ARC-ADR-051 - Active Hypergraph Inferencing and LLM-Compatible Object Interface

One line: untool.ai should migrate reasoning authority from LLM output to an active, traceable hypergraph over RDF truth, LPG operations, and typed Object Model instances, while presenting the result through an LLM-compatible interface.

Context and Problem Statement

The current bootstrap order correctly turns on a guardrailed LLM feed early so humans and agents can build safely before the full platform exists. That LLM feed is necessary, but it should not become the permanent cognitive substrate.

The platform's deeper bet is already present in the architecture:

• Fuseki owns slow semantic truth.
• The LPG operational frontier carries high-speed object, relation, telemetry, and candidacy state.
• Hyperedges are first-class relator vertices with typed role bindings.
• forge emits typed Object Model projections.
• UDA serves those objects from the best backend.
• The LLM gateway governs language-model access.

The missing decision is how these become an active inferencing substrate: a system that can receive a question or task, activate the relevant typed objects, derive admissible facts, judge sufficiency, and return an answer in a form that feels native to today's LLM interfaces without making the LLM the authority.

Decision Drivers

#	Driver
D1	Grounded truth must live in RDF/LPG/Object Model state, not in generated prose.
D2	Embeddings are useful as attention and retrieval indexes, but must not become canonical truth.
D3	Existing LLM-compatible consumers should not need a new mental model on day one.
D4	Every answer that claims platform truth must have a replayable activation trace.
D5	Sufficiency must be scoped by task class; "sufficient AI" is earned, not asserted globally.
D6	The architecture must preserve ARC-ADR-041 pace layering: fast activation can nominate, only the slow formal layer disposes.
D7	Policy and clearance filtering must happen before LLM context assembly and natural-language rendering.

Considered Options

Option A - LLM-first RAG over graph snippets

Use the graph as a retrieval backend, stuff snippets into prompts, and let the LLM reason.

Pros: fastest to demonstrate; familiar stack.
Cons: leaves truth and inference inside the model context; weak replay; embeddings and prompt rankings can quietly become authority.

Option B - Pure symbolic interface

Expose only graph queries, reasoner outputs, and object APIs. Avoid LLM-compatible surfaces.

Pros: clean authority boundary.
Cons: poor UX for humans and current agents; loses the language fluency that makes the platform usable.

Option C - Active hypergraph inferencing behind an LLM-compatible facade

Treat embeddings as an activation field over typed Object Model instances. Use UDA to plan retrieval and hydration, RDF reasoners to derive admissible facts, LPG traversal to expand relators and operational context, and the LLM gateway only for language parsing, proposal, compression, and rendering.

Pros: preserves current interfaces while moving authority into the object hypergraph; replayable; policy-aware; fits ADR-016/019/041/044.
Cons: new planner, trace contract, eval suite, and performance budget.

Decision

Adopt Option C.

Define active hypergraph inferencing as a platform capability:

Given an intent, goal, question, task, or emission, activate a scoped subgraph of
typed Object Model instances, derive admissible facts through RDF/LPG/object
reasoning, rank and explain candidate next moves, and present the result through
an LLM-compatible conversational or tool interface.

Architecture

Active Embedding / Activation Plane

The active embedding space is an attention field over the Object Model. It does not own truth. It records what woke up, why, and under which policy scope.

The Object Model projection may carry statistical properties from the LPG and holographic graph projection: activation weights, edge priors, recency decay, trust, risk, role centrality, support frequency, and usage evidence. These are valid fast-plane properties. They shape inferencing flexibility and attention, but they do not mutate slow-plane ontology truth. This is the useful split: formal RDF says what is admissible; weighted LPG/Object Model projections say what is salient now.

The minimal object vocabulary:

Object	Meaning
ActivationQuery	Normalized user, agent, task, or emission intent.
ActivationContext	Caller, scope, tenant, repo, time, clearance, and policy version.
ActivatedElement	A typed Object Model instance, relator, document, capability, track, or evidence object selected for the loop.
ActivationEdge	Why one element pulled another into the active set: lexical/vector similarity, role-binding adjacency, provenance, inferred relation, policy dependency, or emission causality.
ActivationScore	Decomposed ranking components, never a truth claim by itself.
DerivedFact	A fact derived from accepted inputs, with supporting activated elements.
SufficiencyJudgment	Whether the active set is sufficient for the requested task class.
ActivationTrace	Replayable record of candidate activation, expansion, inference, filtering, hydration, and render inputs.

Runtime Loop

intent
  -> normalize ActivationQuery
  -> activate candidates using embedding/lexical/object indexes
  -> expand through relators, provenance, governance, same-as, and capability tracks
  -> run profile-specific reasoners and rule packs
  -> filter by tenant, clearance, sensitivity, and trust
  -> hydrate typed Object Model instances through UDA
  -> judge sufficiency for the task class
  -> render through LLM gateway only when useful

Authority Boundary

LLMs keep these jobs:

• natural-language parsing,
• conversational rendering,
• summarization and compression,
• hypothesis generation,
• missing-schema surfacing,
• fallback when the active graph is insufficient.

The hypergraph/Object Model owns:

• identity and accepted facts,
• provenance and evidence,
• policy and eligibility,
• relation inference over hyperedges,
• sufficiency judgments,
• replayable explanation.

Any rendered statement not backed by an activation trace is a model claim, not a platform fact.

