# Yemaya Study & Deconstruction Workspace — Implementation Evidence Log Append-only evidence log for [YEMAYA_STUDY_AND_DECONSTRUCTION_WORKSPACE_SOTA_IMPLEMENTATION_CHECKLIST.md](../YEMAYA_STUDY_AND_DECONSTRUCTION_WORKSPACE_SOTA_IMPLEMENTATION_CHECKLIST.md). Contract (YSD-0003): every checked item records its implementation artifacts, test command, passing output, review/approval evidence where applicable, and the commit that landed it. Entries are append-only; corrections append a superseding entry rather than editing history. Each entry's commit is resolvable deterministically with `git log --grep=''` because every implementation commit subject or body names the item IDs it delivers; hashes are additionally recorded here once known. Immutable-link contract (YSD-0112): evidence links must survive later edits to the linked artifact. The convention, in order of preference: 1. **Commits** — full or unambiguous-prefix SHA on `origin/main` (`git log --grep=''` resolves it; the recorded SHA pins content forever). A pinned browse URL is `https://github.com/GreyChimp/oshun/blob//`. 2. **Migrations** — repo path of the migration directory plus the SHA that introduced it (migration files are themselves append-only by repo policy). 3. **API versions** — the version literal in the contract source (e.g. `VIDEO_ADAPTER_VERSION`) plus path@sha. 4. **Evaluation reports / performance runs / accessibility reports** — the generated report file committed under `docs/` or `infra/a11y-reports/` (or the CI run URL), always paired with the workflow name and the commit it ran against. 5. **Threat-model updates** — path@sha of the threat-model document revision. 6. **Release decisions** — the decision artifact path@sha plus the named approver and date (YSD-0015). A bare mutable path (no SHA, no version) is not evidence; entries below that predate this contract already carry SHAs and remain compliant. --- ## YSD-0101 — Machine-readable capability inventory (2026-07-18) - **Status:** complete - **Artifacts:** - `docs/proposals/yemaya-study-workspace/capability-inventory.json` — 14 domain entries (yemaya, nisaba, sophia, hathor, aja, euterpe, aglaea, bellona, neith, maya, metis, isis, iris, oshun), each with owner, API services, data authority (accountable/contributing/boundary per proposal §3.2), maturity for the study workspace (proposal §5.1 legend), persistence (migration-dir evidence), fixture use (raw marker counts plus code-verified findings), test coverage counts, and known limitations; plus 6 program-level missing capabilities from proposal §5.2. - `docs/proposals/yemaya-study-workspace/capability-inventory.schema.json` — JSON Schema (2020-12) for the artifact. - `tools/yemaya-study/check-capability-inventory.mjs` — dependency-free structural validation + domains.json drift check + path-existence check, following the `tools/domains/check-registry.mjs` convention. - **Ground truth collected at commit** `6c87e0df3b98f431c80fbc3ab7a5318d85c20898`: file/test/migration counts via `find`, fixture-marker counts via `grep -rl`, domain registry fields from `domains.json`. Fixture claims verified by reading code: `apps/aja/svc-reference-video/src/metadata-extraction.ts` (simulated FFprobe, lines 259–282/508–511), `apps/aja/svc-reference-video/src/scene-detection.ts` (simulated frame stats/scene changes, lines 271–334), `libs/yemaya/agents/src/creative/performance-reference-library.ts` (in-memory `Map` stores lines 183–185, four-value rights enum line 36). All 15 proposal-cited evidence paths confirmed to exist. - **Test command:** `node tools/yemaya-study/check-capability-inventory.mjs` - **Passing output:** `capability-inventory check passed: 14 domains, 6 missing-capability entries, assessed 2026-07-18.` - **Negative test:** removing the `iris` entry, corrupting an owner, and pointing a verified finding at a nonexistent path made the checker fail with exactly those 3 problems (exit 1); restoring the file returned it to green. - **Commit:** resolve via `git log --grep='YSD-0101'` (subject `docs(yemaya): ysd-0101 machine-readable capability inventory`), landed as `a0710bd396` on branch and merged to origin/main via `0808b8cb5b`. ## YSD-0102 — Proposal §29 evidence-link validation + symbol record (2026-07-18) - **Status:** complete - **Artifacts:** - `docs/proposals/yemaya-study-workspace/section-29-evidence.md` — link validation result plus the exact reusable symbols, services, and contracts for all 15 §29.3 primitives (replacing directory-level claims), with reuse caveats and a prohibited-inference risk flag for four yemaya analyzers (gaze/fatigue/authenticity/response detection) feeding YSD-4052. - **Validation method:** every §29 link resolved from `docs/proposals/` with a shell existence check over all 30 targets (5 ADRs, 10 domain docs, 15 primitives) — all OK, zero stale paths, so no proposal edits were needed. Export surfaces extracted with `grep -n '^export '` per file and read in context; simulated paths re-confirmed (aja scene-detection lines 271–334, metadata-extraction lines 259–282/508–511). - **Test command:** `cd docs/proposals && for p in ; do [ -e "$p" ] || echo STALE $p; done` → no STALE output. - **Note:** continuous re-validation of these links is deliberately deferred to YSD-0111 (automated traceability check), which owns CI enforcement. - **Commit:** resolve via `git log --grep='YSD-0102'`, landed as `e4f7be9eb2`. ## YSD-0103 — Reuse-versus-wrap-versus-replace ledger (2026-07-18) - **Status:** complete (ledger + enforcement built; 10 owner decisions recorded as pending and tracked by the checker — those pending decisions gate later work via the ledger itself and the future YSD-0139 CI decision gate, they do not gate this build item) - **Artifacts:** - `docs/proposals/yemaya-study-workspace/reuse-ledger.json` — 20 entries, one per proposal §5.2 capability row, each with status (§5.1 legend), cited evidence, proposed disposition (reuse/wrap/replace/build-new/ exclude), rationale, and — for every partial or fixture-backed capability — a required ownerDecision block (all currently pending). - `docs/proposals/yemaya-study-workspace/reuse-ledger.schema.json` — JSON Schema with conditional requirements (partial/fixture-backed ⇒ ownerDecisionRequired:true + ownerDecision present; decided ⇒ decidedBy/decidedOn/decision/rationale). - `tools/yemaya-study/check-reuse-ledger.mjs` — parses the §5.2 markdown table straight from the proposal so ledger and proposal cannot drift silently; enforces the decision policy; validates evidence paths; reports the pending-decision count. - **Test command:** `node tools/yemaya-study/check-reuse-ledger.mjs` - **Passing output:** `reuse-ledger check passed: 20 entries covering 20 proposal §5.2 rows; 10 owner decision(s) pending.` - **Negative test:** deleting the rights-resolver entry, un-requiring the nisaba decision, and claiming a decided state without decidedBy/decidedOn/rationale produced exactly 5 problems (exit 1); restore returned green. - **Commit:** resolve via `git log --grep='YSD-0103'`, landed as `d099eb67e1`. ## YSD-0104 — Existing schema inventory + identity conflicts (2026-07-18) - **Status:** complete - **Artifacts:** - `docs/proposals/yemaya-study-workspace/schema-inventory.md` — inventory of the 12 schema families (media, annotation, notebook, evidence, rights, search, graph, learning, replay, telemetry, signing, audit) with exact file paths, key exported types/tables, owning domains, the five migration/schema directories (nisaba, sophia, yemaya, oshun prisma + metis drizzle-style), and 13 documented identity/semantics conflicts, each with the Section 2/3/4 contract obligation that must resolve it. - **Method:** one sequential Explore-agent sweep (no parallel agents, per session-limit policy), then main-session spot-verification of ten load-bearing claims by reading cited files — all ten confirmed (aja dual annotation enums, sophia Notebook:935/EvidencePack:971/RightsStatus:72, CanonicalPlatformAuditEventSchema:160, metis dual MasteryLevel, dual AuditLog models sophia:1331/yemaya:1118, oshun NisabaAnnotation:2017 and NisabaNotebook:2111, bellona REMOTE_REPLAY_BUNDLE_VERSION:66, live-media PlaybackGrantClaimsSchema:44). - **Notable finds feeding later items:** `libs/shared/live-media` playback-grant flow is the closest existing rights-decision primitive (pattern for Section 4.1); the canonical audit-event contract + hash-chain store already exist (`libs/contracts/src/common/canonical-audit-event.ts`, `libs/shared/audit-platform`) and YSD-3060 must ingest them rather than invent a new ledger; oshun already holds cross-domain Nisaba/Metis/Veritas projections, so the workspace's projection pattern has precedent. - **Commit:** resolve via `git log --grep='YSD-0104'`, landed as `dbb87a0916` (merged to origin/main via `84c7410039`). ## YSD-0105 — Infrastructure inventory (2026-07-18) - **Status:** complete - **Artifacts:** - `docs/proposals/yemaya-study-workspace/infrastructure-inventory.md` — databases (Postgres16+pgvector via PgBouncer; 18 domain DBs + oshun_dev from `POSTGRES_MULTIPLE_DATABASES`, including existing `yemaya` and `nisaba` DBs), object stores (MinIO dev / S3 prod / live-media S3 store), queues (Redis+BullMQ via `libs/shared/queue`; SQS+DLQ terraform; Kafka+ Debezium profile-gated), search (Elasticsearch profile + PG FTS), vectors (pgvector default + Qdrant profile), graph (Neo4j profile; TS/Postgres graph engines today), time-series (none dedicated — matches YSD-3043 posture), audit (canonical contract + hash-chain with in-memory-only store; divergent domain tables), observability, RunPod GPU posture, and 4 named gaps feeding Sections 1/3/6. - **Method:** read `docker/docker-compose.dev.yml` (images, profiles, database provisioning line 28), `infra/` and `infra/terraform/` layouts, SQS module naming/alarms, `infra/runpod/endpoints`, BullMQ dependency in `libs/shared/queue/package.json`; `.env.example` present, no committed root `.env`. - **Commit:** resolve via `git log --grep='YSD-0105'`, landed as `21d024fcf2`. ## YSD-0106 — Oshun Studio surface inventory (2026-07-18) - **Status:** complete - **Artifacts:** - `docs/proposals/yemaya-study-workspace/studio-surface-inventory.md` — all eight dimensions: routes (58 /studio route dirs enumerated; no /studio/study yet; 1,464 studio components with fixture caveat), shared navigation (libs/oshun/navigation + shell-core + app components), authentication (libs/oshun/auth, auth-session cookies/types, BFF), tenant context (tenant-console, tenant-scoped prisma uniqueness, TenantIdSchema), Library persistence (LibraryLibraryCollection:1594 + Nisaba projections + mounted /nisaba surfaces), design tokens (shared package + app design-system), responsive baseline (breakpoints/ mediaQueries tokens.ts:329-344), accessibility primitives (AccessibilityShell, focus/keyboard/i18n components), plus reuse-worthy adjacent capabilities (offline, clipper-extension for YSD-5011, DomainDegradation pattern for YSD-2007) and 3 named gaps. - **Method:** direct ls/grep/read of apps/oshun/web/src (app routes, studio routes, components, design-system tokens, auth-session) and libs/oshun/\* (auth, navigation, shell-core, design-tokens, persistence prisma). - **Commit:** resolve via `git log --grep='YSD-0106'`, landed as `596e6bbfd9`. ## YSD-0107 — Harness inventory mapped to release gates (2026-07-18) - **Status:** complete - **Artifacts:** - `docs/proposals/yemaya-study-workspace/harness-inventory.md` — the eight harness families (Playwright/e2e, accessibility, contract, evaluation, performance, deletion, privacy, security) with exact paths/workflows, a gate-by-gate coverage table for all 19 mandatory release gates (YSD-18130–18148), and named gaps (no epistemic-conflation tests, no media-derivative deletion fan-out, no parser-fuzz/SSRF suites, no gold sets pending YSD-0130, gates 3/9/13–19 unharnessed). - **Method:** surveyed `testing/` (e2e, performance/k6+benchmarks, chaos, prompt-injection with held-out sets, boundary validator), all 102 `.github/workflows/` names with study-relevant ones read, deletion/privacy code under libs/oshun (dsar-deletion-cascade + unit/integration tests, privacy erasers, consent stores/ledger), and Section 18.6 gate text. - **Commit:** resolve via `git log --grep='YSD-0107'`, landed as `390e735509` (merged to origin/main via `33956eb359`). ## YSD-0108 — Source-format support matrix (2026-07-18) - **Status:** complete - **Artifacts:** - `docs/proposals/yemaya-study-workspace/source-format-matrix.md` — 12-row matrix (film/video, audio, subtitles, transcripts, images, documents, storyboards, telemetry, creator-owned 3D, level scenes, commentary, paratext) with concrete formats, evidence-backed existing capability, §5.1-legend status, and target checklist items; plus cross-cutting requirements (parser sandboxing, simulated-path quarantine, link-only provider posture, rational frame-rate gap in aja types, capability discovery). - **Key ground truth established:** real ffmpeg/ffprobe execution exists in `libs/shared/encoding` (imf-delivery, audio-analysis, timeline-assembly) and `libs/shared/live-media` (neith-ffmpeg-transcoder, ffmpeg-hls-dash-packager), with on-box `/usr/bin/ffmpeg` + `/usr/bin/ ffprobe` — these, not aja's simulated probe, are the decode foundation. Neith 3D import confirmed by reading `libs/neith/assets/crates/neith-asset-import/src/lib.rs:13` (`GltfImporter, UsdImporter, FbxImporter, ObjImporter, AlembicImporter`). No PDF parser found in nisaba/sophia. - **Commit:** resolve via `git log --grep='YSD-0108'`, landed as `ed20585c24`. ## YSD-0109 — User-persona acceptance matrix (2026-07-18) - **Status:** complete - **Artifacts:** - `docs/proposals/yemaya-study-workspace/persona-acceptance-matrix.md` — all six §6 personas (learner filmmaker, learner game developer, actor/animator/director, character/costume/concept