_consumer.rs:74 crates/eg-durable/src/idempotent_consumer.rs:82 |
| EG-UNIFIED-DATA-PLANE-R010 Maintain an accelerated local copy of attached data Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Maintain an accelerated local copy of attached data.** EG maintains an optional cached virtual graph or columnar replica in eg-lake for attached tables, refreshed by change capture under a per-table acceleration policy. Depends on EG-UNIFIED-DATA-PLANE-R008 (change capture), which is being split concurrently. Split per the net-new rule (no typed acceleration-policy model existed on main): `.1` is the typed model. Rollup: LANDED only once every child is. | A restart/failover test shows the accelerated copy reconverges to the source within its declared lag objective. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 343ebb9c7c6a crates/eg-lake/src/acceleration_policy.rs:110 crates/eg-lake/src/acceleration_policy.rs:72 crates/eg-lake/src/acceleration_policy.rs:83 crates/eg-lake/src/acceleration_policy.rs:94 |
| EG-UNIFIED-DATA-PLANE-R010.1 `AccelerationPolicy` is a typed per-table policy, refusing a declaration its own verification could never check Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`AccelerationPolicy` is a typed per-table policy, refusing a declaration its own verification could never check.** `crates/eg-lake/src/acceleration_policy.rs` validates a declared policy names a real table and, when `enabled`, declares a non-zero lag objective — an enabled policy with no declared lag objective cannot be measured against a "reconverges within its declared lag objective" test. A disabled policy may carry `lag_objective_ms == 0`. | Verified by unit tests: an enabled policy with a positive lag objective validates, a disabled policy with `lag_objective_ms == 0` validates, an empty table name is refused regardless of `enabled`, and an enabled policy with `lag_objective_ms == 0` is refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 343ebb9c7c6a crates/eg-lake/src/acceleration_policy.rs:110 crates/eg-lake/src/acceleration_policy.rs:72 crates/eg-lake/src/acceleration_policy.rs:83 crates/eg-lake/src/acceleration_policy.rs:94 |
| EG-UNIFIED-DATA-PLANE-R009.1 `ConsumerCheckpoint` applies an incoming position idempotently, refusing an unnamed consumer Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`ConsumerCheckpoint` applies an incoming position idempotently, refusing an unnamed consumer.** `crates/eg-durable/src/idempotent_consumer.rs` refuses a checkpoint with no `consumer_id`, and `apply_if_newer` is a no-op on a replayed or stale position rather than reapplying it. | Verified by unit tests: a named checkpoint validates, an empty `consumer_id` is refused, a strictly newer position applies, and replaying the same position a second time is an idempotent no-op. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 79ba71d072a5 crates/eg-durable/src/idempotent_consumer.rs:60 crates/eg-durable/src/idempotent_consumer.rs:66 crates/eg-durable/src/idempotent_consumer.rs:74 crates/eg-durable/src/idempotent_consumer.rs:82 |
| EG-UNIFIED-DATA-PLANE-R011 Route queries by freshness across native, live, and accelerated paths Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Route queries by freshness across native, live, and accelerated paths.** The query router selects between the native store, a live source read, and the accelerated copy based on declared freshness policy, and a client requesting read-your-writes waits for its last committed source position up to a bounded timeout rather than returning a stale result. EXPLAIN reports the selected route. Net-new (no freshness-route type existed on main): split per the net-new rule. `.1` is the typed route/bounded-wait model. Rollup: LANDED only once every child is. | A timeout test confirms a read-your-writes request either waits successfully or fails explicitly, never returning stale data silently, and EXPLAIN output is checked against the actual route taken. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | bff86f252aa4 crates/eg-plan/src/freshness_router.rs:72 crates/eg-plan/src/freshness_router.rs:79 crates/eg-plan/src/freshness_router.rs:85 crates/eg-plan/src/freshness_router.rs:91 |
| EG-UNIFIED-DATA-PLANE-R011.1 `ReadYourWritesWait` is a bounded timeout, refusing a zero (unbounded) declaration; `FreshnessRoute` names exactly the three tiers Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`ReadYourWritesWait` is a bounded timeout, refusing a zero (unbounded) declaration; `FreshnessRoute` names exactly the three tiers.** `crates/eg-plan/src/freshness_router.rs` refuses constructing a wait with `timeout_ms == 0`, and resolves a wait to one of exactly two typed outcomes (satisfied or typed-timeout), never an implicit stale-data path. | Verified by unit tests: a positive timeout constructs, a zero timeout is refused, the two wait outcomes are distinct, and all three routes are known. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | bff86f252aa4 crates/eg-plan/src/freshness_router.rs:72 crates/eg-plan/src/freshness_router.rs:79 crates/eg-plan/src/freshness_router.rs:85 crates/eg-plan/src/freshness_router.rs:91 |
| EG-UNIFIED-DATA-PLANE-R012 Govern write-back to attached sources Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Govern write-back to attached sources.** EG writes back to an attached source only through an approved, idempotent path with an audit reservation, and prefers the application's own API over a direct write when the application declares business logic of its own. Rollup: split into `.1` (below) per SPEC-SIZING §5; further children land the live adapter dispatch and the EG-DURABLE-KERNEL-R031 audit reservation wiring. | A negative test confirms a write missing approval, an audit reservation, or idempotency is rejected before it reaches the source. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | b3aca9fb42ce d0a69c4685f5 crates/eg-types/src/attached_source_governance.rs:109 crates/eg-types/src/attached_source_governance.rs:120 crates/eg-types/src/attached_source_governance.rs:131 crates/eg-types/src/attached_source_governance.rs:142 crates/eg-types/src/attached_source_governance.rs:92 |
| EG-UNIFIED-DATA-PLANE-R012.1 Typed model for attached-source write-back governance, proved by refusal tests Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Typed model for attached-source write-back governance, proved by refusal tests.** `eg-types::attached_source_governance` defines `AttachedSourceWriteRequest` (approval reference, audit reservation digest, idempotency key, application-API-vs-direct-write path) and a fail-closed `validate` that refuses a write missing approval, missing an audit reservation, missing an idempotency key, or taking the direct-write path against a source that declares its own business logic. | Unit tests prove refusal for each of the four missing/disallowed conditions and acceptance for a fully-governed request. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | d0a69c4685f5 crates/eg-types/src/attached_source_governance.rs:109 crates/eg-types/src/attached_source_governance.rs:120 crates/eg-types/src/attached_source_governance.rs:131 crates/eg-types/src/attached_source_governance.rs:142 crates/eg-types/src/attached_source_governance.rs:92 |
| EG-UNIFIED-DATA-PLANE-R013 Implement the Postgres attached-source adapter Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Implement the Postgres attached-source adapter.** The Postgres adapter connects via sqlx/tokio-postgres, reads the pg_catalog, captures changes through pgoutput logical replication, and maps jsonb, array, enum, and pgvector types without loss. | A per-engine conformance entry compares EG's query and capture results against native Postgres for each covered type. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 6bc4b5668ed0 crates/eg-types/src/postgres_adapter.rs:205 |
| EG-UNIFIED-DATA-PLANE-R014 Implement the MySQL and MariaDB attached-source adapters Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Implement the MySQL and MariaDB attached-source adapters.** The MySQL and MariaDB adapters connect via sqlx mysql, read information_schema, capture changes through row-based binlog with GTID, and map each engine's types, with separate conformance entries for MySQL and MariaDB. | A per-engine conformance entry compares EG's query and capture results against native MySQL and against native MariaDB. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | bf6452b7f8d4 |
| EG-UNIFIED-DATA-PLANE-R014.1 Typed MySQL/MariaDB dialect-entry model (producer-first split of R014) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Typed MySQL/MariaDB dialect-entry model (producer-first split of R014).** A pure, typed model (`SqlEngineKind`, `SqlEngineCaptureSupport`, `SqlEngineDialectEntry`) keeps MySQL and MariaDB as two separate, explicitly declared dialect entries rather than one collapsed dialect, refusing to construct an entry with a default version floor or type-map revision. The driver, SQL rendering, catalog reader and binlog capture parts are later slices (`R014.2`+). | A test asserts a MySQL entry and a MariaDB entry built from equivalent inputs remain distinct (never merged), plus negative tests that an empty version floor and a zero type-map revision are both refused rather than defaulted. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 0e6a4eb8555d 3dd56fe53283 crates/eg-types/src/attached_source_dialect.rs:127 crates/eg-types/src/attached_source_dialect.rs:146 crates/eg-types/src/attached_source_dialect.rs:96 |
| EG-UNIFIED-DATA-PLANE-R014.2 Remaining scope of EG-UNIFIED-DATA-PLANE-R014 (slice .2): Implement the MySQL and MariaDB attached-source adapters Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Remaining scope of EG-UNIFIED-DATA-PLANE-R014 (slice .2): Implement the MySQL and MariaDB attached-source adapters.** Child slice of `EG-UNIFIED-DATA-PLANE-R014` (see tasks.md). This row is LANDED only once every child is. | A per-engine conformance entry compares EG's query and capture results against native MySQL and against native MariaDB | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R014.2.1 MySQL/MariaDB adapter skeleton: typed connection-config → driver-config mapping plus the connect/refusal path Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**MySQL/MariaDB adapter skeleton: typed connection-config → driver-config mapping plus the connect/refusal path.** `crates/eg-types/src/mysql_mariadb_connection.rs` defines `MysqlMariadbConnectionConfig`/`MysqlMariadbDriverConfig` and `to_driver_config`, refusing an empty host, empty database, empty username, or zero port before any network attempt — behind the existing `federation-sql` sqlx-mysql feature structure already present in `crates/eg-plan`. The binlog/GTID capture loop and real sqlx connection are `EG-UNIFIED-DATA-PLANE-R014.2.2+`. | Verified by unit tests needing no live database: a MySQL and a MariaDB config both map to a driver config; empty host, empty database, empty username, and zero port are each refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6b382bb1a3ec crates/eg-types/src/mysql_mariadb_connection.rs:107 crates/eg-types/src/mysql_mariadb_connection.rs:119 crates/eg-types/src/mysql_mariadb_connection.rs:130 crates/eg-types/src/mysql_mariadb_connection.rs:141 crates/eg-types/src/mysql_mariadb_connection.rs:152 |
| EG-UNIFIED-DATA-PLANE-R014.2.2 Live MySQL/MariaDB binlog/GTID capture and per-engine conformance Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live MySQL/MariaDB binlog/GTID capture and per-engine conformance.** Child slice of `EG-UNIFIED-DATA-PLANE-R014.2` wiring the real sqlx connection, row-based binlog with GTID, and the information_schema catalog read behind `MysqlMariadbDriverConfig` from `.2.1`. | A per-engine conformance entry compares EG's query and capture results against native MySQL and against native MariaDB. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R015 Implement the SQLite file attached-source adapter (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Implement the SQLite file attached-source adapter (rollup).** The SQLite adapter extends eg-sqlite-format to cover WITHOUT ROWID tables, attaches a live application's database file read-only in a lock-safe manner, and captures changes by WAL-frame tailing where safe or by rowid/updated_at watermark polling otherwise. No typed SQLite catalog model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A conformance test attaches a live SQLite fixture under concurrent writes and confirms no lock contention and correct change capture. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 423b02e97c9d |
| EG-UNIFIED-DATA-PLANE-R015.1 `SqliteSourceCatalog` is a typed catalog model with a WITHOUT-ROWID capture-safety refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`SqliteSourceCatalog` is a typed catalog model with a WITHOUT-ROWID capture-safety refusal.** `crates/eg-types/src/sqlite_attached_catalog.rs` defines `SqliteSourceCatalog`/`SqliteTableCatalog`/`SqliteColumn` with a closed `SqliteCaptureMode` vocabulary (`WalRowidTailing`, `WatermarkPolling`), and `validate_table` refuses a `WITHOUT ROWID` table that declares no primary-key column or that claims rowid/WAL tailing (it has no implicit rowid to tail). | Verified by unit tests: a rowid table with WAL tailing round-trips through `insert_table`; a WITHOUT ROWID table with a declared primary key and watermark polling is valid; a WITHOUT ROWID table with no primary key is refused; a WITHOUT ROWID table claiming WAL tailing is refused; an invalid table is refused rather than silently inserted; the capture-mode variants stay distinct; and the catalog serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 37003f28164f 6c11520aebfc crates/eg-types/src/sqlite_attached_catalog.rs:130 crates/eg-types/src/sqlite_attached_catalog.rs:147 crates/eg-types/src/sqlite_attached_catalog.rs:159 crates/eg-types/src/sqlite_attached_catalog.rs:171 crates/eg-types/src/sqlite_attached_catalog.rs:186 |
| EG-UNIFIED-DATA-PLANE-R015.2 Lock-safe live read-only attach and real WAL-frame tailing/watermark polling Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Lock-safe live read-only attach and real WAL-frame tailing/watermark polling.** Child slice of `EG-UNIFIED-DATA-PLANE-R015` (see tasks.md). This row is LANDED only once every child is. | A conformance test attaches a live SQLite fixture under concurrent writes and confirms no lock contention and correct change capture | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R015.2.1 SQLite live-attach adapter skeleton: typed attach-config → driver-open-config mapping plus the refusal path Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**SQLite live-attach adapter skeleton: typed attach-config → driver-open-config mapping plus the refusal path.** `crates/eg-types/src/sqlite_live_attach.rs` defines `SqliteAttachConfig`/`SqliteDriverOpenConfig` and `to_driver_open_config`, refusing an empty file path and refusing the `ReadOnlyImmutable` open mode paired with either declared `SqliteCaptureMode`. The real WAL-frame tailing/watermark polling against a live, concurrently-written file is `EG-UNIFIED-DATA-PLANE-R015.2.2+`. | Verified by unit tests needing no live database file: a lock-safe attach maps for both `WalRowidTailing` and `WatermarkPolling`. An empty file path is refused. The immutable open mode is refused for either capture mode. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6b382bb1a3ec crates/eg-types/src/sqlite_live_attach.rs:102 crates/eg-types/src/sqlite_live_attach.rs:113 crates/eg-types/src/sqlite_live_attach.rs:124 crates/eg-types/src/sqlite_live_attach.rs:84 crates/eg-types/src/sqlite_live_attach.rs:95 |
| EG-UNIFIED-DATA-PLANE-R015.2.2 Real WAL-frame tailing / watermark polling under concurrent writers Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Real WAL-frame tailing / watermark polling under concurrent writers.** Child slice of `EG-UNIFIED-DATA-PLANE-R015.2` wiring the real lock-safe open and capture loop behind `SqliteDriverOpenConfig` from `.2.1`. | A conformance test attaches a live SQLite fixture under concurrent writes and confirms no lock contention and correct change capture. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R016 Implement the Microsoft SQL Server attached-source adapter (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Implement the Microsoft SQL Server attached-source adapter (rollup).** The SQL Server adapter connects via the tiberius driver, reads the sys.* catalog, renders T-SQL including TOP and OFFSET/FETCH pagination, and captures changes through CDC or Change Tracking polled by LSN. No typed SQL Server catalog model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A conformance entry compares EG's query and capture results against native SQL Server. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R016.1 `MssqlSourceCatalog` is a typed catalog model with a bracket-quoting identifier refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`MssqlSourceCatalog` is a typed catalog model with a bracket-quoting identifier refusal.** `crates/eg-types/src/mssql_attached_catalog.rs` defines `MssqlSourceCatalog`/`MssqlTableCatalog`/`MssqlColumn` with a closed `MssqlCaptureMode` vocabulary (`Cdc`, `ChangeTracking`, `Unsupported`), and `validate_identifier`/`validate_table` refuse a schema or table identifier that is empty or contains `]` or a NUL byte — either would break the renderer's `[schema].[table]` bracket-quoting. | Verified by unit tests: a valid table round-trips through `insert_table`; an empty identifier is refused; a `]`-containing identifier is refused; a NUL-byte identifier is refused; an unsafe identifier is refused rather than silently inserted; `Unsupported` stays a distinct capture-mode variant; and the catalog serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 37003f28164f 6c11520aebfc crates/eg-types/src/mssql_attached_catalog.rs:119 crates/eg-types/src/mssql_attached_catalog.rs:132 crates/eg-types/src/mssql_attached_catalog.rs:141 crates/eg-types/src/mssql_attached_catalog.rs:147 crates/eg-types/src/mssql_attached_catalog.rs:153 |
| EG-UNIFIED-DATA-PLANE-R016.2 tiberius driver connection, T-SQL TOP/OFFSET-FETCH rendering, and LSN-polled CDC/Change Tracking capture Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**tiberius driver connection, T-SQL TOP/OFFSET-FETCH rendering, and LSN-polled CDC/Change Tracking capture.** Child slice of `EG-UNIFIED-DATA-PLANE-R016` (see tasks.md). This row is LANDED only once every child is. | A conformance entry compares EG's query and capture results against native SQL Server | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R016.2.1 MSSQL adapter skeleton: typed connection-config → tiberius-shaped driver-config mapping plus the connect/refusal path Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**MSSQL adapter skeleton: typed connection-config → tiberius-shaped driver-config mapping plus the connect/refusal path.** `crates/eg-types/src/mssql_driver_connection.rs` defines `MssqlConnectionConfig`/`MssqlDriverConfig` and `to_driver_config`, refusing an empty host, empty database, empty username, zero port, or `trust_server_certificate` paired with `Strict` encryption, before any network attempt. T-SQL TOP/OFFSET-FETCH rendering and the real tiberius connection + LSN-polled capture are `EG-UNIFIED-DATA-PLANE-R016.2.2+`. | Verified by unit tests needing no live server: a CDC and a Change Tracking config both map to a driver config. Empty host, empty database, zero port, and trusting an unverified certificate under strict encryption are each refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6b382bb1a3ec crates/eg-types/src/mssql_driver_connection.rs:113 crates/eg-types/src/mssql_driver_connection.rs:124 crates/eg-types/src/mssql_driver_connection.rs:135 crates/eg-types/src/mssql_driver_connection.rs:146 crates/eg-types/src/mssql_driver_connection.rs:157 |
| EG-UNIFIED-DATA-PLANE-R016.2.2 Real tiberius connection, T-SQL TOP/OFFSET-FETCH rendering, and LSN-polled CDC/Change Tracking capture loop Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Real tiberius connection, T-SQL TOP/OFFSET-FETCH rendering, and LSN-polled CDC/Change Tracking capture loop.** Child slice of `EG-UNIFIED-DATA-PLANE-R016.2` wiring the tiberius driver behind `MssqlDriverConfig` from `.2.1`. | A conformance entry compares EG's query and capture results against native SQL Server. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R017 Implement the ClickHouse attached-source adapter (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Implement the ClickHouse attached-source adapter (rollup).** The ClickHouse adapter connects via its HTTP or native client, reads the system.* catalog, and supports federation and acceleration while explicitly declaring that it has no change-capture capability. No typed ClickHouse catalog model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A conformance entry confirms federated query results match native ClickHouse and that capture requests return an explicit unsupported result. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R017.1 `ClickHouseSourceCatalog` is a typed catalog model whose capture capability is always explicit Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`ClickHouseSourceCatalog` is a typed catalog model whose capture capability is always explicit.** `crates/eg-types/src/clickhouse_attached_catalog.rs` defines `ClickHouseSourceCatalog`/`ClickHouseTableCatalog`/`ClickHouseColumn`, and `ClickHouseTableCatalog::capture_capability` always returns the single `ClickHouseCaptureCapability::Unsupported` value rather than a silently-missing `Option<_>`; `validate_table` refuses an empty database/table name or a table with no discovered columns. | Verified by unit tests: a valid table round-trips through `insert_table`; `capture_capability` is always explicitly `Unsupported`; an empty database/table name is refused; a table with no columns is refused; an invalid table is refused rather than silently inserted; and the catalog serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 37003f28164f 6c11520aebfc crates/eg-types/src/clickhouse_attached_catalog.rs:142 crates/eg-types/src/clickhouse_attached_catalog.rs:150 crates/eg-types/src/clickhouse_attached_catalog.rs:159 crates/eg-types/src/clickhouse_attached_catalog.rs:167 crates/eg-types/src/clickhouse_attached_catalog.rs:178 |