LLM-Compatible Surface

The first contract is the activation trace schema:

• contracts/active-hypergraph-inference-trace.schema.json
• contracts/active-hypergraph-inference-trace.example.json
• contracts/hyperbolic-response-gate.schema.json
• contracts/hyperbolic-response-gate.example.json
• contracts/hyperbolic-openai-gateway.openapi.yaml
• contracts/hypergraph-object-inference.openapi.yaml

Future OpenAPI surfaces can sit beside the existing LLM gateway:

• POST /v1/object-inference
• optional extension metadata on /v1/chat/completions
• POST /v1/responses adapter for clients using the newer OpenAI response shape
• embeddings over Object Model element text and emission text, not over truth itself

Production Runtime Boundary

The file-backed Node implementation is a reference harness and conformance fixture, not the production service.

Industrial ownership is:

Concern	Runtime	Boundary
Gateway, auth, policy, guardrails, trace persistence, OpenAI-compatible adapter	Python/FastAPI in backend-core	Public traffic stays behind the existing LLM gateway and backend-core authorization boundary.
UDA planning/hydration and typed Object Model reads	Rust sidecar in backend-core	Low-latency backend routing and object hydration.
Hyperbolic model training, local re-optimization, and evals	Python + PyTorch + Riemannian optimization libraries such as Geoopt	Offline or micro-batch embedding lifecycle, never per-request training.
Candidate vector search	pgvector or Qdrant first; FAISS/Milvus later if scale requires	ANN produces candidates only; exact hyperbolic rerank and sufficiency judgment remain gate responsibilities.
Fleet Console, SDKs, generated clients, mocks, executable examples	TypeScript/Node	Consumer/tooling surface, not authority.
Hot-path geometry/index kernels	Rust after profiling	Optional optimization once production telemetry proves it is needed.
Generated Object Model targets	C#, TypeScript, Python, Rust	Shared typed contract across consumers, not duplicated gate ownership.

The permanent API split is:

• /v1/object-inference as the native authority surface.
• /v1/chat/completions as the compatibility adapter through backend-core's existing OpenAI-compatible gateway.
• /v1/responses as the compatibility adapter for newer OpenAI-style clients that expect response, output_text, and Responses SSE event shapes.
• object-index lifecycle APIs for snapshot rebuilds, delta overlays, and rollback.
• trace read/replay APIs for domain audit, correlated with OTel but distinct from operational traces.

The live embedding space uses versioned snapshots plus delta overlays. Accepted Object Model changes initialize near typed parents, relators, provenance, and capability neighborhoods; Python micro-batches perform local Riemannian re-optimization; serving reads active_snapshot + delta_overlay; promotion requires recall, distance stability, sufficiency, policy, and latency gates.

Sufficiency

The platform may call the graph sufficient only for bounded task classes where it can prove:

• coverage of required object kinds and relators,
• grounding for decisive claims,
• implemented inference closure for the task class,
• policy filtering before rendering,
• conflict detection or explicit surfacing,
• replayable activation trace,
• outcome parity or superiority over LLM-only baselines.

Seed task classes:

1. Capability/adoption status questions.
2. Agent/team routing over known capabilities.
3. Evidence-backed issue and PR closure checks.
4. Ontology/Object Model navigation.
5. Policy-scoped retrieval over accepted documents and evidence.

Consequences

Positive:

• LLM dependence becomes a gradient rather than a cliff.
• "Sufficient AI" becomes testable by task class.
• Embeddings remain useful without becoming authority.
• Agent swarms can reason over shared object state instead of private prompts.

Negative:

• Requires a planner, trace store, and eval harness.
• Natural-language rendering must be constrained to prevent unsupported claims.
• Latency budgets become real because graph activation has multiple phases.

Validation

The first working slice is file-backed:

Operator runbook: docs/active-hypergraph-inference-prototype.md.

node tools/active-hypergraph-inference.mjs --query "which UDA adoption tracks are ready?"
node tools/active-hypergraph-inference.mjs --query "which UDA adoption tracks are ready?" --format object --compact
node tools/active-hypergraph-inference.mjs --query "which UDA adoption tracks are ready?" --format chat --compact
node --test tests/active-hypergraph-inference.test.mjs
node --test tests/active-hypergraph-server.test.mjs
python -m unittest tests.test_active_hypergraph_inference_contract
python -m unittest tests.test_hypergraph_inference_production_prototype
python tools/validate-active-hypergraph-inference-traces.py --live
python tools/validate-active-hypergraph-output-contracts.py
node tools/validate-active-hypergraph-http-runtime.mjs

This proves the trace shape against checked-in capability/adoption Object Model projections, then proves a hyperbolic response gate over the weighted projection can produce an OpenAI-compatible chat-completion packet. It does not yet call Fuseki, ArcadeDB, vector stores, or the production LLM gateway.