artist, teacher/mentor/team lead, researcher/critic) each mapped to jobs (from proposal §6 verbatim), §7 journeys, concrete acceptance checklist items (Section 22.1 proofs + gates), domain dependencies, and one non-negotiable safety/integrity constraint per persona (no-model manual study; no instrumented external titles; no real-state emotion inference; resolution-limited crops + cultural taxonomy authorship; no taste scoring; immutable scholarly history). - **Method:** proposal §6 read in full (lines 341–384) and mapped against Section 22.1/22.2 acceptance items and Section 18.6 gates. - **Commit:** resolve via `git log --grep='YSD-0109'`, landed as `5c1cd4e387`. ## YSD-0110 + YSD-0111 — Traceability ledger + automated check (2026-07-18) - **Status:** complete (built together — the check is the ledger's enforcement — verified individually) - **Artifacts:** - `docs/proposals/yemaya-study-workspace/traceability-ledger.json` (YSD-0110) — GENERATED ledger with 158 entries, one per normative proposal subsection (every `###` under numbered sections 1–29, section-level entries for 26/27, Final Recommendation; Table of Contents excluded as non-normative), each carrying mapped checklist sections with live item ranges/counts, explicit item IDs where established, release gates (23.5 → YSD-18130..18148), and notes. Test evidence per item lives in EVIDENCE_LOG.md (linked from the ledger header). - `tools/yemaya-study/traceability-map.json` — the curated subsection→checklist mapping (158 entries) the ledger is generated from, seeded from the checklist's own coverage index and refined at subsection level (e.g. 9.2→YSD-2072/2073, 9.3→YSD-2074..2077, 17.2→YSD-1002..1004, 29.x→YSD-0102). - `tools/yemaya-study/check-traceability.mjs` (YSD-0111) — parses proposal headers and checklist IDs; fails on: unmapped proposal subsection, stale map entry, nonexistent checklist section/item (exact-token Set membership, never substring — YSD-1002 vs YSD-10020 prefix hazard handled), checklist references to nonexistent proposal sections (`proposal Section N` scan), and ledger drift vs regeneration (`--write` regenerates). - `.github/workflows/ci.yml` — all three yemaya-study checkers added to the quality/lint job beside the domain-registry check (automation requirement of YSD-0111). - **Test command:** `node tools/yemaya-study/check-traceability.mjs` - **Passing output:** `traceability check passed: 158 proposal subsections mapped, 1305 checklist items known, 158 map entries.` - **Negative test:** removing the 9.2 mapping, adding a bogus map key, referencing YSD-99999 and truncated YSD-100 (prefix of real IDs — proves word-boundary semantics), rewriting a checklist reference to `proposal Section 99`, and leaving the ledger stale produced exactly 6 problems (exit 1); restore returned green. - **Commit:** resolve via `git log --grep='YSD-0110'`, landed as `6fd3ff3fd9`. ## YSD-0112 — Implementation evidence log with immutable links (2026-07-18) - **Status:** complete - **Artifacts:** this file's header now carries the immutable-link contract covering all eight classes YSD-0112 names (commits, migrations, API versions, evaluation reports, performance runs, accessibility reports, threat-model updates, release decisions), each with its pinning convention (SHA-anchored paths/URLs, version literals, workflow+commit pairs, named approver for release decisions). Existing entries already comply (every completed item records its landing SHA). - **Verification:** all recorded SHAs resolve on origin/main (`git merge-base --is-ancestor origin/main` for a0710bd396, e4f7be9eb2, d099eb67e1, dbb87a0916, 21d024fcf2, 596e6bbfd9, 390e735509, ed20585c24, 5c1cd4e387, 6fd3ff3fd9 — see commit for the run). - **Commit:** resolve via `git log --grep='YSD-0112'`. ## YSD-0113 — Nisaba primitive generalization assessment (2026-07-18) - **Status:** complete - **Artifacts:** - `docs/proposals/yemaya-study-workspace/reuse-ledger.json` — new `nisabaPrimitiveAssessments` section with six primitive families: annotations-w3c-model (generalizes-with-extension — selector union takes new media selector kinds; FragmentSelector/Media-Fragments is a bridge but lacks rational frame rate/edition identity), editions-critical-edition (needs-new-contract — philology-shaped; VariantUnit review pattern templates EditionAlignmentMap), comparative-structures-collation (needs-new-contract), corpora-canon-registries (generalizes-with-extension — CTS URN/ canonical-uri/versification-mapping discipline is the SourceWork identity shape; versification mapping is the alignment-map precedent), study-plans-research-projects (generalizes), notebooks-library-items (generalizes). - Schema extended (`reuse-ledger.schema.json`) and checker extended (`check-reuse-ledger.mjs`) to require ≥5 assessments with valid outcomes, substantive rationales, and existing evidence paths. - **Ground truth read:** `libs/nisaba/core/src/types/annotations.ts` (W3C motivations + TextQuote/TextPosition/Fragment/XPath selector union), `libs/nisaba/database/prisma/schema.prisma` (CollationProject:306, VariantUnit:349 char-offset units, CriticalEdition:400), `libs/nisaba/workspace/src/research-environment.ts`, `libs/nisaba/canon/`. - **Test command:** `node tools/yemaya-study/check-reuse-ledger.mjs` - **Negative test:** invalid outcome `magically-works` + nonexistent evidence path produced exactly 2 problems (exit 1); restore returned green. - **Commit:** resolve via `git log --grep='YSD-0113'`, landed as `bf148f6544`. ## YSD-0139 — Decision log published + CI rollout gate (2026-07-18) - **Status:** complete. The 18 EXT decisions themselves (YSD-0120, YSD-0122–YSD-0138) remain **unchecked and proposed** — per YSD-0015 they complete only with a named approver; the drafts, harness, and enforcement are this item's deliverable. - **Artifacts:** - `docs/proposals/yemaya-study-workspace/decisions/ysd-0120.md` … `ysd-0138.md` (18 files) — one decision artifact per EXT item, each with Question, Recommendation (grounded in proposal §26 and the Section 0.1 inventories), Options considered with rejection rationale, Consequences, Machine-enforced outcome, and a pending Approval block naming the decision owner (@GreyChimp). - `docs/proposals/yemaya-study-workspace/decisions/decision-log.json` — published machine-readable log (18 entries, all `proposed`, all `blocking: true`). - `tools/yemaya-study/check-decision-log.mjs` — validates completeness of every required decision + artifact sections; rejects approved-without- approver/date/outcome (YSD-0015), log/artifact status disagreement, and expired approvals (reviewBy in the past); `--enforce-rollout` fails while any blocking decision is unresolved — the production-rollout gate the study-workspace deploy pipeline (YSD-1010) must invoke. - `.github/workflows/ci.yml` — plain-mode check added to the quality job. - **Test command:** `node tools/yemaya-study/check-decision-log.mjs` - **Passing output:** `decision-log check passed: 18 decisions tracked, 18 blocking decision(s) still unresolved (informational; rollout gate not enforced)`; `--enforce-rollout` correctly fails listing all 18. - **Negative test:** approved-without-fields, artifact/log disagreement, expired reviewBy, and a removed required decision produced exactly 7 problems (exit 1); restore returned green. - **Commit:** resolve via `git log --grep='YSD-0139'`, landed as `27ea6e7a56`. ## YSD-0150–YSD-0162 + YSD-0165 — Domain responsibility contracts (2026-07-18) - **Status:** complete (14 definition items; YSD-0163 conformance tests and YSD-0164 architecture tests remain unchecked — they need real adapters and scaffolding to test, else they would be self-asserting gates) - **Artifacts:** - `docs/proposals/yemaya-study-workspace/responsibility-contracts.md` — version 1.0.0, superseded-not-edited. YSD-0150 defines the shared convention (one `libs//study-adapter` per accountable owner, `STUDY_ADAPTER_CONTRACT_VERSION` semver, capability discovery + YSD-2007 response vocabulary, domain-native ID preservation, no direct cross-domain DB access). Each domain section (0151 Yemaya, 0152 Nisaba, 0153 Sophia, 0154 Hathor, 0155 Aja, 0156 Euterpe, 0157 Aglaea, 0158 Bellona+runtimes incl. the seven named DCC bridges and bridge-lib reuse, 0159 Metis, 0160 Isis, 0161 Oshun, 0162 Iris, 0165 Neith/Maya) carries Responsibilities (checked word-by-word against the checklist item's enumerated list — every listed responsibility present), Adapter boundary, and Must-not constraints. - **Verification:** each of the 14 sections was diffed against its item's enumerated responsibility list before marking; grounded in the YSD-0101 data-authority fields and the §3.2 matrix. - **Commit:** resolve via `git log --grep='YSD-0150'`, landed as `8ccda3dc4c`. ## YSD-1001 — Architecture ADR (2026-07-18) - **Status:** complete (ADR created with all seven required dimensions; ADR status is Proposed, acceptance explicitly gated on YSD-0120/0122 approvals — creation, not acceptance, is this item's deliverable) - **Artifacts:** - `docs/adr/ADR-0074-yemaya-study-deconstruction-workspace-architecture.md` — logical architecture (five planes with canonical owners), domain boundaries and data authority (Postgres-authoritative, existing yemaya/nisaba/sophia databases, single rights decision point, epistemic identity as contract property), trust boundaries (untrusted bytes/text, tenant, model, rollout gate), route placement (/studio/study per YSD-0122 draft), deployment topology (ECS Fargate + BullMQ/SQS + RunPod via Isis + MinIO/S3 + FTS/pgvector-first projections), and migration path from specialist apps (studio-web pages and svc-reference-video wrapped/retired-behind-redirect, simulated paths never migrated). - **Verification:** all seven content dimensions named by YSD-1001 checked present; consistent with responsibility-contracts.md v1.0.0, the YSD-0104/0105 inventories, and the 18 decision drafts (no contradiction with any proposed recommendation). - **Commit:** resolve via `git log --grep='YSD-1001'`, landed as `398022c496`. ## YSD-1003 — Scaffold apps/yemaya/svc-study-workspace (2026-07-18) - **Status:** complete - **Artifacts:** `apps/yemaya/svc-study-workspace/` — Hono/node service with: - `src/config.ts` — zod env schema, fail-fast `ConfigValidationError` with readable per-field report; production consistency rules (DATABASE_URL required, JSON logs enforced, shutdown grace capped at 25s under the ECS 30s stopTimeout). - `src/logging.ts` — pino structured JSON logs with service/env base fields, credential redaction backstop, YSD-0009 hygiene note. - `src/request-context.ts` — X-Request-Id honor-or-mint (validated token pattern) + real W3C Trace Context: traceparent parse (zero-id rejection), trace continuation with fresh span id, response header emission; request-scoped child logger carries requestId/traceId/ spanId. - `src/metrics.ts` — prom-client registry with default process metrics + RED metrics (duration histogram, in-flight gauge, totals counter) labeled by matched route pattern (bounded cardinality). - `src/readiness.ts` — probe framework with per-probe timeout; real postgres `SELECT 1` probe when DATABASE_URL configured; honest `not-configured` reporting otherwise (visible seam, not fake success). - `src/app.ts` — /health, /ready (503 on failed probe), /metrics, structured 404, error handler that never leaks internals in production; deliberately zero placeholder business routes. - `src/index.ts` — fail-fast config load, serve, graceful shutdown (SIGTERM/SIGINT drain with deadline, pool close, second-signal force exit). - `project.json` (tags scope:yemaya/type:app/plane:experience, build/ serve/lint/test/typecheck targets), catalog-only deps, `deploy/README.md` deployment manifest (ECS naming contract + gated registration steps + container contract), service README. - **Test command:** `npx vitest run` (in the app dir) — **15/15 passed**; `npx tsc --noEmit -p tsconfig.app.json` — clean. - **Runtime proof:** booted live on :4321 — structured logs, /health 200 with identity, /ready 200 with honest postgres `not-configured` probe, inbound `x-request-id: smoke-1` honored + valid traceparent emitted, /metrics served 24 histogram bucket lines, SIGTERM → drain → exit 0. Real-postgres ok-path deferred to walking skeleton (dev compose not running); probe failure/timeout paths unit-tested. - **Note:** a NUL byte corrupted one test string during authoring (made the file grep-binary); found via `cat -A`, fixed byte-safely, suite green. - **Commit:** resolve via `git log --grep='YSD-1003'`, landed as `5238d19b9a`. ## YSD-0120, YSD-0122–YSD-0138 — All 18 P0 EXT decisions approved (2026-07-18) - **Status:** complete — approved **as recommended** by the decision owner (@GreyChimp, the named approver) in this session's conversation ("approve them all as recommended"), recorded 2026-07-18, review-by 2027-07-18. - **Artifacts:** `decisions/decision-log.json` — every entry now `status: approved` with approvedBy/approvedOn/outcome/reviewBy; all 18 `decisions/ysd-01xx.md` artifacts flipped to approved with the approval line filled. Each artifact carries the YSD-0015 required set: decision, named approver, date, rationale, alternatives with rejection reasons, consequences, and machine-enforced outcome. - **Gate result:** `node tools/yemaya-study/check-decision-log.mjs --enforce-rollout` → `18 decisions tracked, 0 blocking decision(s) still unresolved (rollout gate: PASS)`. - **Downstream effects:** ADR-0074 status flipped Proposed → Accepted (was gated on YSD-0120/0122); YSD-1002 (route scaffold), YSD-0121 (Nx/CODEOWNERS boundary encoding), and Section 2 permanent storage shapes (YSD-0128) are now unblocked. The 10 reuse-ledger ownerDecision slots (YSD-0103) are a separate approval set and remain pending. - **Commit:** resolve via `git log --grep='YSD-0120'`, landed as `64955a27a5`. ## YSD-0103 addendum — All 10 reuse-ledger owner decisions approved (2026-07-18) - **Status:** the ledger's pending owner decisions are now decided — approved **as proposed** by the owner (@GreyChimp) in this session's conversation ("approve the reuse-ledger decisions as proposed too"), recorded 2026-07-18. Dispositions now binding: nisaba-study-notebook-substrate → reuse; aja-reference-video-model → wrap; aja-ingestion-scene-detection → replace; performance-reference-library → replace; yemaya-creative-analyzers → wrap (prohibited-inference modules excluded); director-replay-studio-panel → replace; hathor-theory-lenses → reuse; aglaea-fashion-knowledge → reuse; animation-learning-surface → replace; dailies-review-surface → replace. - **Gate result:** `node tools/yemaya-study/check-reuse-ledger.mjs` → `20 entries covering 20 proposal §5.2 rows; 0 owner decision(s) pending.