@sdd-method/maintain-cli 0.12.0 → 0.13.1

package/dist/lib/catalogue/canonical-schema.yaml

@@ -7,7 +7,7 @@
 # Emitted by sdd-cli's YAML emitter with no line folding; the three header scalars are quoted for the
 # textual readers downstream. The one deliberate difference from the authored form is schema_status:
 # the authored form says canonical; a projection never does.
-schema_version: "5.0.0"
+schema_version: "6.0.0"
 schema_owner: "sdd-method"
 schema_status: "generated"
 enums:
@@ -338,6 +338,7 @@ enums:
     - value: capability-spec
     - value: capability-tree
     - value: product-map
+    - value: structural-model
     description: Which artefact a capabilities row was derived from. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
   feature_source:
     values:
@@ -346,6 +347,7 @@ enums:
     - value: feature-tree
     - value: feature-grounding
     - value: capability-spec
+    - value: structural-model
     description: Which artefact a features row was derived from (M-ADR 0145). Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
   artefact_maturity:
     values:
@@ -637,15 +639,13 @@ enums:
     - value: RENAMED
     - value: REMOVED
     description: How a change's delta treated a requirement.
-  requirement_status_value:
+  requirement_assertion_kind:
     values:
-    - value: agreed
-      description: In an agreed, open change.
     - value: declared-shipped
-      description: Its change archived on a passing judge, with this repository's task group complete.
+      description: Its change archived on a passing judge, with this repository's work order implementing it.
     - value: observed
       description: Independent evidence from this repository's code matches (a baseline's characterization tests or a reverse snapshot).
-    description: A requirement's status in one implementing repository (M-ADR 0221 §4.5).
+    description: The kind of evidence an assertion is about one revision, in one repository (M-ADR 0230 §4.7, Proposed).
   change_status:
     values:
     - value: proposed
@@ -694,9 +694,85 @@ enums:
     - value: citation
       description: A citation in the journey feature's living spec (option B).
     description: Where a journey's citation of a requirement was read (M-ADR 0229 §4.4, Proposed).
+  source_of_truth:
+    values:
+    - value: structure
+      description: The structural model in the behaviour store (openspec/structure/), changed by a change's structural deltas.
+    - value: behaviour
+      description: The behaviour store's living specs and changes.
+    - value: interface
+      description: The contract files.
+    - value: decision
+      description: The ADR files.
+    - value: declaration
+      description: A manifest or configuration file that is its own home, such as the SDD manifest.
+    - value: intent
+      description: Intent documents, edited in place.
+    - value: derived
+      description: "Nowhere: computed from other facts, per view; never authored."
+    - value: evidence
+      description: Observations, scores and findings, about a named revision.
+    - value: execution
+      description: "The change records and the build itself: changes, work orders, lineage, and the provenance the build or aggregation stamps."
+    description: Where a catalogue's facts, or a column's, are authored (M-ADR 0230 §4.1, Proposed). Each catalogue carries one; a column carries one only where it differs.
+  relationship_end_cardinality:
+    values:
+    - value: exactly-one
+    - value: zero-or-one
+    - value: one-or-more
+    - value: zero-or-more
+    description: "How many entities one end of a relationship holds for one entity at the other end (M-ADR 0230 §4.3, Proposed): a Mermaid ER end marker (|| exactly one, |o or o| zero or one, }| or |{ one or more, }o or o{ zero or more). A TypeQL relationship is zero-or-more at both ends, because the subset admits no participation cardinality; a role's @card is a cardinality invariant (domain_invariants). Replaced entity_relationship_cardinality in schema 6.0.0."
+  domain_invariant_kind:
+    values:
+    - value: unique
+      description: The named attributes together are unique across the entity's instances.
+    - value: required
+      description: The named attributes are always present.
+    - value: cardinality
+      description: A bound on how many entities the named relationship relates, stated in the statement.
+    - value: rule
+      description: Any other rule, stated in the statement.
+    description: The type of a domain invariant (M-ADR 0230 §4.3, Proposed).
+  revision_state:
+    values:
+    - value: current
+      description: "Published: the living spec states it."
+    - value: intended
+      description: An agreed open change states it.
+    - value: history
+      description: Once published or stated, and no longer current.
+    description: Which view a revision belongs to (M-ADR 0230 §4.7, Proposed).
+  change_effect_element_kind:
+    values:
+    - value: requirement
+      description: A requirement, written by a behaviour delta.
+    - value: structure
+      description: An element of the structural model, written by a structural delta.
+    description: What kind of element a change effect writes (M-ADR 0230 §4.7, Proposed).
+  adr_governs:
+    values:
+    - value: current
+      description: The system as published.
+    - value: intended
+      description: "The system as the agreed changes will leave it: the decision applies from its change's archive."
+    - value: none
+      description: "Neither: proposed, rejected, deprecated, superseded by a decision now in force, or its change withdrawn."
+    description: Which view a decision governs (M-ADR 0230 §4.2, Proposed).
+  contract_revision_state:
+    values:
+    - value: agreed
+      description: Introduced by an agreed open change.
+    - value: active
+      description: "Applicable in the published specification: the file's current content."
+    - value: deprecated
+      description: Applicable, with a sunset.
+    - value: retired
+      description: "No longer applicable: an archived change's revision the file no longer holds."
+    description: A contract revision's applicability in the published specification (M-ADR 0230 §4.2, Proposed).
 catalogues:
   domains:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -713,6 +789,7 @@ catalogues:
       type: string
       nullable: false
       description: platform-profile | application-product | integration-product.
+      source_of_truth: declaration
     - name: reference_architecture_equivalent
       type: string
       nullable: true
@@ -723,19 +800,23 @@ catalogues:
     - name: repo_count
       type: int
       nullable: false
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator at merge time per M-ADR 0134; left empty by per-SDD builders.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     column_enums:
       method_profile: enums.sdd_profile
       status: enums.domain_status
   products:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -760,6 +841,7 @@ catalogues:
       type: string
       nullable: false
       description: Path to _product/ directory, relative to docs/.
+      source_of_truth: derived
     - name: lifecycle
       type: string
       nullable: true
@@ -796,28 +878,35 @@ catalogues:
       type: int
       nullable: true
       description: "DEPRECATED at 3.3.0, for removal at 4.0.0 — superseded by `quality_scores` (rubric_id `reverse-product-quality.product_synthesis_quality`). Score 0-10 from the product-synthesis rubric (reverse method only). WIRED in 2.47.0 from `orchestration/gate-registry/reverse-product-quality-scores.yaml` — the registry family at product granularity — via the SELF-PRODUCT rule: the unit whose `product_path` is '.' AND whose key equals the SDD's sdd_id. Both conditions are required; product_path alone admits synthetic gate fixtures, key-matching alone admits covered sub-products. Backfill only: it fills an empty cell and never overwrites an emitted value. Empty on a forward estate by design — a forward-authored product has no reverse rubric score, and residue-based authoring signals deliberately do NOT write here (see status)."
+      source_of_truth: evidence
     - name: synthesis_band
       type: string
       nullable: true
       description: "DEPRECATED at 3.3.0, for removal at 4.0.0 — superseded by `quality_scores.band`, which is UNBOUND because the vocabulary is per-rubric. This column's closed set accepts only three of the SEVEN band values the reverse estate actually authors (measured 3.3.0: strong, working, weak, moderate, easy, hard, very-hard), silently emptying the rest. developing | working | strong — a CLOSED vocabulary; a band outside it is reported as a convention finding and the cell left empty rather than emitting a value no consumer can interpret. Wired in 2.47.0 alongside synthesis_quality."
+      source_of_truth: evidence
     - name: last_assessed
       type: date
       nullable: true
+      source_of_truth: evidence
     - name: highest_snapshot_impact
       type: string
       nullable: true
+      source_of_truth: evidence
     - name: repo_count
       type: int
       nullable: false
       description: Number of repos mapped to this product.
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: domain_id
       references: domains.id
@@ -830,6 +919,7 @@ catalogues:
       packaging: enums.product_packaging
   applications:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -908,10 +998,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: Filtered view of products where profile = application-product.
     foreign_keys:
     - column: domain_id
@@ -925,6 +1017,7 @@ catalogues:
       packaging: enums.product_packaging
   integrations:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -948,9 +1041,11 @@ catalogues:
     - name: doc_path
       type: string
       nullable: false
+      source_of_truth: derived
     - name: repo_count
       type: int
       nullable: false
+      source_of_truth: derived
     - name: ingestion_pattern
       type: string
       nullable: true
@@ -975,10 +1070,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: Granular provider adapters. Each row is either (a) an integration-product SDD's own row (one per SDD; parent_product_id empty), or (b) a manifest-declared sub-integration of a multi-provider monolith (parent_product_id = umbrella SDD's id). Per M-ADR 0144 (schema 2.6.0), sub-integrations are declared via the optional `sub_integrations:` array in `integration-manifest.yaml`.
     foreign_keys:
     - column: domain_id
@@ -991,6 +1088,7 @@ catalogues:
       invocation_pattern: enums.invocation_pattern
   integration_component:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -1012,6 +1110,7 @@ catalogues:
       type: string
       nullable: false
       description: undeclared | repository | service | unresolved. `undeclared` = no `componentRepo` given (normal, no finding). `repository`/`service` = the declared linkage resolved. `unresolved` = declared but matched no repositories.id or services.id of this SDD, which carries a coverage finding. Re-based on `component_repo` in 2.44.0 — it previously described resolution of `component_id` itself.
+      source_of_truth: derived
     - name: component_type
       type: string
       nullable: true
@@ -1056,14 +1155,17 @@ catalogues:
       type: string
       nullable: false
       description: "components-array | component-manifest — WHICH of M-ADR 0171 §9.1's two homes declared this component. Added in 2.49.0, when the second home became catalogued. Required because §10.1 states that any coverage reasoning MUST say which form it counts, and once one table holds both, a consumer cannot tell them apart: merging them without this recreates the reference-exemplar problem — well-formed rows that do not mean what a consumer assumes. Measured at the time of wiring: the array form was 15 components across 5 SDDs, the per-component form 86 across 21, and the two are DISJOINT (no id collision, no SDD using both). `resolution` also reads differently by form — for the array form `componentRepo` is an optional declaration (0 of 15 declared it); for the per-component form the containing `repos/<component>/` directory IS the repo, so linkage is structural rather than declared."