| EG-UNIFIED-DATA-PLANE-R017.2 HTTP/native client connection and federated query pushdown (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**HTTP/native client connection and federated query pushdown (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R017` (see tasks.md), split producer-first: `.2.1` is the typed driver config plus connect/refusal path. `.2.2` is live federated query pushdown. This row is LANDED only once every child is. | A conformance entry confirms federated query results match native ClickHouse and that capture requests return an explicit unsupported result | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 04791f8c77de |
| EG-UNIFIED-DATA-PLANE-R017.2.1 `ClickHouseDriverConfig` builds from validated host/port/database, and `connect` refuses an unsafe or invalid destination before issuing any request Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`ClickHouseDriverConfig` builds from validated host/port/database, and `connect` refuses an unsafe or invalid destination before issuing any request.** `crates/eg-plan/src/clickhouse_connection.rs` converts host/port/database into a `ClickHouseDriverConfig`, refusing an empty host, a zero port, or an empty database; `connect` resolves the configured host and refuses (does not dial) a non-loopback or otherwise unresolvable destination, mirroring the existing `connect_remote_engine` gate in `crates/eg-plan/src/federation.rs`. No live ClickHouse server is required. | Verified by unit tests needing no live database: a valid config round-trips; an empty host, zero port, and empty database are each refused; an unresolvable destination is refused by `connect`; and a loopback destination passes the refusal gate. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 04791f8c77de crates/eg-plan/src/clickhouse_connection.rs:114 crates/eg-plan/src/clickhouse_connection.rs:124 crates/eg-plan/src/clickhouse_connection.rs:133 crates/eg-plan/src/clickhouse_connection.rs:142 crates/eg-plan/src/clickhouse_connection.rs:151 |
| EG-UNIFIED-DATA-PLANE-R017.2.2 Live HTTP/native client federated query pushdown Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live HTTP/native client federated query pushdown.** `connect`'s validated handle issues real ClickHouse HTTP/native-client queries and pushes federated query fragments down to `system.*`-backed execution. Depends on `EG-UNIFIED-DATA-PLANE-R017.2.1`. | A conformance entry confirms federated query results match native ClickHouse and that capture requests return an explicit unsupported result. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R018 Implement the Oracle and Db2 attached-source adapters (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Implement the Oracle and Db2 attached-source adapters (rollup).** The Oracle and Db2 adapters query and read the catalog through their driver or ODBC, and capture changes through the Debezium bridge. No typed Oracle/Db2 catalog model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A conformance entry compares EG's query results against native Oracle and native Db2, and confirms captured changes match a Debezium-sourced change stream. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | c14a9a63a0b3 |
| EG-UNIFIED-DATA-PLANE-R018.1 `RelationalSourceCatalog` is a typed Oracle/Db2 catalog model with identifier and Debezium-capture refusals Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`RelationalSourceCatalog` is a typed Oracle/Db2 catalog model with identifier and Debezium-capture refusals.** `crates/eg-types/src/relational_attached_catalog.rs` defines `RelationalSourceCatalog`/`RelationalTableCatalog`/`RelationalColumn` over a closed `RelationalEngine` (`Oracle`, `Db2`); `validate_table` refuses a schema/table identifier that is empty or contains `"` or a NUL byte (either breaks double-quoted identifier rendering), and refuses a table marked `captured_via_debezium` with no declared primary-key column. | Verified by unit tests: a valid table round-trips through `insert_table`; a `"`-containing identifier is refused; a NUL-byte identifier is refused; a Debezium-captured table with no primary key is refused; a non-captured table with no primary key is valid; an invalid table is refused rather than silently inserted; and the catalog serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc eb058c53407e crates/eg-types/src/relational_attached_catalog.rs:137 crates/eg-types/src/relational_attached_catalog.rs:147 crates/eg-types/src/relational_attached_catalog.rs:155 crates/eg-types/src/relational_attached_catalog.rs:163 crates/eg-types/src/relational_attached_catalog.rs:173 |
| EG-UNIFIED-DATA-PLANE-R018.2 Driver/ODBC connection, catalog read, and Debezium bridge wiring (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Driver/ODBC connection, catalog read, and Debezium bridge wiring (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R018` (see tasks.md), split producer-first: `.2.1` is the typed driver config plus connect/refusal path; `.2.2` is live catalog read and Debezium bridge wiring. This row is LANDED only once every child is. | A conformance entry compares EG's query results against native Oracle and native Db2, and confirms captured changes match a Debezium-sourced change stream | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 04791f8c77de |
| EG-UNIFIED-DATA-PLANE-R018.2.1 `RelationalDriverConfig` builds from a validated engine/host/port/service name, and `connect` refuses an unsafe or invalid destination before issuing any request Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`RelationalDriverConfig` builds from a validated engine/host/port/service name, and `connect` refuses an unsafe or invalid destination before issuing any request.** `crates/eg-plan/src/relational_connection.rs` converts a `RelationalEngine` (`Oracle`, `Db2`) plus host/port/service name into a `RelationalDriverConfig`, refusing an empty host, a zero port, or an empty service name; `connect` resolves the configured host and refuses (does not dial) a non-loopback or otherwise unresolvable destination, mirroring the existing `connect_remote_engine` gate in `crates/eg-plan/src/federation.rs`. No live Oracle/Db2 server or Debezium bridge is required. | Verified by unit tests needing no live database: a valid config round-trips for each engine; an empty host, zero port, and empty service name are each refused; an unresolvable destination is refused by `connect`; and a loopback destination passes the refusal gate. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R018.2.2 Live driver/ODBC catalog read and Debezium bridge wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live driver/ODBC catalog read and Debezium bridge wiring.** `connect`'s validated handle reads the Oracle/Db2 catalog through its driver or ODBC and wires change capture through the Debezium bridge. Depends on `EG-UNIFIED-DATA-PLANE-R018.2.1`. | A conformance entry compares EG's query results against native Oracle and native Db2, and confirms captured changes match a Debezium-sourced change stream. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R019 Implement the MongoDB and DocumentDB attached-source adapter Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Implement the MongoDB and DocumentDB attached-source adapter.** The MongoDB/DocumentDB adapter connects through its native driver, represents the inferred document JSON shape as its catalog, and captures changes through native change streams. Split per the net-new rule (no document-catalog type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 211962e9c846 |
| EG-UNIFIED-DATA-PLANE-R019.1 `DocumentSourceCatalog` is a typed inferred-shape model with a refusal for a malformed field path Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`DocumentSourceCatalog` is a typed inferred-shape model with a refusal for a malformed field path.** `crates/eg-types/src/document_source_catalog.rs` defines `DocumentSourceCatalog`/`DocumentCollectionShape`/`DocumentField` with a closed `DocumentFieldType` vocabulary (including `Mixed` for sampling that observes more than one type at a path), and `validate_field_path` refuses an empty, leading/trailing-dot, empty-segment, or `$`-operator-prefixed path rather than admitting it into the shape. | Verified by unit tests: a valid dotted path round-trips through `insert_field`, each malformed path shape is refused, a malformed path is refused rather than silently inserted, `Mixed` stays a distinct variant, and the catalog serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 211962e9c846 6c11520aebfc crates/eg-types/src/document_source_catalog.rs:108 crates/eg-types/src/document_source_catalog.rs:119 crates/eg-types/src/document_source_catalog.rs:128 crates/eg-types/src/document_source_catalog.rs:135 crates/eg-types/src/document_source_catalog.rs:141 |
| EG-UNIFIED-DATA-PLANE-R019.2 Native MongoDB/DocumentDB driver connection and change-stream capture into ChangeEnvelope (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Native MongoDB/DocumentDB driver connection and change-stream capture into ChangeEnvelope (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R019` (see tasks.md), split producer-first: `.2.1` is the typed driver config plus connect/refusal path. `.2.2` is the live native-driver connection and change-stream capture. This row is LANDED only once every child is. | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 04791f8c77de 94edcf341758 c3b87d31ac11 |
| EG-UNIFIED-DATA-PLANE-R019.2.1 `DocumentDriverConfig` builds from a validated host/port/database, and `connect` refuses an unsafe or invalid destination before issuing any request Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`DocumentDriverConfig` builds from a validated host/port/database, and `connect` refuses an unsafe or invalid destination before issuing any request.** `crates/eg-plan/src/document_connection.rs` converts host/port/database into a `DocumentDriverConfig`, refusing an empty host, a zero port, or an empty database; `connect` resolves the configured host and refuses (does not dial) a non-loopback or otherwise unresolvable destination, mirroring the existing `connect_remote_engine` gate in `crates/eg-plan/src/federation.rs`. No live MongoDB/DocumentDB server is required; the native driver and change-stream capture are a later slice. | Verified by unit tests needing no live database: a valid config round-trips; an empty host, zero port, and empty database are each refused; an unresolvable destination is refused by `connect`; and a loopback destination passes the refusal gate. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R019.2.2 Live native driver connection and change-stream capture into `ChangeEnvelope` Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live native driver connection and change-stream capture into `ChangeEnvelope`.** `connect`'s validated handle opens a real MongoDB/DocumentDB native-driver session and captures native change-stream events into `ChangeEnvelope`. Depends on `EG-UNIFIED-DATA-PLANE-R019.2.1`. | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R019.3 Conformance entry comparing EG query results and captured change stream against native MongoDB/DocumentDB (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Conformance entry comparing EG query results and captured change stream against native MongoDB/DocumentDB (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R019` (see tasks.md), split producer-first: `.3.1` is the typed per-adapter conformance-entry constructor. `.3.2` is actually running the comparison against native MongoDB/DocumentDB. This row is LANDED only once every child is. | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R019.3.1 `build_document_conformance_entry` builds a MongoDB/DocumentDB conformance entry with a fixed adapter label, refusing a malformed outcome/deviation shape Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`build_document_conformance_entry` builds a MongoDB/DocumentDB conformance entry with a fixed adapter label, refusing a malformed outcome/deviation shape.** `crates/eg-types/src/document_conformance.rs` defines the closed `DocumentConformanceEngine` vocabulary (`MongoDb6`/`MongoDb7`/`DocumentDb`) and builds a `DialectConformanceEntry` (EG-UNIFIED-DATA-PLANE-R022.1) whose `adapter` is always the fixed `mongodb_documentdb` label, never a caller-supplied string, delegating to that type's own refusal for a deviated entry with no reviewed deviation or a green entry carrying one. No live MongoDB/DocumentDB connection is required; actually running the comparison is a later child. | Verified by unit tests needing no live database: a green entry builds with the fixed adapter label; each engine variant maps to its own version label; a deviated entry with no reviewed deviation is refused; a deviated entry with a reviewed deviation builds; and a green entry carrying a deviation is refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | d6e3cf6232d8 crates/eg-types/src/document_conformance.rs:101 crates/eg-types/src/document_conformance.rs:118 crates/eg-types/src/document_conformance.rs:65 crates/eg-types/src/document_conformance.rs:78 crates/eg-types/src/document_conformance.rs:90 |
| EG-UNIFIED-DATA-PLANE-R019.3.2 Live comparison of EG's query results and captured change stream against native MongoDB/DocumentDB Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live comparison of EG's query results and captured change stream against native MongoDB/DocumentDB.** Runs the comparison and records its real outcome through `build_document_conformance_entry`. Depends on `EG-UNIFIED-DATA-PLANE-R019.3.1` and `EG-UNIFIED-DATA-PLANE-R019.2`. | A conformance entry compares EG's query results and captured change stream against native MongoDB/DocumentDB. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R020 Federate Snowflake, BigQuery, DuckDB, and Iceberg sources Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Federate Snowflake, BigQuery, DuckDB, and Iceberg sources.** EG federates queries to Snowflake, BigQuery, DuckDB, and Iceberg as read-only sources, extending the existing iceberg_federation.rs for Iceberg, and uses Arrow Flight SQL where the source offers it. Split per the net-new rule (no warehouse-source-kind type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A conformance entry compares federated query results against each native warehouse or lake engine. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 74870676b1cc |
| EG-UNIFIED-DATA-PLANE-R020.1 `WarehouseSourceKind`/`WarehouseSourceConfig` are a closed source-kind vocabulary with a per-kind required-field refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`WarehouseSourceKind`/`WarehouseSourceConfig` are a closed source-kind vocabulary with a per-kind required-field refusal.** `crates/eg-types/src/warehouse_federation.rs` defines `WarehouseSourceKind` (`Snowflake`/`BigQuery`/`DuckDb`/`Iceberg`), each kind's declared Arrow-Flight-SQL offering and required connection-config fields, and `WarehouseSourceConfig::validate`, which refuses a config with no declared kind or a missing/empty required field rather than deferring the gap to connect time. | Verified by unit tests: a complete Snowflake config validates, an incomplete BigQuery config names its missing field, an empty field value counts as missing, an undeclared kind is refused rather than guessed, Flight SQL is offered only by the declared kinds, and the config serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc 74870676b1cc crates/eg-types/src/warehouse_federation.rs:118 crates/eg-types/src/warehouse_federation.rs:128 crates/eg-types/src/warehouse_federation.rs:136 crates/eg-types/src/warehouse_federation.rs:143 crates/eg-types/src/warehouse_federation.rs:150 |
| EG-UNIFIED-DATA-PLANE-R020.2 Query pushdown per kind (Arrow Flight SQL where offered), extending eg-query::sql::iceberg_federation for Iceberg (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Query pushdown per kind (Arrow Flight SQL where offered), extending eg-query::sql::iceberg_federation for Iceberg (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R020` (see tasks.md), split producer-first: `.2.1` is the typed pushdown-transport dispatch plus its refusal path. `.2.2` is actually issuing the pushed-down query per kind. This row is LANDED only once every child is. | A conformance entry compares federated query results against each native warehouse or lake engine | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R020.2.1 `plan_pushdown` decides the Arrow-Flight-SQL-vs-native transport for a validated `WarehouseSourceConfig`, refusing an invalid config or an unmet Flight SQL preference Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`plan_pushdown` decides the Arrow-Flight-SQL-vs-native transport for a validated `WarehouseSourceConfig`, refusing an invalid config or an unmet Flight SQL preference.** `crates/eg-plan/src/warehouse_pushdown.rs` defines `WarehousePushdownRequest`/`WarehousePushdownTransport` and `plan_pushdown`, which first delegates to `WarehouseSourceConfig::validate` (EG-UNIFIED-DATA-PLANE-R020.1) and then refuses — rather than silently downgrading — a `prefer_flight_sql` request against a kind that does not offer it. Issues no request and opens no connection. | Verified by unit tests needing no live warehouse: Snowflake prefers Flight SQL when requested; DuckDB with no preference uses native; a DuckDB/Iceberg Flight SQL preference is refused rather than downgraded; and an invalid or kind-less config is refused before any transport decision. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | d6e3cf6232d8 crates/eg-plan/src/warehouse_pushdown.rs:111 crates/eg-plan/src/warehouse_pushdown.rs:127 crates/eg-plan/src/warehouse_pushdown.rs:145 crates/eg-plan/src/warehouse_pushdown.rs:160 crates/eg-plan/src/warehouse_pushdown.rs:173 |
| EG-UNIFIED-DATA-PLANE-R020.2.2 Live Arrow Flight SQL / native query pushdown per kind, extending `eg-query::sql::iceberg_federation` for Iceberg Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live Arrow Flight SQL / native query pushdown per kind, extending `eg-query::sql::iceberg_federation` for Iceberg.** `plan_pushdown`'s validated transport decision is used to issue the real pushed-down query against each native warehouse or lake engine. Depends on `EG-UNIFIED-DATA-PLANE-R020.2.1`. | A conformance entry compares federated query results against each native warehouse or lake engine. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R020.3 Conformance entry comparing federated query results against each native warehouse/lake engine (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Conformance entry comparing federated query results against each native warehouse/lake engine (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R020` (see tasks.md), split producer-first: `.3.1` is the typed per-kind conformance-entry constructor. `.3.2` is actually running the comparison against each native engine. This row is LANDED only once every child is. | A conformance entry compares federated query results against each native warehouse or lake engine | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R020.3.1 `build_warehouse_conformance_entry` builds a warehouse/lake conformance entry whose adapter label is derived from the closed `WarehouseSourceKind`, refusing a blank engine version or a malformed outcome/deviation shape Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`build_warehouse_conformance_entry` builds a warehouse/lake conformance entry whose adapter label is derived from the closed `WarehouseSourceKind`, refusing a blank engine version or a malformed outcome/deviation shape.** `crates/eg-types/src/warehouse_conformance.rs` derives the `adapter` label (`warehouse_snowflake`/`warehouse_bigquery`/`warehouse_duckdb`/`warehouse_iceberg`) from `WarehouseSourceKind` (EG-UNIFIED-DATA-PLANE-R020.1) rather than a caller-supplied string, refuses an empty `engine_version`, and delegates to `DialectConformanceEntry::validate` (EG-UNIFIED-DATA-PLANE-R022.1) for the outcome/deviation shape. No live warehouse/lake connection is required; actually running the comparison is a later child. | Verified by unit tests needing no live engine: a green entry builds with the kind-derived label; each kind maps to a distinct label; an empty engine version is refused; a deviated entry with no reviewed deviation is refused; and a deviated entry with a reviewed deviation builds. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | d6e3cf6232d8 crates/eg-types/src/warehouse_conformance.rs:102 crates/eg-types/src/warehouse_conformance.rs:119 crates/eg-types/src/warehouse_conformance.rs:134 crates/eg-types/src/warehouse_conformance.rs:151 crates/eg-types/src/warehouse_conformance.rs:88 |