` - **Commit:** resolve via `git log --grep='YSD-0103 addendum'`, landed as `7ea609cc42`. ## YSD-0121 — Ownership boundaries encoded and enforced (2026-07-18) - **Status:** complete (all six encoding surfaces the item names) - **Artifacts:** - **Nx tags:** `apps/yemaya/svc-study-workspace/project.json` carries `scope:yemaya`, `type:app`, `plane:experience`; the adapter tag scheme (`scope:` + `type:study-adapter` on `libs//study-adapter`) is defined in responsibility-contracts.md and enforced by the architecture checker the moment an adapter directory appears. - **Dependency constraints:** `eslint.config.js` depConstraints — new `plane:experience` rule (may depend only on scope:shared/contracts/ oshun/yemaya, type:study-adapter, plane:experience) and `type:study-adapter` rule (adapters may never import each other; cross-lens composition is experience-plane work). Service files lint clean under the new rules (eslint exit 0). - **CODEOWNERS:** verified generated coverage — `libs/yemaya/` and `apps/yemaya/` owned by @GreyChimp (lines 103–104), `/tools/` covers tools/yemaya-study; staleness is already CI-guarded by check-registry.mjs, so no hand edits (they would break the generator drift check). - **Contract namespaces:** `libs/contracts/src/study/` reserved as the single home for study contracts (responsibility-contracts.md YSD-0150; materialized by YSD-1005); scope:contracts depConstraint already prevents contracts from depending on domain code. - **Service ownership metadata:** domains.json registry entry (yemaya, owner @GreyChimp) + project.json tags; registry sync CI-guarded. - **Architecture tests:** `tools/yemaya-study/check-architecture.mjs` — scans experience-plane and adapter sources for (1) direct cross-domain imports bypassing study adapters, (2) cross-domain database/persistence imports (YSD-0164), (3) prohibited-inference analyzer imports (the four YSD-4052-flagged modules, tests included), and (4) missing required tags; wired into the ci.yml quality job with the other checkers. - **Test command:** `node tools/yemaya-study/check-architecture.mjs` - **Passing output:** `study-workspace architecture check passed: 1 experience-plane project(s), 0 study adapter(s) scanned (1 total).` - **Negative test:** a planted file importing `@sophia/knowledge-graph`, `@hathor/database`, and `.../eye-contact-gaze-monitor` produced exactly 3 problems, one per rule (exit 1); removal returned green. - **Commit:** resolve via `git log --grep='YSD-0121'`, landed as `e8434e418a`. ## YSD-1002 — Canonical Studio route /studio/study (2026-07-18) - **Status:** complete (scaffold at the approved route with the approved layout conventions; the global "Study" nav entry is Section 7 work) - **Artifacts:** - `apps/oshun/web/src/app/studio/study/page.tsx` — follows the Studio route convention exactly (Metadata with canonical `/studio/study` per approved YSD-0122, ShellLayout `active="studio"`, workspace component, quickAction links to real surfaces: /studio, /nisaba/notebooks, /library). - `apps/oshun/web/src/components/studio/StudioStudyWorkspace.tsx` — the entry surface with an explicit honesty contract: a typed `STUDY_LAUNCH_CAPABILITIES` list where every capability reports its real state; the six unshipped capabilities (projects/ingest, playback/ annotation, camera/performance/narrative/sound lenses per the approved YSD-0126 set) render "Not yet available" with zero interactive affordance; the two available entries link to genuinely shipped surfaces (Nisaba notebooks, shared Library). - `apps/oshun/web/vitest.config.ts` — include pattern extended to `.spec.{ts,tsx}` (new `.test.` files are ratcheted; existing pattern only matched `.test.`). - `apps/oshun/web/src/app/studio/study/__tests__/study-page.spec.tsx` — 4 tests: identity/posture; **honesty invariant** (every unavailable capability shows the explicit status and renders no link/button); available links point only to route directories that exist on disk (fs-verified, so the page can never advertise a dead destination); metadata declares the approved canonical route. - **Test command:** `npx vitest run src/app/studio/study` (in apps/oshun/web) — **4/4 passed**. - **Commit:** resolve via `git log --grep='YSD-1002'`, landed as `9eca3bec5e`. ## YSD-1005 + YSD-2001–YSD-2004 — Study contracts namespace + first primitives (2026-07-18) - **Status:** complete (five items, each verified against its full text) - **Artifacts:** `libs/contracts/src/study/` (the YSD-0121-reserved namespace), exported as `@oshun/contracts/study` subpath and `StudyContracts` namespace (namespace-only at root to avoid name collisions with other domains' SegmentId/Timecode): - `ids.ts` (YSD-2001) — 35 branded identifiers covering every Section 2.2 core entity plus AnalysisRunId, RightsDecisionId, ReviewDecisionId, StudyEventId, StudyExportId, ProductionBacklinkId; domain-owned identities referenced through `*Ref` brands over native formats (Nisaba/Metis/Sophia/Isis — never re-minted); `DomainNativeObjectRef` preserves arbitrary native IDs verbatim (YSD-3002 mapping philosophy). - `author.ts` (YSD-2004) — strict discriminated union human/model/imported-system/collaborative-group; model identity carries modelId/modelVersion/analysisRunId and structurally cannot validate with a userId (conflation-rejection tested both directions). - `envelope.ts` (YSD-2002) — all nine required fields (schemaVersion, tenant, project, creator, timestamps, revision, supersession, provenance, deletionState) with supersession-chain refinements and the pure append-only `superseding()` helper (deterministic — caller supplies time; refuses already-superseded and legal-hold records). - `locators.ts` (YSD-2003) — all nine primitives: rational frame rate (exact cross-multiplication equality, gcd canonicalization, known-rate constants), real SMPTE 12M drop-frame timecode (dropped-label validation; bidirectional conversion), monotonic time (bigint-safe string nanoseconds + clock-domain-guarded comparison), wall-clock, normalized/pixel/spatial/document coordinates with refinements, and runtime-event locators requiring at least one locating field. - `study.spec.ts` — 21 tests including known-correct SMPTE anchors (00:00:59;29→1799, 00:01:00;02→1800, 00:10:00;00→17982, 01:00:00;00→107892), a dense 2,000-frame DF round-trip sweep plus 59.94 DF samples, envelope chain negatives, and region round-trips. - **Test command:** `npx vitest run src/study` (in libs/contracts) — **21/21 passed**; `npx tsc --noEmit -p tsconfig.json` — clean. - **No duplicate domain types (YSD-1005):** tenant identity follows the platform's canonical-audit-event convention (opaque token, no new brand); Nisaba/Metis/Sophia records are referenced, not redefined. - **Commit:** resolve via `git log --grep='YSD-1005'`, landed as `1a4a675bd9` (SKIP_TYPECHECK=1 used per the documented nx-typecheck fan-out trap — 289-project hook typecheck surfaced pre-existing common/citation.ts errors in untouched files; libs/contracts itself tsc-clean, verified directly). ## YSD-2005–YSD-2007 — Review states, confidence, response contracts (2026-07-18) - **Status:** complete (three items, each verified against its full text) - **Artifacts (in `libs/contracts/src/study/`):** - `review.ts` (YSD-2005) — the six states as a closed enum; the legal transition table (suggested→accepted/corrected/contested/rejected; accepted|corrected→contested/superseded; contested→accepted/corrected/ rejected; rejected→superseded; superseded terminal) with `canTransitionReviewState`/`assertReviewTransition` and a typed `IllegalReviewTransitionError`; immutable `ReviewEvent` (subject id + pinned revision, reviewer, reason, occurredAt) with refinements: models cannot accept/correct/reject (suggest-and-contest only), corrected transitions must carry corrections; `replayReviewEvents` derives state by replay and rejects broken chains. - `confidence.ts` (YSD-2006) — calibrated confidence with required calibration lineage (method, set id+version, validatedAt), bracketing uncertainty interval with coverage, and applicability boundary; explicit `uncalibrated` (raw score + native scale) and `missing` (typed reason) variants; `isDisplayableProbability` allows only calibrated values — bare numbers do not parse. - `responses.ts` (YSD-2007) — `CapabilityDescriptor` (dotted capability key, supported/unsupported/unavailable with mandatory reason when not supported, adapter contract version) and `makeStudyResponseSchema` producing the full outcome union: ok, ok-degraded (with mode+reason), partial-success (≥1 completion, exact failure manifest), unsupported, unavailable (retryable/retryAfterMs coherence), forbidden (policy), and insufficient-rights (denied action + inspectable RightsDecisionId). - **Test command:** `npx vitest run src/study` (libs/contracts) — **32/32 passed** (11 new: exhaustive 36-pair transition matrix, model-reviewer rejection, replay chain breaks, interval bracketing, partial-success coherence); `tsc --noEmit` clean. - **Commit:** resolve via `git log --grep='YSD-2005'`, landed as `78135b41a5`. ## YSD-2008 — Schema publication, examples, compatibility tests (2026-07-18) - **Status:** complete. Component-by-component against the item text: JSON Schema ✓ (17 draft-2020-12 schemas published from the registry); OpenAPI ✓ (`openapi.components.json` 3.1 components document); runtime validation ✓ (zod layer, declared authoritative in the manifest); generated client — satisfied by the typed package (zod-inferred types are the generated client surface for TS consumers) plus the published schema set proven independently consumable via ajv in the spec suite; HTTP-API client generation explicitly belongs to YSD-1009 where service APIs exist — recorded here so the 22.3 audit can contest the interpretation; canonical examples ✓; negative examples ✓; backward-compatibility tests ✓. - **Artifacts:** - `libs/contracts/src/study/schema-registry.ts` — the single publication registry (17 contracts); a contract cannot exist without entering the pipeline (manifest-vs-registry equality is tested). - `libs/contracts/scripts/generate-study-schemas.ts` — emits per-contract JSON Schema with versioned `$id`, the OpenAPI components doc, and a manifest carrying the runtime-vs-structural caveat; `--check` fails on drift or breaking changes; `--write-baseline` freezes the per-major snapshot (`schemas/study/baseline/v0/`); exports `findBreakingChanges` (removed contract/property, type change, enum narrowing, newly-required property, additionalProperties tightening, union narrowing) — the YSD-2010 detector foundation. - `libs/contracts/src/study/examples.ts` — canonical + structural-negative sets for all 17 contracts, plus `zodOnlyNegatives` pinning exactly where the runtime layer is stricter (cross-field refinements, formats). - `libs/contracts/src/study/schema-publication.spec.ts` — 7 tests: no-drift, example coverage for every contract, canonical examples pass BOTH zod and ajv-against-published-schema, structural negatives fail BOTH layers, runtime-only negatives fail zod, no breaking changes vs the committed baseline, and detector unit tests on synthetic diffs. - CI: `--check` added to the quality job; package scripts `generate:study-schemas` / `check:study-schemas`. - **Test command:** `npx vitest run src/study` (libs/contracts) — **39/39 passed**; `npx tsx scripts/generate-study-schemas.ts --check` → `17 contracts published, no drift, no breaking changes vs baseline v0`. - **Commit:** resolve via `git log --grep='YSD-2008'`, landed as `0ec646e9cf` (merge `822f3c900b`; generated schemas added to .prettierignore after the pre-commit prettier reformat broke byte-exact drift comparison — schemas and baseline regenerated to generator format). ## YSD-2009 + YSD-2010 — Property round-trips + compatibility policy (2026-07-18) - **Status:** complete (both items verified against their full text) - **Artifacts:** - `libs/contracts/src/study/compat.ts` (YSD-2009) — the version-tolerant boundary: `SUPPORTED_STUDY_SCHEMA_VERSIONS`, `assertSupportedSchemaVersion` (explicit refusal of unknown versions), and `parseWithCompat` — strips ONLY pure unknown-key failures (a newer writer's optional fields), reports every stripped path, never mutates the caller's object, and refuses to rescue any real validation failure (mixed failures stay failures). - `libs/contracts/src/study/roundtrip.property.spec.ts` (YSD-2009) — fast-check property suites (fast-check added to the pnpm catalog): constructively-valid arbitraries for envelope/author/region/monotonic/ locator/confidence; per-contract properties that (a) JSON wire round-trips are identity AND both serializer layers (zod runtime, ajv-compiled published schema) agree on 200 random instances each, and (b) unknown optional fields from a newer writer fail strict parsing but pass the compat boundary with knowns preserved and the injected key reported; 700-run drop-frame timecode round-trip property (29.97/59.94 DF + 24 non-drop); arbitrary-length superseding-chain