Repository navigation
release(contract): publish immutable temporal-analysis contract for Orgmetra consumers #638
Description
Cross-repository release gap
Fresh Orgmetra protected-truth review found that ContextualWisdomLab/Orgmetra still documents tepp_adapter as orgmetra.tepp.v1 pinned directly to repository commit 40adac9a26a8af85147ffa2795fb548ea243e0e5.
Fresh TEPP authority is protected main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0, while the GitHub Release inventory is currently empty. The old commit pin is therefore neither current owner truth nor an immutable published consumer release under the CWL released-contract rule.
Orgmetra issue #431 owns the consumer-side integration correction. This issue owns the TEPP-side prerequisite: publish the smallest supported immutable contract needed by Orgmetra workforce_validation/longitudinal-analysis consumers rather than making Orgmetra depend on mutable main, a PR head, or copied TEPP source/schema.
Owner boundary
TEPP remains authoritative for its temporal/text/scientific analysis semantics and implementation. Orgmetra remains authoritative for HRIS/HCM employment truth, Workforce Validation study design/interpretation, purpose-bound authorization and downstream employment decisions.
A TEPP result/receipt is scientific evidence only. It must not become an employment-decision, validity/fairness or lifecycle authority merely because execution succeeded.
Required released projection
First inventory the existing TEPP public API/package surfaces and select the narrowest stable projection actually required by Orgmetra. Do not invent a second Orgmetra-specific implementation if an existing owner contract can be versioned and released.
The released contract must, where applicable to the chosen TEPP surface, bind:
- explicit contract/package/schema identity and semantic version;
- exact analysis method/model/configuration identity rather than a floating alias;
- input/evidence provenance coordinates sufficient for downstream reconstruction without copying HR person-level truth into the shared contract;
- time/window/cohort/multilevel or multiple-membership coordinates required to interpret the result correctly;
- exact output schema and scientific-result locator/digest;
- explicit failure/non-convergence/not-verifiable semantics rather than coercing absence/failure to a numeric result;
- algorithm/runtime/backend identity where result parity materially depends on CPU/GPU/backend behavior; and
- compatibility/deprecation/rollback semantics for consumers.
Keep raw HR person-level data, credentials, hidden provider state, unnecessary free text and Orgmetra application-table identifiers out of the shared projection unless a separately justified purpose-bound contract requires them.
TDD / scientific acceptance
Before release, add owner-side contract tests that prove at least:
- deterministic canonical serialization/versioning for the released projection;
- malformed, floating, unknown or incompatible method/config/schema coordinates fail closed;
- scientific failure/non-convergence/insufficient-evidence states cannot deserialize as successful estimates;
- time, grouping, multilevel/cross-classified/multiple-membership semantics required by the method are not silently discarded;
- no mutable branch/PR/source path is needed by a consumer to reconstruct the released evidence;
- CPU/GPU parity evidence is retained where the released method exposes multiple backends, with declared tolerances and no skipped-backend false GREEN; and
- consumer fixtures allow Orgmetra to reject a mismatched study/result coordinate and preserve
not_verifiable.
Synthetic data may prove mechanism and true-parameter recovery where scientifically appropriate, but any buyer/scientific claim that requires real data must use right-cleared evidence and preserve sampling/error denominators.
Release acceptance
Do not close at source merge. Publish an immutable GitHub/package release and record:
- exact protected-main source head;
- version/tag/artifact identity and digest;
- SBOM and provenance;
- reproducibility and compatibility evidence;
- deprecation/rollback semantics;
- exact-head test, statement/branch/rustdoc/docstring, security and scientific evidence required by the TEPP release gate; and
- zero unresolved valid owner findings under then-live governance.
After release, Orgmetra must pin that exact supported release through its ACL and run its own consumer-conformance tests. Until then, the old 40adac9... commit pin remains design/history evidence only, not production contract authority.
Refs ContextualWisdomLab/Orgmetra#431. No source copy, cross-service SQL, force-push, destructive rebase, self-approval, gate weakening or synthetic release evidence.
