spec(pkg): default personal-knowledge-graph structure (the seed to build over)#13
Merged
Conversation
Canonical contract and runtime engine for the 2026 reframing of Gartner's "Applying AI to the Development Process": the build-AI ladder becomes the platform stack, the AI-autonomy ladder becomes the governed Agent Choir, and a third axis (governed autonomy) gates every rung through the trust kernel. - specs/ai-driven-development.yaml — the canonical L0..L5 ladder, build-ladder -> layer map, per-level gate + enforced_at repo, and IBM-PE layering analogy. - autonomy.py — validator + fail-closed gate engine. evaluate_autonomy() authorizes by role ceiling then admits by evidence, demoting toward L0. - cli: validate-ai-driven-development, evaluate-autonomy. - 6 tests; full suite passes.
Add export-autonomy-ladder CLI + canonical_ladder() that derives a machine-readable ladder (specs/ai-driven-development.ladder.json) from the spec. This is the single source downstream repos (tritfabric, prophet-platform, Noetica) derive from / verify against instead of hand-mirroring the YAML. A drift test asserts the committed export matches the spec.
…ild over)
The ego-centric graph a person starts with, that the Memory Steward grows.
Schema over HellGraph (NodeAtom + AssertionClass{Structural/Assertion/Executable}
+ required provenance + SHACL), scoped by memory-scope.yaml, populated by
prophet-workspace (contacts/calendar/mail/drive), and the per-person graph the
mesh grounds on.
- node_types: Self(anchor) · Person · Place · Organization · Thing · Interest ·
Event · Document · Communication · Account
- edge_types: relatedTo/knows/homeTown/attended/worksAt/owns/interestedIn/
providerFor/participatedIn/authored/communicatedWith/hasAccount
- external_link contract (the dashed edges): sameAs → {general_purpose, social,
domain_specific, ecommerce}, direction=reference_only (privacy: read external,
never leak), confidence + trust_class + provenance required
- every node/edge carries provenance + epistemic_mode + P-RET/P-GEN +
I-DED/IND/ABD + memory_scope + confidence (ties to the grounding-fidelity moat)
- seed = Self + registered external KGs + empty typed slots
- Rule #0: exam/holdout NEVER ingested (no contamination via retrieval)
Makes the default person-graph buildable-over, reading the spec vocabulary: - seed_graph(self_id) → the Self anchor (Structural) + registered external KGs. - ingestion: ingest_contact (family→relatedTo / social→knows), ingest_event (→participatedIn), ingest_message (→communicatedWith), ingest_document (→authored) — every element carries workspace provenance. - link_external → reference-only external-KG link (privacy: read, never leak). - validate() = SHACL-lite: node types + relations in the spec vocabulary, single Self invariant, external KG known, provenance.source required on every element. Brain-agnostic (data model; the mesh grounds on it, memory-steward owns it). 5/5 tests.
Persist and populate the Personal Knowledge Graph on real substrate:
pkg_hellgraph.py — projects a PKG into HellGraph's canonical wire shape
(GraphNode {id,labels,properties,createdAt} + GraphEdge with the mandatory
epistemic fields epistemicClass/confidence/promotionState/createdAt). Maps PKG
inference/method → EpistemicClass (workspace imports = confirmed_relation/
confirmed, labelled inferences = inferred_relation/candidate); external links
stay reference_only in properties. Emits to the TS HellGraphStore façade; the
Rust kernel is untouched (external writers go through the TS projection).
pkg_workspace.py — adapters over the real workspace contracts: contact.schema
(→ Person + worksAt Organization + social sameAs), calendar-event.schema
(→ Event + participatedIn for Self and attendees-with-contactRef),
mail-message.schema (→ communicatedWith from the correspondent), office-artifact
.schema (→ Document + authored). sourceAdapter/accountRef/timestamps flow into
provenance; ingest_workspace() batches a whole export in dependency order so
mail/calendar edges resolve onto Person nodes from contacts (no dup).
15 PKG tests pass (5 spec/builder + 5 writer + 5 adapters).
Non-invasive EmittingPKG wrapper dual-writes every add_node/add_edge as a sourceos-spec v2 EventEnvelope onto an append-only hash-linked log (Fig-18 railroad track). Causal + locus/attestation metadata rides in the open payload; no schema change, pkg.py untouched. Includes deterministic fold() round-trip and verify_chain() tamper check. Emit-only — merge is Slice 3, gate is Slice 4. 5 new tests; full suite 65 green.