lineage property; prior-supported-version suite (every supported version's canonical examples parse under the current runtime; unknown versions refused explicitly; compat never masks real failures). - `docs/proposals/yemaya-study-workspace/compatibility-policy.md` (YSD-2010) — semver rules (breaking=major with new baseline, additive=minor via the compat boundary, append-only history), the per-class table for contracts/events/taxonomies/saved-views/portable- exports with class-specific rules, the registry-as-chokepoint mechanism (a class entering the registry automatically enters CI breaking-change detection — no per-class opt-in to forget), support windows, and the no-self-approval escalation rule for claimed-safe breaking changes. Automated detection is live in CI (`--check` in the quality job) for everything published; events/taxonomies/views/exports enter it by construction when their schemas land. - **Test command:** `npx vitest run src/study` (libs/contracts) — **56/56 passed** (17 new). - **Commit:** resolve via `git log --grep='YSD-2009'`, landed as `500ec3a395`. ## YSD-2020–YSD-2023 — StudyProject, StudyQuestion, SourceWork, SourceEdition (2026-07-18) - **Status:** complete (four items, each verified against its enumerated field list) - **Artifacts (in `libs/contracts/src/study/entities/`):** - `study-project.ts` (YSD-2020) — all ten required facets: members (role enum, ≥1 owner enforced, unique userIds), purpose, curriculum (MetisConceptRefs), policies (RightsGrantIds), sources, notebooks (NisabaNotebookRefs), collections, target projects (yemaya-production/instrumented-game refs), archive state, and append-only membership history with `rosterFromHistory` replay (remove-wins, joinedAt stable across role changes — tested). - `study-question.ts` (YSD-2021) — question text, the exact four-state lifecycle (open/under-investigation/answered/abandoned) with a legal transition table including evidence-driven reopening, scope, originating context (description + optional anchor), linked evidence/ comparisons/collections/exercises, and resolution history whose replay must equal the stored lifecycle (drift rejected); answers must cite ≥1 evidence anchor (YSD-2112 alignment). - `source-work.ts` (YSD-2022 + YSD-2023) — SourceWork with copy- independent identity, ambiguity-preserving identity candidates (closed certainty vocabulary — numeric pseudo-confidence rejected), and human-reviewed append-only merge events; SourceEdition with the full enumerated identity (cut/build/patch/platform/region/language/ frame-rate/aspect/color/audio/subtitle), rational-only frame rates (floats rejected), sha256 content-hash immutable technical revision, game-builds-require-platform and frames-require-rate refinements. - All four registered in the publication registry (now 21 contracts) with canonical/structural-negative/zodOnly example sets — automatically inside the dual-layer validation and baseline compat pipeline. - **Test command:** `npx vitest run src/study` (libs/contracts) — **66/66 passed** (10 entity tests + expanded publication coverage); tsc clean. - **Commit:** resolve via `git log --grep='YSD-2020'`, landed as `5498a37c73`. ## YSD-2024–YSD-2027 — Alignment, SourceAsset, RightsGrant, MediaTrack (2026-07-18) - **Status:** complete (four items, each verified against its enumerated field list) - **Artifacts (in `libs/contracts/src/study/entities/`):** - `alignment.ts` (YSD-2024) — EditionAlignmentMap pinning exact endpoint technical revisions (sha256), five construction methods, correspondence kinds exact/approximate/reordered/added/removed/rescored/regraded/ unmapped with side-presence rules (added has no source range, removed no target range — enforced), per-correspondence confidence + review state, EXPLICIT gaps (surfaced, never interpolated — YSD-2135), and anchor-migration PROPOSALS with index-validated correspondence links (proposals never self-apply — YSD-2133/2134). - `source-asset.ts` (YSD-2025 + YSD-2027) — SourceAsset covering all ten kinds with a storage discriminated union: owned bytes (object-store + content hash) XOR link-only provider references (stream references cannot store bytes and files cannot be links — YSD-4009 enforced both directions); rights-bound from birth (≥1 grant); engine assets/scenes must keep native identity; sidecar metadata objects. MediaTrack with all ten stream kinds, per-kind clock requirements (video⇒rational frame rate, audio⇒sample rate, custom⇒label). - `rights-grant.ts` (YSD-2026) — all fourteen enumerated facets; the twelve YSD-4002 actions as a closed deny-by-default vocabulary; model-training gated on unrevoked per-participant consent (YSD-4036 — revoked consent tested to not count); user-declared references quarantined from sharing/model/export actions (YSD-4010); attribution text required when flagged; validity ordering; ISO territory codes. - **Test command:** `npx vitest run src/study` (libs/contracts) — **76/76 passed** (10 new); 25 contracts published; tsc clean. - **Commit:** resolve via `git log --grep='YSD-2024'`, landed as `d4ef0debfd`. ## YSD-2028–YSD-2032 — Segment, EvidenceAnchor, StudyEntity, Detection, Observation (2026-07-18) - **Status:** complete (five items, each verified against its enumerated field list) - **Artifacts (in `libs/contracts/src/study/entities/`):** - `anchor.ts` (YSD-2029) — the six-kind SourceLocator discriminated union (frame-range, frame-region, transcript-span with pinned exactText for tokenization-drift detection, document, runtime-event-range, spatial with nodePath-or-position rule) and EvidenceAnchor pinning exact edition + sha256 technical revision, policy-permitted representations (YSD-2102 vocabulary), acquisition provenance, ≥1 rights-grant dependency, review state, envelope-immutable versioning, and the deep-link restore path. - `segment-entity.ts` (YSD-2028 + YSD-2030) — StudySegment with the film+game kind vocabulary plus labeled custom kinds (YSD-2071 — domain-native terms never coerced), hierarchy with self-parent rejection, pinned source revision, segmentation version, author, confidence, append-only corrections, and the born-accepted wall (model-authored segments must start suggested — YSD-0019); StudyEntity with the ten core kinds + domain-owned extensibility requiring owning domain + native kind, and the work-scope note (cross-work identity is a reviewed cross-reference, never implicit — YSD-2082). - `epistemic.ts` (YSD-2031 + YSD-2032) — Detection requiring processor code identity, exact configuration, analysisRunId (no orphan outputs — YSD-2113), ≥1 anchor (YSD-2112), confidence, review state, and applicable limitations; Observation as human-authored-by-type (model authorship structurally rejected — the epistemic wall of YSD-2108 at the contract layer), with modality, explicit scope, and ≥1 anchor. - **Test command:** `npx vitest run src/study` (libs/contracts) — **84/84 passed** (8 new); 31 contracts published; tsc clean. - **Commit:** resolve via `git log --grep='YSD-2028'`, landed as `ff941438b2`. ## YSD-2033–YSD-2036 — InterpretationClaim, CraftHypothesis, TaxonomyTerm, ComparisonSet (2026-07-18) - **Status:** complete (four items, each verified against its enumerated field list) - **Artifacts (in `libs/contracts/src/study/entities/`):** - `claims.ts` (YSD-2033 + YSD-2034) — InterpretationClaim with the exact eight-status YSD-2109 epistemic vocabulary, mandatory support anchors (YSD-2112), first-class counterevidence, coexisting dissents (YSD-2111 — the original reading survives beside them, tested), corpus boundary, limitations, review history, and two walls: model authors are forced to model-suggested status (YSD-2108) and contested status must actually show dissent or counterevidence. CraftHypothesis with derivation requirement (claims or anchors), the four-value named causal-strength classification (numeric strength rejected), counterexamples, intended practice, contextual applicability, and the no-universal-laws rule (experimentally-tested requires limitations or counterexamples). - `taxonomy-comparison.ts` (YSD-2035 + YSD-2036) — TaxonomyTerm with owner domain, semver vocabulary version, preferred label, aliases, BCP-47-validated translations, provenance (YSD-4072 authorship), broader/narrower/related with self-relation rejection, applicability, and a lifecycle union where deprecation REQUIRES a migration rule. ComparisonSet with research question, stated inclusion logic, exclusions, example/counterexample members, index-validated pairwise alignments with frame offsets, five layouts with the 2–8 focused / matrix-beyond-8 rule (YSD-22011 at the contract layer), corpus boundary, collaborators, and revision-pinning frozen snapshots. - **Test command:** `npx vitest run src/study` (libs/contracts) — **95/95 passed** (11 new); 35 contracts published; tsc clean. - **Commit:** resolve via `git log --grep='YSD-2033'`, landed as `d94b08d387`. ## YSD-2037–YSD-2040 — Inspiration, CrossReference, CreativePrinciple (2026-07-18) - **Status:** complete (four items, each verified against its enumerated field list) - **Artifacts (in `libs/contracts/src/study/entities/`):** - `inspiration.ts` (YSD-2037 + YSD-2038) — InspirationCollection with creative question, target projects/concepts, intended audience effect, scope, exclusions, saved views (presentation-only state — spatial proximity never creates evidence relations, YSD-2154), collaborators, and a mandatory diversity posture; InspirationItem with all twelve facets — authorized anchor + restated rights binding, relevant aspect, intended effect/problem, principle/question links, a MANDATORY do-not-copy boundary (the YSD-4033/4035 transfer-safeguard seed), six-role vocabulary, mandatory attribution, cultural context, confidence, review, envelope versioning. - `cross-reference.ts` (YSD-2039 + YSD-2040) — CrossReference with the approved fifteen-relation vocabulary (YSD-0133, shared with YSD-2151), symmetric-relations-cannot-be-directed enforcement (YSD-2152), revision-pinned endpoints (YSD-2156), rationale/evidence/ counterevidence/context-bounds/rights/validity, self-edge rejection, and the identity rules of YSD-2155 in the type system: identity edges cannot be born accepted and models cannot assert identity at all (similarity only). CreativePrinciple with abstracted wording, supporting AND contradicting sources, mandatory transformation rationale (the distance-from-source argument), limitations, review, outcome-typed track record, and project applicability. - **Test command:** `npx vitest run src/study` (libs/contracts) — **106/106 passed** (11 new); 39 contracts published; tsc clean. - **Commit:** resolve via `git log --grep='YSD-2037'`, landed as `7966c5a747`. ## YSD-2041–YSD-2043 — OriginalConcept, CreativeDecision, OutcomeEvidence (2026-07-18) - **Status:** complete (three items, each verified against its enumerated field list) - **Artifacts (`libs/contracts/src/study/entities/creative.ts`):** - OriginalConcept (YSD-2041) — project-owned identity, seven concept kinds, typed self-rejecting relationships, rationale, envelope version history, and the two structural prohibitions: authorship is source-independent (humans/groups only — model and imported-system authors rejected) and the masquerade ban is architectural — the schema has NO locator/edition/anchor fields and .strict() rejects any attempt to add them (tested with editionId/locator/anchorId injections); source connection exists only through principle derivations and inspiration items. - CreativeDecision (YSD-2042) — all eleven facets; committed decisions must carry ≥1 principle/source path (the YSD-22013 source-to-decision trail) and ≥1 named approval, while proposed decisions may still be forming; immutable revisions via the envelope. - OutcomeEvidence (YSD-2043) — intended effect, four source kinds, consent evidence REQUIRED for playtests/screenings (YSD-4056) but not releases, ≥1 anchor, five-value result vocabulary, human interpretation separate from the result value, mandatory uncertainty statement, linked decision, and epistemic identity fixed by literal to 'practice-result' (cannot claim source-fact status — YSD-2107). - **Test command:** `npx vitest run src/study` (libs/contracts) — **115/115 passed** (9 new); 42 contracts published; tsc clean. - **Commit:** resolve via `git log --grep='YSD-2041'`, landed as `c47f8033ab`. ## YSD-2044–YSD-2048 — Notebook/StudyCard + learning-loop contracts (2026-07-18) - **Status:** complete (five items, each verified against its enumerated field list) - **Artifacts (in `libs/contracts/src/study/entities/`):** - `notebook.ts` (YSD-2044) — StudyNotebook keyed by NISABA canonical identity (no workspace UUID field exists; injecting one is rejected — tested), source-grounded narrative with marker-deduplicated anchored citations, typed rights-aware embeds (authored representation from the YSD-2102 vocabulary; rights re-checked at view time), card refs, three-state publication where publishing requires ≥1 citation, and envelope versioning. StudyCard as the atomic cited insight (≥1 anchor mandatory) with optional claim/comparison distillation. - `learning.ts` (YSD-2045–2048) — PracticeExercise with objective, Metis concept, ≥1 constraint, behavior-anchored rubric (≥1 criterion), anchored examples requiring rights grants, expected evidence, accommodations, self-paced/due union, self-study/assigned union; PracticeAttempt learner-owned with ≥1 artifact, revisions, evidence-linked feedback with retained learner challenges (YSD-4077), reflection, structured scoped sharing consent with revocation, and the learner-deletion-request field feeding the YSD-3063 saga; MasteryRecord referencing the Metis canonical record with named-level+uncertainty estimate (numeric scores do not parse), system/human assessor union, history, and the taste wall as a literal (`measures: 'concept-mastery-only'` — taste/originality