The service surface, stated

On-demand connector sync for { tenantId, connectorId }.

Deterministic findings, lineage on every row.

Keyed explanation from the recorded input set; withdrawn when inputs cannot be reproduced.

Authority graph ingest from the approval matrix of record.

Decision with rationale, alternatives, and finding snapshot; the ledger freezes what the screen said.

Measured outcome with verdict; misses stay on the record.

The per-domain decision vocabulary and its governance, so a caller proposes in the customer terms rather than inventing its own.

A draft addressed to an accountable person. Decides nothing, writes to no system of record, refused outright if the calling identity lacks the authority a person would need for the same act.

x-assetshop-timestamp within 300s; rejections: timestamp_required, stale_signature, invalid_signature.

Pooled fan-out, five workers, breaker isolation per connector.

The single tenant-checked read door; mismatched tenants reject, foreign ids are 404s by construction.

Sweeps a watched storage prefix and returns one disposition per object. Reads the bucket and writes nothing to it: the store interface behind this has two calls and neither is a write. Returns 503 with AT_CONNECTION when no bucket is bound, rather than an empty result that would read as no data.

The method vault door: an entitled tenant sends a method name and an evaluation and receives the full-tier result; the method body never travels, only the result does. Unknown methods 404 with the served set; a missing evaluation is a 400.