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Integration-product edge (M-ADR 0171 §9, catalogued per §10.1): one row per component declared in the SDD's `integration-manifest.yaml` `components:` array. A component is one of the integration's component code repos (M-ADR 0106) — an integration SDD is a one-to-many spec→code unit — and the tier is the source of truth for the interaction pattern, with the SDD-level `ingestionPattern`/`invocationPattern` as its aggregate (§9.3).
       Built per-SDD, integration-product only (other profiles emit headers-only). A component id is unique within its manifest and names an **interaction surface** — commonly one provider feed — which is NOT necessarily a deployable (§10.2). The optional `component_repo` carries an explicit code linkage; when declared it MUST resolve to a `repositories.id` or `services.id` of the same SDD, and a declared-but-unresolvable linkage is a **coverage finding, not a load failure**. `resolution` records the outcome inline, including `undeclared` for the normal feed-level case, so a consumer filters on it rather than inferring from a join miss.
@@ -1078,6 +1180,7 @@ catalogues:
       declared_in: enums.integration_component_declared_in
   adrs:
     primary_key: id
+    source_of_truth: decision
     columns:
     - name: id
       type: string
@@ -1100,25 +1203,39 @@ catalogues:
     - name: doc_path
       type: string
       nullable: false
+      source_of_truth: derived
     - name: superseded_by_id
       type: string
       nullable: true
+      source_of_truth: derived
     - name: inference_confidence
       type: string
       nullable: true
       description: high | medium | low (reverse-inferred ADRs only).
+      source_of_truth: derived
     - name: supersedes_raw
       type: string
       nullable: true
       description: Raw text from Supersedes bullet for later parsing.
+    - name: effective_change
+      type: string
+      nullable: true
+      description: "From the ADR's **Effective:** line (M-ADR 0230 §4.2, Proposed): the change whose archive makes the decision apply, by its undated name; empty when it applies on acceptance. Added in schema 6.0.0."
+    - name: governs
+      type: string
+      nullable: true
+      description: "Bound to adr_governs: which view the decision governs. An Accepted ADR governs current on acceptance, or once its effective change archives; intended while that change is open; nothing once it is withdrawn or gone. A Superseded ADR governs current until a superseding ADR does. Added in schema 6.0.0."
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: domain_id
       references: domains.id
@@ -1131,8 +1248,10 @@ catalogues:
       nullable: true
     column_enums:
       inference_confidence: enums.confidence_level
+      governs: enums.adr_governs
   glossary_items:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1152,13 +1271,16 @@ catalogues:
       type: string
       nullable: true
       description: Set when this term is an alias for another.
+      source_of_truth: derived
     - name: aliases
       type: string
       nullable: true
       description: "';'-separated list."
+      source_of_truth: derived
     - name: evidence
       type: string
       nullable: true
+      source_of_truth: evidence
     - name: notes
       type: string
       nullable: true
@@ -1166,10 +1288,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: owning_domain_id
       references: domains.id
@@ -1179,6 +1303,7 @@ catalogues:
       nullable: true
   glossary_xref:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1195,6 +1320,10 @@ catalogues:
       nullable: false
       description: alias-of | conflicts-with | references | supersedes (extended in schema 2.12.0 per M-ADR 0158).
     description: "Edge: cross-domain glossary relationships from glossary-alignment-manifest.yaml. Per M-ADR 0158, four walkers ingest into this catalogue: (a) forward declared pair-form {source, target} entries under aliases/conflicts, (b) reverse-method cross_domain_terms (emits references edges per referencer→owner), (c) reverse-method multi-domain conflicts (pair-wise expansion across domains[]), (d) forward-method supersedes (status: superseded entries with superseded_by back-link)."
+    natural_key:
+    - source_id
+    - target_id
+    - relation
     foreign_keys:
     - column: source_id
       references: glossary_items.id
@@ -1206,6 +1335,7 @@ catalogues:
       relation: enums.glossary_xref_relation
   entity_glossary:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1224,14 +1354,17 @@ catalogues:
       type: string
       nullable: false
       description: aligned | matched_direct. Conflicting statuses within a domain resolve matched_direct > aligned with a divergence finding.
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     - name: entity_id
       type: string
       nullable: true
@@ -1249,6 +1382,7 @@ catalogues:
       nullable: true
   services:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1287,6 +1421,7 @@ catalogues:
       type: string
       nullable: true
       description: high | medium | low (reverse-method classification).
+      source_of_truth: evidence
     - name: context
       type: string
       nullable: true
@@ -1298,10 +1433,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: product_id
       references: products.id
@@ -1317,6 +1454,7 @@ catalogues:
       confidence: enums.confidence_level
   capabilities:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1339,6 +1477,7 @@ catalogues:
       type: string
       nullable: true
       description: Evidence class of the capability's claims, from `capability.evidence_class` in the traceability manifest. Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when undeclared. Added in schema 2.20.0.
+      source_of_truth: evidence
     - name: context
       type: string
       nullable: true
@@ -1346,6 +1485,7 @@ catalogues:
     - name: description
       type: string
       nullable: true
+      source_of_truth: intent
     - name: status
       type: string
       nullable: false
@@ -1354,14 +1494,17 @@ catalogues:
       type: string
       nullable: true
       description: Path to capability spec file when one exists.
+      source_of_truth: derived
     - name: contract_provenance
       type: string
       nullable: true
       description: "How this capability's declared contract SET was produced, from `traceability.contracts.provenance`. hand-authored | reverse-extracted | generated — the vocabulary the method already ships for `authoring-mode`, reused deliberately so provenance has one vocabulary and not two. Empty means undeclared, and undeclared reads as `hand-authored` by convention. Added at 3.5.0. ⚠ STRICTLY ORTHOGONAL to the contract-set maturity ladder (`traceability.contracts.status`: planned | provisional | partial | complete | stable | none): provenance never constrains status and status never constrains provenance, and `reverse-extracted` + `complete` is the legitimate pair that motivated the field. Evidence: 2 reverse-estate manifests had written `reverse-extracted` INTO contracts.status, where it is invalid, because a complete reverse-derived contract surface had no way to say both true things at once and the author picked the provenance one. A rule here that constrained maturity would re-create exactly that defect. ⚠ Note the asymmetry this column exposes and does not fix: the maturity ladder it is orthogonal to has NO catalogue column at all — `traceability.contracts.status` is validator-enforced but uncatalogued, so it is queryable by no consumer. That is the authored-but-uncatalogued class (a block with no column has no automated reader, so nothing can notice when it is absent or wrong); this column is given one precisely so the provenance half does not join it. Giving the ladder a column is a candidate follow-on, not done here."
+      source_of_truth: evidence
     - name: source
       type: string
       nullable: false
-      description: capability-tree | product-map | capability-spec.
+      description: "capability-tree | product-map | capability-spec | structural-model. As of schema 6.0.0, source: structural-model is emitted for a capability only the structural model holds (M-ADR 0230 §4.3, Proposed)."
+      source_of_truth: derived
     - name: runway_classification
       type: string
       nullable: true
@@ -1378,10 +1521,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: domain_id
       references: domains.id
@@ -1396,6 +1541,7 @@ catalogues:
       source: enums.capability_source
   feature_groups:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1421,18 +1567,22 @@ catalogues:
       type: string
       nullable: true
       description: Authored description (when group has explicit metadata) or null when derived from heading only.
+      source_of_truth: intent
     - name: source
       type: string
       nullable: false
       description: feature-tree-h2 | feature-tree-h3 | feature-spec-explicit (when an authored feature spec declares group membership) | capability-spec-explicit.
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Hierarchical grouping for features. First-class entity — replaces the previous reverse-only synthetic `feature-tree-group` rows in features.csv. Both forward and reverse can use feature_groups: forward application-product SDDs whose `feature-tree.md` has H2/H3 structure, reverse SDDs whose extracted feature trees are inherently hierarchical, and any SDD that promotes groups to first-class with authored metadata. Groups can nest via `parent_group_id`.
     foreign_keys:
@@ -1447,6 +1597,7 @@ catalogues:
       nullable: true
   features:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1473,10 +1624,12 @@ catalogues:
     - name: description
       type: string
       nullable: true
+      source_of_truth: intent
     - name: maturity
       type: string
       nullable: true
       description: "Standard: working | provisional | unknown | absent. Ecosystem-specific values may be added with parser awareness."
+      source_of_truth: derived
     - name: status
       type: string
       nullable: false
@@ -1484,7 +1637,8 @@ catalogues:
     - name: source
       type: string
       nullable: false
-      description: "feature-tree | feature-set | capability-spec | feature-spec | feature-grounding. NOTE: feature-tree-group source removed in 1.3.0 — groups are now first-class in feature_groups.csv. As of schema 2.2.0, source: feature-tree is emitted by the canonical builder for rows derived from feature-tree.md bullets. As of schema 2.5.0, source: feature-grounding is emitted for rows derived from `docs/domains/<dom>/design/<capability>/feature-grounding.md` markdown tables (per M-ADR 0143). As of schema 2.7.0, source: capability-spec is emitted by the canonical builder for rows derived from `## Feature Grounding (code-path trace)` tables in `docs/domains/<dom>/product/<capability>.md` capability spec markdown (per M-ADR 0145). Feature-grounding and capability-spec rows are both capability-owned: product_id is empty; capability_id resolves from the file path."
+      description: "feature-tree | feature-set | capability-spec | feature-spec | feature-grounding | structural-model. As of schema 6.0.0, source: structural-model is emitted for a feature only the structural model holds (M-ADR 0230 §4.3, Proposed). NOTE: feature-tree-group source removed in 1.3.0 — groups are now first-class in feature_groups.csv. As of schema 2.2.0, source: feature-tree is emitted by the canonical builder for rows derived from feature-tree.md bullets. As of schema 2.5.0, source: feature-grounding is emitted for rows derived from `docs/domains/<dom>/design/<capability>/feature-grounding.md` markdown tables (per M-ADR 0143). As of schema 2.7.0, source: capability-spec is emitted by the canonical builder for rows derived from `## Feature Grounding (code-path trace)` tables in `docs/domains/<dom>/product/<capability>.md` capability spec markdown (per M-ADR 0145). Feature-grounding and capability-spec rows are both capability-owned: product_id is empty; capability_id resolves from the file path."