| EG-UNIFIED-DATA-PLANE-R020.3.2 Live comparison of federated query results against each native warehouse/lake engine Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live comparison of federated query results against each native warehouse/lake engine.** Runs the comparison and records its real outcome through `build_warehouse_conformance_entry`. Depends on `EG-UNIFIED-DATA-PLANE-R020.3.1` and `EG-UNIFIED-DATA-PLANE-R020.2`. | A conformance entry compares federated query results against each native warehouse or lake engine. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R021 Bridge Debezium Kafka events into ChangeEnvelope Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Bridge Debezium Kafka events into ChangeEnvelope.** EG consumes Debezium change events from Kafka and converts them into ChangeEnvelope records for any Debezium-supported source, reimplementing Debezium's envelope semantics natively in EG. Split per the net-new rule (no Debezium event type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A replay test feeds a captured Debezium event stream through the bridge and confirms the resulting ChangeEnvelope sequence matches the source's actual changes. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc 9cb571fb74aa de71b5ddd2b2 crates/eg-types/src/debezium_bridge.rs:273 crates/eg-types/src/debezium_bridge.rs:282 crates/eg-types/src/debezium_bridge.rs:291 crates/eg-types/src/debezium_bridge.rs:303 crates/eg-types/src/debezium_bridge.rs:315 |
| EG-UNIFIED-DATA-PLANE-R021.1 `DebeziumChangeEvent` is a typed envelope shape with an op-code and before/after refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`DebeziumChangeEvent` is a typed envelope shape with an op-code and before/after refusal.** `crates/eg-types/src/debezium_bridge.rs` defines the closed `DebeziumOp` vocabulary (`c`/`u`/`d`/`r`, refusing an unrecognized code), `DebeziumSource`, `DebeziumChangeEvent`, and `validate`, which refuses a create/update/read event with no `after` row or a delete event with no `before` row; `to_change_cursor` maps the source position onto an opaque `ChangeCursor`. | Verified by unit tests: every known op code parses, an unknown code is refused, a create without `after` and a delete without `before` are refused, a well-formed update validates, the cursor stays opaque and carries the source position, and the event serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc 9cb571fb74aa crates/eg-types/src/debezium_bridge.rs:273 crates/eg-types/src/debezium_bridge.rs:282 crates/eg-types/src/debezium_bridge.rs:291 crates/eg-types/src/debezium_bridge.rs:303 crates/eg-types/src/debezium_bridge.rs:315 |
| EG-UNIFIED-DATA-PLANE-R021.2 Kafka consumer plus real conversion into ChangeEnvelope records Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Kafka consumer plus real conversion into ChangeEnvelope records.** Child slice of `EG-UNIFIED-DATA-PLANE-R021` (see tasks.md). | A replay test feeds a captured Debezium event stream through the bridge and confirms the resulting ChangeEnvelope sequence matches the source's actual changes | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | de71b5ddd2b2 crates/eg-types/src/debezium_bridge.rs:361 crates/eg-types/src/debezium_bridge.rs:402 |
| EG-UNIFIED-DATA-PLANE-R021.3 Replay test feeding a captured Debezium event stream through the bridge Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Replay test feeding a captured Debezium event stream through the bridge.** Child slice of `EG-UNIFIED-DATA-PLANE-R021` (see tasks.md). | A replay test feeds a captured Debezium event stream through the bridge and confirms the resulting ChangeEnvelope sequence matches the source's actual changes | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | de71b5ddd2b2 crates/eg-types/src/debezium_bridge.rs:417 |
| EG-UNIFIED-DATA-PLANE-R022 Build a per-dialect conformance harness Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Build a per-dialect conformance harness.** A conformance harness runs each adapter against a containerized matrix of supported engine versions, verifying that pushed-down query results equal the native source's result and that a change-capture replay equals a snapshot of the source. Split per the net-new rule (no conformance-entry type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | The harness reports a green conformance entry per engine/version pair and a reviewed deviation for any known difference. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 23769c3ec0f9 |
| EG-UNIFIED-DATA-PLANE-R022.1 `DialectConformanceEntry`/`ConformanceReport` are a typed per-engine-version result with a refusal for an auto-suppressed deviation Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`DialectConformanceEntry`/`ConformanceReport` are a typed per-engine-version result with a refusal for an auto-suppressed deviation.** `crates/eg-types/src/dialect_conformance.rs` defines `ConformanceOutcome` (green/deviated), `ConformanceDeviation` (description, reviewer, reproducing fixture), and `validate`, which refuses a deviated entry with no deviation record, a green entry carrying one, or a deviation with a blank reviewer — a deviation can never be auto-suppressed. | Verified by unit tests: a green entry without deviation validates, a deviated entry with a reviewed deviation validates, a deviated entry without one is refused, a green entry with one is refused, a blank-reviewer deviation is refused, and a report refuses if any entry is malformed while still reporting its green count. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 23769c3ec0f9 6c11520aebfc crates/eg-types/src/dialect_conformance.rs:121 crates/eg-types/src/dialect_conformance.rs:133 crates/eg-types/src/dialect_conformance.rs:145 crates/eg-types/src/dialect_conformance.rs:160 crates/eg-types/src/dialect_conformance.rs:175 |
| EG-UNIFIED-DATA-PLANE-R022.2 Containerized matrix runner per adapter/engine version Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Containerized matrix runner per adapter/engine version.** Child slice of `EG-UNIFIED-DATA-PLANE-R022` (see tasks.md). | The harness reports a green conformance entry per engine/version pair and a reviewed deviation for any known difference | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R022.3 Change-capture replay comparison against a source snapshot (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Change-capture replay comparison against a source snapshot (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R022` (see tasks.md), split producer-first: `.3.1` is the pure comparison and conformance-entry construction. `.3.2` is running it against a real replay stream and source snapshot. This row is LANDED only once every child is. | The harness reports a green conformance entry per engine/version pair and a reviewed deviation for any known difference | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R022.3.1 `compare_replay_to_snapshot` builds a `DialectConformanceEntry` from a replayed row-state map and a source-snapshot row-state map, refusing a blank engine version Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`compare_replay_to_snapshot` builds a `DialectConformanceEntry` from a replayed row-state map and a source-snapshot row-state map, refusing a blank engine version.** `crates/eg-types/src/replay_conformance.rs` compares the two already-captured maps and delegates to `DialectConformanceEntry::validate` (EG-UNIFIED-DATA-PLANE-R022.1) for the outcome/deviation shape: a difference is `Deviated` with no deviation record, so it still needs human review before it validates — never auto-suppressed. No live replay stream or source connection is read; running the comparison against a real replay is a later child. | Verified by unit tests needing no live replay stream: matching maps build a `Green` entry; differing maps build a `Deviated` entry that is refused until reviewed; a blank engine version is refused; and a fixture source-snapshot comparison builds `Green`. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | a4d1e790a69e crates/eg-types/src/replay_conformance.rs:114 crates/eg-types/src/replay_conformance.rs:124 crates/eg-types/src/replay_conformance.rs:82 crates/eg-types/src/replay_conformance.rs:96 |
| EG-UNIFIED-DATA-PLANE-R022.3.2 Live change-capture replay comparison against a real source snapshot Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live change-capture replay comparison against a real source snapshot.** Feeds a real replay stream's resulting row state and a real source snapshot through `compare_replay_to_snapshot`. Depends on `EG-UNIFIED-DATA-PLANE-R022.3.1` and `EG-UNIFIED-DATA-PLANE-R022.2`. | The harness reports a green conformance entry per engine/version pair and a reviewed deviation for any known difference. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R022.4 Source-category coverage matrix Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Source-category coverage matrix.** The conformance harness must hold one matrix row per `SourceCategory` of `EG-UNIFIED-DATA-PLANE-R038.3.1`. Each row names the standard protocol or format, the pushdown capabilities, the mapping form and the hot-path proof test. The pushdown capabilities are filter, projection, join, aggregate, limit and time range. The matrix is the table in `plan.md`. A category without a passing hot-path proof must report `unproven`. | A unit test fails when a category lacks a row. It reports `unproven` for a category without a passing proof. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R022.4.1 Residency column Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Residency column.** The matrix in `plan.md` must state the default residency of each category. Closed residency values are `virtual` and `ingested`. The web metasearch row must state `virtual` with a 900 s time-to-live. A fetched web page has no virtual category. It enters as a Document through `EG-UNIFIED-DATA-PLANE-R651.7`. Proving test: `crates/eg-types/src/dialect_conformance.rs::tests::matrix_states_residency`. | The test fails when a category row has no residency value. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R023 Operate a shared CloudNativePG and MariaDB platform Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Operate a shared CloudNativePG and MariaDB platform.** EG runs attached applications on a shared platform using CloudNativePG, grouping clusters by major version and required extensions, with a dedicated database and role per application, separate EG read and replication roles, wal_level set to logical, point-in-time recovery to object storage, scheduled restore drills, and local storage volumes. A separate shared MariaDB group serves MariaDB-based applications. Split per the net-new rule (no cluster-group type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 03439e243c80 |
| EG-UNIFIED-DATA-PLANE-R023.1 `SharedPlatformClusterGroup` is a typed cluster-group and role-set model with engine-specific refusals Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`SharedPlatformClusterGroup` is a typed cluster-group and role-set model with engine-specific refusals.** `crates/eg-types/src/shared_db_platform.rs` defines `SharedPlatformEngine` (CloudNativePG/MariaDB), `ApplicationRoleSet` (dedicated application/EG-read/EG-replication roles), and `validate`, which refuses a CloudNativePG group not declaring `wal_level=logical`, a MariaDB group declaring one, an application aliasing two of its three roles, and an empty group. | Verified by unit tests: a well-formed Postgres group validates, a non-logical or absent `wal_level` is refused, a MariaDB group with a `wal_level` is refused and without one validates, an aliased role is refused, and an empty group is refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 03439e243c80 6c11520aebfc crates/eg-types/src/shared_db_platform.rs:138 crates/eg-types/src/shared_db_platform.rs:144 crates/eg-types/src/shared_db_platform.rs:155 crates/eg-types/src/shared_db_platform.rs:166 crates/eg-types/src/shared_db_platform.rs:182 |
| EG-UNIFIED-DATA-PLANE-R023.2 CloudNativePG/MariaDB operator wiring and PITR schedule to object storage (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**CloudNativePG/MariaDB operator wiring and PITR schedule to object storage (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R023` (see tasks.md), split producer-first: `.2.1` is the typed PITR schedule contract and refusal path. `.2.2` is wiring the real operator CRDs and installing the schedule. This row is LANDED only once every child is. | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R023.2.1 `PitrSchedule`/`validate` are a typed PITR schedule contract with an engine/archiving-mode refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`PitrSchedule`/`validate` are a typed PITR schedule contract with an engine/archiving-mode refusal.** `crates/eg-types/src/pitr_schedule.rs` defines `ContinuousArchivingMode` (logical-WAL/binlog) and `PitrSchedule`, whose `validate` refuses an archiving mode that does not match the cluster group's `SharedPlatformEngine` (EG-UNIFIED-DATA-PLANE-R023.1), a zero retention window, or a blank cron or destination URI. No CloudNativePG/MariaDB operator is wired yet; installing the real schedule is a later child. | Verified by unit tests needing no live operator: a well-formed Postgres schedule validates; a Postgres schedule with binlog archiving is refused; a MariaDB schedule with logical-WAL archiving is refused; a MariaDB schedule with binlog validates; zero retention is refused; and a blank cron or destination is refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | a4d1e790a69e crates/eg-types/src/pitr_schedule.rs:110 crates/eg-types/src/pitr_schedule.rs:116 crates/eg-types/src/pitr_schedule.rs:127 crates/eg-types/src/pitr_schedule.rs:139 crates/eg-types/src/pitr_schedule.rs:148 |
| EG-UNIFIED-DATA-PLANE-R023.2.2 Live CloudNativePG/MariaDB operator wiring and PITR schedule installation to object storage Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live CloudNativePG/MariaDB operator wiring and PITR schedule installation to object storage.** Installs a validated `PitrSchedule` against the real operator CRDs. Depends on `EG-UNIFIED-DATA-PLANE-R023.2.1`. | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R023.3 Restore-drill automation and post-restore data-match verification (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Restore-drill automation and post-restore data-match verification (rollup).** Child slice of `EG-UNIFIED-DATA-PLANE-R023` (see tasks.md), split producer-first: `.3.1` is the typed drill-result contract and refusal path. `.3.2` is automating the real drill. This row is LANDED only once every child is. | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R023.3.1 `RestoreDrillResult`/`validate` are a typed drill-result contract that refuses a `data_matched` flag disagreeing with the actual digest comparison Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`RestoreDrillResult`/`validate` are a typed drill-result contract that refuses a `data_matched` flag disagreeing with the actual digest comparison.** `crates/eg-types/src/restore_drill.rs` defines `RestoreDrillResult` and `from_digests`, the only constructor that derives `data_matched` from comparing the pre/post-restore digests; `validate` refuses a matched flag with differing digests, a mismatched flag with equal digests, or a blank digest. No restore is run yet; automating the real drill is a later child. | Verified by unit tests needing no live cluster: matching and differing digests built via `from_digests` both validate; a hand-set matched flag with differing digests is refused; a hand-set mismatched flag with equal digests is refused; and a blank digest is refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | a4d1e790a69e crates/eg-types/src/restore_drill.rs:108 crates/eg-types/src/restore_drill.rs:121 crates/eg-types/src/restore_drill.rs:134 crates/eg-types/src/restore_drill.rs:150 crates/eg-types/src/restore_drill.rs:166 |
| EG-UNIFIED-DATA-PLANE-R023.3.2 Live restore-drill automation and post-restore data-match verification Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Live restore-drill automation and post-restore data-match verification.** Runs the real restore drill and records its digests through `RestoreDrillResult::from_digests`. Depends on `EG-UNIFIED-DATA-PLANE-R023.3.1` and `EG-UNIFIED-DATA-PLANE-R023.2`. | A restore drill independently recovers a cluster from its point-in-time recovery backup and confirms data matches the pre-restore state. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R024 Admit applications to the shared platform with rollback Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Admit applications to the shared platform with rollback.** EG admits each application to the shared database platform one at a time, with a tested rollback path, and retires that application's prior ingest connector only after it is fully attached with parity. Split per the net-new rule (no admission-stage type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | An admission test for each candidate application confirms rollback restores the prior state and that the retired connector no longer writes. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 15a7370ecac3 1b3cc2f03fa2 6c11520aebfc crates/eg-types/src/platform_admission.rs:232 crates/eg-types/src/platform_admission.rs:242 crates/eg-types/src/platform_admission.rs:254 crates/eg-types/src/platform_admission.rs:262 crates/eg-types/src/platform_admission.rs:272 |
| EG-UNIFIED-DATA-PLANE-R024.1 `ApplicationAdmission` is a typed stage machine refusing early connector retirement Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`ApplicationAdmission` is a typed stage machine refusing early connector retirement.** `crates/eg-types/src/platform_admission.rs` defines `AdmissionStage` (`Pending`/`Admitted`/`ParityConfirmed`/`ConnectorRetired`/`RolledBack`) and `advance`, the one entry point that moves a record, which refuses retiring the connector before `ParityConfirmed` and refuses a rollback once the connector is retired. | Verified by unit tests: the full admission path advances in order, retiring the connector before parity or from `Pending` is refused without changing the recorded stage, rollback is allowed before connector retirement, rollback after retirement is refused, and the record serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 1b3cc2f03fa2 6c11520aebfc crates/eg-types/src/platform_admission.rs:232 crates/eg-types/src/platform_admission.rs:242 crates/eg-types/src/platform_admission.rs:254 crates/eg-types/src/platform_admission.rs:262 crates/eg-types/src/platform_admission.rs:272 |
| EG-UNIFIED-DATA-PLANE-R024.2 Admission runner and tested rollback path per candidate application Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Admission runner and tested rollback path per candidate application.** Split per the net-new rule (no runner existed on main): `.1` is the runner slice needing no live service; the live per-application runs against the real candidates are a later child. | An admission test for each candidate application confirms rollback restores the prior state and that the retired connector no longer writes | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 15a7370ecac3 crates/eg-types/src/platform_admission.rs:292 crates/eg-types/src/platform_admission.rs:304 crates/eg-types/src/platform_admission.rs:317 |
| EG-UNIFIED-DATA-PLANE-R024.2.1 `AdmissionRunner` drives `ApplicationAdmission` against a pluggable `PriorIngestConnector`, with a tested rollback path Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`AdmissionRunner` drives `ApplicationAdmission` against a pluggable `PriorIngestConnector`, with a tested rollback path.** `crates/eg-types/src/platform_admission.rs` adds `PriorIngestConnector`, `AdmissionRunner`, and `AdmissionRunError`; the runner retires the connector only after `ParityConfirmed` and refuses to record retirement if the connector still reports writing. Needs no live candidate application: driven against a fake in-process connector. | Verified by unit tests: retiring the connector after parity stops its writes, rollback restores `Pending`-reachable state while the connector keeps writing, and rollback is refused once the connector is retired. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 15a7370ecac3 crates/eg-types/src/platform_admission.rs:292 crates/eg-types/src/platform_admission.rs:304 crates/eg-types/src/platform_admission.rs:317 |
| EG-UNIFIED-DATA-PLANE-R024.3 Per-application admission test confirming rollback and that the retired connector no longer writes Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Per-application admission test confirming rollback and that the retired connector no longer writes.** Split per the net-new rule (no such test existed on main): `.1` covers every candidate application against a fake connector, needing no live service; the live per-application runs against the real candidates are a later child. | An admission test for each candidate application confirms rollback restores the prior state and that the retired connector no longer writes | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 15a7370ecac3 crates/eg-types/src/platform_admission.rs:352 |
| EG-UNIFIED-DATA-PLANE-R024.3.1 One fake-connector admission test per candidate application, confirming rollback and that the retired connector no longer writes Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**One fake-connector admission test per candidate application, confirming rollback and that the retired connector no longer writes.** `crates/eg-types/src/platform_admission.rs` runs the rollback-restores-state and retirement-stops-writes assertions for each of `gramps`, `immich`, and `firefly` against `AdmissionRunner`. Needs no live candidate application. | Verified by a unit test iterating all three candidate applications: each confirms rollback leaves the prior connector writing and that a retired connector stops writing. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 15a7370ecac3 crates/eg-types/src/platform_admission.rs:352 |