Activity
test(api): reject non-verifiable successful analysis results (#638)
test(api): align release validation-state RED with existing wire field (
fix(api): fail closed on non-validated success summaries (#638)
docs(changelog): record fail-closed release validation state (#638)
docs(contract): define temporal-analysis success/failure boundary (#638)
seonghobae commentedon Sep 21, 2026
Fresh owner review found a concrete release-contract ambiguity on protected
main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0:tepp_api::AnalysisResultSummary.validation_statusaccepts any non-empty string, so a wire payload withrun_state = succeededcan carryvalidation_status = "not_verifiable","non_converged", or another non-success value while still retaining a result artifact/digest. This violates #638 acceptance item 3 and must be fixed in TEPP, not reinterpreted in Orgmetra.Draft owner PR #639 now carries the bounded repair from the protected base:
59ce5c971990ecbfd89d4c95a7dbb0dfe06ddf31;4cdf663022560230653f24b8369e87ec5d0b6e84;efd4e9e613ad2bcad036d1a0d271ef3a5a0ec300, admitting only canonicalvalidatedin successful summaries whilenot_verifiable/non_converged/insufficient_evidenceremain artifact-free terminal failures;5f0e592dde9ba71fe9e11fd1c8e0d81701ccea26;faaac1ac6bed2a4f54c8d2e0c89473e60f06c218.#639 deliberately reuses the existing
AnalysisRun*contract instead of creating an Orgmetra-specific projection. It does not close #638: immutable package/tag/artifact identity, SBOM/provenance, reproducibility/compatibility, rollback, exact-head test/security/scientific evidence, and independent review are still required before Orgmetra #431 can pin a supported release. At creation the PR is Draft/open/mergeable; no hosted current-head workflow run had been admitted yet, so no GREEN is claimed.test(api): reject unknown provider success labels (#638)
seonghobae commentedon Sep 21, 2026
TRACEABILITY update: #639 advanced ordinary-forward to exact
ce9f948f426d3bb322d859fac8ef9ad8c995d0a4after extending the contract to reject an unknown non-empty provider label (provider_custom_success), proving the success-state rule is closed (validatedonly) rather than a denylist of known failures. Base remains protectedmain@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0, compare is ahead 6 / behind 0 with merge base equal to protected main. Current-head Rust Foundation35578670108, Security35578670198, CodeQL35578670267, Semgrep35578670260, and Documentation35578670435are admitted but queued; Rust Foundation jobs currently have no runner and no steps. No hosted GREEN or independent approval is claimed.test(api): prove request serialization is clock-independent (#638)
fix(api): separate request wire determinism from live cutoff admission (
docs(changelog): record clock-independent analysis request serializat…
docs(contract): separate replay serialization from live cutoff admiss…
seonghobae commentedon Sep 21, 2026
#639 has now advanced three #638 prerequisites without widening the consumer boundary.
AnalysisResultSummary.validation_status == "validated"; non-converged / insufficient-evidence / unverifiable outcomes stay artifact-free terminal failures.4a9fc85ca4b2f1a82fbd595013b13504f2b09059→ causal fixf0acd5d8b002c8512caf7c4300f680eb400efcc7separates canonical request serialization from live cutoff admission. A syntactically valid future cutoff can be serialized as immutable request evidence without consultingTimestamp::now(), while livefrom_jsonstill refuses the not-yet-available cutoff.4da3adb0a919a50ad57d93fdcaa780ff73c2ab20requires canonical UTC2026-08-01T00:00:00Zto remain valid while equivalent2026-08-01T09:00:00+09:00fails both serialization and live decoding. Causal fix5c6c059f5e934826167d98a5ba7c2435b4eb1e35parses throughKnowledgeCutoffand requires exact equality withKnowledgeCutoff::to_rfc3339().Current doctoring/exact head is
d52ce4f88527dacbf8275fee4faa02a62420f3fa; protected base remainsmain@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0, ahead 14 / behind 0. Current exact-head Rust Foundation35581623907, Semgrep35581623798, Security35581623913, CodeQL35581623903, and Documentation35581624361are non-terminal; all four Rust jobs have no assigned runner andsteps=[]. No current-head review exists, so no hosted GREEN or merge authority is claimed.Scope remains narrow. #638 is still open for full method/configuration and provenance coordinates; time/window/cohort; multilevel/cross-classified/multiple-membership structure; uncertainty/backend identity where material; consumer mismatch fixtures; exact-head scientific/security gates and independent review; protected merge; immutable package/tag/artifact digest; SBOM/provenance; reproducibility/compatibility; rollback/deprecation; and the actual TEPP release. Orgmetra #431 must continue to fail closed rather than consume this Draft head.