+      source_of_truth: derived
     - name: runway
       type: string
       nullable: true
@@ -1497,10 +1651,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: product_id
       references: products.id
@@ -1521,6 +1677,7 @@ catalogues:
       maturity: enums.artefact_maturity
   personas:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1538,20 +1695,24 @@ catalogues:
     - name: description
       type: string
       nullable: true
+      source_of_truth: intent
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: product_id
       references: products.id
       nullable: false
   user_journeys:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1573,23 +1734,28 @@ catalogues:
     - name: trigger
       type: string
       nullable: true
+      source_of_truth: intent
     - name: goal
       type: string
       nullable: true
+      source_of_truth: intent
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: product_id
       references: products.id
       nullable: false
   contracts:
     primary_key: id
+    source_of_truth: interface
     columns:
     - name: id
       type: string
@@ -1621,6 +1787,7 @@ catalogues:
     - name: spec_path
       type: string
       nullable: true
+      source_of_truth: derived
     - name: visibility
       type: string
       nullable: true
@@ -1633,6 +1800,7 @@ catalogues:
       type: string
       nullable: true
       description: Evidence class of the contract surface, from OpenAPI `info.x-evidence-class` (document root accepted as fallback, exactly like x-context). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when untagged. Added in schema 2.20.0.
+      source_of_truth: evidence
     - name: description
       type: string
       nullable: true
@@ -1640,14 +1808,17 @@ catalogues:
       type: string
       nullable: true
       description: discovered | declared-external. `discovered` (default) means the builder walked the spec file and parsed it, so title/version/context/evidence_class are trustworthy. `declared-external` means the row exists ONLY because a capability traceability manifest declared it with an explicit external marker and the file was never read — so those columns are necessarily EMPTY and their emptiness carries no information. A consumer that cannot tell the two apart will treat a declaration as a validated contract. Added in schema 2.51.0 (D13).
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: service_id
       references: services.id
@@ -1662,6 +1833,7 @@ catalogues:
       discovery: enums.contract_discovery
   events:
     primary_key: id
+    source_of_truth: interface
     columns:
     - name: id
       type: string
@@ -1690,14 +1862,17 @@ catalogues:
       type: string
       nullable: true
       description: Evidence class of the event claim, from the per-event `evidence_class` key (alias `evidence-class`) in event-catalog.yaml, falling back to a file-level `evidence_class`/`evidence-class` top-level key in the same catalog YAML. Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty for avsc-only events and when undeclared. Added in schema 2.20.0.
+      source_of_truth: evidence
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Asynchronous messages. Cross-domain events (e.g. shared envelopes) leave domain_id empty. Per M-ADR 0156 (multi-source ingestion, schema 2.12.0): forward-method canonical source is `contracts/avro/*.avsc` files; reverse-method canonical source is `docs/domains/{domain}/contracts/events/event-catalog.yaml`. YAML wins on name/domain/publisher/transport/consumers; avsc augments schema_path/version. Both paths run and merge by id slug."
     foreign_keys:
     - column: publisher_service_id
@@ -1708,6 +1883,7 @@ catalogues:
       nullable: true
   c4_systems:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1728,6 +1904,7 @@ catalogues:
       type: string
       nullable: true
       description: Path to L1 mermaid/markdown. Nullable — row exists for any architectural Product even if no L1 diagram has been authored yet (visible coverage gap).
+      source_of_truth: derived
     - name: description
       type: string
       nullable: true
@@ -1735,10 +1912,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     foreign_keys:
     - column: product_id
       references: products.id
@@ -1747,6 +1926,7 @@ catalogues:
       kind: enums.c4_system_kind
   c4_containers:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1781,10 +1961,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       C4 L2. Each container belongs to exactly one C4 system. `domain_id` is a denormalised organisational tag, not a C4-structural attribute — multi-domain ecosystems use it for filtering/reporting. `service_id` is the optional "may represent" link to a runtime service when the container is a deployable application.
     foreign_keys:
@@ -1801,6 +1983,7 @@ catalogues:
       type: enums.c4_container_type
   c4_components:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1827,10 +2010,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       C4 L3. Each component belongs to exactly one C4 container. `service_id` is denormalised from `c4_containers.service_id` for query convenience — populated when the parent container represents a runtime service.
     foreign_keys:
@@ -1842,6 +2027,7 @@ catalogues:
       nullable: true
   c4_external_systems:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1867,18 +2053,22 @@ catalogues:
       type: string
       nullable: true
       description: "Scope of the first-seen declaration: l1 (context diagram) or l2 (container diagram — scope-relative per M-ADR 0189 §4.1). Added 2.30.0."
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       C4 external software systems — peer systems at the L1 context level that the ecosystem integrates with but does not own (per M-ADR 0155). Rendered `System_Ext(...)` on L1/L2 diagrams. NOT a c4_container (external systems are not inside your system) and NOT a c4_system (they have no owning Product). External systems are inherently shared references: the same external system may be declared by multiple SDDs, so the aggregator dedups identical rows by PK rather than failing on duplicate (the one narrowly-scoped exception to M-ADR 0134's duplicate-PK rule); conflicting attributes on the same id surface as a `convention` finding.
   repositories:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1914,33 +2104,42 @@ catalogues:
     - name: files
       type: int
       nullable: true
+      source_of_truth: evidence
     - name: code
       type: int
       nullable: true
+      source_of_truth: evidence
     - name: comment
       type: int
       nullable: true
+      source_of_truth: evidence
     - name: blank
       type: int
       nullable: true
+      source_of_truth: evidence
     - name: total_lines
       type: int
       nullable: true
+      source_of_truth: evidence
     - name: languages
       type: string
       nullable: true
       description: "';'-separated."
+      source_of_truth: evidence
     - name: doc_path
       type: string
       nullable: false
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     - name: repo_scope
       type: string
       nullable: true
@@ -1957,6 +2156,7 @@ catalogues:
       repo_scope: enums.repo_scope
   domain_models:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -1972,6 +2172,7 @@ catalogues:
       type: string
       nullable: false
       description: Path to data-model.mermaid.md.
+      source_of_truth: derived
     - name: version
       type: string
       nullable: true
@@ -1980,18 +2181,22 @@ catalogues:
       type: string
       nullable: true
       description: Evidence class of the domain model, from a leading ```yaml fence in the data-model markdown carrying `evidence-class:` (documentation-reverse anchor convention). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when undeclared. Added in schema 2.20.0.
+      source_of_truth: evidence
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     - name: notation
       type: string
       nullable: true
       description: "The notation the model artefact is written in — one of enums.model_notation (mermaid-erd | typeql), DERIVED by the builder from the file (data-model.mermaid.md → mermaid-erd; data-model.tql → typeql), never authored. The compliance instrument of M-ADR 0210 §4.6 Decision 2 (as amended): a mermaid-erd row is advisory until the sunset 2027-03-31 and an error after it. Added in 3.11.0."
+      source_of_truth: derived
     description: "Per-domain ER diagram modelling the domain's aggregates, entities, and domain events. Platform-profile only — application and integration profiles emit headers-only. Forward source: `traceability.domain_model.path` in capability traceability manifests. Reverse source: file-system scan of `docs/domains/*/architecture/data-model.mermaid.md`. Added in schema 2.4.0; see M-ADR 0142."
     foreign_keys:
     - column: domain_id
@@ -2001,6 +2206,7 @@ catalogues:
       notation: enums.model_notation
   entities:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2038,14 +2244,17 @@ catalogues:
       type: string
       nullable: true
       description: Evidence class inherited from the owning domain model's file-level declaration (the leading ```yaml fence's `evidence-class:` in data-model markdown). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when the source file declares none, and for manifest-sourced rows (the glossary-alignment manifest has no evidence slot). Added in schema 2.20.0.
+      source_of_truth: evidence
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Data-model entity (a structural realisation of a concept inside a domain's data model). Distinct from glossary_items (vocabulary-level) and from domain_models (file-level). Added in schema 2.13.0 per M-ADR 0159. Forward source: `models[].entities[]` in glossary-alignment-manifest.yaml. Reverse source: `EntityName { ... }` declarations inside `erDiagram` fences in `docs/domains/{domain}/architecture/data-model.mermaid.md`. PK uses an entity-aware slug that normalises across UPPER_SNAKE and PascalCase authoring styles."
     foreign_keys:
     - column: domain_id
@@ -2061,6 +2270,7 @@ catalogues:
       persistence_kind: enums.persistence_kind
   repo_capability:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -2081,6 +2291,7 @@ catalogues:
       nullable: false
   repo_capability_exemption:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -2107,6 +2318,7 @@ catalogues:
       reason: enums.capability_exemption_reason
   service_capability_exemption:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -2133,6 +2345,7 @@ catalogues:
       reason: enums.service_capability_exemption_reason
   external_system_exemption:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -2159,6 +2372,7 @@ catalogues:
       reason: enums.external_system_exemption_reason
   repo_contract:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -2182,6 +2396,7 @@ catalogues:
       - integration-product
   product_capability:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2200,6 +2415,9 @@ catalogues:
       type: string
       nullable: true
     description: "Edge: product depends on / consumes capability. Forward sources from app-platform-dependencies.yaml. capability_id is external because the consuming product (an application-product SDD) references a capability owned by the platform SDD."
+    natural_key:
+    - product_id
+    - capability_id
     foreign_keys:
     - column: product_id
       references: products.id
@@ -2212,6 +2430,7 @@ catalogues:
       role: enums.consumption_role
   product_service:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2231,6 +2450,9 @@ catalogues:
       nullable: true
       description: "provisional | stable | unknown. The consuming SDD's expectation of contract stability, carried verbatim from app-platform-dependencies.yaml. Not a bound enum: an out-of-vocabulary value is carried, not rejected, and is reported by validate-app-dependencies.sh."
     description: "Edge: product depends on / consumes service. Forward sources from app-platform-dependencies.yaml. service_id is external because the consuming product (an application-product SDD) references a service owned by the platform SDD."