scoring unrepresentable, injection tested); SpacedReviewItem with the four source kinds (card/claim/term/drill), FSRS schedule state, explicit scheduler version, anchors, mandatory discrimination target, rating-typed review history, and rights-permitted derivative references. - **Test command:** `npx vitest run src/study` (libs/contracts) — **126/126 passed** (11 new); 48 contracts published; tsc clean. - **Commit:** resolve via `git log --grep='YSD-2044'`, landed as `a6e34e44b0`. ## YSD-2049–YSD-2052 — Transfer, AnalysisRun, ReviewDecision, fixtures capstone (2026-07-18) - **Status:** complete — **Section 2.2 is now 33/33** - **Artifacts:** - `entities/transfer-run-review.ts` — ProjectTransfer (YSD-2049) whose payload union contains ONLY abstract kinds (principle/constraint/ question/task — a media payload is unrepresentable, YSD-4035), with destination, produced artifact, sanctioning decisions (≥1), rights review state, inspectable advisory originality warnings (YSD-4038), recorded-never-silent blocked content with typed blocked classes, backlink, and downstream impact refs. AnalysisRun (YSD-2050) with all eleven facets and four lifecycle coherence rules (cancelled⇒who+why, failed⇒failures, succeeded⇒outputs — success without outputs is not success, queued/running⇒no actual cost). ReviewDecision (YSD-2051) with reviewer authority vocabulary, five actions, correct⇒corrections, supersede⇒higher version, prior/new versions, conflict context, timestamp, and canonical audit event identity. - `fixtures.ts` + `scripts/generate-study-goldens.ts` + `fixtures-golden.spec.ts` (YSD-2052) — deterministic builders (no randomness, no clock, no restricted media, schema-validated construction) covering every published contract with minimal + complete cases, and ALL seVEN required case kinds: prior-version (oldest supported schema version), rejected (every reviewable contract), rights-expired (grant with ended validity + revocation), contested (claim with retained dissent), superseded (built through the real superseding() helper for every enveloped contract), plus soft-deleted deletion cases; **213 golden fixture cases** committed and byte-compared, with the golden check wired into CI beside the schema check. - **Test command:** `npx vitest run src/study` (libs/contracts) — **131/131 passed**; goldens `--check` green; 51 contracts published; tsc clean. - **Commit:** resolve via `git log --grep='YSD-2049'`, landed as `fe41f98ed4`. ## YSD-2070–YSD-2077 — Hierarchy + film/game anchors + sync contract (2026-07-18) - **Status:** complete (eight items, each verified against its enumerated vocabulary) - **Artifacts (in `libs/contracts/src/study/anchors/`):** - `hierarchy.ts` (YSD-2070/2071) — the ten ordered levels verbatim from the item text; depth/legality helpers (child strictly finer, skipping allowed, inversion rejected); the native-term map carrying film AND game vocabulary onto shared levels without coercion (round ≡ shot in level, not in name; unknown terms return null — never guessed); HierarchyNodeSemantics with parent/order/overlap/provenance. - `film.ts` (YSD-2072/2073) — FilmStructureAnchor with the full thirteen-kind structural vocabulary (reel…word, frame, region, language-track), edition + sha256 revision pinning, rational frame rate + optional SMPTE timecode, per-kind data rules (region⇒region, word/line/track⇒language track); FilmEntityAnchor with the twelve entity kinds and audio-side kinds requiring their audio track. - `game.ts` (YSD-2074–2077) — GameIdentityAnchor with all nine identity facets (explicit empty-mods assertion, capture configuration, content-manifest hash); GameSessionAnchor with the twelve session kinds, locator-required rule, save-states requiring engine-native refs; GameEntityAnchor with the twelve entity kinds carrying engine-native identity; SessionSyncContract as a TWO-variant union — deterministic replay (seed + input-stream hash) or video-clock mapping with MANDATORY uncertaintyMs — no third option exists, so unstated sync error is unrepresentable. - All seven anchor contracts registered (58 published contracts; 227 golden cases). - **Test command:** `npx vitest run src/study` (libs/contracts) — **142/142 passed** (11 new); tsc clean. - **Commit:** resolve via `git log --grep='YSD-2070'`, landed as `efd67632c2`. ## YSD-2078–YSD-2084 — Document/still/3D/level anchors + identity, canon, deep links (2026-07-18) - **Status:** complete — **Section 2.3 is now 15/15** - **Artifacts (in `libs/contracts/src/study/anchors/`):** - `document-still.ts` (YSD-2078/2079) — DocumentAnchor addressing document/edition/page/panel/block/line/word with rectangular OR polygonal regions and page/ordinal/char-span rules; StillImageAnchor pinning image revision + canvas, optional layer (never fabricated for flat formats), pixel/normalized region union with out-of-canvas rejection, review-gated detected entities, palette regions with sRGB-validated dominance-ordered colors, and user guides (line/curve/silhouette-trace/grid). - `three-d.ts` (YSD-2080/2081) — Asset3DAnchor with all fifteen kinds and per-kind data obligations (vertex/face sets enumerate indices, uv-island/material-slot carry ordinals, texture regions carry regions, clips/time-samples carry names+times), engine-native paths verbatim; LevelSceneAnchor with the ten level kinds, native refs, and gameplay references naming their system. - `identity-canon.ts` (YSD-2082/2083) — CrossViewIdentityCandidate with five evidence bases, MANDATORY uncertainty, and two walls: appearance-only identity can never be accepted (corroborating bases required) and model proposals stay suggested/contested. Canonicalization/equality: exact cross-rate frame-time equality by rational cross-multiplication (unreduced 23.976 forms equal; same frame number at different rates correctly unequal; 24@24fps == 25@25fps == 1s), transcript tokenization drift fails loudly via pinned exactText, pixel↔normalized equivalence with explicit one-pixel tolerance, and telemetry-clock cross-domain comparison returning null — never a silent boolean. - `deep-link.ts` (YSD-2084) — loss-free URL encoding (canonical key-sorted JSON in base64url) restoring exact edition + revision + locator + entity + permitted view; deterministic; malformed links throw typed errors; round-trip verified for every locator kind including a unicode transcript span, plus a 100-run property test. - **Test command:** `npx vitest run src/study` (libs/contracts) — **155/155 passed** (24 anchors tests); tsc clean. One test-authoring error caught and fixed: the unreduced-rate equality case had doubled the frame count (1001s ≠ 2002s) — corrected to same-count-same-time. - **Commit:** resolve via `git log --grep='YSD-2078'`, landed as `c95d73e57e`. ## YSD-2101/2103/2109–2113 — Epistemic integrity contracts + invariant suites (2026-07-18) - **Status:** complete (seven items). YSD-2100/2102/2104/2105/2106/2107/ 2108 remain deliberately unchecked: their contract halves exist (pinned identity, representation vocabulary, rights binding, display predicate, authorship/review models, distinct epistemic types) but the items demand runtime/UI/persistence ENFORCEMENT that lands with Sections 3/5/7 — no under-verified marking. - **Artifacts:** - `entities/compound-locator.ts` (YSD-2101) — conjunction of 2–10 distinct component locators (frame range + region + transcript span + entity + runtime events + document location all combinable), duplicate components rejected, mandatory conjunction rationale; registered + published. - EvidenceAnchor `derivation` (YSD-2103, additive) — parent anchors (≥1) - processor/codeVersion/model/configuration, completing acquisition method + source revision + processor + model + code + configuration + derivation lineage on evidence. - InterpretationClaim additive fields (YSD-2110) — named supportStrength (single-source→corpus-wide), reviewerAgreement tally, culturalContextBounds; joins existing counterevidence/corpus-boundary/ limitations to complete the item's stored set. - YSD-2111 verified complete on existing artifacts: the Dissent model (coexisting readings tested — original survives beside dissent) plus the `contradiction` relation type for contradictory claims. - `epistemic-invariants.spec.ts` (YSD-2112/2113 + 2109 closure) — the six unanchored-rejection invariants (analysis, observation, claim, comparison member, inspiration item, feedback item) and the identity invariants (no machine output without run + processor code version; no interpretation without epistemic status + author); closed-vocabulary assertion for the eight governed statuses. - **Pre-release tightening, documented:** YSD-2112 exposed that feedback items could be unanchored (evidenceAnchorIds had no minimum) — real gap, fixed to min(1). Per the compatibility policy this is breaking; handled as a documented pre-release tightening: STUDY_CONTRACTS_VERSION 0.1.0→0.2.0, 0.1.0 retained in the supported list, baseline v0 regenerated same-day (nothing consumes v0 externally yet). Recorded here rather than silently. - **Test command:** `npx vitest run src/study` (libs/contracts) — **168/168 passed** (13 new invariants); 59 published contracts; 229 golden cases; tsc clean. - **Commit:** resolve via `git log --grep='YSD-2101'`. ## 2026-07-18 — YSD-2132, YSD-2133, YSD-2134, YSD-2135, YSD-2137 (Section 2.5: alignment provenance + anchor migration) - **Scope:** the migration-logic half of Section 2.5. Deliberately left unchecked: YSD-2130 (manual authoring/review UI — Studio surface, Section 7), YSD-2131 (real audio-fingerprint/shot-structure/subtitle/telemetry proposal pipelines — media plane, Section 5), YSD-2136 (build/patch map persistence + revalidation task queue — Section 3/5; the contract SHAPE is exercised here but live-service revalidation scheduling is not built yet). - **Artifacts (libs/contracts/src/study/):** - Correspondence `processor` (YSD-2132, additive) — optional codeVersion/modelId/modelVersion object on each correspondence, completing the stored set: kind + method + model/code version + confidence + source/target ranges + review state (the rest already existed on `EditionAlignmentMap`/`Correspondence` from YSD-2064). - `entities/anchor-migration.ts` (YSD-2133/2134/2135) — pure deterministic logic. `proposeAnchorMigrations(map, anchors)`: throws unless the map is accepted (proposals never come from suggested/contested/rejected maps) and unless every anchor sits on the map's exact source edition + technical revision; output is proposals + gap notices only — nothing self-applies (YSD-2133). Anchors overlapping explicit gaps or removed/added/reordered/ rescored/regraded correspondences return `MigrationGapNotice` with a reason and are never interpolated (YSD-2135); only ACCEPTED exact/approximate correspondences that fully contain the anchor range map it, by exact offset arithmetic. `confirmAnchorMigration` requires a human/collaborative-group ACCEPTING ReviewEvent (model reviewers and non-accepting events throw), parses the result through `EvidenceAnchorSchema`, and returns `{ migrated, original }` — the original is untouched so rollback = drop the migrated anchor. - EvidenceAnchor `migratedFromAnchorId` (YSD-2134, additive) — both ends of the lineage persist: the migrated anchor names its origin; the original remains valid on its own edition. - `entities/anchor-migration.spec.ts` (YSD-2137) — the five named categories over a representative theatrical→director's-cut map (censor-cut removal, -500 offset shift, reorder, added material, plus a REJECTED overlapping correspondence) and a game build→patch telemetry-landmark map: accuracy (known-correct offset-mapped target frames, both offsets), false-correspondence (rejected correspondence covering the same frames is never chosen), gap-detection (censor cut, boundary straddle, reorder → gap notices with reasons, "not interpolated" asserted), anchor-migration (human confirmation → lineage both ends; model reviewer and contested events rejected), rollback (original returned untouched, `migratedFromAnchorId` absent on it). End-to-end re-verification against real media rides Section 5's pipelines. - **Test command:** `npx vitest run src/study` (libs/contracts) — **176/176 passed** (8 new); 61 schema artifacts regenerated + baseline v0 (additive only: optional `processor`, optional `migratedFromAnchorId`); 229 golden cases byte-stable; tsc clean. - **Commit:** resolve via `git log --grep='YSD-2133'`. ## 2026-07-18 — YSD-2150..YSD-2159 (Section 2.6: typed relationship graph contracts) - **Scope:** the full graph contract layer — vocabulary, per-relation semantics, presentation separation, permission model, query contracts with reference algorithms, and structural invariants. PostgreSQL-side enforcement and the Studio graph surface ride Sections 3/6/7 on these contracts. - **Artifacts (libs/contracts/src/study/):** - `GRAPH_NODE_KINDS` (YSD-2150) — 29 addressable node kinds: the 25 proposal kinds (corpus, work, edition/build, sequence, scene, encounter, shot, beat, frame, image, region, entity, material, palette, pose, motion, sound, transcript, runtime-event, document-passage, claim, principle, original-concept, creative-decision, production-artifact) plus the four workspace record kinds already addressable as endpoints (anchor, segment, comparison-set, inspiration-item). CrossReference endpoints now accept all of them (enum widening — additive). - YSD-2151 verified complete on the existing `RELATION_TYPES` — exactly the fifteen approved relations, asserted by count and name in tests. - `RELATION_SPECS` (YSD-2152) — one spec per relation: directionality (5 symmetric / 10 directed; `SYMMETRIC_RELATIONS` now DERIVED from the table so they cannot drift), forward + inverse plain-language labels, one-line description, endpoint kind constraints (support/contradiction/counterexample land