test(api): require canonical UTC cutoff identity in analysis requests (…
fix(api): canonicalize request cutoff byte identity (#638)
42 remaining items
seonghobae commentedon Sep 21, 2026
#646 owner-path follow-up on canonical #605: #645 count/min/max provenance was still non-unique, so a same-shaped cohort could reuse an owner-derived design classification without an exact support mismatch signal. Source RED
7a71fef17e5873669261a200b68e4e4012cdeca4requires order-insensitive but multiplicity-sensitive exact support identity and distinguishes same design/count/window with a different opaque member coordinate. Production lineage addssha2(4c27462e...), canonical owner digest76ac7441..., public digest-version export2f34c69e..., explicit version/topology fixtures35e55783.../477bea00..., changelogc7740c8f..., and reachable-topology canonicalization/current head539c5ee7b7f85e22dce4c6f7d2ba0a9222318925.tepp.membership_observation_support.v1hashes the sorted observation multiset and, for each(MemberId, EventTime), sorted active role/group plus exact binary64 weight bits with explicit framing. Reordering cannot change identity; duplicate observations remain multiplicity-sensitive; changing the opaque support or active group topology changes identity.Boundary remains strict: SHA-256 is identity binding, not reconstruction. #638/#639 still need a released, privacy-appropriate, interpretable observation-support/time/window/cohort projection and must verify it against this owner digest after #605 lands normally.
seonghobae commentedon Sep 21, 2026
Membership owner update from #605/#649, exact source head
e425c7034da3f505c8dff49fc19d3ffe80adf40d.#646's owner SHA-256 closed exact support/topology identity but was intentionally not reconstruction evidence. #649 now adds the missing Membership-owned reconstructable longitudinal support projection:
tepp.membership_observation_support_projection.v1carries projection-local member/group ordinals, canonical UTC event times, stable role names, exact binary64 membership-weight bits, declared design version/name, and the exact #646 source-support digest. RawMemberId/GroupIdUUID strings are not serialized; this is purpose-scoped privacy reduction, not anonymity.RED
ba3d8a674e88dedb73fd5b225a71d5446a88e659→ initial owner projectionb7d3dad74b64e3560627566312b3d806282eee0b→ hardening/export/fixture/changelog through55841295677be6905fb555c4e2cef259c4e891a6. Fresh review then found parsed bytes could relabel a nested topology as another valid design name. REDd8e70c2bbe62c69fd3873379ea7a2baf37510538→ canonical Membership design-signal reuse1716b2f31278a4a727f24160b4dd21ba42407797→ topology-bound parser fixb6adb39cc80a5c117874355e2248cd1a20beadfc→ current doctoring/coveragee425c7034da3f505c8dff49fc19d3ffe80adf40d.Consumer boundary remains strict: #639 must not copy this mutable source or reproduce ordinal/digest/design mapping. After #605 lands on protected main, #639 can bind the owner-issued support projection and add consumer mismatch fixtures. This closes the Membership-side reconstruction coordinates for observation-specific time, repeated-member/group linkage, role, topology, weights, design and support identity; Analysis still owns broader run/window/cohort semantics and must not infer HR/person truth from local ordinals.
Current-head gates are fresh but non-terminal: Rust Foundation
35642670231, Security35642670233, Semgrep35642670345, CodeQL35642670212, Documentation35642670208. No hosted GREEN or release authority is claimed.seonghobae commentedon Sep 21, 2026
Follow-up Membership owner coordinate gap #650 is now implemented on #605 exact
2eca15330e52e585ed4044fc152b88fac29ca2ec.#649's canonical support wire is intentionally sorted/privacy-reduced, so it could not by itself tell Analysis which of its own documents should be associated with which local member ordinal without consumer-side raw-ID sorting. RED
0355549c187043768e69c0d4a667b18e3a27e672captures that DDD leak.e2e8eb2668c18d2e65d47ef8f885ec37e6f6de78adds Membership-issued non-wire input coordinates(member_ordinal, EventTime)parallel to the admitted observation slice;ce4d068a1381debb6a8e9d8503e44a025dd76b45exports the contract;2eca153...doctoring is current.After #605 protected landing, #639 can zip its own document IDs with
input_coordinates()and serialize the owner support wire without reproducing UUID ordering. Duplicate observation coordinates remain duplicate; canonical support bytes remain input-order insensitive. This is still mutable owner source today, not release authority.seonghobae commentedon Sep 21, 2026
Membership owner hardening #651 is now source-complete on #605 exact
3177e98c40135368f81644bf5354baaf80216a46.Fresh review found
tepp.membership_observation_support_projection.v1could deserialize states canonicalMembershipNetworkcan never admit: duplicate simultaneous(role, group)edges with different valid weights, and same-role weights whose exact represented binary64 sum exceeds1.0(including1.0 + min_subnormal, which ordinary f64 accumulation can round back to unity). RED2774e1c327f971dcba370dfec28dc74b81f49c99→ shared owner-internal exact budget predicatefff822d40cd8ad28f6ed8aa3c17b63beafbcbf15→ parser repair8a73734d3f3f36dfa8f141bacea6c08171cca938→ doctoring3177e98c40135368f81644bf5354baaf80216a46.This keeps reconstruction inside the owner aggregate's reachable state space without duplicating numerical/share-budget semantics in Analysis. #639 must still wait for protected-main landing; no mutable source consumption is authorized.