+    natural_key:
+    - product_id
+    - service_id
     foreign_keys:
     - column: product_id
       references: products.id
@@ -2244,6 +2466,7 @@ catalogues:
       required_stability: enums.required_stability
   service_contract:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2260,6 +2483,10 @@ catalogues:
       nullable: false
       description: exposes | consumes.
     description: "Edge: service exposes or consumes contract. Both FKs are external (per M-ADR 0147): federated SDDs that walk per-repo service-architecture tables emit consumes rows where service_id resolves to the platform-root catalogue's services.csv (post-aggregation) and contract_id resolves to the platform-root contracts.csv. Internal builds (a single-SDD platform) still optimistically validate locally. Schema 2.8.0."
+    natural_key:
+    - service_id
+    - contract_id
+    - role
     foreign_keys:
     - column: service_id
       references: services.id
@@ -2273,6 +2500,7 @@ catalogues:
       role: enums.contract_participation
   service_event:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2289,6 +2517,10 @@ catalogues:
       nullable: false
       description: publishes | consumes.
     description: "Edge: service publishes or consumes event."
+    natural_key:
+    - service_id
+    - event_id
+    - role
     foreign_keys:
     - column: service_id
       references: services.id
@@ -2300,6 +2532,7 @@ catalogues:
       role: enums.event_participation
   service_entity:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2319,15 +2552,22 @@ catalogues:
       type: string
       nullable: true
       description: Source markdown path or feature-grounding row that produced the edge. Audit aid.
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Edge: service touches data-model entity. Added in schema 2.13.0 per M-ADR 0159. Primary source: per-domain `## Data Store Mapping` markdown table in `docs/domains/{domain}/architecture/data-model.mermaid.md` (relation=owns). Optional forward source (Phase 5 deferred): `entities:` block in `orchestration/repo-config/<repo>.yaml`. Service names resolve via heuristic (slug-of-name; trailing-id-segment) with optional adopter-authored alias map at `docs/platform/reference/service-name-aliases.yaml`."
+    natural_key:
+    - service_id
+    - entity_id
+    - relation
     foreign_keys:
     - column: service_id
       references: services.id
@@ -2339,6 +2579,7 @@ catalogues:
       relation: enums.service_entity_relation
   capability_feature:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2350,6 +2591,9 @@ catalogues:
       type: string
       nullable: false
     description: "Edge: capability decomposes into features. Forward: traceability.runway.enables. Reverse: parsed from spec Feature Grounding."
+    natural_key:
+    - capability_id
+    - feature_id
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2359,6 +2603,7 @@ catalogues:
       nullable: false
   capability_service:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2389,8 +2634,13 @@ catalogues:
       type: string
       nullable: true
       description: Where the coupling is evidenced — a path or anchor in the SDD, from `evidence:` on the services[] entry. Prose about the coupling stays in dependency_notes; this is the pointer a reviewer follows.
+      source_of_truth: evidence
     description: |
       Edge: capability is realised by services. Sourced from the capability traceability manifest services[] block. service_id is an external FK (schema 2.29.0): a traceability entry marked `owner_sdd:` declares a cross-SDD reference (e.g. the service moved to a sibling SDD at an M-ADR 0170 §4.2 carve) — the per-SDD builder emits the edge, logs it `[finding] external`, and aggregation validates it hard against the owning sibling's rows. An UNMARKED id that does not resolve locally is NOT emitted — it stays a member-tier orphan finding (or convention, when it names a known external system).
+    natural_key:
+    - capability_id
+    - service_id
+    - role
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2408,6 +2658,7 @@ catalogues:
       interaction_pattern: enums.interaction_pattern
   capability_event:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2426,6 +2677,7 @@ catalogues:
       type: string
       nullable: false
       description: authored | derived. `authored` rows come from a traceability declaration (shape A or shape B); `derived` rows come from `capability_service ⋈ service_event` and represent associative coupling, not ownership. Schema 2.14.0 per M-ADR 0160.
+      source_of_truth: derived
     description: "Edge: capability publishes or consumes event. Schema 2.14.0 (per M-ADR 0160) multi-source ingestion: (1) forward shape A — `traceability.events[{id, role}]` (legacy aspirational shape, unauthored across observed adopters); (2) forward shape B — `traceability.contracts.published_events[]` / `consumed_events[]` with `{event, status, notes}` (the observed forward-method shape; event name slug-resolves against events.csv); (3) derived — `capability_service ⋈ service_event` join (zero authoring; associative not authoritative). Authored rows win on PK conflict with derived. The `source` column distinguishes the two so governance queries can filter to authoritative ownership. The earlier `## Related Events` capability-spec heading is retired (no adopter authored it; the template never carried the section)."
     foreign_keys:
     - column: capability_id
@@ -2439,6 +2691,7 @@ catalogues:
       source: enums.edge_source
   capability_contract:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2453,7 +2706,11 @@ catalogues:
       type: string
       nullable: false
       description: "declared — the only emitted value. `derived` is reserved vocabulary: the reverse derivation it anticipated was never built (0 rows across 105 measured units) and the claim was corrected at 3.0.0 (M-ADR 0203 §4.5); the value re-enters if a decision builds a reverse source."
+      source_of_truth: derived
     description: "Edge: capability is bound to a contract. Whether the capability exposes or depends on it is not stated by the source (traceability.contracts), so this description asserts no direction (M-ADR 0211 §1). Forward-declared only. Forward-declared only (traceability.contracts). The reverse derivation this description long claimed (service_contract ⋈ capability_service) was measured nonexistent — 0 `source: derived` rows across 105 units, builder references neither catalogue — and the CLAIM was corrected at 3.0.0 (M-ADR 0203 §4.5, gap class absent-derivation per M-ADR 0196 §4.1). The edge is forward-one-directional until a decision builds a reverse source."
+    natural_key:
+    - capability_id
+    - contract_id
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2463,6 +2720,7 @@ catalogues:
       nullable: false
   journey_feature:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2474,6 +2732,9 @@ catalogues:
       type: string
       nullable: false
     description: "Edge: journey touches features. Parsed from Related features bullet."
+    natural_key:
+    - journey_id
+    - feature_id
     foreign_keys:
     - column: journey_id
       references: user_journeys.id
@@ -2483,6 +2744,7 @@ catalogues:
       nullable: false
   persona_feature:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2494,6 +2756,9 @@ catalogues:
       type: string
       nullable: false
     description: "Edge: persona uses features. Parsed from Related features bullet."
+    natural_key:
+    - persona_id
+    - feature_id
     foreign_keys:
     - column: persona_id
       references: personas.id
@@ -2503,6 +2768,7 @@ catalogues:
       nullable: false
   feature_service:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2514,6 +2780,9 @@ catalogues:
       type: string
       nullable: false
     description: "Edge: feature is implemented by service. Parsed from Feature Services table in feature-tree.md."
+    natural_key:
+    - feature_id
+    - service_id
     foreign_keys:
     - column: feature_id
       references: features.id
@@ -2523,6 +2792,7 @@ catalogues:
       nullable: false
   feature_event:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -2553,6 +2823,7 @@ catalogues:
       role: enums.event_participation
   feature_repo:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -2573,6 +2844,7 @@ catalogues:
       nullable: false
   feature_contract:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -2601,6 +2873,7 @@ catalogues:
       derivation_path: enums.feature_contract_derivation_path
   feature_subscription_channels:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2621,6 +2894,7 @@ catalogues:
       type: string
       nullable: true
       description: Evidence-file citation (`<sub-repo>/<path>:<line>`) anchoring the channel declaration. Mirrors the citation pattern used elsewhere in evidence yamls.
+      source_of_truth: evidence
     - name: payload_ref
       type: string
       nullable: true
@@ -2629,10 +2903,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Edge: feature delivers async push via a named channel/topic. Peer of `graphql_operations:` in the per-feature evidence shape — `graphql_operations:` carries the GraphQL operation names declared in the schema (Queries / Mutations / Subscriptions); `feature_subscription_channels` rows carry the channel/topic layer that physically delivers the push events (AppSync WebSocket endpoints, Pekko WS channels, MQTT topics, server-sent-event streams). A single GraphQL Subscription operation may listen on multiple channels; one channel may be consumed by multiple operations — modelling as a separate edge catalogue (not as a feature column) accommodates the many-to-many. Built per-SDD from `reverse-evidence/feature-grounding-evidence.yaml` `subscription_channels:` entries on each feature. Added in schema 2.9.0."
     foreign_keys:
     - column: feature_id
@@ -2642,6 +2918,7 @@ catalogues:
       transport: enums.subscription_channel_transport
   capability_domain_model:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2657,7 +2934,11 @@ catalogues:
       type: string
       nullable: false
       description: traceability-manifest | inferred.
+      source_of_truth: derived
     description: "Edge: capability references a domain model. Forward: declared in `traceability.domain_model` field of the capability traceability manifest. Reverse: inferred via capability → domain → domain_model. Platform-profile only. Added in schema 2.4.0; see M-ADR 0142."
+    natural_key:
+    - capability_id
+    - domain_model_id
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2669,6 +2950,7 @@ catalogues:
       source: enums.capability_domain_model_source
   feature_domain_model:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -2694,6 +2976,7 @@ catalogues:
       nullable: false
   persona_journey:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2709,6 +2992,10 @@ catalogues:
       nullable: false
       description: primary | handoff | supporting.
     description: "Edge: persona participates in journey. Roles: primary | handoff | supporting."
+    natural_key:
+    - persona_id
+    - journey_id
+    - role
     foreign_keys:
     - column: persona_id
       references: personas.id
@@ -2720,6 +3007,7 @@ catalogues:
       role: enums.journey_participation
   persona_c4system:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2736,6 +3024,9 @@ catalogues:
       nullable: true
       description: Optional interaction label from the Rel(...) line, e.g. 'Web browser' / 'Mobile app'.
     description: "Edge: persona (C4 Person) uses a C4 system. Captures the L1 context 'Person uses System' relationship, extracted from Person(...) macros on the L1 context diagram and matched to personas rows. Per M-ADR 0155. Added in schema 2.10.0."
+    natural_key:
+    - persona_id
+    - c4_system_id
     foreign_keys:
     - column: persona_id
       references: personas.id
@@ -2745,6 +3036,7 @@ catalogues:
       nullable: false
   persona_container:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2762,6 +3054,9 @@ catalogues:
       description: Optional interaction label from the Rel(...) line. May hold multiple '; '-joined labels.
     description: |
       Edge: a persona uses a C4 container — the L2-granularity companion to persona_c4system (M-ADR 0189, ratified 2026-07-10). Eleven of one estate's L2 diagrams and the bulk of another's 81 unroutable Rels drew Person→Container relationships that had no catalogue and raised no finding. Harvested at member tier from Rel(...) lines whose endpoints resolve to a file-local Person and a local container (either direction; the row is normalised persona→container). A Person that matches no persona row is a coverage finding, never a silent skip. Both authoring directions feed from the same diagram surface (M-ADR 0157 parity). Added in schema 2.34.0.