| EG-UNIFIED-DATA-PLANE-R025 Evaluate a pgrx companion extension through a spike Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evaluate a pgrx companion extension through a spike.** A pgrx-based companion extension spike evaluates running a slice of EG inside Postgres, covering SPARQL over tables, vector search, one time-series kernel, and a wait-for-position helper, concluding in an approved go/no-go architecture decision record. Split per the net-new rule (no spike-decision type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | The spike's results and the recorded decision are reviewed against its defined scope before further pgrx work is authorized. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | e265a52820f5 |
| EG-UNIFIED-DATA-PLANE-R025.1 `PgrxSpikeDecision` is a typed decision record refusing an outcome without full-scope evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`PgrxSpikeDecision` is a typed decision record refusing an outcome without full-scope evidence.** `crates/eg-types/src/pgrx_spike.rs` defines the closed `PgrxSpikeArea` vocabulary (SPARQL over tables, vector search, time-series kernel, wait-for-position helper) and `validate`, which refuses a decision missing evidence for any declared area or recording no outcome. | Verified by unit tests: a complete decision validates with its outcome, a missing area is refused and named, a decision without an outcome is refused, an empty decision names every missing area, and the record serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc e265a52820f5 crates/eg-types/src/pgrx_spike.rs:171 crates/eg-types/src/pgrx_spike.rs:181 crates/eg-types/src/pgrx_spike.rs:197 crates/eg-types/src/pgrx_spike.rs:207 crates/eg-types/src/pgrx_spike.rs:217 |
| EG-UNIFIED-DATA-PLANE-R025.2 Run the spike across its declared scope areas Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run the spike across its declared scope areas.** Split per the net-new rule (no spike runner existed on main): `.1` is the runner slice needing no live pgrx/Postgres instance; the live run inside pgrx/Postgres is a later child. | The spike's results and the recorded decision are reviewed against its defined scope before further pgrx work is authorized | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 15a7370ecac3 crates/eg-types/src/pgrx_spike.rs:229 crates/eg-types/src/pgrx_spike.rs:242 crates/eg-types/src/pgrx_spike.rs:257 |
| EG-UNIFIED-DATA-PLANE-R025.2.1 `run_spike` assembles a `PgrxSpikeDecision` from one evidence source per declared area, deferring to the typed model's full-scope refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`run_spike` assembles a `PgrxSpikeDecision` from one evidence source per declared area, deferring to the typed model's full-scope refusal.** `crates/eg-types/src/pgrx_spike.rs` adds `PgrxSpikeAreaEvaluator` and `run_spike`, which collects one `PgrxSpikeEvidence` per evaluator and validates the assembled decision. Needs no live pgrx extension or Postgres instance: driven against fake evaluators. | Verified by unit tests: a full set of evaluators plus an outcome produces a valid decision, an evaluator set missing an area is refused and named, and a complete evaluator set with no outcome is refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 15a7370ecac3 crates/eg-types/src/pgrx_spike.rs:229 crates/eg-types/src/pgrx_spike.rs:242 crates/eg-types/src/pgrx_spike.rs:257 |
| EG-UNIFIED-DATA-PLANE-R025.3 Review the spike's results and recorded decision; produce the approved ADR Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Review the spike's results and recorded decision; produce the approved ADR.** Child slice of `EG-UNIFIED-DATA-PLANE-R025` (see tasks.md). This row is LANDED only once every child is. | The spike's results and the recorded decision are reviewed against its defined scope before further pgrx work is authorized | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R025.3.1 Review skeleton: typed review request → approved ADR mapping plus the refusal path Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Review skeleton: typed review request → approved ADR mapping plus the refusal path.** `crates/eg-types/src/pgrx_spike_review.rs` defines `PgrxSpikeReviewRequest`/`ApprovedPgrxAdr` and `approve`, refusing an invalid underlying decision, an empty reviewer, or an empty ADR title before any ADR is approved. Filing the ADR document and the live spike results it reviews are `EG-UNIFIED-DATA-PLANE-R025.3.2+`. | Verified by unit tests needing no live service: a well-formed review approves the ADR. An invalid decision, an empty reviewer, and an empty ADR title are each refused. The approved ADR serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 04347dc35255 crates/eg-types/src/pgrx_spike_review.rs:106 crates/eg-types/src/pgrx_spike_review.rs:119 crates/eg-types/src/pgrx_spike_review.rs:130 crates/eg-types/src/pgrx_spike_review.rs:141 crates/eg-types/src/pgrx_spike_review.rs:97 |
| EG-UNIFIED-DATA-PLANE-R025.3.2 File the approved pgrx ADR from the live spike results Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**File the approved pgrx ADR from the live spike results.** Remaining scope of `EG-UNIFIED-DATA-PLANE-R025.3` after the `.1` review skeleton: review the real spike results recorded by `R025.2`, approve through `approve`, and file the ADR document before further pgrx work is authorized. | The filed ADR names the reviewed `PgrxSpikeDecision`, its reviewer and scope, and is produced through `approve` from the live spike results. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R026 Run the Gramps native-hosting pilot phases P0 through P5 Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run the Gramps native-hosting pilot phases P0 through P5.** The Gramps pilot records a baseline content digest, establishes a real-Postgres control with a captured driver statement corpus, runs that corpus unmodified against EG, fixes only proven gaps with a failing test first, verifies restore paths, and demonstrates schema understanding through an approved mapping and query. Split per the net-new rule (no phase-gate type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Each phase's exit artifact, as defined in the specification, is produced and reviewed before the next phase begins. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 30af64b172d4 |
| EG-UNIFIED-DATA-PLANE-R026.1 `GrampsPilotProgress` is a typed P0-P5 phase gate refusing a wrong, unreviewed, or out-of-order exit Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`GrampsPilotProgress` is a typed P0-P5 phase gate refusing a wrong, unreviewed, or out-of-order exit.** `crates/eg-types/src/gramps_pilot_phase.rs` defines the closed `GrampsPilotPhase` order and each phase's required exit-artifact kind, `PhaseExitArtifact::validate` (refuses a mismatched artifact kind or a blank reviewer), and `GrampsPilotProgress::admits`/`next_phase`, which refuse admitting a phase before every earlier phase has a valid exit. | Verified by unit tests: a well-formed exit validates, a wrong artifact kind and an unreviewed exit are refused, a fresh pilot admits only P0, skipping ahead without a prior exit is refused, an invalid exit does not advance progress, and the full ordered exit sequence completes the pilot. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 30af64b172d4 6c11520aebfc 9a7674d1bae5 eb058c53407e crates/eg-types/src/gramps_pilot_phase.rs:151 crates/eg-types/src/gramps_pilot_phase.rs:157 crates/eg-types/src/gramps_pilot_phase.rs:168 crates/eg-types/src/gramps_pilot_phase.rs:176 crates/eg-types/src/gramps_pilot_phase.rs:185 |
| EG-UNIFIED-DATA-PLANE-R026.2 Run P0-P2 (baseline digest, Postgres control, unmodified corpus replay) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run P0-P2 (baseline digest, Postgres control, unmodified corpus replay).** Child slice of `EG-UNIFIED-DATA-PLANE-R026` (see tasks.md). This row is LANDED only once every child is. | Each phase's exit artifact, as defined in the specification, is produced and reviewed before the next phase begins | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R026.2.1 P0 adapter skeleton: typed baseline-digest → P0 phase-exit mapping plus the refusal path Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**P0 adapter skeleton: typed baseline-digest → P0 phase-exit mapping plus the refusal path.** `crates/eg-types/src/gramps_baseline_digest.rs` defines `GrampsBaselineDigest` and `to_phase_exit`, refusing a zero record count, an empty digest, or an unreviewed exit before P0 is marked closed. The real baseline capture, the Postgres control, and the unmodified corpus replay (P1-P2) are `EG-UNIFIED-DATA-PLANE-R026.2.2+`. | Verified by unit tests needing no live service: a well-formed digest maps to the P0 exit. A zero record count, an empty digest, and an unreviewed exit are each refused. The digest serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 04347dc35255 crates/eg-types/src/gramps_baseline_digest.rs:100 crates/eg-types/src/gramps_baseline_digest.rs:111 crates/eg-types/src/gramps_baseline_digest.rs:121 crates/eg-types/src/gramps_baseline_digest.rs:78 crates/eg-types/src/gramps_baseline_digest.rs:89 |
| EG-UNIFIED-DATA-PLANE-R026.2.2 Run P0-P2 live: real baseline capture, Postgres control, unmodified corpus replay Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run P0-P2 live: real baseline capture, Postgres control, unmodified corpus replay.** Remaining scope of `EG-UNIFIED-DATA-PLANE-R026.2` after the `.1` P0 skeleton: capture the real Gramps baseline digest, stand up the Postgres control, and replay the unmodified corpus, recording each phase exit through `to_phase_exit`. | Each of P0-P2 produces its reviewed phase-exit artifact from the live run before the next phase begins. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R026.3 Run P3-P5 (proven-gap fixes, restore verification, schema-understanding demonstration) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run P3-P5 (proven-gap fixes, restore verification, schema-understanding demonstration).** Child slice of `EG-UNIFIED-DATA-PLANE-R026` (see tasks.md). This row is LANDED only once every child is. | Each phase's exit artifact, as defined in the specification, is produced and reviewed before the next phase begins | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R026.3.1 P3 adapter skeleton: typed proven-gap-fix → P3 phase-exit mapping plus the refusal path Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**P3 adapter skeleton: typed proven-gap-fix → P3 phase-exit mapping plus the refusal path.** `crates/eg-types/src/gramps_gap_fix.rs` defines `GrampsProvenGapFix` and `to_phase_exit`, refusing an empty description, an empty failing or passing test name, an identical before/after test name, or an unreviewed exit before P3 is marked closed. Real restore verification (P4) and the schema-understanding demonstration (P5) are `EG-UNIFIED-DATA-PLANE-R026.3.2+`. | Verified by unit tests needing no live service: a well-formed fix maps to the P3 exit; an empty description, an empty failing-test name, an identical before/after test name, and an unreviewed exit are each refused; the fix serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 04347dc35255 crates/eg-types/src/gramps_gap_fix.rs:105 crates/eg-types/src/gramps_gap_fix.rs:116 crates/eg-types/src/gramps_gap_fix.rs:127 crates/eg-types/src/gramps_gap_fix.rs:138 crates/eg-types/src/gramps_gap_fix.rs:148 |
| EG-UNIFIED-DATA-PLANE-R026.3.2 Run P4-P5 live: restore verification and the schema-understanding demonstration Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run P4-P5 live: restore verification and the schema-understanding demonstration.** Remaining scope of `EG-UNIFIED-DATA-PLANE-R026.3` after the `.1` P3 skeleton: verify a real restore and demonstrate schema understanding over the Gramps corpus, recording each phase exit. | P4 and P5 each produce their reviewed phase-exit artifact from the live run. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R027 Fix Postgres compatibility gaps proven by captured traffic Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Fix Postgres compatibility gaps proven by captured traffic.** EG implements each Postgres compatibility feature in its inventory only once captured application traffic proves it is needed, with a test that fails before the fix and passes after. Split per the net-new rule (no feature-fix-proof type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | Each fixed feature has a committed test shown failing against the prior behavior and passing against the fix. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 5873d340b4de 6c11520aebfc e8b99c7db914 crates/eg-types/src/pg_compat_feature.rs:193 crates/eg-types/src/pg_compat_feature.rs:204 crates/eg-types/src/pg_compat_feature.rs:215 crates/eg-types/src/pg_compat_feature.rs:228 crates/eg-types/src/pg_compat_feature.rs:240 |
| EG-UNIFIED-DATA-PLANE-R027.1 `FeatureFixRecord` is a typed inventory entry refusing a fix without complete captured-traffic/test proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`FeatureFixRecord` is a typed inventory entry refusing a fix without complete captured-traffic/test proof.** `crates/eg-types/src/pg_compat_feature.rs` defines the closed `PgCompatFeature` inventory and `validate`, which accepts an unfixed (no-proof) record, accepts a fixed record only with a non-empty captured-traffic reference and a non-empty failing/passing test-reference pair, and refuses any proof with an empty field. | Verified by unit tests: an unfixed feature with no proof validates, a fixed feature with complete proof validates and reports fixed, a proof with an empty traffic or failing-test reference is refused and reports unfixed, and the record serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 5873d340b4de 6c11520aebfc crates/eg-types/src/pg_compat_feature.rs:193 crates/eg-types/src/pg_compat_feature.rs:204 crates/eg-types/src/pg_compat_feature.rs:215 crates/eg-types/src/pg_compat_feature.rs:228 crates/eg-types/src/pg_compat_feature.rs:240 |
| EG-UNIFIED-DATA-PLANE-R027.2 Capture application traffic per feature and record the proof reference Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Capture application traffic per feature and record the proof reference.** Split per the net-new rule (no capture runner existed on main): `.1` is the runner slice needing no live candidate application. The live per-feature captures against real traffic are a later child. | Each fixed feature has a committed test shown failing against the prior behavior and passing against the fix | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | e8b99c7db914 crates/eg-types/src/pg_compat_feature.rs:262 crates/eg-types/src/pg_compat_feature.rs:272 crates/eg-types/src/pg_compat_feature.rs:280 |
| EG-UNIFIED-DATA-PLANE-R027.2.1 `capture_feature_fix` assembles a `FeatureFixRecord` from a pluggable `TrafficCaptureSource`, refusing an unproven or incomplete capture Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`capture_feature_fix` assembles a `FeatureFixRecord` from a pluggable `TrafficCaptureSource`, refusing an unproven or incomplete capture.** `crates/eg-types/src/pg_compat_feature.rs` adds `TrafficCaptureSource` and `capture_feature_fix`, which refuses to produce a fixed record when the source has not yet captured traffic proving the feature needed, and bubbles `FeatureFixRecord::validate`'s refusal for an incomplete proof. Needs no live candidate application: driven against a fake capture source. | Verified by unit tests: a complete captured proof produces a valid fixed record, a source with no traffic yet is refused as not proven, and an incomplete captured proof is refused and reports the underlying validation error. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | e8b99c7db914 crates/eg-types/src/pg_compat_feature.rs:262 crates/eg-types/src/pg_compat_feature.rs:272 crates/eg-types/src/pg_compat_feature.rs:280 |
| EG-UNIFIED-DATA-PLANE-R027.3 Implement each proven feature with its failing-then-passing test Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Implement each proven feature with its failing-then-passing test.** Split per the net-new rule (no fix-application runner existed on main): `.1` is the runner slice needing no live Postgres-compatible target. Applying each real feature's fix is a later child. | Each fixed feature has a committed test shown failing against the prior behavior and passing against the fix | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | e8b99c7db914 crates/eg-types/src/pg_compat_feature.rs:295 crates/eg-types/src/pg_compat_feature.rs:311 |
| EG-UNIFIED-DATA-PLANE-R027.3.1 `apply_proven_fix` applies a feature's fix only once its record is proven fixed, refusing -- without invoking the fix -- an unproven record Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`apply_proven_fix` applies a feature's fix only once its record is proven fixed, refusing -- without invoking the fix -- an unproven record.** `crates/eg-types/src/pg_compat_feature.rs` adds `apply_proven_fix`, which checks `FeatureFixRecord::is_fixed()` before invoking the caller-supplied fix closure. Needs no live Postgres-compatible target: driven against a fake fix closure. | Verified by unit tests: a proven record invokes the fix exactly once for its feature, and an unproven record is refused without invoking the fix. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | e8b99c7db914 crates/eg-types/src/pg_compat_feature.rs:295 crates/eg-types/src/pg_compat_feature.rs:311 |
| EG-UNIFIED-DATA-PLANE-R028 Build the Postgres-equivalence differential harness Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Build the Postgres-equivalence differential harness.** A differential harness compares EG against real Postgres. Its inputs are the Postgres regression suite, generated metamorphic query cases and captured application traffic. The harness records each known difference as a reviewed, named deviation. It never uses a self-updating baseline. Split per the net-new rule (no deviation-baseline type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | The harness report lists every deviation with its owner and a reproducing fixture, and no deviation is auto-suppressed on a subsequent run. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 2f94e96c5129 |
| EG-UNIFIED-DATA-PLANE-R028.1 `DeviationBaseline::reconcile` refuses a baseline update that drops a deviation without an explicit resolution Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`DeviationBaseline::reconcile` refuses a baseline update that drops a deviation without an explicit resolution.** `crates/eg-types/src/pg_diff_baseline.rs` defines the closed `DifferentialSource` vocabulary (Postgres regression suite, metamorphic-generated, captured application traffic), `PostgresDeviation` (name, source, owner, reproducing fixture), and `reconcile`, which refuses when a current run's baseline is missing a prior deviation that is not named in an explicit `resolved` list — a deviation never silently vanishes. | Verified by unit tests: an identical baseline reconciles, a new deviation is not a problem, a dropped deviation without resolution is refused and named, a dropped deviation with explicit resolution reconciles, an emptied current baseline against a nonempty prior is refused, and a deviation serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 2f94e96c5129 6c11520aebfc crates/eg-types/src/pg_diff_baseline.rs:141 crates/eg-types/src/pg_diff_baseline.rs:149 crates/eg-types/src/pg_diff_baseline.rs:157 crates/eg-types/src/pg_diff_baseline.rs:166 crates/eg-types/src/pg_diff_baseline.rs:177 |
| EG-UNIFIED-DATA-PLANE-R028.2 Run the Postgres regression suite and generated metamorphic query corpora against EG Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run the Postgres regression suite and generated metamorphic query corpora against EG.** Split per the net-new rule (no harness runner existed on main): `.1` is the runner slice needing no live Postgres instance; the live regression-suite and metamorphic-generated runs are a later child. | The harness report lists every deviation with its owner and a reproducing fixture, and no deviation is auto-suppressed on a subsequent run | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | e8b99c7db914 crates/eg-types/src/pg_diff_baseline.rs:210 crates/eg-types/src/pg_diff_baseline.rs:233 crates/eg-types/src/pg_diff_baseline.rs:245 |
| EG-UNIFIED-DATA-PLANE-R028.2.1 `run_differential_harness` assembles a run's `DeviationBaseline` from one evaluator per declared corpus source and reconciles it against the prior baseline Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`run_differential_harness` assembles a run's `DeviationBaseline` from one evaluator per declared corpus source and reconciles it against the prior baseline.** `crates/eg-types/src/pg_diff_baseline.rs` adds `DifferentialCaseEvaluator` and `run_differential_harness`, which merges each evaluator's deviations by name and bubbles `DeviationBaseline::reconcile`'s refusal for an unaccounted drop. Needs no live Postgres instance: driven against fake evaluators. | Verified by unit tests: deviations from every declared source merge into one baseline, a dropped prior deviation with no resolution is refused and named, and an explicitly resolved drop reconciles. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | e8b99c7db914 crates/eg-types/src/pg_diff_baseline.rs:210 crates/eg-types/src/pg_diff_baseline.rs:233 crates/eg-types/src/pg_diff_baseline.rs:245 |