seonghobae commentedon Sep 21, 2026
Membership owner handoff update from #605/#652: the current owner branch now distinguishes two evidence identities.
support_sha256remains the exact opaque-source support/topology fingerprint and is intentionally not recomputable after UUID redaction; newtepp.membership_observation_support_projection_digest.v1is recomputed from the complete privacy-reduced serialized projection, including the source digest, local member/group ordinals, canonical event times, roles and exact binary64 weights. RED028a0660eeea76c6ce0c16ecfd7b179accb99a9d→ causal repair4e5b64e663868d63a77d9dbed2baedd7cae27621→ export/coverage/changelog through #605 exact32871b52e801bd501d3ff1f4fee8cd12f17530b3.For #638 acceptance, Analysis should not reproduce either digest algorithm or treat the recomputable wire digest as authentication. After #605 lands/release authority exists, #639 should consume the owner projection, bind its own document IDs through
input_coordinates(), retain the canonical support wire, and add mismatch fixtures. Release provenance/signature remains separate from this deterministic content-binding contract.seonghobae commentedon Sep 21, 2026
Membership owner-path update from canonical #605: issue #653 found that
tepp.membership_observation_support_projection.v1could represent the same local(member_ordinal, EventTime)twice with different individually valid assignment topology. That state is impossible under deterministic canonicalMembershipNetworkresolution even though duplicate observation multiplicity itself is valid.#605 lineage: RED
0bee645841bc9bb5029e4d82ec0083663d291395→ causal parser repair8cd8a6db62c5ce75a56cd342302bb3c9466704e4→ CHANGELOG/current exact headef50885bc21e7e1247a22e4ce1e1c59d8efbd331. Repeated identical coordinates remain valid/multiplicity-sensitive; contradictory repeats fail closed.This is still mutable Draft owner work. #638/#639 must not copy the parser or consume this head. Wait for normal #605 protected-main landing, then bind the released/landed Membership projection and add consumer mismatch fixtures.
seonghobae commentedon Sep 21, 2026
Fresh #639 review found a separate deterministic-byte-identity defect in the digest-bound topic-lineage artifact:
Uuid::parse_straccepted alternate textual aliases for predecessor/successor document IDs even though the producer emits canonicalUuid::to_string()text. That allowed semantically identical document coordinates to mint different valid artifact bytes/SHA-256 identities.Owner lineage is now #654 RED
153d6f62ecd0d056ba5152626a43588517714095→ causal validation repaird87f7f5295e476f016352df2e8b07840c5b42c24→ CHANGELOG35c674e098d16c41720996e78579de0eb5ef547e→ release-contract doctoring/current #639 head3343f0ca7a9f62ef84338b496b3f9817dc0c09cd.The fix keeps UUID identity, edge topology, estimator arithmetic and schema v2 unchanged; it only requires stored predecessor/successor text to equal the lowercase hyphenated representation returned by
Uuid::to_string(). #639 is ahead 53 / behind 0 from protectedmain@a243f18d...; current exact-head workflows are non-terminal, so no hosted GREEN/release claim is made. Membership/time-window integration and the other #638 release gates remain open.seonghobae commentedon Sep 21, 2026
Fresh #639 owner update closes another deterministic configuration-identity defect required by this release contract. Issue #656 established that the zero-capable
relation_strengthandridgecontrols could serialize IEEE-754-0.0and0.0into distinct digest-bound method-configuration bytes even though both represent the same zero-strength scientific policy.Lineage is RED
16273447913c20c49e41e7f88324932314f41183→ causal wire repair86455d8e1ad4b45ea683a0e57ce6ea18a89c1794→ CHANGELOG57271e66ba078db5c274963e390133049a92832b→ release-contract doctoring/current #639 head38aac65c1c93e1a2da1c1761598b6ef0447e5d8d. The parser rejects sign-negative zero only at the retained v1 configuration serialization boundary; estimator arithmetic and positive numerical domains are unchanged.#655 also landed ordinary-forward on the same Draft branch before #656: RED
c160d0b987c0308b399dd4a9f5cee74bae3a09b6→ canonical edge-order repair9419edef834e9353b1fe0838367c5203d34155f8→ CHANGELOGa54288c99426a645022c4f85e69ed4925c70c82b→ contract doctoring8c1f7f477056365652e7038c2a4f1b2f28fd573c.#639 is now ahead 61 / behind 0 from protected