+    natural_key:
+    - persona_id
+    - container_id
     foreign_keys:
     - column: persona_id
       references: personas.id
@@ -2771,6 +3066,7 @@ catalogues:
       nullable: false
   system_external_dependency:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2791,6 +3087,9 @@ catalogues:
       nullable: true
       description: The Rel's non-external endpoint resolved to a local container at member tier, when it is one (2.33.0) — the datum that lets adjudication rewrite this edge onto container_dependency instead of destroying it. Empty when the endpoint is the system itself or unresolvable.
     description: "Edge: a C4 system integrates with an external software system. Captures the L1 context 'System integrates with External System' relationship, extracted from System_Ext(...) + Rel(...) on L1/L2 diagrams. Per M-ADR 0155. Container-level external dependencies are out of scope (system-level only). Added in schema 2.10.0. From 2.30.0 (M-ADR 0189 §4.4): edges whose external endpoint the aggregator adjudicates as an INTERNAL system are rewritten onto system_system_dependency and removed from this catalogue."
+    natural_key:
+    - c4_system_id
+    - external_system_id
     foreign_keys:
     - column: c4_system_id
       references: c4_systems.id
@@ -2803,6 +3102,7 @@ catalogues:
       nullable: true
   container_dependency:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2822,12 +3122,17 @@ catalogues:
       type: string
       nullable: true
       description: SDD whose diagram declared the originating reference. Member-emitted rows set it directly; adjudication-derived rows are stamped by the aggregator.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Edge: a C4 container depends on another INTERNAL container (the system-tier gap exactly one tier down: "no edge for internal" at L2). Derived by the aggregator at adjudication: an external-system candidate that resolves to an internal container was never external — each of its dependency edges whose member-resolved `from_container_id` is known is rewritten here, and a candidate with no remaining edges is dropped (it was a phantom duplicate of the container). A candidate with unconvertible edges is kept with the tier-contradiction finding, so no edge is ever destroyed to make a build quieter — the measured cost that stopped an adopter remediating 22 contradictions was eight real edges. ALSO emitted at member tier (2.33.1): the C4-correct authoring — Rel(container_a, container_b) between two Container(...) nodes — emits its edge directly; adjudication merges into a catalogue that already has content rather than being its only source, so the metamodel no longer rewards mis-declaration over correct authoring. Added in schema 2.33.0.
+    natural_key:
+    - from_container_id
+    - to_container_id
     foreign_keys:
     - column: from_container_id
       references: c4_containers.id
@@ -2837,6 +3142,7 @@ catalogues:
       nullable: false
   system_system_dependency:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -2856,10 +3162,12 @@ catalogues:
       type: string
       nullable: true
       description: SDD whose diagram declared the originating reference. Populated by the aggregator.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Edge: a C4 system depends on another INTERNAL system (M-ADR 0189 §4.3). Derived by the aggregator at adjudication (§4.4): an external-system candidate whose declared identity resolves to an internal system was never external — its Rel(...) dependency edges are rewritten onto this catalogue and the candidate row is dropped. Not emitted at member tier (a member cannot see sibling systems); headers-only there, like cross_sdd_platform_capability. Both authoring directions feed it from the same diagram surface (M-ADR 0157 parity). Added in schema 2.30.0.
     foreign_keys:
@@ -2871,6 +3179,7 @@ catalogues:
       nullable: false
   c4_container_entity:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -2889,10 +3198,12 @@ catalogues:
     - name: source_sdd_id
       type: string
       nullable: true
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Derived edge: C4 container is responsible for data-model entity. Added in schema 2.13.0 per M-ADR 0159 §4.8. Pure transitive derivation: `service_entity ⋈ c4_containers.service_id`. Only the subset of containers with `service_id` populated contribute edges (per M-ADR 0155 the container ↔ service cardinality is o-or-1; data-store containers and infra-umbrella containers without a service mapping legitimately emit no rows)."
     foreign_keys:
     - column: container_id
@@ -2903,6 +3214,7 @@ catalogues:
       nullable: false
   c4_system_entity:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -2921,10 +3233,12 @@ catalogues:
     - name: source_sdd_id
       type: string
       nullable: true
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Derived edge: C4 system is responsible for data-model entity. Added in schema 2.13.0 per M-ADR 0159 §4.8. Pure aggregation roll-up: `c4_container_entity ⋈ c4_containers.system_id`, with container_count recording how many of the system's containers touch the entity (governance signal for cross-container concerns)."
     foreign_keys:
     - column: system_id
@@ -2935,6 +3249,7 @@ catalogues:
       nullable: false
   capability_adr:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -2949,7 +3264,11 @@ catalogues:
       type: string
       nullable: false
       description: spec | high | medium.
+      source_of_truth: derived
     description: "Edge: ADR informs capability. Forward: declared in capability spec Architecture Decisions. Reverse: same plus heuristic match supplements with confidence."
+    natural_key:
+    - capability_id
+    - adr_id
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2961,6 +3280,7 @@ catalogues:
       confidence: enums.capability_adr_confidence
   adr_supersedes:
     primary_key: id
+    source_of_truth: decision
     columns:
     - name: id
       type: string
@@ -2981,6 +3301,7 @@ catalogues:
       nullable: false
   product_platform_dependencies:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -3026,14 +3347,17 @@ catalogues:
       type: string
       nullable: true
       description: Comma-separated list of service names within the consuming product that consume the dependency. Free-text; not FK-validated (services are within-product and resolution is owner-side concern).
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Per-SDD edge: an application-side or integration-side SDD declares that its product depends on a platform-side capability + service pair. Built from `reverse-evidence/feature-grounding-evidence.yaml` `platform_dependencies:` block (product-level — the cohort source shape carries product-scoped dependency rows with a `consumed_by:` list naming which services within the consuming product depend on the target). Each row records one (consuming product, target capability, target service) triple. The aggregator then joins these rows against platform-side `capability_service` to emit `cross_sdd_platform_capability` edges at aggregation time. Cross- SDD references (target_capability_id, target_service_id) are external — they're not expected to resolve in the per-SDD build, only at aggregation. Added in schema 2.9.0.
     foreign_keys:
@@ -3054,6 +3378,7 @@ catalogues:
       contract_type: enums.dependency_contract_type
   cross_sdd_platform_capability:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -3071,6 +3396,7 @@ catalogues:
       type: string
       nullable: false
       description: SDD slug of the platform side that owns the resolved capability.
+      source_of_truth: execution
     - name: platform_capability_id
       type: string
       nullable: false
@@ -3096,6 +3422,7 @@ catalogues:
       external: true
   application_data_plane_bindings:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3113,6 +3440,7 @@ catalogues:
       type: string
       nullable: false
       description: "inbound | output. DERIVED from `pattern` by a single method-tier mapping — not authored, and not a manifest field, so it cannot disagree with `pattern`. Materialises the output-side sub-set §4.7 declares (generate/publish => output; everything else => inbound). Exists because three §4.7 rules branch on direction: platform-dep reconciliation is inbound-only, the archetype WARN must compare like with like, and the M-ADR 0187 convergence reasoning differs by direction. Added in 2.40.0."
+      source_of_truth: derived
     - name: locality
       type: string
       nullable: true
@@ -3137,10 +3465,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Application-product edge (M-ADR 0193): one row per declared data-plane binding — a typed way the service sources, holds, produces or exposes data. The data-plane is a COMPOSITION of these bindings, a second axis orthogonal to `application_archetype` (0191). Built per-SDD from the manifest's `data_plane.bindings` block (application-product only; other profiles emit headers-only). The `pattern` vocabulary splits by DIRECTION (§4.7): an INBOUND data-sourcing sub-set (retrieve | own-store | stream-ingest | project) and an OUTPUT-side sub-set (generate | publish), materialised as the derived `direction` column. An INBOUND binding whose `target` is a platform capability/service reconciles with `product_platform_dependencies` — a `retrieve@internal` binding is a synchronous platform dependency and a `stream-ingest@internal` binding is the M-ADR 0192 `contract_type: event` async dependency; the genuinely new inbound rows are `own-store` (a self-binding) and any `external-vendor` binding. OUTPUT-side rows do NOT participate in that reconciliation (§4.7 rule 1): `publish` is a contract the service PROVIDES, not one it consumes, so it has no inbound counterpart to cross-check — consumers must filter on `direction` before reconciling, which is what the column is for. The archetype-default-vs-declared WARN keys on the bare `pattern` token and so spans both directions (§4.7 rule 2). Added in schema 2.37.0; `direction` added in 2.40.0.
     foreign_keys:
@@ -3153,6 +3483,7 @@ catalogues:
       locality: enums.data_plane_locality
   application_data_plane_deviations:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3174,10 +3505,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Application-product annotation (M-ADR 0191 §4.3 overlay): one row per declared departure from the archetype's default data-plane composition. Built per-SDD from the manifest's `data_plane.deviations` block so the overlay WARN — which runs at AGGREGATION tier, where the reference- architecture bundle (and its `expected_bindings`) resolves — can suppress a mismatch it is told is sanctioned variance. The `expectation` value is the **bare pattern token** (`retrieve` | `own-store` | `stream-ingest` | `project` | `generate` | `publish`) that the product knowingly diverges from; it must match the pattern the WARN keys on. The token set spans both directions — the WARN keys on the bare pattern, so an output-side expectation is deviated exactly like an inbound one (M-ADR 0193 §4.7 rule 2). Added in schema 2.38.0; output-side tokens documented in 2.40.0.
     foreign_keys:
@@ -3188,6 +3521,7 @@ catalogues:
       expectation: enums.data_plane_pattern
   application_conformance_coverage:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3205,6 +3539,7 @@ catalogues:
       type: string
       nullable: false
       description: covered (the product's suite exercises it) | deviated (deliberately not covered, with a rationale).