Member
Author
Added: CRDT Slice 1 — EventEnvelope op-emitter (
|
materialize(): deterministic add-wins OR-Set fold with observed-remove retracts + LWW(lamport,eventId) value resolution — order-independent reconstruction from a log. merge(): dedup-by-eventId union of replicas' logs; commutative/associative/idempotent → strong eventual consistency, zero coordination. Closes local-first ideals 2 (multi- device) + 4 (collaboration) without touching 5/6/7. Adds retract_node/edge (observed- remove) + apply_remote (ingest without re-emit) to EmittingPKG. 9 new tests: commutativity, associativity, idempotence, offline convergence, random- shuffle order-independence, add-wins-over-concurrent-retract, retract-wins. Suite 74 green.
Member
Author
Added: CRDT Slice 2/3 — reconstruct + converge (
|
…ss moat) gate() splits a converged op-log into a canonical view (ops from local/trusted_private, or attested_fog/burst_cloud WITH a passing correctness receipt) vs. a quarantine view (everything else, retained not authoritative). Fail-closed: unattested gated-locus ops are quarantined, so an untrusted retract cannot silently delete canonical data. Emits a SyncCycleReceipt-shaped receipt per cycle. This is where TEE-confidentiality ends and correctness-attestation begins — the moat, made executable. 7 tests incl. fail-closed admission, attested-admit, the untrusted-retract security property, longevity (nothing lost), and SyncCycleReceipt v2 conformance. Suite 81 green.
Member
Author
Added: CRDT Slice 4 — locus/attestation merge gate (
|
…complete) Replica: a live device/agent that syncs with peers by anti-entropy (exchange only missing ops), converging two live participants with no coordinator. sync() is bidirectional + idempotent; Lamport advances on receive so later local edits win. replay_to_hellgraph(): the ingester the writer promised but never had (gap #4) — replays a materialized PKG through a HellGraphStore-shaped sink (addNode/addEdge), idempotent via content-addressing. persist_canonical() composes it with the Slice-4 gate so ONLY the proven-correct sub-graph reaches the store; unattested cloud ops converge into every log (longevity) but are never persisted. 6 tests: live convergence, sync idempotence, post-sync propagation, replay + idempotent replay, and the end-to-end 'only canonical graph reaches HellGraph'. Suite 87 green. All 5 CRDT slices landed.
Member
Author
Added: CRDT Slice 5 — live replicas + HellGraph ingester (
|
The test job (ruff check src tests) was red: 4 unused imports (F401) in pkg_gate.py and the pkg tests, and 7 semicolon-joined statements (E702) in pkg_ops.py and test_pkg_replica.py. Removed the unused imports and split the compound statements onto their own lines. ruff clean + pytest green, no behaviour change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The default ego-centric graph a person starts with — the seed the Memory Steward grows over. Not a new store: a schema over HellGraph (NodeAtom + AssertionClass + required provenance + SHACL), scoped by
memory-scope.yaml, populated by prophet-workspace, and the per-person graph the mesh grounds on.Maps the diagram directly:
Self(single anchor) ·Person(Mom, Jamie, "Mom's dentist") ·Place(Hometown) ·Organization(High school) ·Thing(Electric/Acoustic guitar) ·Interest·Event·Document·Communication·Account.relatedTo/knows/homeTown/attended/owns/interestedIn/providerFor/participatedIn/authored/communicatedWith/hasAccount.sameAs → {general_purpose (Wikidata/KKO), social_network, domain_specific, ecommerce_catalog}withdirection: reference_only— privacy invariant: the PKG reads external KGs for grounding, never leaks private data outward (the digital-soul boundary).confidence+trust_class+provenancerequired.Every node/edge carries provenance + epistemic mode + P-RET/P-GEN + I-DED/IND/ABD +
memory_scope+ confidence — the same axes as the grounding-fidelity moat, so the PKG is provenance-native.Seed = the
Selfnode + registered external KGs + empty typed slots; prophet-workspace ingestion (contacts→Person, calendar→Event, mail→communicatedWith, drive→Document) fills them. Rule #0: exam/holdout content is never ingested (no contamination via retrieval).