Current rigor levels:

Level	Claim under test
L0	The planner emits a valid activation trace for a real checked-in capability/adoption question.
L1	Capability identity hints constrain activation and prevent unrelated target text from leaking into the active set.
L2	Every derived fact is supported by activated objects and every activation edge resolves.
L3	Sufficiency is task-class scoped: adoption status can pass; agent routing is partial until its rule pack exists; unsupported prompts fail closed.
L4	Static and live traces conform to the JSON Schema plus policy invariants.
L5	Negative traces fail when they lack supports, lack facts while claiming sufficiency, or contain object-native model claims.
L6	Trace replay order is stable: deterministic output for fixed inputs, unique activated elements, descending score order, and fixed phase order.
L7	Hyperbolic response gates are executable: Poincare distance, deterministic weighted placement, nearest-neighborhood allow/block, native object output, and OpenAI-compatible chat output are tested.
L8	Gate and output contracts fail closed: live trace, gate, object.inference, and chat.completion packets validate; allowed gates require sufficient traces, nearest distances stay inside threshold, every exposed point stays inside the unit ball, and chat metadata remains public-redacted.
L9	Runtime ownership is explicit: backend-core owns production gateway/policy/runtime, Rust owns UDA/hot paths, Python owns embedding training/evals, and TS/Node remains tooling/reference.
L10	Production release gates cover OpenAPI lint/bundling, generated SDK compile checks, property tests, poisoning/adversarial tests, cross-language parity, performance budgets, and trace replay.
L11	Native object and chat output contracts exist: JSON Schemas validate tracked object.inference and chat.completion outputs against the same fixed trace/gate evidence.
L12	HTTP/OpenAPI prototype is executable: a dependency-light server and OpenAPI contract verify /healthz, /v1/object-inference, trace fetch/replay, /v1/object-index-updates, /v1/chat/completions, bearer-token fail-closed mode, request correlation, Problem Details, and public-redacted chat/trace metadata.
L13	Object-index delta overlays participate in serving: provenance-required AdoptionTrack upserts are accepted into an active in-memory delta overlay, health counters expose the overlay, and subsequent inference activates and derives facts from the updated Object Model projection without request-path embedding training.
L14	Object-index lifecycle can promote and roll back snapshots: delta overlays compact into candidate snapshots, candidate snapshots promote into active serving, rollback restores the previous active snapshot, and trace replay uses the recorded serving view for deterministic audit.
L15	Candidate promotion requires gate evidence: compaction emits recall, distance-stability, sufficiency, policy, and latency gate evidence, and promotion fails without the matching passed promotionGateId.
L16	Authenticated lifecycle operations are scope-gated: configured bearer auth defaults to read-only, object-index writes require object-index:write, compaction/promotion require object-index:promote, rollback requires object-index:rollback, and trace read/replay require trace scopes.
L17	Runtime emits audit evidence: allowed, denied, and error outcomes across inference, trace, and object-index lifecycle operations emit structured audit events with request id, action, outcome, status, code, principal, scopes, and operation metadata.
L18	Object Model projection can come through a UDA-style transport: the runtime can hydrate the current Object Model view from a JSON HTTP source via --current-view-url / HYPERGRAPH_CURRENT_VIEW_URL, preserving the source in trace context while keeping file fixtures supported.
L19	Runtime emits OTel-shaped telemetry evidence: source loading, object inference, chat completion, trace replay, policy, and object-index lifecycle paths emit trace-correlated activeHypergraphTelemetrySpan records, honor W3C traceparent, and persist spans in file-backed mode.
L20	Local prototype state can survive restart: optional file-backed persistence restores trace fetch, active promoted snapshot serving, audit events, telemetry spans, and rollback stack across process restart.
L21	Spigot budget enforcement fails closed: an optional principal-scoped request budget gate rejects exhausted callers with 429 Problem Details before inference or lifecycle mutation, emits audit and telemetry evidence, exposes health counters, and persists counters with prototype state.
L22	Object-native inference can stream active evidence: /v1/object-inference:stream emits activation, gate, final, and done server-sent events over the same authority path; the final event is the native object.inference packet and its trace remains fetchable/replayable.
L23	OpenAI-compatible chat can stream from graph authority: /v1/chat/completions with stream: true emits OpenAI-style chat.completion.chunk SSE data frames, includes public-redacted hypergraph trace metadata, terminates with [DONE], supports optional usage frames, and keeps the streamed trace fetchable.
L24	OpenAI-compatible discovery and embeddings are hypergraph-native: /v1/models, /v1/models/{model}, and /v1/embeddings expose the untool-hypergraph-gate-0 model, deterministic Poincare-ball coordinates, unit-ball invariants, usage accounting, audit, and telemetry without treating embeddings as truth.
L25	OpenAI-compatible Responses clients can use graph authority: /v1/responses with non-stream and stream: true modes returns Responses-style response, output_text, and response.* SSE events over the same native object-inference trace, with public-redacted hypergraph metadata and fetchable traces.
L26	Backend-core production port remains follow-on work: durable quota/budget state, durable trace storage backend, production UDA transport binding, production lifecycle storage, production-grade promotion gates, persistent object-index storage, OTel collector export, and production auth/policy middleware still need integration.
L27	Production readiness is machine-checkable: contracts/active-hypergraph-production-readiness.schema.json, its example, validator, and unit tests separate local prototype evidence from required backend-core production gates and keep public traffic blocked while required gates are non-passing.
