Module context_lineage 

One context decision lineage (strategy package 2026-10-14, doc 19).

The gateway already decides every context object once, in one place: the admission that emits ContextDecisionReceiptV1. This module adds what that record does not say, without changing it: the request the decision answered (who, through which route, from which sources, toward which destination), the state of each source candidate, a single outcome vocabulary, and the honest delivery state of the receipt. A ContextDecisionLineageV1 references the existing records by digest; it replaces none of them, so every V1 reader and digest stays as it is.

Three rules are enforced by validation, not by convention:

• only a SourceValidityV1::Valid candidate may be materialized: a stale, revoked, deleted, unavailable or unsupported source never becomes an allow, and nothing falls back from revoked to stale;
• ContextReceiptStateV1::ObservedModelEgress is claimed only for a route that observes model egress AND with at least one transport observation; a context-only route reports prepared or handed_off, never what the host may have sent afterwards;
• every outcome other than allow names a reason.

Structs

ContextDecisionLineageV1

Request → candidates → decisions → receipt, as one record over the existing ones (referenced by digest, never copied).

ContextRequestV1

What was asked: identity, purpose, sources in scope, route, destination. A caller-supplied tenant or user string is not an identity; the principal is the one the gateway authenticated or unknown.

ObjectOutcomeV1

The decision about one object, in the doc 19 vocabulary.

SourceCandidateV1

Enums

AclCheckV1

How the candidate’s right to be read was established.

ContextDecisionOutcomeV1

The five outcomes of doc 19. Projection of ContextDispositionV1; a source that could not be decided at all is unavailable.

ContextReceiptStateV1

How far a delivery is known to have gone.

IntegrationRouteV1

The consumer path a request came through, and what that path can observe.

SourceValidityV1

State of a source candidate at decision time. Exactly one of these, from the source’s own re-check; only valid may be materialized.

Constants

CONTEXT_LINEAGE_SCHEMA_VERSION

MAX_LINEAGE_CANDIDATES

MAX_LINEAGE_OBSERVATIONS

MAX_LINEAGE_OUTCOMES