| EG-UNIFIED-DATA-PLANE-R028.3 Run the captured-application-traffic corpus and publish the harness report Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run the captured-application-traffic corpus and publish the harness report.** Child slice of `EG-UNIFIED-DATA-PLANE-R028` (see tasks.md). | The harness report lists every deviation with its owner and a reproducing fixture, and no deviation is auto-suppressed on a subsequent run | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R029 Expose a schema_context query surface Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Expose a schema_context query surface.** EG exposes a schema_context query that answers what a table is, what joins to it, which ontology class and application it belongs to, and the impact of a change, following the same pattern as the existing code_context surface. Split per the net-new rule (no schema_context answer type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | A query test against a known catalog fixture confirms schema_context returns the expected joins, class, application, and impact for a table. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc c1bf552a9c33 d9b702c9e7e2 efcab03c2fa8 crates/eg-types/src/schema_context.rs:146 crates/eg-types/src/schema_context.rs:156 crates/eg-types/src/schema_context.rs:163 crates/eg-types/src/schema_context.rs:170 crates/eg-types/src/schema_context.rs:179 |
| EG-UNIFIED-DATA-PLANE-R029.1 `SchemaContextCatalog::schema_context` is a typed answer lookup refusing an unknown table Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`SchemaContextCatalog::schema_context` is a typed answer lookup refusing an unknown table.** `crates/eg-types/src/schema_context.rs` defines `SchemaContextAnswer` (joins, ontology class, application, change impact) and `schema_context`, which refuses a table absent from the catalog rather than returning a default/empty answer. | Verified by unit tests: a known table returns its full answer, an unknown table is refused rather than defaulted, an empty catalog refuses every table, and the answer serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc d9b702c9e7e2 crates/eg-types/src/schema_context.rs:146 crates/eg-types/src/schema_context.rs:156 crates/eg-types/src/schema_context.rs:163 crates/eg-types/src/schema_context.rs:170 |
| EG-UNIFIED-DATA-PLANE-R029.2 Wire the real schema_context query entry point through Graph OS, following the code_context pattern Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wire the real schema_context query entry point through Graph OS, following the code_context pattern.** Child slice of `EG-UNIFIED-DATA-PLANE-R029` (see tasks.md). | A query test against a known catalog fixture confirms schema_context returns the expected joins, class, application, and impact for a table | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | c1bf552a9c33 efcab03c2fa8 crates/eg-types/src/schema_context.rs:179 crates/eg-types/src/schema_context.rs:202 |
| EG-UNIFIED-DATA-PLANE-R030 Resolve entities across attached applications Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Resolve entities across attached applications.** EG proposes cross-application entity links among Gramps, Immich, Twenty, and Firefly using blocking, field similarity, and a Fellegi-Sunter model, and records each link as an owl:sameAs proposal that only becomes active once approved. Split per the net-new rule (no entity-link-proposal type existed on main): `.1` is the typed model (this requirement's rollup is LANDED only once every child is). | An entity-resolution fixture with true matches, false matches, and ambiguous candidates confirms no proposal is asserted as owl:sameAs before approval. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 648e9b47f700 |
| EG-UNIFIED-DATA-PLANE-R030.1 `EntityLinkProposal::assert_same_as` refuses an unapproved or non-Match candidate Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`EntityLinkProposal::assert_same_as` refuses an unapproved or non-Match candidate.** `crates/eg-types/src/entity_link_proposal.rs` defines `AttachedApplication` (Gramps/Immich/Twenty/Firefly), `MatchClass` (Match/NonMatch/Ambiguous), and `assert_same_as`, which refuses a `NonMatch`/`Ambiguous` candidate even if marked approved, and refuses an unapproved or blank-approver `Match`. | Verified by unit tests: an approved match asserts, an unapproved match is refused, an approved non-match and an approved ambiguous candidate are both refused, a blank approver is refused, and the proposal serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 648e9b47f700 6c11520aebfc crates/eg-types/src/entity_link_proposal.rs:109 crates/eg-types/src/entity_link_proposal.rs:116 crates/eg-types/src/entity_link_proposal.rs:123 crates/eg-types/src/entity_link_proposal.rs:130 crates/eg-types/src/entity_link_proposal.rs:137 |
| EG-UNIFIED-DATA-PLANE-R030.2 Blocking and field-similarity candidate generation across Gramps/Immich/Twenty/Firefly Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Blocking and field-similarity candidate generation across Gramps/Immich/Twenty/Firefly.** Child slice of `EG-UNIFIED-DATA-PLANE-R030` (see tasks.md). | An entity-resolution fixture with true matches, false matches, and ambiguous candidates confirms no proposal is asserted as owl:sameAs before approval | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R030.3 Real Fellegi-Sunter scoring and the approval workflow Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Real Fellegi-Sunter scoring and the approval workflow.** Child slice of `EG-UNIFIED-DATA-PLANE-R030` (see tasks.md). | An entity-resolution fixture with true matches, false matches, and ambiguous candidates confirms no proposal is asserted as owl:sameAs before approval | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R031 Enforce consolidation safety across attached applications (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Enforce consolidation safety across attached applications (rollup).** EG isolates each attached application by tenant and principal, exposes its data only through approved mappings, enforces quotas that bound the blast radius of one application's load or failure, and applies an explicit upgrade-coupling policy and admission criteria before adding another application. No typed admission/quota model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A fault-isolation test confirms one application's failure or quota breach does not degrade another attached application's service. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R031.1 `ApplicationAdmission`/`ConsolidationIsolationRegistry` are a typed admission model with identity and quota refusals Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`ApplicationAdmission`/`ConsolidationIsolationRegistry` are a typed admission model with identity and quota refusals.** `crates/eg-types/src/consolidation_isolation.rs` defines `ApplicationAdmission` (tenant/principal/quota/`UpgradeCouplingPolicy`); `validate_admission` refuses an admission with an empty application/tenant/principal or a quota with every bound at zero, and `ConsolidationIsolationRegistry::admit` additionally refuses re-admitting the same tenant/application pair under a different principal. | Verified by unit tests: a valid admission round-trips through `admit`; an empty identity is refused; an all-zero quota is refused; the same principal re-admitting is idempotent; a different principal re-admitting the same tenant/application is refused; and an invalid admission is refused rather than silently admitted. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc eb058c53407e crates/eg-types/src/consolidation_isolation.rs:160 crates/eg-types/src/consolidation_isolation.rs:170 crates/eg-types/src/consolidation_isolation.rs:178 crates/eg-types/src/consolidation_isolation.rs:193 crates/eg-types/src/consolidation_isolation.rs:206 |
| EG-UNIFIED-DATA-PLANE-R031.2 Real fault-isolation enforcement and quota metering Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Real fault-isolation enforcement and quota metering.** Child slice of `EG-UNIFIED-DATA-PLANE-R031` (see tasks.md). | A fault-isolation test confirms one application's failure or quota breach does not degrade another attached application's service | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R032 Run the Immich connector pilot phases I0 through I6 (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run the Immich connector pilot phases I0 through I6 (rollup).** The Immich pilot generates a version-pinned API client from a checked-in OpenAPI fixture, provides read-first MCP tools with approval-gated writes, registers the connector across every required release catalog, ingests assets and per-user people incrementally with no-op replay on a second run, resolves cross-application entity proposals, and adds health, lag, and upgrade-digest checks. No typed phase-gate model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | Each phase's fixture and test, as defined in the specification, passes, including the no-op replay and one-change incremental ingest tests. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R032.1 `ImmichPilotProgress` is a typed phase gate (I0-I6) with exit-artifact and skip-ahead refusals Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`ImmichPilotProgress` is a typed phase gate (I0-I6) with exit-artifact and skip-ahead refusals.** `crates/eg-types/src/immich_pilot_phase.rs` defines the closed `ImmichPilotPhase` order (I0 client generation through I6 health checks) with each phase's required exit-artifact kind; `PhaseExitArtifact::validate` refuses a mismatched artifact kind or a blank reviewer, and `ImmichPilotProgress::admits`/`next_phase` refuse admitting a phase before every earlier phase has a valid exit. | Verified by unit tests: a well-formed exit validates; a wrong artifact kind is refused; an unreviewed exit is refused; a fresh pilot admits only I0; skipping ahead without a prior exit is refused; an invalid exit does not advance progress; and the full I0-I6 order completes the pilot. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc eb058c53407e crates/eg-types/src/immich_pilot_phase.rs:158 crates/eg-types/src/immich_pilot_phase.rs:167 crates/eg-types/src/immich_pilot_phase.rs:178 crates/eg-types/src/immich_pilot_phase.rs:186 crates/eg-types/src/immich_pilot_phase.rs:198 |
| EG-UNIFIED-DATA-PLANE-R032.2 Run phase I0 (version-pinned OpenAPI client generation and digest) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Run phase I0 (version-pinned OpenAPI client generation and digest).** Child slice of `EG-UNIFIED-DATA-PLANE-R032` (see tasks.md). | Each phase's fixture and test, as defined in the specification, passes, including the no-op replay and one-change incremental ingest tests | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R033 Cut over Gramps to EG-backed storage in production (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Cut over Gramps to EG-backed storage in production (rollup).** Gramps P6 moves the production family tree to EG-backed storage with a Postgres replica and a nightly independent XML export, keeps a 30-day read-only SQLite fallback available, and proceeds only after an explicit, separately recorded go-ahead following the P0 through P5 evidence. No typed go-ahead model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | A rehearsed failover test exercises the fallback path and confirms the nightly export and replica remain consistent throughout the 30-day observation window. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | 273dc35315ff |
| EG-UNIFIED-DATA-PLANE-R033.1 `GrampsCutoverGoAhead` is a typed go-ahead model gated on a valid P5 exit and a 30-day fallback window Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`GrampsCutoverGoAhead` is a typed go-ahead model gated on a valid P5 exit and a 30-day fallback window.** `crates/eg-types/src/gramps_cutover_gate.rs` reuses `gramps_pilot_phase::PhaseExitArtifact`; `validate_go_ahead` refuses a go-ahead that cites any phase but `P5SchemaUnderstanding`, cites an invalid (unreviewed) P5 exit, names no approver, or declares a fallback window shorter than the required 30 days. | Verified by unit tests: a well-formed go-ahead validates; citing the wrong phase is refused; citing an unreviewed P5 exit is refused; naming no approver is refused; a fallback window under 30 days is refused; and the model serializes and decodes round-trip. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 6c11520aebfc 9a7674d1bae5 crates/eg-types/src/gramps_cutover_gate.rs:101 crates/eg-types/src/gramps_cutover_gate.rs:107 crates/eg-types/src/gramps_cutover_gate.rs:121 crates/eg-types/src/gramps_cutover_gate.rs:132 crates/eg-types/src/gramps_cutover_gate.rs:143 |
| EG-UNIFIED-DATA-PLANE-R033.2 Real production cutover: Postgres replica, nightly independent XML export, and the rehearsed failover test Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Real production cutover: Postgres replica, nightly independent XML export, and the rehearsed failover test.** Child slice of `EG-UNIFIED-DATA-PLANE-R033` (see tasks.md). | A rehearsed failover test exercises the fallback path and confirms the nightly export and replica remain consistent throughout the 30-day observation window | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R034 Keep eg-core's build, Clippy, and generated contract suite green Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Keep eg-core's build, Clippy, and generated contract suite green.** eg-core's root library compiles successfully, and Clippy passes cleanly with all features and targets enabled. The generated contract suite passes all of its cases, and the scanner/contract/catalog test suite passes all of its cases. | Continuous integration enforces a successful root library build, a clean all-features/all-targets Clippy run, and full passes of the generated contract and scanner/contract/catalog test suites. | requirement | EG-UNIFIED-DATA-PLANE | LANDED | 2e6d7617289a |
| EG-UNIFIED-DATA-PLANE-R035 Share the compiled ontology cache with attached-schema graphs Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Share the compiled ontology cache with attached-schema graphs.** EG reuses the compiled shapes and ontology cache on every RDF write to a graph with an attached, non-core schema source, rather than recomputing the full parse-and-classification composition in icv_guard::compiled_policy on each write, matching the caching EG-TYPED-PACKS-R051 requires for core-schema graphs. | A benchmark test measures per-write latency on an attached-schema graph and confirms it matches cache-hit performance rather than full-recomputation performance. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 bee3dd02e6ed src/server/graph_schema/compiled_tests.rs:68 src/server/graph_schema/compiled_tests.rs:79 src/server/graph_schema/compiled_tests.rs:93 |
| EG-UNIFIED-DATA-PLANE-R036 Derive HealthAnomaly and Incident facts with conformance checking Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Derive HealthAnomaly and Incident facts with conformance checking.** EG's complex-event-processing pipeline derives HealthAnomaly and Incident facts from the data plane's change and telemetry events, and checks each derived fact against its declared-versus-observed conformance. | A test feeds a known event sequence through the pipeline and confirms the expected HealthAnomaly and Incident facts and conformance result are produced. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 155bd9b55e81 6c11520aebfc crates/eg-stream/src/telemetry/tests/derive.rs:108 crates/eg-stream/src/telemetry/tests/derive.rs:121 crates/eg-stream/src/telemetry/tests/derive.rs:139 crates/eg-stream/src/telemetry/tests/derive.rs:28 crates/eg-stream/src/telemetry/tests/derive.rs:48 |
| EG-UNIFIED-DATA-PLANE-R760 Served incident authority (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Served incident authority (rollup).** Extends `EG-UNIFIED-DATA-PLANE-R036`. Rust-native in `eg-cep`. Children `.1` to `.6` deliver it. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R760.1 Model: served incident authority Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model: served incident authority.** `eg-cep` keeps `Incident{id, tenant, signature_digest, severity, status, opened_at_ms}` and `HealthAnomaly{entity_ref, signal, observed, baseline, at_ms}`. Arbora deleted its own incident tool and anomaly writer and calls the served methods instead. | Planned: model tests in `crates/eg-cep/tests/incident_authority.rs` | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R760.2 Behavior: served incident authority Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior: served incident authority.** Correlation groups anomalies by entity and window in one pass in O(events). An open incident with the same signature is reused. A status moves only from open to acknowledged to resolved. | Planned: behavior tests in `crates/eg-cep/tests/incident_authority.rs` | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R760.3 Wiring: served incident authority Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring: served incident authority.** The served methods are `incident.record_anomaly`, `incident.correlate`, `incident.evidence`, `incident.related_claims` and `incident.set_status`. Arbora reaches each one through its generated `eg.<domain>.<Method>` operation. | Planned: a contract test checks that the manifest lists every method. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R760.4 Refusal: served incident authority Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal: served incident authority.** The engine refuses a call without the tenant scope. It refuses a status move that skips a state and a read of another tenant's incident. | Planned: refusal tests in `crates/eg-cep/tests/incident_authority.rs` | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R760.5 Evidence: served incident authority Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence: served incident authority.** Tests assert one incident per signature, the evidence set of each incident and the state order. | Planned: evidence tests in `crates/eg-cep/tests/incident_authority.rs` | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R760.6 Hot-path proof: served incident authority Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof: served incident authority.** Criterion benchmark `incident_correlate` correlates 100,000 anomalies in one pass under 250 ms and under 64 MiB, with a p99 per anomaly under 5 microseconds. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress by more than 10 percent. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R037 Virtual-graph vocabulary is an EG core schema source Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Virtual-graph vocabulary is an EG core schema source.** EG ships `core:virtual-graph@1` with three classes: `SourceConnection`, `MetadataContract` and `VirtualMapping`. A `SourceConnection` carries a source kind, an endpoint reference and declared capabilities. Source kinds cover API, MCP, A2A, GraphQL, SQL, Iceberg, Teradata-style warehouses and SPARQL endpoints. A `MetadataContract` describes one source at one schema version under a content digest. It lists discovered entities, fields, relationships and operations. A `VirtualMapping` binds one ontology class to one discovered entity, with a key field and predicate-to-field pairs. SHACL shapes refuse an endpoint reference with credentials. They also refuse a mapping that names an undiscovered entity or field. Only an approved mapping serves reads. | Shape fixtures accept a valid connection, contract and approved mapping. They reject credential-bearing references, undiscovered fields and unapproved mappings at read time. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 3dd56fe53283 85f4ea82f45f 9b6036853937 src/server/graph_schema/virtual_graph_tests.rs:52 src/server/graph_schema/virtual_graph_tests.rs:74 src/server/graph_schema/virtual_graph_tests.rs:80 |
| EG-UNIFIED-DATA-PLANE-R038 Materialize metadata and hot subsets; virtualize the rest (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Materialize metadata and hot subsets; virtualize the rest (rollup).** Metadata discovery runs for every registered source kind, not only SQL dialect catalogs. Discovery writes a versioned, hashed `MetadataContract` and never copies entity rows. Entity rows stay at the source by default and answer queries through approved virtual mappings. A mapping copies rows only under an acceleration policy. That policy needs the source `copy` capability, a declared hot-subset predicate and a freshness watermark. A missing watermark disables the copied route. EXPLAIN states whether each fragment ran live or from a copy. No typed `MetadataContract`/acceleration-policy model existed on main; split producer-first: `.1` is the typed model. This row is LANDED only once every child is. | Tests prove discovery writes metadata only, a cold mapping reads live, a hot mapping copies only its declared subset, and a stale watermark falls back to live reads. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.1 `MetadataContract`/`AccelerationPolicy` are typed models with a capability refusal and a watermark-missing live fallback Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`MetadataContract`/`AccelerationPolicy` are typed models with a capability refusal and a watermark-missing live fallback.** `crates/eg-types/src/metadata_acceleration.rs` defines `MetadataContract` (source-kind-generic, metadata only, no row data field) and `AccelerationPolicy`; `validate_policy` refuses a policy that declares a hot-subset predicate for a source with no `copy` capability, and `AccelerationPolicy::resolve_mode` returns `FragmentExecutionMode::Live` whenever the copy capability, predicate, or freshness watermark is missing, `Copy` only when all three are present. | Verified by unit tests: a well-formed contract validates; an empty source kind is refused; a fully declared policy resolves to `Copy`; a missing watermark falls back to `Live`; a mapping with no predicate is `Live`; and a predicate declared without copy capability is refused. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 9a7674d1bae5 crates/eg-types/src/metadata_acceleration.rs:121 crates/eg-types/src/metadata_acceleration.rs:127 crates/eg-types/src/metadata_acceleration.rs:135 crates/eg-types/src/metadata_acceleration.rs:147 crates/eg-types/src/metadata_acceleration.rs:154 |