L28	Backend-core serving handoff is machine-checkable: contracts/active-hypergraph-serving-handoff.schema.json, its example, validator, and unit tests pin route ownership, stores, GPU worker options, parity tests, and graph-derived hyperbolic embedding composition from node, edge, hyperedge, relator, role-binding, and literal-feature embeddings.
L29	Embeddings are derived from active hypergraph support: /v1/embeddings computes graph-derived Poincare coordinates from the activated Object Model slice when support exists, reports node/edge/hyperedge source embeddings and composition metadata, and uses deterministic fallback only when no grounded slice activates.
L30	Backend-core-shaped Python authority core is executable: tools/hypergraph_inference/production_prototype.py verifies policy-before-activation, object.inference authority, chat/Responses adapters, fail-closed gates, trace integrity, public-redacted metadata, and graph-derived embeddings as the backend-core port target.
L31	Python authority traces are replayable: ActiveHypergraphInferenceRuntime stores authority responses with their recorded serving view, exposes public-redacted trace envelopes, and replays deterministically against the recorded view.
L32	Python runtime budget enforcement fails closed: the runtime denies exhausted principals with 429 Problem Details before object inference, adapters, or embeddings run, creates no trace for denied work, and emits audit/health evidence.
L33	Python runtime state survives restart rehearsal: JSON export/import and file round-trip recovery preserve recorded traces, replay behavior, audit events, and prototype budget counters.
L34	Python route adapters cover backend-core endpoint semantics: framework-free handlers exercise health, object inference, trace fetch/replay, chat, Responses, and embeddings paths with Problem Details, budget propagation, redaction, and adapter-safe status handling.
L35	Python runtime emits observability evidence: OTel-shaped activeHypergraphTelemetrySpan records cover inference, adapters, embeddings, trace operations, health, budget denial, and route errors, and survive restart rehearsal.
L36	Python route scopes fail closed when supplied: object inference, chat, Responses, embeddings, trace read, and trace replay enforce operation scopes before work, emit audit/telemetry, and avoid trace creation on denial.
L37	Python model discovery is OpenAI-compatible: /v1/models and /v1/models/{model} expose the hypergraph gate model card, object-inference authority, Poincare geometry, truth-boundary metadata, unknown-model Problem Details, and telemetry.
L38	Python streaming adapters preserve graph authority: object-inference, chat, and Responses stream envelopes expose activation/gate/final or OpenAI-style events over the same native trace, and denied streams fail closed before partial output.
L39	Python object-index delta overlays participate in serving: provenance-required AdoptionTrack upserts/deletes feed subsequent inference and graph-derived embeddings, with scope gates, audit/telemetry, health counters, and JSON restart recovery.
L40	Python object-index lifecycle can promote and roll back snapshots: compaction emits candidate snapshots and gate evidence, promotion requires matching gate ids, active snapshots affect serving, and rollback restores the prior active view.
L41	Python port target has Node reference parity checks: fixed seeded and fail-closed queries compare contract-level fields against the Node CLI reference harness to catch drift during backend-core porting.
L42	Sufficiency evals pin the first bounded task envelope: deterministic cases assert sufficient, partial, and fail-closed behavior with fact-kind, activation, support, and no-model-claim invariants.
L43	Python authority core is service-shaped: the dependency-free HTTP harness wraps the same route adapter, verifies bearer auth, supplied scopes, native inference, object-index mutation, OpenAI-style SSE, and JSON state reload, and gives backend-core a closer executable port target.
L44	Hyperbolic training worker contract is executable: the Python rehearsal accepts provenance-required graph deltas, derives candidate Poincare coordinates from hypergraph support, emits loss and sufficiency evidence, stores candidate snapshots, and preserves the rule that training is outside the request path.
L45	Training candidate outputs are contract-gated: JSON Schema, OpenAPI, live output validation, and contract tests verify candidate snapshot shape, unit-ball coordinates, loss non-regression, eval-gated promotion status, and route declaration.
L46	Training candidates can be handed off as artifacts: candidates can be fetched by id, saved as contract-shaped JSON, loaded into a fresh runtime, and promoted through the same evidence-gated promotion API.
L47	Training candidates have poisoning gates: weak provenance, object-id mismatches, unsupported states, prompt-injection markers, and oversized text block promotion evidence before candidate activation.
L48	Training candidates have performance budgets: deterministic estimates for inference, training, and promotion must pass before a candidate can expose passed promotion evidence.
L49	OpenAPI routes match the Python authority harness: contract tests enumerate declared GET/POST paths and prove the backend-core-shaped route adapter serves each one without route misses or server errors.
L50	Runtime state persistence is contract-gated: exported state snapshots validate replay records, budgets, audit/telemetry, overlays, training candidates, active snapshots, and rollback stack against a JSON Schema.
L51	Readiness evidence validation commands are gated: the production-readiness validator rejects missing critical evidence ids and unapproved validation command strings so the manifest cannot cite stale or invented checks.
L52	The production prototype has one proof surface: an umbrella validator lists and runs the Python and Node test ladders, readiness/handoff manifests, live contract validators, runtime-state validation, HTTP smoke validation, and focused whitespace checks.
L53	GPU worker hosting is deployable as a contract: serving handoff schemas and tests require managed-cloud and experiment-worker topologies for the offline hyperbolic training worker, with request-path exclusion and promotion gates.