+      source_of_truth: derived
     - name: rationale
       type: string
       nullable: true
@@ -3213,10 +3548,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Application-product annotation (M-ADR 0191 §4.3 overlay, second element): one row per conformance tag the product asserts about its archetype's conformance expectations. Built per-SDD from the manifest's `conformance` block so the AGGREGATION-tier conformance GATE can read it. `status=covered` means the product's own conformance suite exercises the tag; `status=deviated` means the product declares (with a rationale) that it deliberately does not. At aggregation, an archetype-expected conformance tag that is neither covered nor deviated raises a deviation-visible WARN. The method gates the DECLARATION — it does not run the adopter's conformance suite. Added in schema 2.39.0.
     foreign_keys:
@@ -3225,6 +3562,7 @@ catalogues:
       nullable: false
   screens:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3250,6 +3588,7 @@ catalogues:
       type: string
       nullable: false
       description: screen-spec (forward) | screen-extraction (reverse).
+      source_of_truth: derived
     - name: domain
       type: string
       nullable: true
@@ -3266,14 +3605,17 @@ catalogues:
       type: string
       nullable: true
       description: "Evidence class of the screen's claims, from frontmatter `evidence_class:` (alias `evidence-class:`). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when undeclared. Completes the evidence-class dimension for the packaged-SaaS case: a packaged-SaaS SDD catalogues the vendor's STANDARD screens (documentation-reversed from vendor publications, `vendor-doc`) alongside the organisation's CUSTOMISED screens (code-reversed, `code-reverse`) per M-ADR 0175 §3.1 — without this column the two are indistinguishable, and doc-derived UI claims masquerade as code-verified. Orthogonal to `source` (`screen-spec` | `screen-extraction`), which records the authoring DIRECTION, not the evidence's strength: a `screen-extraction` screen can be either class, since a vendor's documented UI is extracted-but-not-code-verified. Added in schema 2.42.0."
+      source_of_truth: evidence
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "UI screen specified in the OpenUI Lang grammar (per M-ADR 0166). One row per screen / coherent screen group. Application-product profile (other profiles emit headers-only). Source: authored `screens/*.md` (frontmatter + ```openui-lang block); the reverse toolkit produces these from a router + component-tree projection."
     foreign_keys:
     - column: product_id
@@ -3283,6 +3625,7 @@ catalogues:
       status: enums.artefact_maturity
   ui_components:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -3308,10 +3651,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "An entry in the adopter-owned component registry that screens compose against (per M-ADR 0166) — the UI-structure contract. A screen composes registry components but never defines one. Application-product profile. Source: components referenced across the SDD's screen-spec ```openui-lang blocks (registry projection); the reverse toolkit discovers the authoritative registry from the design-system import surface."
     foreign_keys:
     - column: product_id
@@ -3321,6 +3666,7 @@ catalogues:
       kind: enums.ui_component_kind
   screen_component:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -3336,10 +3682,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Edge: screen composes a UI component. Parsed from the screen-spec ```openui-lang block's component references (per M-ADR 0166)."
     foreign_keys:
     - column: screen_id
@@ -3350,6 +3698,7 @@ catalogues:
       nullable: false
   screen_feature:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3365,10 +3714,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Edge: screen realises a feature (traceability). Forward: `realises:` frontmatter on the screen-spec. Reverse: route → feature mapping. Per M-ADR 0166."
     foreign_keys:
     - column: screen_id
@@ -3382,6 +3733,7 @@ catalogues:
       - integration-product
   persona_screen:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3397,10 +3749,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Edge: persona can access a screen. Forward: `persona_access:` frontmatter. Reverse: route persona-access guards, permission/feature-flag config, or a host shell's per-persona menu (where the backend pre-filters visible screens). Per M-ADR 0166."
     foreign_keys:
     - column: persona_id
@@ -3411,6 +3765,7 @@ catalogues:
       nullable: false
   screen_action:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -3431,10 +3786,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Edge: screen emits an action, optionally resolved to a catalogued event. The behavioural MFE seam — inter-bundle communication as a catalogued contract, not an ad-hoc string. Forward: `action=` declarations in the ```openui-lang block. Reverse: emitted custom-event / event-bus wiring. event_id is external-capable (the event may live in the platform SDD). Per M-ADR 0166 + M-ADR 0156."
     foreign_keys:
     - column: screen_id
@@ -3446,6 +3803,7 @@ catalogues:
       external: true
   conformance_finding:
     primary_key: id
+    source_of_truth: evidence
     columns:
     - name: id
       type: string
@@ -3505,10 +3863,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: "Conformance-reverse drift summary, one row per check (method M-ADR 0180). NOT produced by `catalogue build` (it reads the spec repo) — produced by `sdd-cli conformance --emit-finding` (which has the code repo) and federated here by the aggregator. Each row is a run-dated snapshot of declared-vs-observed drift for an implementation member (M-ADR 0181 role/lifecycle), so estate-wide conformance is queryable (aggregate union) and trendable (snapshot diff across runs/commits). Verdicts are PROVISIONAL — disposition (code-defect | spec-stale | divergence) is triage, recorded elsewhere. No enforced FK on implementation_repo: the code repo is frequently cross-repo and not in this SDD's repositories.csv. Added in schema 2.25.0."
     column_enums:
       target: enums.conformance_target
@@ -3516,6 +3876,7 @@ catalogues:
       lifecycle: enums.implementation_lifecycle
   quality_scores:
     primary_key: id
+    source_of_truth: evidence
     columns:
     - name: id
       type: string
@@ -3569,6 +3930,10 @@ catalogues:
       type: string
       nullable: true
       description: "The commit the assessment read — the precise staleness anchor. NEW AUTHORING introduced by this change-set: no score written before it carries one, so this column is empty across both estates at introduction and fills forward as registries are rewritten. The reverse family already has the idea under a different name (`snapshot.source_revision`)."
+    - name: input_paths
+      type: string
+      nullable: true
+      description: "';'-separated paths of the review's other assessed inputs (its `inputs:` list, M-ADR 0230 §4.9, Proposed), beside target_path: a feature's UX evidence, say. Each is read at corpus_ref, so a later edit to any of them makes the score stale, as an edit to the target does. Added in schema 6.0.0."
     - name: staleness_basis
       type: string
       nullable: false
@@ -3621,10 +3986,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134; left empty by per-SDD builders.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Rubric assessment of a target artefact, one row per (target, rubric), per M-ADR 0205 §4.5. Source: `orchestration/gate-registry/<rubric>-scores.yaml` — the authored surface stays YAML because a score is a judgment, authored where it asserts intent; these rows are DERIVED and never edited.
       Models the EFFECTIVE score only — `current`, as chosen by the registry's `selection_policy`. The authored `reviews[]` history is deliberately not catalogued: variable-length history in a fixed-grain catalogue would give two answers to "what is the score". `review_run_id` and `selection_method` make each row name which review it is.
@@ -3637,6 +4004,7 @@ catalogues:
       nullable: true
   quality_score_dimensions:
     primary_key: id
+    source_of_truth: evidence
     columns:
     - name: id
       type: string
@@ -3674,10 +4042,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       One row per (target, rubric, dimension) — the per-dimension detail behind a `quality_scores` row, per M-ADR 0205 §4.5.
       A child catalogue rather than columns, and this is forced rather than stylistic: the fifteen rubrics carry FIFTEEN DISJOINT dimension vocabularies (`A1`-`A8`, `C1`-`C8`, `G1`-`G7`, `T1`-`T7`, `D1`-`D6`, `S1`-`S6`, `I1`-`I6`, plus five fully-named sets such as `definition_precision` and `intent_fidelity`) — 45 distinct keys measured in one estate alone. No fixed column set can hold them; serialised JSON in a cell would be unjoinable and break the relational metamodel; generic `d1..d8` columns would be lossy and re-create the positional-index failure class. A child table is what this metamodel already does for every one-to-many, and it joins natively on the M-ADR 0205 §4.1 engine.
@@ -3687,6 +4057,7 @@ catalogues:
       nullable: false
   scaffolds:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3704,6 +4075,7 @@ catalogues:
       type: string
       nullable: false
       description: Repo-relative path of the manifest this row derives from, e.g. orchestration/scaffolds/payments-settlement.yaml.
+      source_of_truth: derived
     - name: corpus_ref
       type: string
       nullable: false
@@ -3720,10 +4092,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134; left empty by per-SDD builders.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       Forward scaffold declaration, one row per unit of work, per M-ADR 0207 §4.1. Source: `orchestration/scaffolds/*.yaml` — the authored surface stays YAML because a scaffold is a declaration of intent, authored where the work is scoped; these rows are DERIVED and never edited (M-ADR 0205 §4.0 governs unchanged).
       The scaffold states the catalogue shape a unit of work will comprise — its items are `scaffold_items` rows — and the declared-vs-derived delta against the built catalogues is the unit's definition of done: delta zero (structural) AND every realised artefact score-current (content, via `quality_scores`), per M-ADR 0207 §4.5. The unit is the change-set's declared delta; estate-level scaffold totality is an explicit non-goal (M-ADR 0207 §4.4), so an estate region no scaffold covers produces no finding.
@@ -3736,6 +4110,7 @@ catalogues:
       status: enums.scaffold_status
   scaffold_items:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3769,14 +4144,17 @@ catalogues:
       type: string
       nullable: false
       description: Resolution verdict — see the scaffold_item_state enum. Derived, never authored; recomputed on every build, so realisation flips rows exactly when the target lands.
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+      source_of_truth: execution
     description: |
       One declared item of a scaffold — an entity, edge, or contract the unit of work promises — per M-ADR 0207 §4.1. Derived from the manifest's item list; `state` is the builder's resolution verdict against the same build's catalogue rows.
       THE POLYMORPHIC TARGET DECLARES NO FOREIGN KEY, by design (the quality_scores.target_ref precedent, taken further): a scaffold exists to reference targets BEFORE they exist. FK truth here is CONDITIONAL ON STATE — a `declared` item's (target_kind, target_ref) MUST NOT resolve in the built catalogues, a `realised` item's MUST — and the builder's resolution pass is what enforces it: it computes `state` FROM resolution, so a disagreement between state and resolution cannot be emitted by a conforming builder. The M-ADR 0207 §4.8 delta instrument re-derives the same verdict on the engine as its self-check.