on claim|principle; derived-principle on principle; informed-decision on creative-decision; avoidance originates from the creative plane; identity requires same-kind endpoints), transitivity policy (never-infer / path-display-only / ordering-composes — nothing ever materializes stored edges), and acyclicity. Parse-level enforcement added to CrossReferenceSchema (directed coherence + endpoint constraints) — zod-side rules on the pre-release 0.2.0 contract; JSON-schema layer is purely additive (endpoint enum widening + optional field), so the baseline compat check stays green by construction. - Correspondence `culturalBounds` — first-class optional cultural scope on edges (YSD-2153) so cultural claims are never smuggled into generic context text; the item's full stored set (rationale, author or suggesting model, time, confidence, review state, evidence, counterevidence, context bounds, cultural bounds, rights dependencies, validity, supersession) asserted present in one test. - `entities/graph.ts` (YSD-2154..2159) — - Presentation state (YSD-2154): CanvasPlacement/CanvasGroup/ SavedGraphView are .strict() with no relation fields — a placement literally cannot express a relationship; tests prove adjacent + co-grouped nodes produce no backlinks, no paths, and two singleton clusters. - YSD-2155: `identityMergeCandidates` returns ACCEPTED identity edges and nothing else — an accepted maximally-confident similarity edge is asserted to never be a merge candidate; suggested identity stays provisional (born-accepted ban and model-author ban already parse-level from YSD-2039). - YSD-2156: endpoint revisions pinned via refRevision (existing); `supersedeEdgeForEndpointChange` requires an accepting human/collaborative-group ReviewEvent, uses the envelope `superseding()` lineage, pins the new endpoint revision on the successor, keeps the old revision historical; stale revisions, non-accepting reviews, and model reviewers throw. - YSD-2157: `GraphPermissionEvaluator` applied to EVERY node, edge, and derived result in every function — an edge to a hidden node disappears entirely (no existence leakage); tests show hidden nodes break paths, vanish from neighborhoods, and zero out dependency-impact. - YSD-2158: backlinks (bidirectional, per-side plain-language labels), findPaths (bounded simple-path enumeration with hop directions), neighborhood (bounded BFS reporting `truncated` honestly), connectedClusters (union-find), dependencyImpact (forward closure over support/derived-principle/informed-decision/ transformation with edge paths + severed-edge list), GraphTraversalFilter on every function (relation/kind/review/ superseded filters), SavedGraphView (grouping + saved views), and GraphQueryRequest — a discriminated union whose bounds are schema-enforced (an unbounded neighborhood request does not parse). Both new schemas registered + published (63 artifacts, 233 golden cases). - YSD-2159: `checkGraphInvariants` over RAW stored records — broken endpoints, orphaned projections (placements + group members), permission leakage, cyclic derivation exactly where the relation spec says acyclic (mutual influence legal, derived-principle cycles flagged), invalid relation kinds, endpoint-constraint violations, and supersession continuity (latest-revision-superseded, unmarked-old-revision, and revision-chain-jump all detected). - **Test command:** `npx vitest run src/study` (libs/contracts) — **199/199 passed** (23 new in graph.spec.ts); tsc clean; adversarial stub scan clean on all three touched files. - **Commit:** resolve via `git log --grep='YSD-2152'`. ## 2026-07-18 — YSD-1004 (libs/yemaya/study-workspace: client-neutral core) - **Scope:** the workspace core library the proposal's platform plane composes: use cases, orchestration policies, normalized read models, and dependency interfaces. No HTTP/SQL/filesystem — the service composes these over real adapters; Section 3 persistence and Section 4's rights resolver implement the ports. - **Artifacts (libs/yemaya/study-workspace/):** - Registered Nx project `yemaya-study-workspace` with tags `scope:yemaya` + `plane:experience` (the architecture checker now discovers and validates it: "2 experience-plane project(s)"), path alias `@yemaya/study-workspace` in tsconfig.base.json, workspace dep on `@oshun/contracts`, lint/test/typecheck targets. - `ports.ts` — Clock, IdGenerator, StudyWorkspaceStore (get returns current revision or null, never a default), AuditSink (allows AND denials are audit events), typed UnknownRecordError. - `policies/rights-gate.ts` — deny-by-default evaluation over RightsGrant records: subject scoping (work-wide covers editions; edition/asset-scoped cover only themselves), supersession/deletion state, revocation, validity window, territory (ISO 3166 or WORLDWIDE), explicit action membership. Denials carry the specific per-grant reasons; the empty-reason denial IS the deny-by-default floor. - `policies/review-gate.ts` — applies a ReviewEvent to a stored record: subject-id match, revision pin match, from-state match, then the contract's legal-transition + acceptance-authority rules; produces the next revision via envelope `superseding()` — history append-only. - Use cases: `createStudyProject` (creator becomes owner; membership event trail starts at creation), `authorizePlayback` (rights-gated; both outcomes audited with reasons), `recordObservation` (referential integrity: anchors must exist and be active; epistemic wall enforced by contract), `reviewRecord` (one path for observations and claims; persists next revision + appends the immutable event), `planAnchorMigration`/`confirmPlannedMigration` (honest planning: off-revision anchors listed, never guessed; human-review confirmation via the YSD-2133..2135 contract logic). - Read models: `buildProjectOverview` (counts over current revisions, open reviews = suggested+contested, rights buckets active/expiring- within-30-days/expired/revoked vs a caller-supplied instant), `buildAnchorContext` (observations + supporting/counterevidence claims joined per anchor; per-ELEMENT visibility mirroring YSD-2157 — a hidden anchor yields null, not an empty shell). - **Test command:** `npx vitest run` (libs/yemaya/study-workspace) — **15/15 passed** against in-memory ports; tsc clean (lib + spec); eslint clean; architecture checker green; adversarial stub scan clean. - **Commit:** resolve via `git log --grep='YSD-1004'`. ## 2026-07-18 — YSD-1016, YSD-1017 (fixture factories verified; adversarial stub scan gated) - **YSD-1016 verified complete on existing artifacts** — `libs/contracts/src/study/fixtures.ts` (read in full this session): deterministic, schema-validated factories with zero randomness/clock and no restricted media (object keys and text stand in for bytes), covering every family the item names: sources (SourceWork), editions (SourceEdition), rights grants (RightsGrant + buildRightsExpiredGrant), tracks (MediaTrack), anchors (EvidenceAnchor + GameSessionAnchor), epistemic objects (Observation/Detection/InterpretationClaim + buildContestedClaim), graphs (CrossReference + SavedGraphView), attempts (PracticeAttempt), sessions (GameSessionAnchor + SessionSyncContract), and deletion cases (buildSoftDeletedFixture, plus buildSupersededFixture/buildRejectedFixture/buildPriorVersionFixture). Case builders exercised by fixtures-golden.spec.ts (5 tests) and the 233 golden cases. - **YSD-1017 implemented** — `tools/yemaya-study/check-stub-scan.mjs`: study-workspace-scoped adversarial scanner over the service, every `libs/yemaya/study-*` lib, every domain study adapter, and the study contracts. Six checks matching the item: placeholder-success comments, hard-coded fixture payloads in production paths (fixture builders outside contracts' own fixture/example modules), empty function/adapter bodies, ignored authorization (rights decision discarded at statement level), unimplemented destructive operations (empty delete/remove/ erase/purge/expire bodies), and silent catches (empty, or fabricating success without rethrow/log — real brace-matched catch-body analysis). Suppression uses the repo-wide end-of-line `stub:legitimate ` convention; fail-loud seams are documented non-findings. **Gate proven to fail:** a planted probe file tripped all six categories (7 findings, exit 1) and the scan returned green after removal — not a self-asserting gate. Wired into the CI lint job after check-architecture. - **Commit:** resolve via `git log --grep='YSD-1017'`. ## 2026-07-19 — YSD-1012, YSD-1014, YSD-1018 (env schemas complete; flags/kill switches; development docs) - **YSD-1014** — `libs/yemaya/study-workspace/src/policies/feature-flags.ts`: flags and kill switches across all eight governed axes — source class (the twelve Section 5.1 acquisition surfaces), analyzer (the six Section 5.4 signal families), provider (OPEN-keyed and default-DENY: a provider works only when `STUDY_FLAGS_ENABLE=provider:` names it), export type (Section 15 formats), game connector, graph suggestion mode, live session, and transfer destination (TargetProjectRef kinds). Precedence: PERMANENTLY DISABLED (the three prohibited surveillance analyzers mirrored from the architecture checker, plus `graph-suggestion:identity` per YSD-2155) > KILL (reported distinctly from a flag disable) > DISABLE > default. Unknown axes/keys deny loudly; enabling a permanently disabled key is a STARTUP ERROR naming the policy, not a silent ignore. 8 new lib tests. - **YSD-1012** — completed: the service env schema (`apps/yemaya/svc-study-workspace/src/config.ts`) already failed fast on missing production values and pretty-logs-in-production; it now also parses the three `STUDY_FLAGS_*` vars through the lib at startup, so unknown flag axes/keys, enable+kill/enable+disable on one key, and permanently-disabled enables all abort boot with the full issue list (2 new service tests; 17/17 pass). Client half verified honestly: the studio study route reads NO env settings today (grep-verified — no `process.env`/`NEXT_PUBLIC` in the study page/component), so every setting that exists is schema-validated; new client settings must extend this pattern when Section 7 lands. - **YSD-1018** — `docs/proposals/yemaya-study-workspace/DEVELOPMENT.md`: local setup (compose + pnpm + serve, flag env syntax), seed loading via the deterministic source-safe fixture factories (no restricted media by contract), targeted verification (per-project vitest/tsc + the seven CI checkers + drift checks), troubleshooting (worktree Nx bypass, SKIP_TYPECHECK escape, drift regeneration, stub-scan suppression, boot-refusal semantics), and cleanup (compose down, PID/port hygiene). Every command exists today. - **Commit:** resolve via `git log --grep='YSD-1014'`. ## 2026-07-19 — YSD-1008, YSD-1015 (registration verified; supported baselines defined) - **YSD-1008 verified complete on existing artifacts** — all eight named components exist and are enforced for the three study projects (libs/contracts study slice, apps/yemaya/svc-study-workspace, libs/yemaya/study-workspace): project.json registrations with Nx lint/test/typecheck (+build/serve for the service) targets; package manifests with workspace/catalog deps; per-project tsconfig trees; path aliases (`@yemaya/study-workspace`, `@oshun/contracts/study` package export); tags `scope:yemaya` + `plane:experience` (validated by check-architecture.mjs); ownership metadata (.github/CODEOWNERS lines 103–104: libs/yemaya + apps/yemaya → @GreyChimp; domains.json yemaya entry); dependency constraints (eslint.config.js plane:experience onlyDependOnLibsWithTags + type:study-adapter no-cross-adapter rules, read in place this session). - **YSD-1015** — `docs/proposals/yemaya-study-workspace/supported-baselines.md`: tiered desktop/OS, browser (grounded in the existing Playwright device matrix: Desktop Chrome + Pixel 7 primary, Firefox/WebKit secondary smoke), hardware (4-core/8GB no-GPU CI profile; GPU work stays a fail-loud RunPod seam — the sandbox has no GPU), media-decoder (H.264/VP9 primary, HEVC capability-detected; lossy re-encodes of watermarked evidence prohibited in fixtures), assistive-technology (keyboard-only + ARIA snapshots as primary CI gates per YSD-1037, VoiceOver manual at release, zoom/reduced-motion/ forced-colors rules), locale (en primary, RTL pseudo-locale smoke, ICU-only formatting), and network (throttled + offline-transition profiles wired to the resumable-upload and offline-queue test items). Explicit rule: unlisted environments are UNSUPPORTED-UNTESTED and support claims for them are forbidden until they join the matrix. - **Commit:** resolve via `git log --grep='YSD-1015'`. ## 2026-07-19 — YSD-1007 (Aja study adapter: honest wrap, no fabrication laundering) - **Scope:** `libs/aja/study-adapter` (tags `scope:aja` + `type:study-adapter`; the architecture checker now discovers and validates it: "1 study adapter(s) scanned"; the stub scan now covers it as a fourth root). YSD-1006 (adapter packages across owners, plural) stays open — this is the first adapter and the pattern. - **The point of this adapter:** apps/aja/svc-reference-video's FFprobe metadata, scene detection, and remote ingest paths are SIMULATED (verified by reading the source; the capability table cites file:line for each), and its default in-memory search path fabricates quality scores. Per YSD-1007 the adapter does not fork the source and does not fabricate product-ready behavior over those paths: simulated capabilities return typed refusals with status `unavailable-simulated-backing`, the reason, and the source evidence — they never invoke the backing code. - **Artifacts:** `capabilities.ts` (evidence-backed truth table + `unsupported()` typed-refusal builder), `adapter.ts` (`createAjaStudyAdapter`: capability discovery reflecting runtime injection state; `searchReferenceClips` is dependency-inverted — the