L54	Hyperbolic training has a worker entrypoint: a container-friendly Python CLI accepts job/current-view paths and emits candidate artifacts plus summaries around the same promotion-gated training core.
L55	Hyperbolic training worker has a container contract: a digest-pinned, non-root, no-ingress prototype image template packages the worker CLI and is validated by static image checks plus artifact smoke output.
L56	Hyperbolic training worker IO is schema-bound: JSON Schemas validate queue job input and worker summary output around the existing candidate snapshot artifact contract.
L57	Hyperbolic training worker IO examples are contract fixtures: canonical job and result examples give backend-core MLOps a stable queue/result handoff shape.
L58	Active-hypergraph contracts are bundle-gated: the production prototype proof ladder runs the fleet contract bundle drift guard so schemas, examples, OpenAPI, readiness, and handoff artifacts remain distributable.
L59	Worker image build plan is schema-bound: JSON Schema validates the image build/run contract, linked worker IO contracts, no-ingress posture, and validation commands.
L60	Backend-core to worker queue seam is handoff-gated: serving handoff schemas and tests define the training job queue producer, consumer, IO schemas, retry/DLQ policy, request-path exclusion, and promotion gates.
L61	Backend-core port bindings are contract-gated: a backend-core port manifest maps OpenAPI routes to handlers, scopes, middleware, durable stores, UDA hydration, OTel export, and offline promotion/training bindings without converting readiness gates to pass.
L62	Training promotion is content-addressed: a promotion package contract binds candidate, worker result, source snapshot, worker image, contract bundle, idempotency key, and backend-core revalidation checks before active snapshot mutation.
L63	Runtime state has a write-through store seam: the Python runtime can persist trace, budget, audit, telemetry, delta overlay, and training-candidate state through an explicit store adapter for backend-core durable-store porting.
L65	Embedding derivation is schema-bound: /v1/embeddings derivation metadata now has a JSON Schema, graph/fallback examples, serving handoff projection recipe, output validator coverage, and tests that pin source counts, weighting, normalization, activated support, trace linkage, and fallback-only-when-ungrounded behavior.
L66	Embedding index deltas are content-addressed: offline training candidates now carry a schema-bound hyperbolic-embedding.index-delta with source snapshot digest, object-index change hash, per-object embedding digests, source refs, dependent ids, and promotion-package digest revalidation.
L67	OTel export mapping is contract-gated: the backend-core port manifest maps concrete active-hypergraph.* prototype span names to backend-core collector span names with required attributes, prompt-redaction, traceparent, category coverage, and validator drift checks.
L68	UDA hydration exchange is schema-bound: the UDA-shaped hydration path now emits contracts/uda-hypergraph-hydration.schema.json packets with scope-filter evidence, fallback disallowance, hydrated object kinds, scoped view digest, and hydrated-before-inference boundary.
L69	Durable store operations are schema-bound: the Python runtime now projects trace records, budget counters, audit events, telemetry spans, delta overlays, candidate snapshots, active snapshots, and rollback stack state into contracts/active-hypergraph-durable-store-operations.schema.json batches with digests and idempotency keys for backend-core durable-store consumers.
L70	Policy decisions are schema-bound: supplied-scope route authorization now emits contracts/active-hypergraph-policy-decision.schema.json packets for JWT/RBAC middleware replacement, including principal, route, action, required/granted scopes, decision reason, middleware ids, and request-path training exclusion.
L71	OTel export batches are schema-bound: runtime telemetry spans now project into contracts/active-hypergraph-otel-export-batch.schema.json collector handoffs with service metadata, prompt-redaction checks, traceparent requirement, span counts, active-hypergraph namespace enforcement, and status consistency validation.
L72	Backend-core service port plan is file-level: contracts/active-hypergraph-service-port-plan.schema.json now pins the FastAPI package root, route/service/dependency/schema/store/UDA/telemetry/training files, validation commands, and exact route parity with the backend-core port manifest.
L73	Hyperbolic embedding source sets are schema-bound: graph-derived /v1/embeddings outputs now carry contracts/hyperbolic-embedding-source-set.schema.json source records for node, edge, hyperedge, relator, role-binding, and literal-feature points; derivations carry source-set ref/digest; validators recompute the barycenter and reject source-count, digest, tombstone, and unit-ball drift.
L74	Hyperbolic embedding source sets are independently gateable: contracts/hyperbolic-embedding-source-set.example.json, tools/validate-hyperbolic-embedding-source-set.py, and unit tests validate canonical and live source sets without requiring the full output validator, including barycenter recomposition, duplicate source refs, redaction, digest checks, and unit-ball safety.
L75	Embedding index deltas bind source-set evidence: graph-derived training candidate entries now carry source-set ref/digest from their derivation, include those fields in embeddingDigest, and validator/tests reject source-set digest drift before backend-core promotion.
L76	Promotion revalidation requires source-set evidence: hyperbolic training promotion packages and backend-core port bindings now require source-set digest checks alongside candidate, worker, source snapshot, image, contract bundle, and embedding index delta lineage before active snapshot mutation.
L77	Backend-core service port plans include promotion revalidation: contracts/active-hypergraph-service-port-plan.schema.json, its example, validator, and tests now require the FastAPI port to implement candidate/package/source-set/index-delta revalidation in app/llm/hypergraph/training_queue.py while keeping active snapshot mutation disallowed until checks pass.