@@ -3790,6 +4168,7 @@ catalogues:
       state: enums.scaffold_item_state
   implementations:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3811,17 +4190,21 @@ catalogues:
       type: string
       nullable: false
       description: Path of the binding file, relative to the SDD root.
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+      source_of_truth: execution
     description: "An implementation of this SDD's spec: the durable system identity whose snapshots are its versions (M-ADR 0181 §2.5, M-ADR 0214 §4.1). One row per .sdd/implementation-binding.yaml that names its implementation; a binding without an implementation key emits nothing and a finding, because there is no identity to key on."
   implementation_members:
     primary_key: id
+    source_of_truth: declaration
     columns:
     - name: id
       type: string
@@ -3852,10 +4235,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+      source_of_truth: execution
     description: "Edge: a repository is a member of an implementation, with the member's role, lifecycle and evidence direction (M-ADR 0181 §2.1, M-ADR 0214 §4.2). Role and lifecycle live here once: repo_capability, repo_contract and feature_repo resolve their repository to this row rather than copying them (M-ADR 0214 §4.3). Membership is independent of the repository's repo_scope (M-ADR 0213): a shared library under conformance checks is a support member."
     foreign_keys:
     - column: implementation_id
@@ -3870,6 +4255,7 @@ catalogues:
       evidence_direction: enums.evidence_direction
   snapshots:
     primary_key: id
+    source_of_truth: evidence
     columns:
     - name: id
       type: string
@@ -3894,10 +4280,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+      source_of_truth: execution
     description: One implementation's member set pinned at one observation (M-ADR 0181 §2.5, M-ADR 0214 §4.4). One row per dated baseline in the implementation's snapshot area whose snapshot.yaml names the same implementation. Needs the snapshot store root (build --snapshot-store or SDD_SNAPSHOT_STORE); without it the catalogue is empty and the build says so.
     foreign_keys:
     - column: implementation_id
@@ -3908,6 +4296,7 @@ catalogues:
       nullable: true
   snapshot_members:
     primary_key: id
+    source_of_truth: evidence
     columns:
     - name: id
       type: string
@@ -3939,10 +4328,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+      source_of_truth: execution
     description: "Edge: a repository at one revision in one snapshot, with its presence — observed in this baseline, carried from an earlier one, or removed since the prior (M-ADR 0214 §4.4)."
     foreign_keys:
     - column: snapshot_id
@@ -3955,6 +4346,7 @@ catalogues:
       presence: enums.member_presence
   data_items:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -3978,13 +4370,16 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+      source_of_truth: execution
     description: "A unit of data an integration may supply and a feature may need, at the canonical boundary (M-ADR 0216 §4.1). Platform-owned, like events. Not a wire signal: payload grammar stays adopter territory."
   integration_data_item:
     primary_key: id
+    source_of_truth: evidence
     columns:
     - name: id
       type: string
@@ -4016,10 +4411,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+      source_of_truth: execution
     description: "Supply: what one integration states about one data item, from its feature-grounding (M-ADR 0216 §4.2). Several rows per item are normal (one per evidence_ref); coverage reads the best. No row reads unknown, and unknown is never written."
     foreign_keys:
     - column: integration_id
@@ -4036,6 +4433,7 @@ catalogues:
       basis: enums.supply_basis
   feature_data_requirement:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -4059,15 +4457,21 @@ catalogues:
       type: string
       nullable: true
       description: Where the need is stated (path and line).
+      source_of_truth: evidence
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+      source_of_truth: execution
     description: "Demand: a data item one feature needs, from the feature spec's Data Requirements table (M-ADR 0216 §4.3). Feature grain only: a capability's need is the union of its features'."
+    natural_key:
+    - feature_id
+    - data_item_id
     foreign_keys:
     - column: feature_id
       references: features.id
@@ -4082,6 +4486,7 @@ catalogues:
       necessity: enums.data_necessity
   feature_integration_support:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -4109,10 +4514,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+      source_of_truth: execution
     description: "Coverage: whether one integration can support one feature, DERIVED at aggregation from supply and demand (M-ADR 0216 §4.4); empty in a member build. SUPPORTED MEANS THE ITEMS REACH THE CANONICAL BOUNDARY, NOT THAT THE FEATURE WORKS END TO END: routing past that boundary is not checked."
     foreign_keys:
     - column: feature_id
@@ -4129,6 +4536,7 @@ catalogues:
       limiting_reason: enums.limiting_reason
   evidence_target_repo:
     primary_key: id
+    source_of_truth: evidence
     columns:
     - name: id
       type: string
@@ -4146,10 +4554,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+      source_of_truth: execution
     description: "A reverse evidence file names a repository another SDD owns, through its top-level target_repo (M-ADR 0214 §4.10). A reference, never a claim: the repository is described by exactly one SDD, elsewhere."
     foreign_keys:
     - column: repo_id
@@ -4158,6 +4568,7 @@ catalogues:
       external: true
   repo_dependency:
     primary_key: id
+    source_of_truth: structure
     columns:
     - name: id
       type: string
@@ -4183,15 +4594,21 @@ catalogues:
       type: string
       nullable: false
       description: The file the row came from, relative to the SDD root; the declared source when both name the dependency.
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+      source_of_truth: execution
     description: "Edge: a repository depends on another repository's code without either being a running service — a library linked at build time, or a template family it was generated from (M-ADR 0217). The depended-on repository may belong to another SDD, which describes it; this row only references it."
+    natural_key:
+    - from_repo_id
+    - to_repo_id
     foreign_keys:
     - column: from_repo_id
       references: repositories.id
@@ -4204,6 +4621,7 @@ catalogues:
       kind: enums.repo_dependency_kind
   requirements:
     primary_key: id
+    source_of_truth: behaviour
     columns:
     - name: id
       type: string
@@ -4221,22 +4639,27 @@ catalogues:
       type: string
       nullable: false
       description: "Bound to requirement_stage: living (in the living spec), agreed (added by an open change whose agreement record is agreed) or retired (removed by an archived change)."
+      source_of_truth: derived
     - name: spec_path
       type: string
       nullable: false
       description: "The file that holds the requirement: the living spec, or the open change's delta."
+      source_of_truth: derived
     - name: scenario_count
       type: integer
       nullable: false
       description: Scenarios under the requirement in that file.
+      source_of_truth: derived
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
+      source_of_truth: execution
     description: "A requirement in the SDD's behaviour store (M-ADR 0221): one row per requirement of a living spec, keyed by the catalogue feature the spec describes, and per requirement an open agreed change adds. Projected from openspec/ at the SDD's commit; never authored here."
     foreign_keys:
     - column: feature_id
@@ -4246,6 +4669,7 @@ catalogues:
       stage: enums.requirement_stage
   requirement_lineage:
     primary_key: id
+    source_of_truth: execution
     columns:
     - name: id
       type: string
@@ -4289,48 +4713,61 @@ catalogues:
     column_enums:
       change_kind: enums.requirement_change_kind
       operation: enums.requirement_operation
-  requirement_status:
+  requirement_assertions:
     primary_key: id
+    source_of_truth: evidence
     columns:
     - name: id
       type: string
       nullable: false
-      description: <requirement_id>__<repo_id>.
+      description: <revision_id>__<repo_id>.
+    - name: revision_id
+      type: string
+      nullable: false
+      description: The revision the evidence is about.
     - name: requirement_id
       type: string
       nullable: false
+      description: The revision's requirement, copied for joining without the revision; the revision's foreign key is the reference.
+      source_of_truth: derived
     - name: repo_id
       type: string
       nullable: false
       description: "The implementing repository: a work order's repository, or a repository a baseline was observed in."
-    - name: status
+    - name: kind
       type: string
       nullable: false
-      description: Bound to requirement_status_value.
+      description: Bound to requirement_assertion_kind.
     - name: basis
       type: string
       nullable: false
-      description: "The change that produced the status: its changes.id, <sdd_id>::<directory>."
+      description: "The change that produced the evidence: its changes.id, <sdd_id>::<directory>."
     - name: source_sdd_id
       type: string
       nullable: true
       description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
-    description: "Edge: a requirement's status in a repository that implements it (M-ADR 0221 §4.5; M-ADR 0223 §4.7). Derived, never authored: agreed from an open agreed change's work orders, declared-shipped from an archived change's PASS verdict and its work orders, observed from a baseline's evidence. The latest event in archive order wins. Limitation: a requirement and repository hold one status. An agreed open change's status replaces the evidence about the revision that is live until the change archives, and evidence is not bound to the requirement revision it concerns."
+      source_of_truth: execution
+    description: "Edge: evidence about one revision of a requirement, in one repository that implements it (M-ADR 0230 §4.7, Proposed; replaces requirement_status in schema 6.0.0). Derived, never authored: observed from a baseline's **Observed in:** line, declared-shipped from an archived change's PASS verdict through its work orders' implements lists, each about the revision that change's delta states. An assertion is current while its revision is, and history once a later change moves the requirement, so evidence about one revision is never read as proof of another. An agreed change is not an assertion: it is an intended revision (requirement_revisions) and a change effect (change_effects). Per (revision, repository), the latest assertion wins."
+    natural_key:
+    - revision_id
+    - repo_id
     foreign_keys:
-    - column: requirement_id
-      references: requirements.id
+    - column: revision_id
+      references: requirement_revisions.id
       nullable: false
     - column: repo_id
       references: repositories.id
       nullable: false
     column_enums:
-      status: enums.requirement_status_value
+      kind: enums.requirement_assertion_kind
   changes:
     primary_key: id
+    source_of_truth: execution
     columns:
     - name: id
       type: string
@@ -4371,6 +4808,7 @@ catalogues:
       verdict: enums.judge_verdict
   change_work_order:
     primary_key: id
+    source_of_truth: execution
     columns:
     - name: id
       type: string
@@ -4407,6 +4845,7 @@ catalogues:
       status: enums.work_order_status
   change_work_item:
     primary_key: id
+    source_of_truth: execution
     columns:
     - name: id
       type: string
@@ -4439,6 +4878,7 @@ catalogues:
       nullable: false
   journey_requirement:
     primary_key: id
+    source_of_truth: derived
     columns:
     - name: id
       type: string
@@ -4458,10 +4898,12 @@ catalogues:
       type: string
       nullable: true
       description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+      source_of_truth: execution
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
+      source_of_truth: execution
     description: "Edge: a requirement a user journey cites for one of its steps (M-ADR 0229 §4.4, Proposed). Derived, never authored: from the @req tags in the journey's end-to-end test file, or from the citations in its journey feature's living spec. A journey with no row is untraced."
     foreign_keys:
     - column: journey_id
@@ -4472,3 +4914,311 @@ catalogues:
       nullable: false
     column_enums:
       basis: enums.journey_requirement_basis
+  entity_attributes:
+    primary_key: id
+    source_of_truth: structure
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Immutable id: <entity_id>__<attribute name slug> when first written; never re-keyed."