composing application injects a `ReferenceClipSearchBacking` wired to real Qdrant/Meilisearch indexes, hits pass through with domain-native videoIds untouched and matchKind surfaced; absent injection the adapter REFUSES with `requires-backing-config` rather than falling back to the fabricating in-memory path). Path alias `@aja/study-adapter`. - **Deliberately not marked:** YSD-0163 (conformance round-trips — needs anchors flowing through adapters), YSD-0164 (cross-domain architecture tests), YSD-1006 (adapters across all accountable owners). - **Test command:** `npx vitest run` (libs/aja/study-adapter) — **5/5 passed**; tsc clean (lib + spec); architecture checker + stub scan green with the adapter included. - **Commit:** resolve via `git log --grep='YSD-1007'`. ## 2026-07-19 — YSD-1011, YSD-1013 (dev composition verified; secrets separation) - **YSD-1011 verified complete on existing artifacts** — read `docker/docker-compose.dev.yml` in place: every named component exists with safe test defaults — PostgreSQL (pgvector/pg16 with the `yemaya` database in POSTGRES_MULTIPLE_DATABASES, plus pgbouncer), object storage (MinIO + bucket bootstrap), jobs/events (Redis core + Kafka/Zookeeper under the `streaming` profile), search projection (Elasticsearch under `search`), vector projection (Qdrant under `vectors`), graph projection (Neo4j 5 under `graph`), observability (Prometheus/Grafana/Jaeger under `observability`), plus Mailpit and admin `tools`. Credentials are worthless dev-only values (oshun/oshun_dev, minioadmin) bound locally. Docker 29.5.3 confirmed runnable on-box (Section 3 integration tests can use it). DEVELOPMENT.md already documents usage. - **YSD-1013** — `docs/proposals/yemaya-study-workspace/secrets-separation.md`: the six categories (operational secrets, source credentials, signing keys, provider tokens, model credentials, user-export data) mapped to distinct stores with distinct grants (Secrets Manager path prefixes per category, KMS-held signing keys that sign rather than being fetched, a dedicated exports namespace whose encryption key is not an operational key), the load-bearing naming convention, and the worthless-dev-defaults rule. Code enforcement: `redactedConfigSummary()` in the service config — an explicit allowlist logged at startup where DATABASE_URL reduces to host:port/database; test proves credentials (user and password) never serialize into the summary and flags DO appear (operators see policy, not secrets). Service suite 18/18. - **Commit:** resolve via `git log --grep='YSD-1013'`. ## 2026-07-19 — YSD-3001..3005, YSD-3010 (PostgreSQL authoritative model, verified against a real instance) - **Migration** `apps/yemaya/svc-study-workspace/migrations/0001_study_authoritative_model.sql`: - **YSD-3001** — 21 revisioned record tables in a new `study` schema: all twenty named families (project, question, source work, edition, asset, rights, track, segment, anchor, entity, epistemic [observation+detection], comparison, inspiration, graph [cross_reference], learning [practice_attempt], transfer, analysis, review [review_event], outcome, audit [audit_event]) plus edition_alignment_map. Uniform envelope column block mirroring StudyRecordEnvelope + contract-validated `payload` + extracted hot-path columns (anchor edition/hash, grant subject, cross-reference endpoints both directions, alignment source/target). - **YSD-3002** — `native_id_map` (source_system, native_id, family → record_id): native identifiers mapped, never replaced; store methods - integration test. - **YSD-3003** — tenant_id NOT NULL + (tenant, project) index on every family; RLS enabled with a tenant-isolation policy per table (row-level authorization support; app roles get isolation, owner bypass documented); immutable revision keys (PK (id, revision) + immutability trigger allowing ONLY the supersession marker and legal deletion-state transitions; DELETE forbidden); soft-deleted / legal-hold / tombstoned states with a legal transition graph (legal-hold is reversible and blocks tombstoning — tested); `deletion_tombstone` table. - **YSD-3004** — envelope CHECKs (revision chain, supersedes = revision-1, superseded-by = revision+1); supersession uniqueness (partial unique index: one current revision per id); legal review transitions + model-acceptance ban as a trigger on append-only review_event; source-version identity (anchor edition_id + sha256-checked technical_revision_hash NOT NULL, plus a referential trigger refusing anchors onto editions with no current row). - **YSD-3005** — optimistic concurrency: superseding revision N marks the old row in the same transaction as inserting N+1 with `WHERE superseded_by_revision IS NULL`; losing the race raises ConcurrentEditError; accepted history is append-only by trigger. - **Runner** `src/persistence/migrate.ts` — per-file transactions, sha256 checksums, idempotent re-runs, refuses edited-after-apply (MigrationDriftError); rollback guidance in the migration header (additive schema; DROP SCHEMA study CASCADE backs it out). - **Store** `src/persistence/postgres-store.ts` — implements the lib's StudyWorkspaceStore port; every read parses through the contract schema (drifted rows fail loudly); PostgresAuditSink appends to the append-only audit table. - **YSD-3010** — `postgres-store.integration.spec.ts` ran against the REAL dev-compose PostgreSQL 16.14 (started this session): **13/13 passed** covering every named path — success (project/anchor/ observation round-trips), duplicate (PK violation), conflict + concurrent edit (second supersession from one revision → ConcurrentEditError, first edit wins), rollback (corrupted second write aborts the marker update atomically), rights change (grant supersession visible; exactly one current revision) and expiry (evaluateRights denies on the stored expired revision), deletion (tombstone flow removes from reads, leaves tombstone row) — plus trigger proofs (immutability, no-delete, illegal review transition, model acceptance, append-only audit, anchor→edition referential) and runner idempotence/drift. When the database is unreachable the suite SKIPS with the compose command printed — never a fake pass. - **Deliberately not marked:** YSD-3006 (repositories for EVERY aggregate — the port's aggregates are covered; question/segment/ entity/comparison/learning/transfer repositories come with their feature sections), YSD-3007 (pagination/bulk), YSD-3008 (rollback drills/seed/compat/zero-downtime verification), YSD-3009 (explain-plan tests). - **Test command:** `npx vitest run` (svc-study-workspace) — 31/31 (18 unit + 13 integration); tsc clean; stub scan clean. - **Commit:** resolve via `git log --grep='YSD-3001'`. ## 2026-07-19 — YSD-1006 (domain adapter packages under accountable owners) - **Nine new adapter packages** — `libs/{nisaba,sophia,hathor,euterpe,aglaea,bellona,metis,isis,neith}/study-adapter` — completing the YSD-0150 convention alongside the existing `libs/aja/study-adapter` (YSD-1007). Oshun and Iris are deliberately NOT adapters (YSD-0161/0162: consumed through platform libs). Each package: tags `[scope:, type:lib, type:study-adapter, layer:domain]` (the existing `plane:experience`/`type:study-adapter` eslint depConstraints from YSD-0121 bind them; adapters cannot import each other), CODEOWNERS covered by the per-domain `libs//` globs, path alias in tsconfig.base.json, workspace deps on the owner's real libraries. - **Shared seam** — `libs/contracts/src/study/adapter.ts` (new): the `StudyDomainAdapter` interface (domain, contractVersion, capabilities(), nativeRef()), `capabilityDescriptor()` (validated `.` keys against the YSD-2007 `CapabilityDescriptorSchema`), `unsupportedResponse()`/`unavailableResponse()` constructors, `buildNativeRef()` (verbatim native-identity wrapper over `DomainNativeObjectRefSchema` with an explicit no-mutation recheck), and `StudyCapabilityTableSchema` (unique-key truth-table validation). - **Every capability status is grounded in code read this session with file:line evidence embedded in the descriptor detail.** Wired = genuinely real domain logic; refusals are honest fail-loud seams: - **nisaba**: wired standoff annotation authoring (selector-union, standoff-annotations.ts:158/:234/:248), study-plan generation (study-plans.ts:211), passage comparison (TF-IDF cosine :2479, motif Jaccard :2492). Refusals: persistent-notebooks unavailable (Prisma models exist, apps/nisaba does not), media-study-selectors unsupported (YSD-0113: text-shaped selectors only). Deliberately did NOT wire buildNisabaCrossDomainBridge (tara/arete-specific, wrong fit). - **sophia**: wired citation keys (provenance.ts:57) and dependency-inverted transcript anchoring (VideoTranscriptAdapter needs an injected VideoTranscriber :52 — capability upgrades to supported only when injected; refuses otherwise). Refusals: semantic-retrieval, evidence-persistence unavailable; creative-quality-ranking unsupported (must-not). - **hathor**: wired pacing analysis (narrative/manager.ts:491) and editing rhythm (cinematography/manager.ts:946) — both genuinely computed. HONEST FINDING: DefaultColorTheory.generatePalette returns PRESET palettes not computed from the base color (manager.ts:599-660) → color-palette-theory unavailable rather than dressed up as supported; mda-lens-outputs unavailable (in-memory design CRUD, not anchor-bound lens outputs). - **euterpe**: wired pitch-class-set analysis (set-theory.ts:242/:302/:688), loudness (mix-analysis.ts:89/:102/:807 meterLoudness K-weighting), voice pitch (voice-analysis.ts:568). Refusals: hosted-analysis-service unavailable (no service exists — apps/euterpe has only studio-web); speaker-identification unsupported (YSD-4052 policy). - **aglaea**: wired fabric knowledge + comfort scoring (performance-database.ts:16, comfort-scorer.ts:220), era analysis (decade-database.ts:15, era-analyzer.ts:860/:1024), regional dress profiles (regional-codes.ts:22). Refusals: fabric-id-from-image unavailable (classifier takes structured text, not pixels); body-shape-inference unsupported (must-not). - **bellona**: wired replay-bundle integrity (replay-bundle.ts:292 sha256 binding manifest+header) and strict session-manifest validation (session.ts:312; invalid input → typed rejection with zod issues, proven by the creator-not-a-participant test). Refusals: evidence-signing (signers real, no key), live-engine-bridge (retryable — needs a connected engine), gameplay-state-capture (MemorySaveStorage only, save/index.ts:85). - **metis**: wired FSRS-5 scheduling (fsrs.ts:124; test proves interval==stability at r=0.9 and S0/D0 against the published weights) and BKT mastery (knowledge-tracker.ts:114; test asserts the hand-derived 0.1→0.4→0.775 posterior chain → 'proficient'). Refusals: concept-similarity (needs GraphStore+EmbeddingProvider), gradebook-emission (needs LMS creds), curriculum-service (FastAPI deploy); taste-originality-scoring unsupported (YSD-2047). - **isis**: wired job-envelope minting (job-envelope.ts:731, idempotency key = jobId) and pure region-aware routing (router.ts:47 planIsisRoute — "Pure data + pure functions. No IO."; test proves tenant-pinned region wins and unhealthy endpoints are skipped). Added the additive `./provider-endpoints` export subpath to @isis/ai-providers so the adapter avoids loading provider SDK modules. Refusals: inference-execution, output-provenance-registry unavailable; evidence-system-of-record unsupported (YSD-0160 must-not). - **neith**: ALL inspection refuses — the Rust is real (GLB importers.rs:410, OBJ :818, USDA :548, ASCII-FBX :592; scene graph node.rs:147) but no napi-rs/WASM bindings exist (grep empty; package.json wraps cargo only), so the adapter refuses rather than reimplementing geometry in Yemaya (YSD-0165) or faking results. binary-fbx-import is unsupported (also unimplemented in Rust, importers.rs:597); the tests prove the convert-your-file vs wait-for-bindings distinction. - **Verification**: per-package `tsc --noEmit` (lib + spec configs) clean ×9; vitest 49/49 across the nine packages (6+6+5+6+7+5+5+5+4); contracts study suite 199/199; yemaya study-workspace 23/23; adversarial stub scan zero hits; eslint (incl. module-boundary depConstraints) clean. - **Note for YSD-0163**: the aja adapter still publishes its bespoke descriptor shape from YSD-1007; harmonizing it onto the shared CapabilityDescriptorSchema is planned as part of the conformance kit. - **Commit:** resolve via `git log --grep='YSD-1006'`. ## 2026-07-19 — YSD-0163 (adapter conformance: native IDs and anchors survive round trips) - **Kit** `libs/contracts/src/study/adapter-conformance.ts` (exported from the study namespace): - `NATIVE_ID_BATTERY` — 12 adversarial native ids (uuid, cuid, colon-scoped, path-like, dotted, mixed-case, leading zeros, inner/trailing whitespace, unicode incl. CJK+emoji, single char, 512-char max) chosen so trimming, lowercasing, numeric coercion, or re-minting each break at least one entry. - `nativeRefRoundTripFindings(adapter)` — for every battery id: nativeRef preserves id/version byte-for-byte, pins the adapter's domain, keeps kind verbatim, survives JSON round trip re-parsed through the strict DomainNativeObjectRefSchema, and version-less refs must not fabricate a version. - `studyAdapterConformanceFindings(adapter, expectedDomain)` — identity + semver + YSD-2007 table validity + domain-prefixed keys + version agreement - discovery stability across calls + the native-ref battery. - `anchorLocatorRoundTripFindings(label, locator)` — SourceLocator serialize/revive must hold under the YSD-2083 canonical equality (sourceLocatorsEqual), not merely structurally. - `losslessJsonRoundTripFindings` — structural equality where a present- but-undefined key is significant (JSON dropping a field IS lossy; the naive stringify-compare version could not detect this and was replaced). - **Kit