| EG-UNIFIED-DATA-PLANE-R038.2 Real per-source-kind discovery writing the contract, the copy pipeline, and EXPLAIN's per-fragment live/copy reporting Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Real per-source-kind discovery writing the contract, the copy pipeline, and EXPLAIN's per-fragment live/copy reporting.** Child slice of `EG-UNIFIED-DATA-PLANE-R038` (see tasks.md). | Tests prove discovery writes metadata only, a cold mapping reads live, a hot mapping copies only its declared subset, and a stale watermark falls back to live reads | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.3 Transactional row stores answer through one consistent snapshot (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Transactional row stores answer through one consistent snapshot (rollup).** The engine registers transactional row stores as one source category. All pushed fragments of one query must read one source snapshot. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.3.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add the closed `SourceCategory` enum in `crates/eg-types/src/metadata_acceleration.rs` beside `MetadataContract` (line 21). It lists every category of the coverage matrix in `EG-UNIFIED-DATA-PLANE-R022.4`. Add `SnapshotSemantics{isolation, snapshot_token, replica_lag_bound_ms}`. Closed `isolation` values are `snapshot` and `repeatable_read`. Proving test: `crates/eg-types/src/metadata_acceleration.rs::tests::snapshot_semantics_round_trip`. | A serde round trip keeps every field and rejects an unknown category or isolation. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.3.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** The planner opens one read-only transaction per source per query. Every fragment of that source carries the same snapshot token. A declared read replica serves the read only within its lag bound. The default lag bound is 5000 ms. The default statement timeout is 30 s. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::fragments_share_snapshot`. | Two fragments of one query read one snapshot while a concurrent writer commits. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.3.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** `foreign_scan` at `crates/eg-plan/src/federation_opt/run.rs:26` opens the snapshot through the source session. `SourceCapabilities` at `crates/eg-plan/src/federation_opt/capability.rs:63` carries `snapshot_reads`. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::foreign_scan_opens_snapshot`. | A served query over a transactional source reaches the snapshot path. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.3.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A multi-fragment query on a source without `snapshot_reads` must refuse with `SNAPSHOT_UNAVAILABLE`. A request may accept per-fragment consistency explicitly. A replica over its lag bound must not serve the read. A write path must not be reachable from the read plan. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::snapshot_refusals`. | Each case returns its code and runs no source statement. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.3.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** EXPLAIN and answer provenance must carry the snapshot token, isolation, source and read time. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::provenance_names_snapshot`. | The answer provenance names one snapshot token per source. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.3.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is the served SPARQL method over a transactional source mapped by R2RML. A concurrent writer commits during the query. The answer must match the snapshot and the engine must store no source rows. Proving test: `tests/federation/test_oltp_snapshot_served.py::test_fragments_share_one_snapshot`. | The answer matches the snapshot oracle and the engine row count for that source stays unchanged. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.4 Metastore catalogs and ORC and Avro files answer in place (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Metastore catalogs and ORC and Avro files answer in place (rollup).** The engine reads table metadata from a catalog that speaks the Hive metastore Thrift protocol. It reads ORC and Avro files in place, with no copy. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.4.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `MetastoreCatalogSpec{endpoint, database_filter, auth_ref}` and the `Orc` and `Avro` file formats in `crates/eg-lake`. A `MetadataContract` row carries partition keys, file locations and column statistics. Proving test: `crates/eg-lake/src/tests/metastore_model.rs::metastore_spec_round_trips`. | A serde round trip keeps every field and rejects an unknown format. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.4.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** Discovery writes one `MetadataContract` per table. Scans prune partitions by pushed predicates. ORC scans skip stripes by stripe statistics. Avro scans project the reader schema. A catalog listing pages at 1,000 tables. Proving test: `crates/eg-lake/src/tests/metastore_scan.rs::partition_and_stripe_pruning`. | A pushed predicate reads only the matching partitions and stripes. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.4.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Discovery attaches to the per-source-kind discovery of `EG-UNIFIED-DATA-PLANE-R038.2`. Scans attach at `foreign_scan` (`crates/eg-plan/src/federation_opt/run.rs:26`). Proving test: `crates/eg-lake/src/tests/metastore_scan.rs::served_scan_reaches_pruning`. | A served query over a metastore table reaches the pruned scan. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.4.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A reader and writer Avro schema pair that does not resolve must refuse with `SCHEMA_INCOMPATIBLE`. A transactional delta layout without a readable base must refuse with `UNSUPPORTED_TABLE_LAYOUT`. An unreachable catalog must abstain and name the source. Proving test: `crates/eg-lake/src/tests/metastore_scan.rs::metastore_refusals`. | Each case returns its code and reads no data file. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.4.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** The scan receipt must list pruned partitions, files read, stripes read and bytes read. Proving test: `crates/eg-lake/src/tests/metastore_scan.rs::receipt_counts_match`. | The receipt counts match the files the scan opened. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.4.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is the served SPARQL method over a fixture metastore. The fixture holds one partitioned ORC table and one Avro table. The query must read only the matching partitions. Proving test: `tests/federation/test_metastore_orc_avro_served.py::test_partition_pruned_scan`. | The answer matches the full-scan oracle and the receipt shows pruning. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.5 Search-index sources answer with relevance pushdown (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Search-index sources answer with relevance pushdown (rollup).** Full-text and vector index sources answer through approved mappings. The planner pushes the relevance query and top-k to the index. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.5.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `SearchIndexCapability{full_text, vector_space, filter_fields, max_k, score_kind}` beside `SourceCapabilities` (`crates/eg-plan/src/federation_opt/capability.rs:63`). A mapping binds a document id to an entity IRI and the score to a named score channel (`EG-FEDERATED-QUERY-R067`). Proving test: `crates/eg-plan/src/federation_opt/tests.rs::search_capability_round_trips`. | A serde round trip keeps every field and rejects an unknown score kind. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.5.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** The planner pushes text match, vector nearest-neighbour search, declared filters and top-k. A remote vector query must use a compatible embedding space (`EG-FEDERATED-QUERY-R039.1`). Local residual filters replenish to k or return a typed shortfall (`EG-FEDERATED-QUERY-R039`). Proving test: `crates/eg-plan/src/federation_opt/tests.rs::relevance_pushdown_replenishes`. | A pushed query returns k results with remote scores in their channel. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.5.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Pushdown attaches at `foreign_scan` (`run.rs:26`). Fusion with local scores reuses `fuse_rrf` at `crates/eg-plan/src/exec.rs:848`. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::served_search_reaches_fusion`. | A served query reaches the remote index and the shared fusion. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.5.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** An incompatible vector space must refuse with `EMBEDDING_SPACE_MISMATCH`. A k above `max_k` must page. The engine must not invent a score for a remote result. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::search_refusals`. | Each case returns its code or pages, and no result carries an invented score. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.5.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Each fragment receipt must name the index source, the query digest, k, the score kind and the returned count. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::search_receipt`. | The receipt matches the remote request. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.5.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is the served `UnifiedQuery` method. The query joins a remote full-text index with a local graph filter. The filter drops some results. Proving test: `tests/federation/test_search_index_pushdown_served.py::test_relevance_pushed_and_k_replenished`. | The answer holds k results, and the engine stores no index documents. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.6 openCypher and Gremlin answer over relational and lake sources without a copy (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**openCypher and Gremlin answer over relational and lake sources without a copy (rollup).** The served openCypher and Gremlin surfaces answer over virtual sources. They use the same approved mappings as SPARQL. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.6.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `GraphView{mapping_digest, node_labels, relationship_types}` in `crates/eg-types/src/virtual_graph_view.rs`. A node label maps to an ontology class. A relationship type maps to a join of approved R2RML mappings (`EG-UNIFIED-DATA-PLANE-R005`). Proving test: `crates/eg-types/src/virtual_graph_view.rs::tests::graph_view_round_trips`. | A serde round trip keeps every field and rejects an unmapped label. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.6.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** The planner translates node and relationship patterns into virtual-graph scans. It pushes same-source joins and filters into source SQL through the `EG-UNIFIED-DATA-PLANE-R006` path. The default variable-length path depth limit is 8. Proving test: `crates/eg-query/src/cypher/tests/virtual_view.rs::pattern_pushes_join`. | One pattern renders one pushed SQL statement per same-source join. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.6.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** `handle_cypher_read` at `src/server/handlers/query/cypher.rs:61` resolves the graph view before `parse` (`crates/eg-query/src/cypher/parser.rs:1181`). The Gremlin text surface compiles into the same plan. Proving test: `crates/eg-query/src/cypher/tests/virtual_view.rs::served_read_resolves_view`. | A served openCypher read over a mapped source reaches the view resolution. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.6.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A write against a view must refuse with `VIRTUAL_VIEW_READ_ONLY`. An unmapped label must refuse with `UNMAPPED_LABEL`. A path over the depth limit must refuse with `PATH_DEPTH_EXCEEDED`. Proving test: `crates/eg-query/src/cypher/tests/virtual_view.rs::view_refusals`. | Each case returns its code and runs no source statement. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.6.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** EXPLAIN must show the pushed statement per fragment and the mapping digest. Proving test: `crates/eg-query/src/cypher/tests/virtual_view.rs::explain_names_mapping`. | EXPLAIN names the mapping digest of each fragment. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.6.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is the served Cypher method and the Gremlin method. One question runs in openCypher, Gremlin and SPARQL over one relational source. Proving test: `tests/federation/test_graph_language_virtual_served.py::test_cypher_and_gremlin_match_sparql_over_sql_source`. | The three answers are equal, and the engine row count for that source stays unchanged. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.7 Web metasearch sources answer at query time through a cached connector query (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Web metasearch sources answer at query time through a cached connector query (rollup).** A web metasearch connector is one source category. A SPARQL or UQL pattern over web results becomes one connector query. Results are typed graph resources with a time-to-live cache and provenance. The engine copies no result into the graph store. Tool selection for a web search job runs through `EG-DECISION-ENGINE-R176`. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.7.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `WebSearchCapability{categories, engines, time_ranges, languages, max_results}` beside `SourceCapabilities` (`crates/eg-plan/src/federation_opt/capability.rs:63`). Add `WebResult{url, title, snippet, engine, rank, retrieved_at}` mapped to `cv:SearchResult` (`EG-MEDIA-VOCAB-R004.4`). Add `SourceCategory::WebMetasearch`. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_result_round_trips`. | A serde round trip keeps every field and rejects a result without a URL. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.7.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** The planner pushes the query text, the category, the engine set, the time range and the language as connector arguments. It pushes the result limit. The cache key is the canonical argument digest. The default time-to-live is 900 s. A cache hit returns the cached rows with their original retrieval time. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_search_pushdown_and_ttl`. | A repeated pattern within the time-to-live sends one connector query. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.7.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Pushdown attaches at `foreign_scan` (`crates/eg-plan/src/federation_opt/run.rs:26`) through the operation-bound MCP source kind of `EG-FEDERATED-QUERY-R073`. The time-to-live cache reuses `FragmentCacheScope` (`crates/eg-plan/src/federation_opt/cache.rs:27`). Proving test: `crates/eg-plan/src/federation_opt/tests.rs::served_web_search_reaches_cache`. | A served pattern over web results reaches the connector operation and the shared cache. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.7.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** An argument outside the declared capability must refuse with `UNSUPPORTED_SEARCH_ARGUMENT`. An expired entry must not serve a read. An unreachable connector must abstain and name the source. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_search_refusals`. | Each case returns its code, and no expired row serves a read. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.7.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Each result row must carry the connector, the argument digest, the engine, the rank and the retrieval time. The answer must state whether each row came from the cache. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_result_provenance`. | Each row names its engine, rank and retrieval time, and a cached row says so. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.7.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is the served SPARQL method over a fixture web metasearch connector. The test asks one pattern twice within the time-to-live and once after it. Proving test: `tests/federation/test_web_metasearch_served.py::test_pattern_pushes_to_connector_with_ttl_cache`. | The connector receives two queries, the rows are typed, and the graph store holds no result rows. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R038.7.7 Candidate handoff Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Candidate handoff.** A web result row is a fetch candidate, not a stored record. The engine must not ingest a result by default. Each row must carry the query text, the query digest, the engine, the rank and the retrieval time. Add `WebCandidateSet{query_text, query_digest, candidates, retrieved_at}` beside `WebResult` (`crates/eg-plan/src/federation_opt/capability.rs:63`). The candidate set is the input of the fetch selection of `EG-DECISION-ENGINE-R802`. Proving test: `crates/eg-plan/src/federation_opt/tests.rs::web_candidates_carry_query_provenance`. | A served pattern returns candidates with query provenance, and the graph store holds no result rows. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R039 Authenticated, tenant-scoped Iceberg REST catalog (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Authenticated, tenant-scoped Iceberg REST catalog (rollup).** The lake catalog endpoint must refuse unauthenticated and cross-tenant requests. It must reuse EG's verified request envelope and tenant model, not a second token store. External engines then read EG tables as Iceberg tables. | Tests prove a valid token lists and loads its own tables, and a missing or cross-tenant token is refused. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R039.1 `CatalogPrincipal` typed model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**`CatalogPrincipal` typed model.** `crates/eg-lake/src/catalog.rs` must define `CatalogPrincipal` with tenant, subject and scopes, built only from the verified request envelope. | Unit test builds a principal from a verified envelope and rejects an unsigned one. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R039.2 Catalog authorization refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Catalog authorization refusal.** `authorize_catalog_call` in `crates/eg-lake/src/catalog.rs` must refuse a call whose principal tenant differs from the table tenant, and must refuse an absent principal. | Two unit tests: cross-tenant refusal and absent-principal refusal. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R039.3 Locate and wire the REST listener Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Locate and wire the REST listener.** The first step must locate the lake REST listener and call `authorize_catalog_call` on every route. No route may keep the deny-all stub. | Route test enumerates every catalog route and asserts each calls the check. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R039.4 Partition spec in emitted Iceberg metadata Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Partition spec in emitted Iceberg metadata.** `crates/eg-lake/src/iceberg.rs` must emit a partition spec and per-partition field summaries when a table declares a partition column. Unpartitioned tables stay unchanged. | Metadata test reads back the partition spec and prunes one manifest by a partition predicate. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R039.5 End-to-end external read Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**End-to-end external read.** An external Iceberg client must load a table through the authenticated catalog, and an out-of-tenant client must be refused. | Disposable-fixture test with a pinned external reader loads one table and fails the cross-tenant load. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R040 Per-modality retrieval gate blocks promotion of a shared embedding space (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Per-modality retrieval gate blocks promotion of a shared embedding space (rollup).** Embeddings for the text, image and audio modalities share one vector space. After any model or projector change, the engine must re-validate each modality on its own retrieval check. A modality that regresses must block promotion. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R040.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `ModalityCheck{modality, probe_set_digest, metric, floor, baseline}` and `PromotionVerdict` in new `crates/eg-types/src/embedding_promotion.rs`. Closed `modality` values are `text`, `image` and `audio`. `EmbeddingVersion` at `crates/eg-ann/src/version.rs:32` names a model and version but holds no check result. Proving test: `crates/eg-types/src/embedding_promotion.rs::tests::checks_round_trip`. | A serde round trip keeps every field and rejects an unknown modality. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R040.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** Add `evaluate_promotion(candidate, checks)` in `embedding_promotion.rs`. It computes recall at k per modality with `recall_at_k` at `crates/eg-ann/src/recall.rs:28` on that modality probe set. A drop beyond the tolerance blocks promotion. The default tolerance is 0.02 absolute and is a named replaceable default. A modality with no probe set blocks promotion. Proving test: `crates/eg-types/src/embedding_promotion.rs::tests::one_regression_blocks_promotion`. | One regressed modality blocks even when the mean improves. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R040.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** The gate attaches before `EmbeddingVersionStore::tag_batch` at `crates/eg-ann/src/version.rs:129` in the re-embed path. No production caller of `tag_batch` or `tag` exists today. This row creates the call site in the re-embed worker queued by `EG-FEDERATED-QUERY-R077.3`, and it reads the binding at `crates/eg-query/src/tables/embedding_binding.rs:526`. Proving test: `crates/eg-ann/src/version.rs::tests::tag_requires_passing_verdict`. | The re-embed worker calls the gate before it tags a new version. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R040.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A blocked promotion must leave the prior version active. The engine must return `PromotionBlocked` naming each regressed modality, its baseline and its measured value. The engine must not tag any vector with the candidate version. Proving test: `crates/eg-ann/src/version.rs::tests::blocked_promotion_tags_nothing`. | No vector carries the candidate version after a block. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R040.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** The engine must store each `PromotionVerdict` as a node linked to the candidate model and version. It carries the per-modality metric, floor and probe set digest. The node is readable through a graph query. Proving test: `crates/eg-types/src/embedding_promotion.rs::tests::verdict_is_stored_with_modality_entries`. | A graph query returns the verdict with one entry per modality. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R040.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is a served row write on a bound text column. The test replaces the embedding model with a candidate that regresses the image check. The write passes through the re-embed worker and the wired gate. The test observes the blocked promotion and the prior version still active. Proving test: `tests/embedding/test_promotion_gate_served.py::test_regressed_modality_blocks_promotion`. | The served write leaves the prior version active and records the verdict. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R026.4 EG:64 source definition Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**EG:64 source definition.** Expose graph-backed relational projections through an approved, version-pinned schema mapping. Reuse `AttachedCatalogGraph`/R2RML and the existing query surface. A projection-read request binds tenant, actor, graph, mapping id/revision, table, selected columns, typed predicates, and query digest. Its response binds mapping revision, graph revision, column types, and result digest. Projection reads are read-only. Refuse INSERT, UPDATE, DELETE, or DDL through projected tables. Apply the same refusal to read-only principals and principals with separate write grants. A write request names the target graph mutation and passes existing policy/admission through the authoritative `MutationBatch` path. A mutation grant does not make a projection a writer. Preserve R026 P0–P5. Reuse R003/R005 for catalog and mapping. Reuse R029 for schema context. **Explicit hold:** The source record names no external application, relational table/column contract, or driver statement corpus. Keep application-level schema compatibility open until the R026 P0/P5 owner provides and approves the concrete mapping and captured statements. Do not imply a universal relational schema. **Original source objective:** The platform acts as a persistent store backend for external applications expecting a relational schema. Expose graph data read-only through that schema unless writes are explicitly granted. **Source SHA-256:** `c55bc629b1bfefc9d0346b75b8bb95e5a231b891e7e34297df17b960d6c9773c`. **Preserves:** EG-DURABLE-KERNEL-R035, EG-DURABLE-KERNEL-R043, EG-FEDERATED-QUERY-R080, EG-UNIFIED-DATA-PLANE-R026, EG-FEDERATED-QUERY-R080.1, EG-FEDERATED-QUERY-R080.2, EG-FEDERATED-QUERY-R080.3, EG-FEDERATED-QUERY-R080.4, EG-FEDERATED-QUERY-R080.5, and EG-FEDERATED-QUERY-R080.6. Delivery state remains SPECIFIED. This text does not assert implementation or served evidence. | A served external client reads a mapped table through an approved, pinned mapping. Bind the result to schema/graph revisions and row digest. Try INSERT, UPDATE, DELETE, and DDL through read-only and separately mutation-granted principals. Each attempt refuses and leaves graph revision unchanged. Submit an authorized graph `MutationBatch`. Confirm the projection read reflects its committed revision. Also refuse stale/unapproved mappings and unauthorized graph mutations. Keep application-level SQL/schema conformance open until R026 provides the approved target mapping and captured statement corpus. These are acceptance targets only. No test, implementation, receipt, or served result is asserted. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R612 Registered external graph connections, schema profiles and governed tabular reads are one registry (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Registered external graph connections, schema profiles and governed tabular reads are one registry (rollup).** Children `.1` to `.6`. | Satisfied only when `.1` to `.6` are verified. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R612.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** `crates/eg-federation/src/connections.rs` defines ExternalGraphConnection, SchemaProfile, LabelMapping, TabularRequest, FleetCatalogTable. Fields are typed and every identifier is validated at construction. | Unit test round-trips each type and rejects an invalid identifier. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R612.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** Named connections to external graph or SQL stores are persisted without secrets. Profiling imprints a source schema into the graph and maps source labels onto ontology classes with scored candidates. Governed tabular reads return a columnar batch under the caller's scope. Fleet catalog tables keep versioned discovery rows with migration refusal for a newer schema. | Unit tests cover each rule with positive and boundary cases. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R612.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Extends EG-UNIFIED-DATA-PLANE-R002 and R029. No other production caller may duplicate this behavior. | Test drives the entry point and asserts the capability ran. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R612.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A connection spec carrying an inline secret is refused; only references persist. The stable code is `CONNECTION_SECRET_INLINE`. | Test submits the invalid input and asserts the code and zero partial writes. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R612.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Per profile: labels mapped, unmapped, candidates. | Test reads the trace or metrics after one success and one refusal. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R612.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** profile of 5k labels under 1.5 s p99; tabular read of 100k rows under 400 ms p99. The benchmark is `benches/r612_unified_data_plane.rs` and gates a regression above 10 percent. | The benchmark and its integration test run in the spec checks. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R750 Conversation history source, run audit rows and step store (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Conversation history source, run audit rows and step store (rollup).** Rust-native in `crates/eg-durable/src/history`. Delivered through its child requirements. | Child requirements prove it. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R750.750 Model: Conversation history source, run audit rows and step store Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model: Conversation history source, run audit rows and step store.** The engine serves these records by query. They are per-run audit records and tool-call rows linked to trace nodes. They are also redacted identities and a scoped conversation-search source over stored steps. Types: `HistorySource`, `StepStore`, `RunAuditRecord`, `ToolCallRecord`. Concurrency: read paths are lock-free over immutable snapshots; writes go through the single write authority. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R750.751 Behavior: Conversation history source, run audit rows and step store Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior: Conversation history source, run audit rows and step store.** Audit append is idempotent per run and tool call. Search is tenant- and scope-filtered before ranking. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R750.752 Refusal: Conversation history source, run audit rows and step store Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal: Conversation history source, run audit rows and step store.** A record with an unredacted identity field and a search outside the caller scope are refused. | Unit tests assert the stated behaviour and golden vectors replay identically on every supported target. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R750.753 Hot-path proof: Conversation history source, run audit rows and step store Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof: Conversation history source, run audit rows and step store.** Criterion benchmark `history_search` over 1M steps. The p50 is under 12 ms and the p99 is under 35 ms. Memory stays under 128 MiB. | The named benchmark runs in CI. It fails the gate when p50, p99 or memory regress. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R650 Phase-ordered ingestion pipeline (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Phase-ordered ingestion pipeline (rollup).** EG runs ingestion as a registry of ordered phases. The phases run in this order. First come scan, parse, registry, embedding and communities. Next come centrality, community reports and SHACL quarantine. Then come sync, memory, validation, observability, knowledge base and external graphs. The phases have explicit dependencies and a shared context. Enrichment does not block. The Rust home is `crates/eg-jobs/src/pipeline.rs`. Satisfied only when children `EG-UNIFIED-DATA-PLANE-R650.1`-`EG-UNIFIED-DATA-PLANE-R650.6` are satisfied. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R650.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `PipelinePhase{id,deps,blocking}`, `PipelineContext`, `PhaseRegistry`, `PhaseReceipt`, `QuarantineProjection` in `crates/eg-jobs/src/pipeline.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R650.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** Topologically order phases in O(P+D). Run blocking phases to the commit. Enqueue enrichment phases as budgeted durable jobs. Quarantine invalid candidates before sync and report them without blocking valid ones. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R650.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Phase list is data in the registry; the Leiden driver of `EG-REPO-INGEST-R011` backs communities and centrality. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R650.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A cyclic phase graph, a missing dependency and a sync that bypasses quarantine are refused at registration. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R650.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Record phase order, receipts, durations and quarantine counts. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R650.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** Benchmark `pipeline_phase_dispatch` (14 phases, 100k nodes): p50 200 us, p99 1 ms, peak memory 8 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-jobs pipeline_phase_dispatch` against the stored baseline. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R651 Document ingest, update and delete across every store (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Document ingest, update and delete across every store (rollup).** One document operation keeps the document record, its vectors and its graph relationships consistent. Ingest writes all three. Update regenerates embeddings and relationships. Delete cascades and leaves no orphan behind. The Rust home is `crates/eg-durable/src/document_ops.rs`. Satisfied only when children `EG-UNIFIED-DATA-PLANE-R651.1`-`EG-UNIFIED-DATA-PLANE-R651.6` are satisfied. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R651.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `DocumentOp{Ingest,Update,Delete}`, `CascadePlan`, `OrphanReport` in `crates/eg-durable/src/document_ops.rs`. Types are serde-stable, tenant-scoped, and included in the contract digest. | A contract test lists the types in `contract/methods.json` and fails on an undeclared field change. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R651.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** Plan the cascade from the document's back-references. Apply it in one transaction. Verify that no orphan remains by a post-condition scan limited to the plan's keys. | Unit tests assert the behavior on fixed fixtures and a property test asserts determinism across runs and thread counts. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R651.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Served `DocumentIngest`, `DocumentUpdate`, `DocumentDelete` through SourceIngest. | A wiring test shows the served method reaches this code and no second implementation remains outside EG. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R651.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A delete with live external references or a partial cascade is refused as a whole. | One refusal test per case asserts the stable code and that no state changed. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R651.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Record cascade plan, affected keys and the orphan report. | A served-path test reads the evidence back through a separately authorized query and compares every field. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R651.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** Benchmark `document_cascade_delete` (document with 500 chunks): p50 2 ms, p99 12 ms, peak memory 16 MiB. Concurrency target: lock-free reads, one writer per tenant shard, linear scaling to 8 readers. The bench gate fails on a 10% regression. | `cargo bench -p eg-durable document_cascade_delete` against the stored baseline. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R651.7 Fetched web pages enrich through the one document path (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Fetched web pages enrich through the one document path (rollup).** A fetched web page becomes one Document through `SourceIngest`. The served `EnrichDocument` method chunks the Document, embeds the chunks and links every chunk and vector to the Document. Entity, relation and claim extraction is child `.7.7`. The path reuses `EG-REPO-INGEST-R652` (chunking), the vector path of `AddEmbedding` and `EG-INGEST-WORKER-R701` (extraction). No second chunker, embedder or extractor exists. Children `.7.1` to `.7.7` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | tests/web_document_enrich_served.rs:218 |
| EG-UNIFIED-DATA-PLANE-R651.7.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** `crates/eg-types/src/source_ingestion/web_document.rs` holds `EnrichDocumentRequest{document_id, text_property, fetch_backend, max_chunk_bytes, overlap_bytes}`, `EnrichDocumentReceipt` and the closed `FetchBackend` values `webarchiver` and `archivebox`. The Document carries its web provenance as properties: `url`, `canonical_url`, `retrieved_at`, `content_digest`, `title` and `fetch_backend`. Proving test: `web_document.rs::tests::web_provenance_round_trips`. | A serde round trip keeps every field and rejects a missing Document ID or an unknown backend. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | b3d7b62e5f61 crates/eg-types/src/source_ingestion/web_document.rs:94 |
| EG-UNIFIED-DATA-PLANE-R651.7.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** `EnrichDocument` chunks the Document text with `eg_document::processing::chunk_text`. Chunks follow headings and paragraphs, have a size limit and an overlap, and carry byte and character offsets. The chunks are embedded through the `/v1/embeddings` wire endpoint named by `EPISTEMIC_GRAPH_EMBEDDING_URL`, `EPISTEMIC_GRAPH_EMBEDDING_MODEL` and `EPISTEMIC_GRAPH_EMBEDDING_DIMS`. Without an endpoint, the deterministic hash embedder is used and `embedder = hash` is recorded. Each chunk node links to the Document by a `chunkOf` edge and holds its vector. An enriched content digest is a no-op. A new digest supersedes the chunks of the earlier digest. The stored chunks do not depend on the backend. Proving test: `src/server/handlers/web_ingest_tests.rs::links_chunks_vectors_and_facts`. | Unit tests observe linked chunks and vectors. An equal digest is a no-op, and a new digest supersedes. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | b3d7b62e5f61 crates/eg-document/src/processing.rs:269 crates/eg-document/src/processing.rs:282 crates/eg-document/src/processing.rs:301 src/server/handlers/web_ingest/embedder.rs:212 src/server/handlers/web_ingest_tests.rs:44 |
| EG-UNIFIED-DATA-PLANE-R651.7.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** The served `EnrichDocument` method reaches `src/server/dispatch/graph_pipeline/web_ingest.rs` after graph ACL and placement. It reads only an RLS-visible Document. It commits through the `ApplyChangeEnvelope` authority, the same commit path as `IndexRepository`. `SemanticSearch` then finds the chunk vectors. The production caller is the arbora operation `ARBORA-OPS-R067`. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | A served `EnrichDocument` call commits chunks, edges and vectors, and a served `SemanticSearch` returns a chunk. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | 780ae2e14170 9c20a3137fe3 b3d7b62e5f61 cbe98c46062a tests/web_document_enrich_served.rs:219 |
| EG-UNIFIED-DATA-PLANE-R651.7.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A missing or invisible Document must refuse with `DOCUMENT_NOT_FOUND`. A Document without text must refuse with `DOCUMENT_TEXT_MISSING`. An unknown stored backend must refuse with `WEB_BACKEND_INVALID`. A chunk window outside 64 to 65 536 bytes must refuse with `CHUNK_CONFIG_INVALID`. An embedding endpoint failure must refuse with `EMBEDDING_UNAVAILABLE`. A refusal must write no chunk or vector. Proving test: `tests/web_document_enrich_served.rs::test_web_document_refusals`. | Each case returns its code, and the graph version does not change. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | b3d7b62e5f61 cbda3e13e4c8 d715658809da crates/eg-document/src/processing.rs:314 src/server/handlers/web_ingest_tests.rs:113 tests/web_document_enrich_served.rs:421 |
| EG-UNIFIED-DATA-PLANE-R651.7.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** The receipt and one `DocumentEnrichment` record node name the Document, the content digest, the fetch backend, the embedder, the model, the dimensions and the chunker version. They list the chunk, vector and superseded counts. Every chunk node holds the backend, the embedder, its offsets and the citation fields of the Document. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | The receipt counts match a separate read of the chunk nodes and edges. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | b3d7b62e5f61 tests/web_document_enrich_served.rs:220 |
| EG-UNIFIED-DATA-PLANE-R651.7.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is the served `EnrichDocument` method followed by served `SemanticSearch`. The test enriches the same page through each backend. Both runs store equal chunk text and offsets. Chunking a 1 MiB Markdown document must stay under 3 ms p50 and 15 ms p99. The benchmark is `crates/eg-document/benches/document_chunk_tree.rs`. Proving test: `tests/web_document_enrich_served.rs::test_web_page_enriches_once_for_both_backends`. | The served test passes, and the benchmark meets both budgets. | requirement | EG-UNIFIED-DATA-PLANE | VERIFIED | b3d7b62e5f61 tests/web_document_enrich_served.rs:221 |