+    - name: entity_id
+      type: string
+      nullable: false
+      description: The entity the attribute belongs to.
+    - name: name
+      type: string
+      nullable: false
+      description: The attribute's name, unique within its entity.
+    - name: type
+      type: string
+      nullable: false
+      description: The attribute's type as the domain model states it (a primitive, a value object, or another entity's id); open by decision.
+    - name: nullable
+      type: boolean
+      nullable: true
+      description: 'True when the attribute may be absent: false for a primary key or a TypeQL @key or @card(1..1); true for @card(0..1), an unannotated TypeQL ownership (whose default is @card(0..1)) or a Mermaid comment that opens with "nullable"; empty where the model does not say.'
+    - name: foreign_key
+      type: boolean
+      nullable: true
+      description: "True when the domain model marks the attribute as a foreign key (a Mermaid FK or PK_FK marker). TypeQL has none: a reference is a role. Added in schema 6.0.0."
+    - name: description
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+      source_of_truth: execution
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform SDD the row belongs to (stamped at aggregation).
+      source_of_truth: execution
+    description: "An attribute of a domain-model entity, an element of its own (M-ADR 0230 §4.3, Proposed): adding a field to an entity adds an attribute and does not modify the entity. Built from the domain model: a Mermaid ER diagram's attribute lines, or a TypeQL entity's owned attributes. Authored in the structural model (openspec/structure/) where an SDD has one. Added in schema 5.1.0; built from domain models since 6.0.0."
+    natural_key:
+    - entity_id
+    - name
+    foreign_keys:
+    - column: entity_id
+      references: entities.id
+      nullable: false
+  entity_relationships:
+    primary_key: id
+    source_of_truth: structure
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Immutable id: <from_entity_id>__<relationship name slug>__<to_entity_id> when first written; never re-keyed."
+    - name: from_entity_id
+      type: string
+      nullable: false
+      description: The entity the relationship is stated on.
+    - name: to_entity_id
+      type: string
+      nullable: false
+      description: The entity it relates to.
+    - name: name
+      type: string
+      nullable: false
+      description: "The relationship's name, unique among the relationships between its two entities: a Mermaid relationship's label, or a TypeQL relation's label."
+    - name: from_cardinality
+      type: string
+      nullable: false
+      description: How many from-entities relate to one to-entity. Bound to relationship_end_cardinality.
+    - name: to_cardinality
+      type: string
+      nullable: false
+      description: How many to-entities relate to one from-entity. Bound to relationship_end_cardinality.
+    - name: from_role
+      type: string
+      nullable: true
+      description: The role the from-entity plays, where the domain model names one (a TypeQL role).
+    - name: to_role
+      type: string
+      nullable: true
+      description: The role the to-entity plays, where the domain model names one (a TypeQL role).
+    - name: description
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+      source_of_truth: execution
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform SDD the row belongs to (stamped at aggregation).
+      source_of_truth: execution
+    description: "A named relationship from one domain-model entity to another, an element of its own (M-ADR 0230 §4.3, Proposed). Built from the domain model: a Mermaid ER diagram's relationship lines, or a TypeQL binary relation, with each end's cardinality and role. Authored in the structural model (openspec/structure/) where an SDD has one. Added in schema 5.1.0; built from domain models since 6.0.0, when one cardinality became two, one per end."
+    natural_key:
+    - from_entity_id
+    - to_entity_id
+    - name
+    foreign_keys:
+    - column: from_entity_id
+      references: entities.id
+      nullable: false
+    - column: to_entity_id
+      references: entities.id
+      nullable: false
+    column_enums:
+      from_cardinality: enums.relationship_end_cardinality
+      to_cardinality: enums.relationship_end_cardinality
+  domain_invariants:
+    primary_key: id
+    source_of_truth: structure
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: Immutable id, never re-keyed.
+    - name: entity_id
+      type: string
+      nullable: false
+      description: The entity the invariant constrains.
+    - name: kind
+      type: string
+      nullable: false
+      description: Bound to domain_invariant_kind.
+    - name: attribute_ids
+      type: string
+      nullable: true
+      description: "';'-separated list of entity_attributes ids, each the entity's own. Required for unique and required."
+    - name: relationship_id
+      type: string
+      nullable: true
+      description: The entity's own relationship the invariant constrains. Required for cardinality.
+    - name: statement
+      type: string
+      nullable: false
+      description: The invariant as the domain model states it.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+      source_of_truth: execution
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform SDD the row belongs to (stamped at aggregation).
+      source_of_truth: execution
+    description: "A domain invariant, a typed element of the domain model (M-ADR 0230 §4.3, Proposed): a rule the entity's data always satisfies. It is structure, not intent, wherever it is first written. Built from the domain model's keys: a primary key (PK, or a TypeQL @key) or a unique key (UK) is a unique invariant over its attributes, and a TypeQL role's @card is a cardinality invariant on its relationship. Authored in the structural model (openspec/structure/) where an SDD has one, which can state every kind. Added in schema 5.1.0; built from domain models since 6.0.0."
+    foreign_keys:
+    - column: entity_id
+      references: entities.id
+      nullable: false
+    - column: relationship_id
+      references: entity_relationships.id
+      nullable: true
+    column_enums:
+      kind: enums.domain_invariant_kind
+  requirement_revisions:
+    primary_key: id
+    source_of_truth: behaviour
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <requirement_id>@<the digest's first 12 hex digits>.
+    - name: requirement_id
+      type: string
+      nullable: false
+    - name: digest
+      type: string
+      nullable: false
+      description: sha256:<hex> of the requirement block, its lines trimmed and blank lines dropped.
+      source_of_truth: derived
+    - name: state
+      type: string
+      nullable: false
+      description: Bound to revision_state.
+      source_of_truth: derived
+    - name: change_id
+      type: string
+      nullable: true
+      description: The change whose delta states this text (changes.id), the latest where several do; empty where none does.
+      source_of_truth: execution
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+      source_of_truth: execution
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform SDD the row belongs to (stamped at aggregation).
+      source_of_truth: execution
+    description: "One row per distinct text of a requirement (M-ADR 0230 §4.7, Proposed; schema 6.0.0). Derived from the behaviour store: the living spec's text is current; an agreed open change's ADDED or MODIFIED block is intended; an archived change's block the living spec no longer holds is history. A revision is identified by its digest, so the same text is one revision wherever it appears."
+    foreign_keys:
+    - column: requirement_id
+      references: requirements.id
+      nullable: false
+    - column: change_id
+      references: changes.id
+      nullable: true
+    column_enums:
+      state: enums.revision_state
+  change_effects:
+    primary_key: id
+    source_of_truth: execution
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <change_id>__<element_kind>__<element_id>.
+    - name: change_id
+      type: string
+      nullable: false
+    - name: element_kind
+      type: string
+      nullable: false
+      description: Bound to change_effect_element_kind.
+    - name: element_id
+      type: string
+      nullable: false
+      description: A requirements.id (for a requirement a change not yet agreed adds, the id it will have), or a structural element as <catalogue>/<id>.
+    - name: operation
+      type: string
+      nullable: false
+      description: Bound to requirement_operation.
+    - name: base_revision
+      type: string
+      nullable: true
+      description: The revision the change was written against; empty for an addition.
+    - name: target_revision
+      type: string
+      nullable: true
+      description: The revision the change leaves; empty for a removal.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform SDD the row belongs to (stamped at aggregation).
+    description: "One row per element a change writes (M-ADR 0230 §4.7, Proposed; schema 6.0.0): a requirement from its behaviour deltas, a structural element from its structural deltas (an archived change's from its effect record, structure/applied.yaml). Base and target are the revisions it moves the element between; a requirement's are revision ids (<requirement>@<12 hex digits of its digest>), catalogued in requirement_revisions except the target of a change not yet agreed; a structural element's are sha256 digests."
+    natural_key:
+    - change_id
+    - element_kind
+    - element_id
+    foreign_keys:
+    - column: change_id
+      references: changes.id
+      nullable: false
+    column_enums:
+      element_kind: enums.change_effect_element_kind
+      operation: enums.requirement_operation
+  contract_revisions:
+    primary_key: id
+    source_of_truth: interface
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <contract_id>@<the digest's first 12 hex digits>.
+    - name: contract_id
+      type: string
+      nullable: false
+    - name: digest
+      type: string
+      nullable: false
+      description: sha256:<hex> of the contract file's bytes.
+      source_of_truth: derived
+    - name: state
+      type: string
+      nullable: false
+      description: Bound to contract_revision_state.
+      source_of_truth: derived
+    - name: sunset_date
+      type: string
+      nullable: true
+      description: "For a deprecated revision, the date it is retired. Not yet populated: the builder does not yet read a version's sunset date (BASELINE.md's optional sunset_date)."
+    - name: change_id
+      type: string
+      nullable: true
+      description: "The change that moved the revision to its state (changes.id): the change whose agreement record agrees it (for an agreed or a retired revision), or, for the active one, the archived change that agreed the current content; empty where none is recorded."
+      source_of_truth: execution
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+      source_of_truth: execution
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform SDD the row belongs to (stamped at aggregation).
+      source_of_truth: execution
+    description: A contract version's content revisions, each identified by its content digest (M-ADR 0230 §4.2, Proposed; schema 6.0.0). The contract file's current content is active (deprecated where the contract is); a revision an agreed open change pins as the one it agrees (agreement record 1.2.0, contracts[].agrees) is agreed; one an archived change agreed that the file no longer holds is retired. A compatible amendment is a new revision at the same path, so an agreed revision and the active one coexist, both checked. Active is a claim about the published specification, not about deployment.
+    foreign_keys:
+    - column: contract_id
+      references: contracts.id
+      nullable: false
+    - column: change_id
+      references: changes.id
+      nullable: true
+    column_enums:
+      state: enums.contract_revision_state