Add IdeaOS portfolio graph domain and hydration seam

.github/governance/quality-thresholds.yaml

@@ -2,20 +2,20 @@
   "schema": "l9.quality-threshold-selection/v1",
   "profiles": {
     "pr_fast": {
-      "sdk_policy": ".github/governance/semgrep-policy.yaml"
+      "sdk_policy": "semgrep-policy.yaml"
     },
     "merge": {
-      "sdk_policy": ".github/governance/semgrep-policy.yaml"
+      "sdk_policy": "semgrep-policy.yaml"
     },
     "nightly": {
-      "sdk_policy": ".github/governance/semgrep-policy.yaml"
+      "sdk_policy": "semgrep-policy.yaml"
     },
     "release": {
-      "sdk_policy": ".github/governance/semgrep-policy.yaml"
+      "sdk_policy": "semgrep-policy.yaml"
     },
     "supply_chain": {
-      "sdk_policy": ".github/governance/semgrep-policy.yaml"
+      "sdk_policy": "semgrep-policy.yaml"
     }
   },
-  "note": "Core selects an SDK policy file but never evaluates finding thresholds itself. Point sdk_policy at a policy file the pinned SDK understands to raise/lower gates."
+  "note": "Core selects an SDK policy filename relative to governance-root but never evaluates finding thresholds itself. Point sdk_policy at a policy file the pinned SDK understands to raise/lower gates."
 }

.github/workflows/ci.yml

@@ -68,7 +68,7 @@
 
       - name: Install Validation Tools
         run: |
           python -m pip install --upgrade pip
           pip install pyyaml
 
       - name: Check Python Syntax
@@ -142,7 +142,7 @@
 
       - name: Install Linting Tools
         run: |
           python -m pip install --upgrade pip
           # requirements-ci.txt is the single source of truth for lint tool
           # versions (ruff/mypy) plus the runtime deps mypy needs to resolve
           # Pydantic models (pydantic, neo4j, structlog, ...).
@@ -203,7 +203,7 @@
 
       - name: Install Runtime + Dev Dependencies
         run: |
           python -m pip install --upgrade pip
           # Needed for the "language: system" local hooks (pytest-unit,
           # deprecated-import checks, etc.) which shell out to the ambient
           # `python3` rather than an isolated pre-commit-managed env.
@@ -280,7 +280,7 @@
 
       - name: Install Dependencies
         run: |
           python -m pip install --upgrade pip
           if [ -f "${{ env.REQUIREMENTS_FILE }}" ]; then
             pip install -r ${{ env.REQUIREMENTS_FILE }}
           else
@@ -339,7 +339,7 @@
 
       - name: Install Security Tools
         run: |
           python -m pip install --upgrade pip
           pip install pip-audit==2.9.0 safety bandit==1.9.1
 
       # gitleaks-action@v2 requires a paid org license (GITLEAKS_LICENSE).
@@ -465,7 +465,7 @@
           persist-credentials: false
 
       - name: Run OpenSSF Scorecard
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: scorecard.sarif
           results_format: sarif

.github/workflows/supply-chain.yml

@@ -64,7 +64,7 @@
           persist-credentials: false
 
       - name: Run OpenSSF Scorecard Analysis
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: scorecard.sarif
           results_format: sarif
@@ -181,7 +181,7 @@
 
       - name: Install Dependencies
         run: |
           python -m pip install --upgrade pip
           REQS="${{ vars.REQUIREMENTS_FILE || 'requirements.txt' }}"
           if [ -f "$REQS" ]; then
             pip install -r "$REQS"

docs/FEATURE_GATES.md

@@ -61,6 +61,7 @@ independently of the code default.
 | Tenant Auth (JWT allowed_tenants) | `TENANT_AUTH_ENABLED` | `True` | `True` | active |
 | Capability Auth (domain-spec model) | `CAPABILITY_AUTH_ENABLED` | `True` | `True` | active |
 | PostgreSQL Audit Pool | `POSTGRES_DSN` | unset (`None`) | set | active (opt-in, soft dependency — see §7) |
+| Idea Portfolio Graph | `IDEA_PORTFOLIO_ENABLED` (`idea_portfolio_enabled`) | `False` | unset | dormant; opt-in IdeaOS portfolio reads/hydration |
 | Constellation Orchestration | — | — | — | accepted architectural gap — see §9 |
 