main@a243f18d…; its current exact-head workflows are fresh but non-terminal. This remains mutable Draft evidence, not release authority. Membership projection integration, mismatch fixtures, uncertainty quantities/parity, broader provenance, recovery evidence, exact-head GREEN + independent review, protected merge, and immutable package/tag/SBOM/provenance/reproducibility/rollback remain open before Orgmetra can pin TEPP.seonghobae commentedon Sep 21, 2026
Fresh #639 review found another deterministic release-identity defect at the outer artifact boundary:
TopicLineageArtifact::from_jsonaccepted byte-distinct JSON (for example trailing newline or pretty printing) even though the result SHA-256 is over compact owner serialization. #657 now owns that finding. Canonical #639 lineage is REDcf637dd9826a92ce361212f43ffe23f104ae9c09→ parser repair468b702b322e5ebdebab13b581fa7f4a72d7b806→ CHANGELOGb6772ab596c691aa2f068b2fcfd5600d2be261d6→ release-contract doctoringab7f3afeab7fe2251f69da82dfeaa8e76cd1904f→ rustfmt-only current head49f599c5b132a5d4a1a458645d61e068d12085d3. The parser now requires the supplied v2 bytes to equal owner canonical serialization exactly; it does not normalize aliases. This closes one #638 canonical-serialization prerequisite only. Membership projection, uncertainty quantities/parity, broader provenance, recovery/rolling-origin, compatibility/rollback, protected-head GREEN/review, and immutable release remain open.seonghobae commentedon Sep 21, 2026
New owner-bound provenance gap #658: topic-lineage execution currently accepts a detached
snapshot_idstring beside an already-builtReferenceTopicInput, so matching the request ID does not prove the estimator population came from that owner snapshot.ReferenceTopicInput::newchecks document membership in a suppliedCorpusSnapshotbut does not retain an owner-issued snapshot/content provenance coordinate. Do not patch this with a free digest. Correct order is Evidence #527 owner settlement/released consumer form as applicable → typed Analysis/Evidence ACL or provenance-bearing admitted input → mismatch RED (input from B while claiming A fails before fitting) + result identity drift on owner source evidence drift + cutoff-safe future exclusion → #639 projection binding. #658 is broader-provenance acceptance under #638, not estimator arithmetic.seonghobae commentedon Sep 21, 2026
Release-contract update from #639, with #660 fixture correction recorded explicitly. #659 has a valid source-level causal RED: duplicate deterministic seeds (
079cb2f51ee2f6c6bcd928bcb083ad2837b40d36) → parser repair5f3e0fc429d1ba9f1cb5199a4c512c598681c12a→ CHANGELOG97e95f8fb140c59858a3598dc2d8a99dadb435d8→ doctoringd19f4bf6f1c31a187ea2d12e6b105f59c54646e0. #660 independently verifies that wire seed0aliases seed1numerically because the CPU reference RNG starts fromseed.max(1); production repair6c9a86d5105c0137f9da48c8c7d6f9a9e836d03frejects zero at the unreleased wire boundary, followed by CHANGELOG9a638c9e...and doctoring7f3813f0.... The initial #660 fixturef1753a96...was confounded byselected_seed = 1against[0,11]and is not claimed as RED; corrected regressiond7989f9ce7ea2f3a2daa6300f5aa77dadea592a1binds selected seed zero. Distinct nonzero seed order is preserved; no normalization or estimator arithmetic change. #658 Evidence-owned source provenance and #605 Membership projection remain open prerequisites; no release authority is claimed.seonghobae commentedon Sep 22, 2026
#639 owner-path update: #661 closes one additional digest-bound artifact identity alias without changing estimator arithmetic. Causal source RED
f4237a790c93f0b2a6370729d61e83b44031fbd5provesobjective=+0.0and-0.0are numerically equal but byte-distinct; minimal Analysis validation repair82510f0a75f92623b2d49aaa743b5d5d39ccc639refuses only sign-negative zero. CHANGELOGc1effb2da5097a9317fb6115f00204608764164aand release-contract doctoring65a42cd2f834e3db0376b2f303484bed62432072are ordinary-forward on #639.This does not change #638’s remaining causal frontier: Evidence-owned source-provenance binding (#658/#527), Membership-owned reconstructable longitudinal support (#605), uncertainty quantities/backend parity, mismatch/recovery/rolling-origin evidence, compatibility/rollback, exact-head gates/review, and actual immutable release remain open. #639 stays Draft; no predecessor evidence or consumer activation is claimed.