L78	Promotion API exposes package evidence: contracts/hypergraph-object-inference.openapi.yaml now lets /v1/object-index-promotions carry optional promotion-package evidence with source-set and embedding-index-delta digest checks, so SDK callers can hand backend-core the same graph-derived lineage that the service port must revalidate.
L79	Promotion evidence is runtime-gated: the Python prototype rejects malformed /v1/object-index-promotions promotionPackage handles before mutating the active snapshot and records accepted package digest/check-count evidence in audit and telemetry metadata.
L80	Backend-core FastAPI skeleton is generated and parity-gated: templates/backend-core-active-hypergraph/ now contains the route-complete app/llm/hypergraph service-port package and tools/validate-active-hypergraph-backend-core-skeleton.py proves file, handler, route-decorator, schema, dependency, and promotion-check parity against the service-port plan.
L81	Backend-core skeleton scopes are parity-gated: the skeleton validator now parses FastAPI Depends(require_scope(...)) calls and fails if any generated route requires a different scope than the service-port plan, including rollback/promote boundary drift.
L82	Backend-core route policy matrix is parity-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/route_policy.py now pins handler, required scope, middleware ids, and request-training exclusion for every route, and the skeleton validator rejects middleware or requestTrainingAllowed drift from the service-port plan.
L83	Backend-core durable store ports are skeleton-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/stores.py now exposes trace, budget, audit, telemetry, delta overlay, candidate, active snapshot, and rollback stack store methods over the durable operation store ids, and the skeleton validator rejects missing store ids or methods.
L84	Backend-core telemetry policy is skeleton-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/telemetry_policy.py now pins exporter, export contract, traceparent, prompt-redaction, span mappings, categories, and required attributes from the backend-core port manifest, and the skeleton validator rejects telemetry drift.
L85	Backend-core UDA hydration policy is skeleton-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/uda_policy.py now pins the UDA binding id, gate, component, transport, contract, hydrated element kinds, fallback disallowance, and scope-filter-before-hydration flags from the backend-core port manifest.
L86	Backend-core training/promotion policy is skeleton-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/training_policy.py now pins promotion binding ids, gate ids, hyperbolic-training-jobs, candidate/result/promotion package schemas, and request-path exclusion from the backend-core port manifest.
L87	Backend-core embedding derivation policy is skeleton-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/embedding_policy.py now pins the serving handoff projection recipe, including Poincare geometry, derivation contract, source embedding inputs, graph-derived/fallback methods, composition, fallback policy, and request-path training exclusion.
L88	Backend-core response gate policy is skeleton-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/response_gate_policy.py now pins the public response-gate contract and runtime allow rule, including nearest-eight support, sufficient-only allow, distance thresholds, nearest-distance requirement, derived-fact requirement, and allowed/blocked statuses.
L89	Backend-core OpenAI adapter policy is skeleton-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/adapter_policy.py now pins chat/Responses contracts, native object.inference authority, public-redacted hypergraph metadata, blocked content_filter behavior, stream events, and [DONE] termination.
L90	Backend-core request schemas are skeleton-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/request_schema_policy.py now pins OpenAPI request required fields, additional-properties policy, object-index lifecycle ids, promotion ids, chat model/messages, and Responses input/messages alternatives.
L91	Backend-core model discovery and health policy are skeleton-gated: templates/backend-core-active-hypergraph/app/llm/hypergraph/model_policy.py now pins model id, owner, object.inference authority, activation-index embedding authority, Poincare geometry, graph-derived embedding derivation, truth boundary, model capabilities, health capabilities, and health counters.
L92	Backend-core health and graph-derived serving computation are skeleton-gated: health.py keeps /healthz unauthenticated while embedding_policy.py requires served query coordinates to be recomputed from the activated hypergraph slice using node, edge, hyperedge, relator, role-binding, and literal-feature priors.
L93	Backend-core policy decision evidence is skeleton-gated: policy_decision_policy.py pins JWT/scope middleware evidence to contracts/active-hypergraph-policy-decision.schema.json, and dependencies.py must preserve contract, middleware, principal-redaction, and request-training evidence tokens.
L94	Backend-core budget policy is skeleton-gated: budget_policy.py pins budget-policy, principal-budget-store, durable-budget-store, budget-counter operations, 429 fail-closed denial metadata, and pre-inference/adapter quota boundaries.
L95	Backend-core durable store operation policy is skeleton-gated: store_operation_policy.py pins durable-store operation contract fields, store ids, gate ids, operation verbs, payload kinds, read/write methods, idempotency format, request-path flags, durability, and request-training exclusion.
L96	Backend-core spigot guardrail policy is skeleton-gated: spigot_policy.py pins audit-log, problem-details, OTel trace, redaction, Problem Details content type/required fields, public-redacted visibility, blocked content_filter behavior, audit outcomes, denied exports, and middleware order.
L97	Backend-core package composition is skeleton-gated: package_policy.py and __init__.py pin router exports, service exports, policy modules, mount prefixes, package root, gateway installation boundary, and request-training exclusion.
L64	UDA hydration has a policy-first adapter seam: the Python runtime can hydrate a typed Object Model view through a UDA-shaped adapter that scope-filters before inference, disallows fallback, and emits audit/telemetry.