| EG-UNIFIED-DATA-PLANE-R651.7.7 Extraction Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Extraction.** Entity, relation and claim extraction of `EG-INGEST-WORKER-R701` runs over the enriched chunks. Each fact links to its chunk and its Document. Proving test: `tests/web_document_enrich_served.rs::test_enriched_chunks_extract_facts`. | Each extracted fact links to a chunk of the Document. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R700 Governed Actions: typed parameters, submission criteria, effects and write-back (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Governed Actions: typed parameters, submission criteria, effects and write-back (rollup).** A named Action declares typed parameters, submission criteria and an ordered effect list. The engine validates a submission, applies effects as one mutation, records status, and supports vendor write-back through the same path. Notification delivery is a consumer of the action outbox, not part of the engine. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R700.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** `ActionSpec { name, params: Vec<ActionParameter>, criteria: Vec<SubmissionCriterion>, effects: Vec<ActionEffectSpec> }`, `EffectKind`, `ActionStatus` in `crates/eg-types`; the registry is a `BTreeMap` per graph. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R700.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** Template resolution of parameters is a single pass over effect text. Criteria evaluate with `CriterionOp` comparisons in declared order and stop at the first failure. All effects commit in one `MutationBatch`. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R700.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Extends write-back governance (R012) and Decide-routed write-back proposals (DE R043). Action completion emits outbox events consumed by graph-os for notification. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R700.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A submission failing any criterion is refused with the criterion name. An unknown parameter or a type mismatch is refused. A write-back to an unattached source is refused. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R700.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Each action run stores parameters, the criterion verdicts and the effect receipts. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R700.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/data_plane/test_actions_served.py::test_failed_criterion_applies_no_effect` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/action_apply.rs` must show p50 under 2 ms and p99 under 12 ms with peak memory under 32 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R701 Standards conformance: cohorts, drift scores and consolidation recommendations (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Standards conformance: cohorts, drift scores and consolidation recommendations (rollup).** The engine groups assets into capability cohorts and scores each against its declared enterprise standard. It reports drift per domain and organization. It recommends consolidation for cohorts with overlapping capability. Implemented in eg-core. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R701.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** `Standard`, `CapabilityCohort`, `DriftScore { asset, standard, score }`, `ConsolidationRecommendation` in `crates/eg-types`. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R701.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** One grouping pass forms cohorts from shared capability classes. Drift is a weighted fraction of satisfied rules. Recommendations are scored by overlap and cost. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R701.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Extends consolidation safety (R031): a recommendation across attached applications is only a proposal. | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R701.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A recommendation touching assets of different tenants is refused. An asset with no applicable standard reports `not_applicable`, never score zero. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R701.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Each score lists the satisfied and failed rules. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R701.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/data_plane/test_standards_drift_served.py::test_missing_standard_is_not_zero` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/standards_drift.rs` must show p50 under 4 ms and p99 under 30 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R702 ETL runs record lineage and consume OpenLineage run events (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**ETL runs record lineage and consume OpenLineage run events (rollup).** A declarative ETL run writes typed records and lineage between source and target datasets. Its field transforms include coalesce, cast, rename, flatten and stable id. The engine maps external lineage run events, de-duplicates them and drains them into the same lineage graph. It quarantines malformed events. Implemented in eg-core, eg-types. | Every child `.1` to `.6` is verified; the rollup is landed only when all are. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R702.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** `EtlRun`, `LineageEdge { dataset_in, dataset_out, run }`, `QuarantinedLineageEvent` in `crates/eg-types`; dataset ids are content-addressed. | Compile-time test: the types reject the invalid shapes named in `.4`; golden serialization vector round-trips. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R702.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** Event mapping is a pure function. Drain is idempotent on the event id. It processes in batches of the configured size with bounded memory. | Unit tests cover the stated complexity bound on fixtures of 10, 1,000 and 100,000 items. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R702.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** UQL serves lineage queries over the lineage graph (as derived series lineage R004). Consumption of the event topic follows the change-capture framework (R008, R009). | The served test in `.6` reaches the behavior through the wire method, not through a unit entry point. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R702.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A malformed dataset reference is quarantined with a typed reason and never dropped. A replayed event adds no edge. | Negative tests assert each refusal code and that durable state is unchanged. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R702.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Quarantined events keep their original payload digest. | A read of the stored record reproduces the recorded decision from its recorded inputs. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R702.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The entry point is the served wire method. The test `tests/data_plane/test_lineage_drain_served.py::test_replay_adds_no_edges_and_bad_events_quarantine` drives the wired call over a fixture and observes the behavior in `.2`. The benchmark `benches/lineage_drain.rs` must show p50 under 3 ms and p99 under 18 ms with peak memory under 64 MiB per request. Concurrency target: independent graphs run in parallel; one graph is serialized per writer. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R710 Message-stream adapters normalize into ChangeEnvelope: model and behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Message-stream adapters normalize into ChangeEnvelope: model and behavior.** Extends `EG-UNIFIED-DATA-PLANE-R008`. Adapters consume Kafka-style and subject-based message streams. Each adapter maps a message to a ChangeEnvelope with an opaque cursor. It commits offsets only after the durable write. It exposes consumer enablement as configuration. The framework treats every stream alike. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R711 Message-stream adapters normalize into ChangeEnvelope: refusal, evidence and hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Message-stream adapters normalize into ChangeEnvelope: refusal, evidence and hot-path proof.** Extends `EG-UNIFIED-DATA-PLANE-R008`. A message that cannot map is dead-lettered with its payload digest, never dropped. Test `tests/data_plane/test_stream_adapters_served.py::test_offset_commits_after_durable_write`; benchmark `benches/stream_adapter.rs` sustains 50,000 messages per second per consumer with p99 map latency under 0.2 ms, memory under 64 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R030.700 Identity evidence kinds and merge decisions for candidate links: model and behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Identity evidence kinds and merge decisions for candidate links: model and behavior.** Each candidate link carries typed identity evidence (exact key, normalized name, version variant, entropy-qualified token, embedding). It also carries a merge decision, and that decision is a proposal. Names that look like opaque high-entropy tokens never merge on name alone. Version variants link and do not merge. Crate and data structures are named in the owning rows; complexity and memory are as stated here. | Unit tests pin the typed model and the stated bound. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R030.701 Identity evidence kinds and merge decisions for candidate links: refusal, evidence and hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Identity evidence kinds and merge decisions for candidate links: refusal, evidence and hot-path proof.** A merge decision without an approver is refused. Test `tests/data_plane/test_identity_evidence_served.py::test_high_entropy_names_do_not_merge`; benchmark `benches/identity_candidates.rs` p50 under 20 ms and p99 under 100 ms per 10,000 records with blocking, memory under 128 MiB. | The served test passes and the benchmark receipt meets the budget. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R761 Dataset and column profiling (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Dataset and column profiling (rollup).** The engine must profile attached and native datasets. A profile holds per-column statistics and attaches to the R003 catalog graph. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R761.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `ColumnProfile{dataset, column, rows, nulls, distinct_estimate, min, max, top_k, histogram, profiled_at}` in `crates/eg-types/src/profile.rs`. | `crates/eg-types/tests/profile.rs::profile_round_trips` round-trips a profile. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R761.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** Profiling pushes aggregate queries to the source through R006 where the dialect supports them. It samples otherwise. Distinct counts use a sketch with 1 percent relative error. | `crates/eg-core/tests/profile.rs::distinct_estimate_within_error` profiles 1M rows and checks the error. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R761.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Add the job kind `DatasetProfile` to the `AnalyticsJob` path in `src/server/handlers/jobs/submit.rs`. The job calls the R803 sensitive data scan of EG-TYPED-PACKS per column. | `tests/test_profile_served.py::test_profile_job_attaches_to_catalog` profiles a fixture table and reads the catalog node. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R761.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A profile of a dataset outside the caller scope must refuse with `PROFILE_FORBIDDEN`. A source without aggregate support and without sampling must refuse with `PROFILE_UNSUPPORTED`. | `tests/test_profile_served.py::test_profile_refusals` asserts both codes. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R761.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Each profile records the method, pushdown or sample, and the sample size. | `tests/test_profile_served.py::test_profile_method_recorded` reads the method back. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R761.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/column_profile.rs` profiles 10 columns over 10M native rows. It stays under 3 s and 256 MiB. | `cargo bench --bench column_profile` fails on a 10 percent regression. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R762 Data quality rules, scores and quality incidents (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Data quality rules, scores and quality incidents (rollup).** The engine must evaluate declared quality rules over datasets and graphs. It must record scores per dimension and open a quality incident on a breach. Children `.1` to `.8` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R762.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `QualityRule{id, target, dimension, expression, threshold, severity}` and `QualityScore{rule, value, passed, at}` in `crates/eg-types/src/quality.rs`. `dimension` is a closed set: `completeness`, `uniqueness`, `validity`, `consistency`, `freshness`, `accuracy`. | `crates/eg-types/tests/quality.rs::rule_round_trips` round-trips a rule and a score. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R762.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** A SQL rule compiles to one pushed aggregate query. A graph rule compiles to a SHACL shape of `crates/eg-shacl`. A freshness rule reads the change-capture lag of R008. Three consecutive failures of one rule open one incident through R760. | `crates/eg-core/tests/quality.rs::three_failures_open_one_incident` fails one rule three times. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R762.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** Add the job kind `QualityEvaluate` to the `AnalyticsJob` path in `src/server/handlers/jobs/submit.rs`. The R805 contract check of EG-TYPED-PACKS reads the scores. arbora serves `quality.*` through `ARBORA-OPS-R856`. | `tests/test_quality_served.py::test_rule_scores_and_incident` evaluates a failing rule and reads the incident. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R762.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** A rule whose expression does not compile must refuse with `QUALITY_RULE_INVALID`. A threshold outside 0 to 1 must refuse with `QUALITY_THRESHOLD_INVALID`. | `tests/test_quality_served.py::test_quality_refusals` asserts both codes. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R762.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Each score records the compiled query digest and the row counts that produced it. | `tests/test_quality_served.py::test_score_evidence_reads_back` compares every field. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R762.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/quality_evaluate.rs` evaluates 100 rules over a 10M-row native dataset. It stays under 5 s. | `cargo bench --bench quality_evaluate` fails on a 10 percent regression. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R762.7 Rule proposals from profiles Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Rule proposals from profiles.** The engine must propose quality rules from each R761 profile. A null ratio, a key-like distinct count or a value pattern yields one candidate rule. Each candidate enters the R802 change request flow of EG-TYPED-PACKS as `proposed`. It never evaluates as active before approval. | `crates/eg-core/tests/quality.rs::profile_yields_proposed_rules` profiles a fixture and lists the proposals. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R762.8 Quality results from outside checkers Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Quality results from outside checkers.** The engine must accept quality results from outside checkers through `SourceIngest` as `QualityScore` records. Each record names its checker. Outside and native scores share one dimension set and one incident rule. | `tests/test_quality_served.py::test_outside_scores_open_incident` ingests three failing outside scores and reads the incident. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R763 Column-level lineage from SQL text (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Column-level lineage from SQL text (rollup).** The engine must derive column-level lineage from view definitions, ETL transforms and query logs. It extends the dataset lineage of R702 down to columns. Children `.1` to `.6` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R763.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `ColumnLineageEdge{source_column, target_column, transform, query_digest}` in `crates/eg-types/src/lineage.rs`. `transform` is a closed set: `identity`, `expression`, `aggregate`, `filter_only`. | `crates/eg-types/tests/lineage.rs::column_edge_round_trips` round-trips an edge. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R763.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** The engine parses SQL with the shared planner parser. It resolves each output column to its input columns through the R003 catalog. Star expansion uses the catalog. An unresolved column stays a typed gap. | `crates/eg-core/tests/column_lineage.rs::view_columns_resolve` parses a join view with an aggregate. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R763.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** The R003 catalog reader calls the parser for each view definition. The R702 drain calls it for each ETL run with SQL text. An impact query walks the column edges. | `tests/test_column_lineage_served.py::test_view_lineage_and_impact` attaches a source with a view and asks the impact of one column. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R763.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** SQL that fails to parse must quarantine with `LINEAGE_SQL_UNPARSEABLE`. It never drops silently. | `tests/test_column_lineage_served.py::test_unparseable_sql_quarantines` reads the quarantine record. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R763.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Each edge records the source query digest and the parser version. | `tests/test_column_lineage_served.py::test_edge_evidence_reads_back` compares every field. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R763.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/column_lineage.rs` parses 10,000 view definitions. The p99 per view stays under 2 ms. | `cargo bench --bench column_lineage` fails on a 10 percent regression. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R764 Asset usage statistics and catalog search (rollup) Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Asset usage statistics and catalog search (rollup).** The engine must count asset use per principal and period. Catalog search over datasets, columns, terms, products and stored queries ranks by text, vector and usage. Children `.1` to `.8` deliver it. | See each child. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R764.1 Model Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Model.** Add `AssetUsage{asset, principal, period, reads, queries}` in `crates/eg-types/src/asset_usage.rs` and `CatalogSearchHit{asset, kind, score, usage_rank}`. | `crates/eg-types/tests/asset_usage.rs::usage_round_trips` round-trips both records. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R764.2 Behavior Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Behavior.** The engine increments usage from the query audit, never from client claims. Search fuses text and vector scores of EG-FEDERATED-QUERY-R008 with a usage prior capped at 20 percent of the score. | `crates/eg-core/tests/catalog_search.rs::usage_prior_is_capped` checks the cap. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R764.3 Wiring Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Wiring.** The audit append of EG-DURABLE-KERNEL-R031 feeds usage buckets in `eg-tsdb`. Add the served method `CatalogSearch`. arbora serves `catalog.search` through `ARBORA-OPS-R855`. | `tests/test_catalog_search_served.py::test_search_ranks_used_asset_higher` queries two equal assets with different usage. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R764.4 Refusal Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Refusal.** Search never returns an asset outside the caller access. A query over 1,000 characters must refuse with `CATALOG_QUERY_TOO_LONG`. | `tests/test_catalog_search_served.py::test_search_refusals` checks both cases. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R764.5 Evidence Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Evidence.** Each hit lists its text, vector and usage components. | `tests/test_catalog_search_served.py::test_hit_components_listed` reads the components back. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R764.6 Hot-path proof Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Hot-path proof.** The benchmark `benches/catalog_search.rs` searches 1M assets. The p99 stays under 30 ms. | `cargo bench --bench catalog_search` fails on a 10 percent regression. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R764.7 Usage from attached-source query logs Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Usage from attached-source query logs.** The engine must read the query history of each attached source that exposes one, through its R013 to R020 adapter. It parses each statement with the R763 parser. It counts reads per table and column and per principal. It records the joins and filters in common use. | `tests/test_catalog_search_served.py::test_source_query_log_feeds_usage` loads a fixture query log and reads usage and join counts. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |
| EG-UNIFIED-DATA-PLANE-R764.8 Frequent users and usage suggestions Definition — EG-UNIFIED-DATA-PLANE / EG-UNIFIED-DATA-PLANE — Unified data planeCanonical requirement and verification source**Frequent users and usage suggestions.** The engine must name the most frequent principals per asset as suggested contacts. It must offer the most common joins and filters of an asset as query suggestions. Both read only usage that the caller may see. | `tests/test_catalog_search_served.py::test_frequent_users_and_join_suggestions` reads both answers for one table. | requirement | EG-UNIFIED-DATA-PLANE | SPECIFIED | No recorded commit/test evidence |