seonghobae commentedon Sep 22, 2026
#662 now has a source-level runtime-causal RED on #639 exact
fd6e2f475c2b07dec2674eb91bd69e2fd33616fb. The positive fixture is an otherwise-validtepp.trsl_topic_lineage.v2payload with coordinate-bounddiagonal_laplace_uncertainty; current owner parsing rejects it only because v2 still has no quantity projection. The earlier compile-time prototypefb8e817e...is retained in history but is not the causal RED claim.The intended GREEN boundary is narrower than joint posterior work:
topic_measurementalready ownsReferenceTopicModel::document_coordinate_variances; Analysis should project those existing quantities only after obtaining read-only modeled document IDs fromReferenceTopicInput. Rows must be UUID-canonical, complete for every evidence document,K-1coordinates each, with coordinatej = topic j / reference topic K-1, finite strictly-positive variance, and digest binding. Callingbuild_joint_coordinate_precisionmerely to recover IDs would recompute a stronger uncertainty object and is explicitly out of scope.The negative malformed/reordered/detached fixtures are present but not individually claimed as predecessor REDs yet because unknown-field rejection masks them. Before #662 can close, the producer must use a real converged reference fit and a fit-A/artifact-B mismatch must demonstrate that changing the uncertainty projection changes the terminal result identity. #638 remains open through #658 provenance, #605 Membership reconstruction, backend parity/calibration/recovery, compatibility/rollback, exact-head GREEN/review, and immutable release.
seonghobae commentedon Sep 22, 2026
#639 has ordinary-forwarded #662 through current source head
ce919d0c1c4c25b4fa9e30b1ddc43dfed6244e94: fit-owneddocument_coordinate_variancesare now projected with canonical document UUIDs and explicit ALR numerator/reference coordinates, included in artifact hashing, with an actual converged-fit fixture and fit-A/fit-B terminal-result mismatch coverage. Exact-head hosted gates are still queued, so #662/#638 remain open.Fresh review then opened #663. The remaining v2 topic coordinates are still bare integer topic indexes: sequence-edge
topic_indexand uncertainty ALR indexes are not bound to an owner-derived fitted topic basis even though the numerical owner retainstopic_term_probabilities. #663 owns a deterministic topic-basis identity/mismatch contract; no LLM topic naming or post-hoc topic reordering is allowed. If basis identity needs immutable vocabulary/source coordinates, it stays dependent on #658 rather than minting a detached caller digest.seonghobae commentedon Sep 22, 2026
Fresh scientific gap from #662 review: #664 tracks the missing fitted ALR location beside released diagonal-Laplace variance. Source progress on #639 current head
c582997602daa1f9e05f6c8a3be248f50c8e9c82adds only the numerical-owner prerequisitetepp.fitted_document_coordinate_summary.v1: admitted document + explicit ALR numerator/reference + fitted location + existing positive diagonal variance, with actual-reference-fit positive coverage and malformed-state refusal. The v2 artifact wire is intentionally unchanged. Release-level projection remains dependent on #663 fitted-topic basis binding and #658/#527 source/vocabulary provenance; no joint covariance, calibration, or source authority is claimed.