Follow-up Work

1. Promote this ADR from draft after reviewing issue #422.
2. Add ontology entries for the activation objects.
3. Add backend-core UDA planner implementation.
4. Add /v1/object-inference, object-index lifecycle, and trace replay APIs.
5. Add a trace viewer in Fleet Console.
6. Add sufficiency evals for the first bounded task class.
7. Add OpenAPI lint/bundle and generated SDK compile gates.
8. Add property, poisoning, performance, and cross-language parity tests.
9. Map prototype activeHypergraphTelemetrySpan records into backend-core's OTel collector/export path.
10. Keep contracts/active-hypergraph-production-readiness.example.json current as backend-core gates move from missing/in-progress to pass.
11. Use contracts/active-hypergraph-serving-handoff.example.json as the backend-core port checklist for route ownership, GPU worker placement, graph-derived embedding composition, and parity tests.

Revision History

Version	Date	Author	Change
0.1	2026-05-31	Codex	Initial draft ADR plus file-backed executable trace prototype.
0.2	2026-05-31	Codex	Added production runtime/language boundary after architecture, ML, backend, API, security, and test subagent review.
0.3	2026-05-31	Codex	Added backend-core-shaped Python production prototype with policy-first activation and object-inference/chat adapter tests.
0.4	2026-05-31	Codex	Added native hypergraph object-inference OpenAPI contract with trace replay and object-index update lifecycle surfaces.
0.5	2026-05-31	Codex	Reconciled current tracked prototype evidence around Node trace, gate, object-inference, and chat-completion output contracts plus live validator.
0.6	2026-05-31	Codex	Added dependency-light HTTP prototype and OpenAPI contract for health, native object inference, and OpenAI-compatible chat completions.
0.7	2026-05-31	Codex	Added in-memory trace fetch/replay to the HTTP prototype with public-redacted trace envelopes.
0.8	2026-05-31	Codex	Added provenance-required object-index updates and in-memory delta overlay serving to the HTTP prototype.
0.9	2026-05-31	Codex	Added overlay compaction, candidate snapshot promotion, rollback, and recorded-view replay to the HTTP prototype and contract.
0.10	2026-05-31	Codex	Added optional file-backed prototype persistence for traces, snapshot lifecycle state, delta overlays, and rollback stack.
0.11	2026-05-31	Codex	Added explicit promotion gate evidence and required matching promotionGateId for candidate snapshot promotion.
0.12	2026-05-31	Codex	Added prototype operation scopes for authenticated inference, trace, object-index, promotion, and rollback routes.
0.13	2026-05-31	Codex	Added structured audit events for allowed, denied, and error outcomes across inference, trace, and object-index lifecycle routes.
0.14	2026-05-31	Codex	Added UDA-style HTTP current-view source loading beside file-backed Object Model projection loading.
0.15	2026-05-31	Codex	Added OTel-shaped telemetry spans with W3C traceparent correlation for source loading, inference, chat, policy, trace, and object-index lifecycle routes.
0.16	2026-05-31	Codex	Added optional principal-scoped request budget enforcement before inference and object-index lifecycle mutation.
0.17	2026-05-31	Codex	Added object-native SSE streaming for activation, gate, final, and done inference events.
0.18	2026-05-31	Codex	Added OpenAI-compatible chat completion streaming over the hypergraph authority response.
0.19	2026-05-31	Codex	Added OpenAI-compatible model discovery and hyperbolic embedding endpoints for the active hypergraph activation space.
0.20	2026-05-31	Codex	Added OpenAI-compatible Responses non-stream and streaming adapters over the native object-inference authority path.
0.21	2026-05-31	Codex	Added machine-readable production-readiness manifest and validator for backend-core graduation gates.
0.22	2026-06-01	Codex	Added backend-core serving handoff manifest and validator for graph-derived hyperbolic embedding composition, GPU worker options, stores, route ownership, and parity tests.
0.23	2026-06-01	Codex	Updated /v1/embeddings to derive supported Poincare coordinates from activated hypergraph/Object Model support.
0.24	2026-06-01	Codex	Added dependency-light Python authority core and tests for backend-core-shaped policy, adapter, gate, trace, and embedding behavior.
0.25	2026-06-01	Codex	Added Python runtime wrapper for trace storage, public-redacted trace envelopes, and deterministic recorded-view replay.
0.26	2026-06-01	Codex	Added principal-scoped Python request budget enforcement, audit events, and health counters for fail-closed spigot rehearsal.
0.27	2026-06-01	Codex	Added Python runtime state export/import and file-backed restart rehearsal for traces, audit events, and budget counters.
0.28	2026-06-01	Codex	Added framework-free Python route handlers for backend-core endpoint semantics and OpenAI-compatible adapter status handling.
0.29	2026-06-01	Codex	Added OTel-shaped Python telemetry spans for inference, adapters, embeddings, trace operations, health, budget denials, route errors, and restart recovery.
0.30	2026-06-01	Codex	Added supplied-scope enforcement to Python route handlers for inference, adapters, embeddings, trace read, and trace replay.
0.31	2026-06-01	Codex	Added OpenAI-compatible Python model discovery handlers and hypergraph gate model metadata.
0.32	2026-06-01	Codex	Added Python streaming event envelopes for object inference, chat completions, and Responses adapters with fail-closed budget behavior.
0.33	2026-06-01	Codex	Added provenance-required Python object-index delta-overlay updates that participate in inference, embeddings, and restart recovery.
0.34	2026-06-01	Codex	Added Python object-index compaction, promotion gate validation, active snapshot promotion, rollback, and lifecycle state recovery.
0.35	2026-06-01	Codex	Added Python-vs-Node contract parity tests for seeded and fail-closed object-inference responses.
0.36	2026-06-01	Codex	Added deterministic sufficiency eval harness for seeded, partial, and fail-closed active hypergraph task envelopes.
0.37	2026-06-01	Codex	Added dependency-free Python HTTP harness for service-shaped backend-core authority runtime rehearsal.