 ---

domains/idea-portfolio/spec.yaml

@@ -0,0 +1,148 @@
+# --- L9_META ---
+# l9_schema: 1
+# origin: domain-specific
+# engine: graph
+# layer: [config]
+# tags: [domains, ideaos, portfolio, matching]
+# owner: domain-team
+# status: candidate
+# --- /L9_META ---
+---
+domain:
+  id: idea-portfolio
+  name: IdeaOS Portfolio Graph
+  description: Cross-idea portfolio intelligence. IdeaOS owns idea/lifecycle truth; CEG owns graph persistence, intersections, and ranking.
+  version: 0.1.0
+ontology:
+  nodes:
+    - label: Idea
+      managedby: sync
+      candidate: true
+      properties: [{name: idea_id, type: string, required: true}, {name: source_digest, type: string}, {name: projection_digest, type: string}, {name: graph_revision, type: string}, {name: lifecycle_stage, type: string}, {name: decision, type: enum, values: [GO, CONDITIONAL_GO, HOLD, NO_GO]}, {name: proof_state, type: string}, {name: execution_state, type: string}, {name: unknowns_json, type: string}, {name: self_dependency_facet_id, type: string}, {name: active, type: bool}, {name: hydrated_at, type: datetime}, {name: tombstoned_at, type: datetime}]
+    - label: IdeaQuery
+      managedby: api
+      queryentity: true
+      properties: [{name: idea_id, type: string}]
+    - label: PortfolioFacet
+      managedby: sync
+      auxiliary: true
+      properties: [{name: facet_id, type: string, required: true}, {name: kind, type: enum, values: [capability, substrate, proof_asset, data_asset, market, customer_type, dependency]}, {name: key, type: string, required: true}, {name: last_seen_revision, type: string}]
+    - label: IdeaPortfolioHydrationState
+      managedby: sync
+      auxiliary: true
+      properties: [{name: state_id, type: string, required: true}, {name: current_revision, type: string}, {name: source_snapshot_ref, type: string}, {name: source_snapshot_digest, type: string}, {name: batch_digest, type: string}, {name: completed_at, type: datetime}]
+  edges:
+    - &source_edge
+      type: PRODUCES
+      from: Idea
+      to: PortfolioFacet
+      direction: DIRECTED
+      category: capability
+      managedby: sync
+      properties: [{name: assertion_id, type: string, required: true}, {name: kind, type: string}, {name: evidence_state, type: string}, {name: source_refs_json, type: string}, {name: projection_digest, type: string}, {name: graph_revision, type: string}]
+    - <<: *source_edge
+      type: REQUIRES
+    - <<: *source_edge
+      type: TARGETS
+      category: market
+    - <<: *source_edge
+      type: USES
+    - <<: *source_edge
+      type: DEPENDS_ON
+      category: context
+matchentities:
+  candidate: [{label: Idea, matchdirection: portfolio_context_for_idea}]
+  queryentity: [{label: IdeaQuery, matchdirection: portfolio_context_for_idea}]
+queryschema:
+  matchdirections: [portfolio_context_for_idea]
+  fields:
+    - {name: idea_id, type: string, required: true}
+    - {name: requires_facets, type: string, default: ""}
+    - {name: requires_count, type: int, default: 0}
+    - {name: produces_facets, type: string, default: ""}
+    - {name: produces_count, type: int, default: 0}
+    - {name: uses_facets, type: string, default: ""}
+    - {name: uses_count, type: int, default: 0}
+    - {name: targets_facets, type: string, default: ""}
+    - {name: targets_count, type: int, default: 0}
+    - {name: depends_on_facets, type: string, default: ""}
+    - {name: self_dependency_facet_id, type: string, default: ""}
+traversal: {steps: []}
+gates:
+  - {name: active_only, type: boolean, candidateprop: active, nullbehavior: fail, matchdirections: [portfolio_context_for_idea]}
+  - {name: exclude_self, type: threshold, candidateprop: idea_id, queryparam: idea_id, operator: "!=", nullbehavior: fail, matchdirections: [portfolio_context_for_idea]}
+# VERIFIED and source-backed SUPPORTED_INFERENCE assertions can rank.
+# HYPOTHESIS/UNKNOWN remain graph context and cannot become rank evidence.
+scoring:
+  dimensions:
+    - name: incoming_requirement_fit
+      source: computed
+      computation: customcypher
+      expression: >-