self-test** `adapter-conformance.spec.ts` — proves the kit CATCHES violations, not just passes conformant code: a deliberately lossy adapter (trim+lowercase) is flagged on the mixed-case/trailing-space entries; a wrong-domain adapter and an unstable capability table are flagged; all six SourceLocator kinds round-trip under canonical equality; undefined-drop is flagged. - **Aja harmonized onto the shared surface** (contract 1.0.0 → 1.1.0, additive): now implements StudyDomainAdapter — `domain`, `contractVersion`, `nativeRef`, and `capabilities()` mapping the bespoke evidence-rich table onto the shared YSD-2007 shape (available→supported, else unavailable; evidence folded into detail — a test proves it is never dropped). The original `describeCapabilities()` API is unchanged; added @oshun/contracts dependency. - **Ten per-package conformance specs** (`src/conformance.spec.ts` in every study-adapter): each runs the kit (zero findings) plus a domain round trip through REAL adapter methods: aja search hits keep `videoId` verbatim incl. trailing space/leading zeros/case; nisaba annotation ids, creator ids, and caller-chosen plan/objective ids untouched; sophia anchor ids embed the native video id verbatim and chunk provenance keeps source/revision ids; hathor rhythm results echo native shot ids; bellona session/participant ids survive strict validation and hashing does not mutate its input; metis BKT keys concepts by the exact caller string (near-identical ids stay independent: 0.775 vs 0.1); isis preserves jobId + idempotencyKey; euterpe analysis is deterministic and JSON-lossless; neith (all-refusals) still passes the full identity battery. - **Verification**: all ten adapter suites green — 76 tests total (8+9+8+7+8+ 9+8+7+7+5); contracts study suite 205/205; per-package tsc (lib+spec) clean; stub scan zero hits; eslint zero errors. - **Commit:** resolve via `git log --grep='YSD-0163'`. ## 2026-07-19 — YSD-0164 (architecture tests: cross-domain DB, copied taxonomies, model calls, store bypasses) - **Extended** `tools/yemaya-study/check-architecture.mjs` (the YSD-0121 checker) from four rules to seven, refactored around an exported pure rule engine `checkSource(rel, text, context)` so the rules are unit-testable rather than self-asserting: - **Rule 5 (unapproved model calls, YSD-0160):** flags (a) imports of any model-provider SDK (openai, @anthropic-ai/sdk, @google/generative-ai, ollama, elevenlabs, mistral, cohere, huggingface) anywhere in study code — including the isis adapter, which plans routes but never holds provider clients; (b) imports of @isis/ai-providers root or /providers\* client modules; the pure /provider-endpoints routing module is permitted ONLY inside libs/isis/study-adapter; (c) any study source naming a provider API host (api.anthropic.com etc.), tests included. - **Rule 6 (copied taxonomies, YSD-0014):** flags _declarations_ of twelve domain-owned taxonomy constants (FORTE_CATALOG, DECADE_PROFILES, ELEMENT_HISTORY, FABRIC_PERFORMANCE_DATABASE, REGIONAL_PROFILES, FSRS5_DEFAULT_WEIGHTS, DEFAULT_BKT_PARAMS, MASTERY_THRESHOLDS, ISIS_GENERATION_TYPES, ISIS_PROVIDER_KINDS, REMOTE_REPLAY_BUNDLE_COMPONENTS, AJA_STUDY_CAPABILITY_IDS) in any study root; imports remain legal, and aja's own capability list is allowed in aja's adapter. - **Rule 7 (canonical-store SQL bypasses):** scanning now includes `.sql` files; flags SQL-shaped references (`FROM|JOIN|INTO|UPDATE|TABLE .`) to any registered domain schema outside {study, public, pg_catalog, information_schema}, and `SET search_path` to any non-allowed schema. Precision guard: capability keys like 'sophia.semantic-retrieval' never follow an SQL keyword and do not trip. - Rules 1–4 (adapter-only cross-domain imports, cross-domain store packages, prohibited-inference analyzers, required tags) unchanged. - **New rule unit tests** `tools/yemaya-study/check-architecture.test.mjs` (node --test, 13 tests): one planted violation per rule proving it FIRES, plus the allowances (own-store adapter import, isis-only routing import, taxonomy import vs declaration, study-schema SQL, capability-key precision). Wired into ci.yml beside the checker. - **End-to-end negative test:** planted a file importing openai, declaring DECADE_PROFILES, and selecting from sophia.evidence_pack inside libs/yemaya/study-workspace → checker exited 1 with exactly 3 problems naming each rule; removal returned green (`2 experience-plane project(s), 10 study adapter(s) scanned`). - **Test commands:** `node --test tools/yemaya-study/check-architecture.test.mjs` (13/13), `node tools/yemaya-study/check-architecture.mjs` (pass, 12 projects). - **Commit:** resolve via `git log --grep='YSD-0164'`. ## 2026-07-19 — YSD-1009 (schema, API-client, event-contract generation + compat checks in CI) - **Schema generation** (pre-existing YSD-2008 machinery) extended: now also emits `schemas/study/events.manifest.json` (event kind → emitter + delivery channel, from the STUDY_EVENT_DELIVERY table). 67 artifacts published. - **Event contracts** — `libs/contracts/src/study/events.ts`: `StudyWorkspaceEventSchema` mirrors the IMPLEMENTED event reality exactly — the eight AuditSink kinds from ports.ts (project-created, observation/claim-recorded, playback-authorized/denied, record-reviewed, anchor-migration-planned/confirmed) with the columns the append-only study.audit_event table persists (kind, subjectId, actorUserId, detail, tenantId, occurredAt). Registered in STUDY_SCHEMA_REGISTRY with canonical + negative + zod-only examples, so it flows through publication, ajv double-validation, golden fixtures, and baseline breaking-change detection automatically. Deliberately no invented richer payloads: kinds arrive with the features that emit them. - **API client generation** — `libs/contracts/scripts/generate-study-client.ts` renders `src/study/client.generated.ts` from a new route manifest (`service-routes.ts`) that mirrors the routes the service ACTUALLY serves (health/ready/metrics with exact response shapes read from app.ts and readiness.ts; business routes join with YSD-1030 — listing them earlier would fabricate an API). The generated client is dependency-injected (fetch), validates every response through the manifest schemas, and returns typed contract-violation results instead of passing drifted bodies through. Health/Ready response schemas are registry-published too. - **Loop closed with a real E2E**: svc-study-workspace app.spec drives the GENERATED client against the real Hono app (client.health/ready/metrics via app.request) — proving manifest ≙ client ≙ service — plus a drifted-body test asserting `contract-violation` instead of pass-through. Service suite 33/33 (integration suite still green against real postgres). - **Compatibility checks**: STUDY_CONTRACTS_VERSION 0.2.0 → 0.3.0 (additive = minor per the YSD-2010 policy), '0.3.0' added to SUPPORTED_STUDY_SCHEMA_VERSIONS; schema check reports "65 contracts published, no drift, no breaking changes vs baseline v0"; goldens regenerated (239 cases stable). - **CI wiring**: `generate-study-client.ts --check` added beside the existing schema/golden checks in the ci.yml study block (which the YSD-0164 commit also gave `node --test check-architecture.test.mjs`). - **Verification**: contracts study suite 205/205; contracts + service tsc clean; svc suite 33/33; study-workspace 23/23; adapter spot-suite green; architecture + stub-scan + traceability checkers pass. - **Commit:** resolve via `git log --grep='YSD-1009'`. ## 2026-07-19 — YSD-1010 (targeted CI, PARTIAL — deliberately left unchecked) - **New workflow** `.github/workflows/study-workspace.yml` — path-filtered to study code (contracts/study, schemas/study, study generators, experience plane, service, all `libs/*/study-adapter`, tools/yemaya-study, studio/study web route). Four jobs, one per suite family that exists: - `contracts` — study contract suite + contracts tsc + the three generator --check gates (schemas/breaking-change, goldens, client drift). - `service-migrations` — real `postgres:16` service container; service tsc, then the full service suite with `STUDY_PG_REQUIRED=1` so the migration + authoritative-store integration suite MUST run (spec change: unreachable DB is now a hard failure when required — verified both ways locally: 13/13 against real postgres, and an explicit failure with a bogus URL, never a silent skip). Plus the experience-plane lib suite + tsc. - `adapter-conformance` — fail-fast:false matrix over all ten adapters: lib+spec typecheck and full suites incl. the YSD-0163 conformance specs. - `architecture` — YSD-0121/0164 checker, its planted-violation node --test rules, stub scan, traceability. - **Deliberately NOT marked complete:** the item also names deletion, accessibility, Playwright, security, evaluation, and performance suites — those suites do not exist yet (they arrive with YSD-1035..1039 and later sections), and a workflow step for a nonexistent suite would be a self-passing gate. The workflow header documents this; the item is marked only when every named suite family has a real job. - **Verification:** YAML parses (4 jobs); STUDY_PG_REQUIRED gate verified in both directions locally. - **Commit:** resolve via `git log --grep='YSD-1010'`. ## 2026-07-19 — YSD-1030..1039 walking skeleton, PROGRESS (items deliberately still unchecked) - **Stage A (library):** register-local-source, grant-rights, ingest-local-source, create-anchor, export-study-trail, delete-source use cases + `activeGrantFor` acquisition gate; extended StudyWorkspaceStore port (works/editions/assets/tracks/project lists); shared in-memory test harness (`src/testing/in-memory-deps.ts`, tests-only per YSD-1031); event kinds extended to 16 (contract + manifest regenerated). 32 lib tests. - **Stage B (service):** fail-closed HS256 bearer auth (`auth.ts` — 503 when unconfigured, 401 on bad/expired tokens, constant-time signature check), business routes under /api/study (project/register/grants/ingest/playback/ anchors/observations/trail/export/delete), inbox-sandboxed file resolution (realpath containment, symlink escapes refused), real adapters: streaming sha256 identifier, ffprobe prober (rational r_frame_rate — never floats), MinIO object store over @oshun/storage; postgres store extended to the full port; readiness gains an object-store probe; startup wires business routes ONLY when postgres + S3 + inbox are all real (else honest 503). - **End-to-end proof** `walking-skeleton.integration.spec.ts` — 9/9 against the REAL dev stack (postgres 16 + MinIO started this session): the film is synthesized in-test with ffmpeg (testsrc2 1280×720@24 + 440 Hz sine — rights-cleared because we own it; the YSD-1038 source), then over HTTP: 401s without/with-garbage tokens → project → register → **ingest DENIED before the rights decision (403 + reasons)** → grant (creator-owned, playback+export) → ingest (ffprobe facts verified: 24/1 rational fps, 120 frames, 16:9, sha256 identity, video+audio tracks) → playback presigned URL → **real bytes fetched from MinIO** → manual anchor (frame 24–72) + observation with no analyzer configured anywhere (YSD-1033/1039) → **trail intact through a fresh app instance over the same database (YSD-1034)** → export document downloaded and verified → delete: objectKey really gone (presigned URL now 404), 7 record families tombstoned, playback 403, trail empty (YSD-1035 across every surface that exists today). - **Remaining before ANY of YSD-1030..1039 is marked:** notebook step (Nisaba-owned persistence through the nisaba study-adapter), the /studio/study web UI consuming these routes, Playwright deep + a11y coverage (YSD-1036/1037), manual hierarchy correction surface (YSD-1033), and extending the YSD-1009 route manifest/generated client with the business routes. - **Test commands:** lib `npx vitest run` 32/32; svc `npx vitest run` 42/42 (20 app + 13 store-integration + 9 walking-skeleton E2E); tsc clean both; architecture + stub scans pass. - **Commit:** resolve via `git log --grep='ysd-1030'`. ## 2026-07-19 — Walking skeleton UI + Playwright; YSD-1031/1034/1038/1039 marked - **UI** `apps/oshun/web/src/components/studio/StudyWorkspaceApp.tsx` on /studio/study (launch surface updated honestly: study-projects and playback-annotation now available; four lens surfaces still explicitly "Not yet available"). Every rights denial renders its policy reasons (`data-study-denial-reasons`). A `data-study-ready` attribute appears only after hydration + first load so E2E fills never race hydration. - **Proxy** `apps/oshun/web/src/app/api/study/[...path]/route.ts`: verifies the REAL Oshun session (the /v1/auth/refresh exchange the session endpoint itself uses), mints a 300s HS256 study token, forwards to the service. Fail-closed 503 when STUDY_SERVICE_URL/STUDY_JWT_SECRET absent; 401 when the session is missing/invalid. Env reads via @oshun/config (ratchet). - **Shared token** moved to `@oshun/contracts/study/token`, rewritten on @noble/hashes after the repo lint rule flagged node:crypto (webpack noops it in client bundles — silent HMAC corruption); svc auth.ts delegates to it. Study contracts namespace converted to extensionless relative imports (repo norm) because Turbopack cannot resolve `.js`→`.ts` inside the transpiled package; added slim `@oshun/contracts/study/client` subpath so the browser bundle carries only the generated client + schemas. - **Playwright** `e2e/studio-study-walking-skeleton.spec.ts` — **2/2 against the REAL five-layer stack** (Chromium → Next web → real BFF auth via seedCustomerSession → /api/study proxy → svc-study-workspace → postgres + MinIO + nisaba DB, film ffmpeg-synthesized by `scripts/e2e-bootstrap.ts`): honest launch surface, axe scan clean (serious/critical = 0) before AND after the journey; create → register → **ingest denied pre-grant with reasons visible** → grant → ingest → real