Module binding 

Binding format v1 — the additive format foundation for the projection promotion (bundle plan 03-projection-promotion, decisions D1/D5/D6).

This is the live binding shape: crate::pipeline_store::load_pipeline_configs reads it (version-gated), the projection CLI tree writes it, and the resolve / brief / status / advance paths consume it. The legacy four-primitive Projection + flat-ingest store is parsed only by the migrate/legacy path (via [crate::pipeline_store::LegacyIngest]); the retired Ingest / IngestMode machinery is gone.

Three things live here:

1. BindingV1 — the versioned binding record (D1): one file per source→mem obligation, collapsing the projection + ingest split into a single record with an operations { build, sync, verify } block.
2. hash_binding — hash(D) (D5): the lowercase-hex SHA-256 of the canonical JSON of a binding’s content-defining resolved projection. Scheduling knobs (trigger / batch_size / post_actions) are excluded by construction; a facet selection pattern or a medium pointer changing — inputs outside the binding file — changes the hash.
3. medium_capabilities + validate_binding — the medium-capability matrix (D6) and the validation entry point that generalizes the render-time preparation refusal to binding-validation time.

The findings-store key + record (plan 03’s schema stub, once here) now live as the real, IO-backed store in crate::ingest::findings (group A of plan 05): crate::ingest::findings::FindingKey keys it, hash(D) still partitions its keyspace so a declaration edit invalidates prior findings.

Structs

BindingV1

A binding, format version 1 (D1). One versioned record per source→mem obligation: the projection declaration (intent, source_facets, reference_mems, destination_mem, deny_paths, coverage_semantics, rules) plus an operations { build, sync, verify } block. Collapses the legacy projection + flat-ingest split into one record.

BuildOperation

The build operation — the only operation carrying a mode. Grows new coverage (or runs a one-shot lens). trigger / batch_size / post_actions are scheduling attributes, excluded from hash_binding.

MediumCapabilities

What a medium can support (D6) — the row of the capability matrix for a MediumType. Pure data; validate_binding reads it to refuse operations a medium cannot support.

Operations

The operations block of a BindingV1: every operation is optional (D1/D6). An absent build / sync block makes that mutating operation refuse at run time with a projection enable <op> remedy; an absent verify block means engine defaults (verify is read-only — never a refusal). build is optional in serde so an absent block yields the remedy-bearing refusal rather than a generic “missing field” parse error.

PruneConfig

The prune configuration of a BindingV1 (F1) — additive, optional. An absent prune block means prune is not enabled for the binding (no deletion proposals are produced). Prune has no independent schedule: it rides the sync brief (the sole maintenance-writer channel), so it carries no trigger / batch_size — only the requested PruneGuarantee. Like the sync / verify blocks it is excluded from hash_binding: a maintenance policy never changes what the mem claims.

ResolvedBinding

A binding joined to its resolved primary sources — the shape hash_binding and validate_binding consume. reference_mems are carried on the BindingV1 itself; only the primary facets need resolving (each facet’s selection patterns, preparation, and its medium’s type / pointer / change-detection).

SyncOperation

The sync operation — the (future) sole maintenance writer. Optional: an absent sync block makes that mutating operation refuse at run time. Carries no mode.

VerifyOperation

The verify operation — read-only measurement. Optional: an absent verify block means engine defaults, never a refusal (verify is read-only). Carries no mode.

Enums

BuildMode

How a BuildOperation engages its binding. refinement is deleted from the vocabulary (D1) — it is neither a variant here nor migrated, so deserializing "mode": "refinement" fails as an unknown value.

CapabilityError

A validation-time capability refusal (D6). Sibling to crate::ingest::resolve::ResolveError (which refuses dangling references); this refuses declared operations a medium cannot support. Every refusal names the offending facet/medium so it is diagnosable without re-reading the store.

CoverageSemantics

Coverage semantics — whether the binding claims to cover everything in its declared scope (exhaustive) or a deliberately partial slice (curated). Defaults to CoverageSemantics::Exhaustive.

Operation

A binding operation subject to capability validation.

PruneGuarantee

The prune guarantee a binding requests (bundle plan 05-verify-sync-engine, F1). Prune produces deletion proposals surfaced in the sync brief (it never mutates the mem); the guarantee governs how a prune proposal treats a model-side edit that races a source removal.

Constants

BINDING_VERSION

The current binding format version. A v1 binding carries version: 1.

DEFAULT_ADJUDICATION_CAP

Default per-run tier-3 adjudication cap (bundle plan 05-verify-sync-engine, D1/D4). Dogfood-tuned against the live engine/graph binding (524 source artifacts): a fully-drifted mem of that scale clears its adjudication backlog in ~11 verify runs while each run’s asserted-drift work stays bounded and its token cost predictable. 0 disables the cap (adjudicate every candidate).

DEFAULT_FULL_RESYNC_EVERY

Default full_resync_every (bundle plan 05-verify-sync-engine, D3/D4): fire a guaranteed full-enumeration coverage sweep every N verify runs. Dogfood-tuned against engine/graph (524 artifacts, sample batch 20 → a rotation completes in ~27 runs): a sweep every 20 runs guarantees a complete coverage picture without waiting on the rotation to happen to finish. 0 disables scheduled full walks (rotating sample only).

PREPARATION_IMPL_VERSION

The engine’s current preparation-implementation version — the single source of truth for “which preparation implementation is live”.

Functions

hash_binding

Compute hash(D) (D5) — the lowercase-hex SHA-256 of the canonical JSON of a binding’s content-defining resolved projection.

medium_capabilities

The capability-matrix row for a medium type (D6). The single source of truth the fidelity report (E3b) will also render.

prune_guarantee_for_medium

The strongest prune guarantee a medium can support (F1), derived from the capability matrix: a base-leg-retrievable medium (git-backed — codebase / filesystem / git / graph) supports the full never-clobber three-way merge; a non-retrievable medium (web) supports only conflict-flag degradation. Validation refuses a request that exceeds this.

validate_binding

Validate a resolved binding against the medium-capability matrix (D6), returning every capability refusal (empty Err never returned — Ok means clean). Generalizes the render-time preparation refusal to binding-validation time.