+        CASE WHEN $requires_count <= 0 THEN 0.0 ELSE toFloat(size([(candidate)-[rel:PRODUCES]->(f:PortfolioFacet) WHERE rel.evidence_state IN ['VERIFIED', 'SUPPORTED_INFERENCE'] AND rel.source_refs_json <> '[]' AND $requires_facets CONTAINS ('|' + f.facet_id + '|') | f])) / toFloat($requires_count) END
+      weightkey: wincoming
+      defaultweight: 0.25
+      matchdirections: [portfolio_context_for_idea]
+    - name: outgoing_requirement_fit
+      source: computed
+      computation: customcypher
+      expression: >-
+        CASE WHEN $produces_count <= 0 THEN 0.0 ELSE toFloat(size([(candidate)-[rel:REQUIRES]->(f:PortfolioFacet) WHERE rel.evidence_state IN ['VERIFIED', 'SUPPORTED_INFERENCE'] AND rel.source_refs_json <> '[]' AND $produces_facets CONTAINS ('|' + f.facet_id + '|') | f])) / toFloat($produces_count) END
+      weightkey: woutgoing
+      defaultweight: 0.25
+      matchdirections: [portfolio_context_for_idea]
+    - name: shared_usage
+      source: computed
+      computation: customcypher
+      expression: >-
+        CASE WHEN $uses_count <= 0 THEN 0.0 ELSE toFloat(size([(candidate)-[rel:USES]->(f:PortfolioFacet) WHERE rel.evidence_state IN ['VERIFIED', 'SUPPORTED_INFERENCE'] AND rel.source_refs_json <> '[]' AND $uses_facets CONTAINS ('|' + f.facet_id + '|') | f])) / toFloat($uses_count) END
+      weightkey: wusage
+      defaultweight: 0.20
+      matchdirections: [portfolio_context_for_idea]
+    - name: shared_target
+      source: computed
+      computation: customcypher
+      expression: >-
+        CASE WHEN $targets_count <= 0 THEN 0.0 ELSE toFloat(size([(candidate)-[rel:TARGETS]->(f:PortfolioFacet) WHERE rel.evidence_state IN ['VERIFIED', 'SUPPORTED_INFERENCE'] AND rel.source_refs_json <> '[]' AND $targets_facets CONTAINS ('|' + f.facet_id + '|') | f])) / toFloat($targets_count) END
+      weightkey: wtarget
+      defaultweight: 0.15
+      matchdirections: [portfolio_context_for_idea]
+    - name: query_depends_on_candidate
+      source: computed
+      computation: customcypher
+      expression: >-
+        CASE WHEN candidate.self_dependency_facet_id IS NOT NULL AND $depends_on_facets CONTAINS ('|' + candidate.self_dependency_facet_id + '|') THEN 1.0 ELSE 0.0 END
+      weightkey: wquerydependency
+      defaultweight: 0.10
+      matchdirections: [portfolio_context_for_idea]
+    - name: candidate_depends_on_query
+      source: computed
+      computation: customcypher
+      expression: >-
+        CASE WHEN $self_dependency_facet_id = '' THEN 0.0 ELSE CASE WHEN size([(candidate)-[rel:DEPENDS_ON]->(f:PortfolioFacet) WHERE rel.evidence_state IN ['VERIFIED', 'SUPPORTED_INFERENCE'] AND rel.source_refs_json <> '[]' AND f.facet_id = $self_dependency_facet_id | f]) > 0 THEN 1.0 ELSE 0.0 END END
+      weightkey: wcandidatedependency
+      defaultweight: 0.05
+      matchdirections: [portfolio_context_for_idea]
+sync: {endpoints: []}
+gdsjobs: []
+compliance:
+  enabled: true
+  audit: {enabled: true, logallmatches: true, logretentiondays: 365}
+  pii: {enabled: false}
+  prohibitedfactors: {enabled: true, blockedfields: [], enforcement: compiletime}
+  regionalrules: []
+  counterfactualaudit: false
+capabilities:
+  - {name: portfolio_read, actions: [match:read], allowed_subjects: ["*"]}
+feedbackloop: {enabled: false}
+causal: {enabled: false}
+counterfactual: {enabled: false}
+semantic_registry: {enabled: false}
+decision_arbitration: {enabled: false}
+feature_catalog:
+  - {feature_id: incoming_requirement_fit, owner: ceg, scoring_dimension: incoming_requirement_fit, evidence_required: true}
+  - {feature_id: outgoing_requirement_fit, owner: ceg, scoring_dimension: outgoing_requirement_fit, evidence_required: true}
+  - {feature_id: shared_usage, owner: ceg, scoring_dimension: shared_usage, evidence_required: true}
+  - {feature_id: shared_target, owner: ceg, scoring_dimension: shared_target, evidence_required: true}
+  - {feature_id: query_depends_on_candidate, owner: ceg, scoring_dimension: query_depends_on_candidate, evidence_required: true}
+  - {feature_id: candidate_depends_on_query, owner: ceg, scoring_dimension: candidate_depends_on_query, evidence_required: true}