0.38	2026-06-01	Codex	Added dependency-light hyperbolic training worker rehearsal for promotion-gated candidate snapshots outside the request path.
0.39	2026-06-01	Codex	Added JSON Schema, OpenAPI route declaration, and live validator coverage for hyperbolic training candidate snapshots.
0.40	2026-06-01	Codex	Added training candidate artifact fetch, save, load, and promotion handoff rehearsal.
0.41	2026-06-01	Codex	Added deterministic poisoning/adversarial gate evidence for hyperbolic training candidates.
0.42	2026-06-01	Codex	Added deterministic performance-budget evidence for hyperbolic training candidates.
0.43	2026-06-01	Codex	Added OpenAPI-to-Python route parity tests and explicit Python object-inference stream route support.
0.44	2026-06-01	Codex	Added runtime-state JSON Schema and live validator for Python prototype persistence.
0.45	2026-06-01	Codex	Added production-readiness evidence command allowlisting and required evidence id checks.
0.46	2026-06-01	Codex	Added an umbrella production-prototype validator for the active-hypergraph proof ladder.
0.47	2026-06-01	Codex	Added machine-checkable GPU/container deployment topologies for the offline hyperbolic training worker.
0.48	2026-06-01	Codex	Added a container-friendly Python worker entrypoint for hyperbolic training candidate artifact generation.
0.49	2026-06-01	Codex	Added a non-root worker image template and validator for the offline hyperbolic training worker contract.
0.50	2026-06-01	Codex	Added JSON Schema contracts for hyperbolic training worker job input and worker summary output.
0.51	2026-06-01	Codex	Added canonical worker job/result examples for backend-core MLOps queue handoff.
0.52	2026-06-01	Codex	Added fleet contract bundle drift checking to the active-hypergraph proof ladder.
0.53	2026-06-01	Codex	Added a schema-bound worker image build plan for release-engineering handoff.
0.54	2026-06-01	Codex	Added a schema-backed backend-core to hyperbolic-worker training job queue handoff.
0.55	2026-06-01	Codex	Added a schema-backed backend-core port binding contract for remaining production gates.
0.56	2026-06-01	Codex	Added a content-addressed hyperbolic training promotion package contract for backend-core revalidation.
0.57	2026-06-01	Codex	Added a write-through runtime state store seam for backend-core durable-store port rehearsal.
0.59	2026-06-01	Codex	Added a schema-bound hypergraph embedding derivation contract and serving handoff projection recipe.
0.60	2026-06-01	Codex	Added content-addressed hyperbolic embedding index delta contract and promotion package binding.
0.61	2026-06-01	Codex	Added backend-core OTel span mapping contract gates for active-hypergraph runtime spans.
0.62	2026-06-01	Codex	Added schema-bound UDA hypergraph hydration exchange contract and backend-core port binding.
0.63	2026-06-01	Codex	Added schema-bound durable store operation batches for backend-core trace, budget, audit, telemetry, and object-index store consumers.
0.64	2026-06-01	Codex	Added schema-bound active-hypergraph policy decisions for backend-core JWT/RBAC middleware replacement.
0.65	2026-06-01	Codex	Added schema-bound active-hypergraph OTel export batches for backend-core collector integration.
0.66	2026-06-01	Codex	Added file-level backend-core FastAPI service port plan with route parity validation.
0.67	2026-06-01	Codex	Added digest-backed hyperbolic embedding source sets for graph-native embedding composition.
0.68	2026-06-01	Codex	Added standalone hyperbolic embedding source-set validator and readiness evidence.
0.69	2026-06-01	Codex	Bound embedding index deltas to graph-derived source-set ref/digest evidence.
0.70	2026-06-01	Codex	Required source-set digest checks in promotion package and backend-core port lineage.
0.71	2026-06-01	Codex	Added service-port promotion revalidation plan for backend-core FastAPI implementation.
0.72	2026-06-01	Codex	Exposed optional promotion-package evidence on the OpenAI-compatible object-index promotion API.
0.73	2026-06-01	Codex	Added runtime validation for supplied promotion-package evidence before active snapshot mutation.
0.74	2026-06-01	Codex	Added a parity-gated backend-core FastAPI skeleton template for the active hypergraph service port.
0.75	2026-06-01	Codex	Added required-scope parity validation for backend-core FastAPI skeleton route dependencies.
0.76	2026-06-01	Codex	Added route policy matrix parity for backend-core middleware and request-training exclusion.
0.77	2026-06-01	Codex	Expanded and validated backend-core skeleton durable store ports.
0.78	2026-06-01	Codex	Added backend-core skeleton telemetry policy parity for OTel export and redaction gates.
0.79	2026-06-01	Codex	Added backend-core skeleton UDA hydration policy parity for fallback and scope-filter gates.
0.80	2026-06-01	Codex	Added backend-core skeleton training/promotion policy parity for queue/schema/request-path gates.
0.81	2026-06-01	Codex	Added backend-core skeleton embedding derivation policy parity for serving handoff projection gates.
0.82	2026-06-01	Codex	Added backend-core skeleton response gate policy parity for sufficient-only allow and support gates.
0.83	2026-06-01	Codex	Added backend-core skeleton OpenAI adapter policy parity for native authority and stream contracts.
0.84	2026-06-01	Codex	Added backend-core skeleton request-schema parity for OpenAPI required fields and request alternatives.
0.85	2026-06-01	Codex	Added backend-core skeleton model discovery and health policy parity.
0.86	2026-06-01	Codex	Added backend-core health route parity and graph-derived serving-computation guards.
0.87	2026-06-01	Codex	Added backend-core skeleton policy-decision evidence parity for JWT/RBAC middleware.
0.88	2026-06-01	Codex	Added backend-core skeleton budget policy parity for principal budget store and fail-closed denial evidence.
0.89	2026-06-01	Codex	Added backend-core skeleton durable-store operation policy parity for replayable state writes.
0.90	2026-06-01	Codex	Added backend-core skeleton spigot guardrail policy parity for audit, Problem Details, OTel, redaction, and blocked adapter semantics.
0.91	2026-06-01	Codex	Added backend-core skeleton package composition parity for router and service exports.
0.58	2026-06-01	Codex	Added a policy-first UDA DataObject hydration adapter seam to the Python production prototype.