Ontology Guardrails v0.4-pre

Status: pre-release implementation baseline Date: 2026-06-18

These rules exist to stop future agents and developers from merging similar-looking but different NodeDC concepts.

Core Naming Rules

Use canonical IDs from CANONICAL_ENTITY_CATALOG.md.
Treat aliases as aliases, not new roots.
If source evidence is missing, mark the entity as pending; do not invent implementation facts.
Keep source-confirmed, owner-confirmed, product-required, and future-concept separate.
Use ops.card as the canonical work object. Issue, task, work item, and ticket are aliases or subtypes.

hub.open_contour is not an ordinary hub.client_context.
hub.public_pool_client is a special source-backed Client used by public pool context.
hub.public_user and hub.client_user are classifications of hub.user, not separate hard user tables/classes unless future source proves otherwise.
hub.application_card is presentation only. Access authority belongs to hub.application_access, hub.app_grant, and hub.app_exception.
Authentik, OIDC, JWT, and provider-specific auth names are implementation aliases under ndcauth.identity / ndcauth.session.

OPS Product is the operational work/project/card layer.
OPS Product must not be derived from ENGINE-side server/routes/ops.js or Agent Monitor experiments.
Plane Issue maps to canonical ops.card.
ops.card_priority is a card attribute, not a global root entity.
ops.responsible is not automatically equal to ops.assignee; keep the distinction until source/product semantics are finalized.
ops.card_artifact_link is a relation/link to outputs, not a global artifact root.

OPS Gateway is the scoped MCP/API access layer for agents.
agent.identity is a Gateway execution identity, not a human user and not a universal assistant persona.
agent.token is an opaque credential. Do not treat it as user identity.
agent.scope is a tool/capability permission. Do not confuse it with HUB/OPS roles.
Gateway writes must remain scoped, audited, and idempotent.
Gateway does not own raw OPS product truth. Tasker/OPS remains source of truth for projects/cards.
HUB remains source of truth for platform user/client/application entitlement.

ENGINE is workflow/dev environment, not the final home for heavy product UIs.
engine.workflow_l1 is the NodeDC canvas/workflow graph.
engine.workflow_l2 is the protected Engine execution layer.
engine.workflow_l2_runtime_id is not the same as NodeDC engine.workflow_l1 id.
engine.l2_run, engine.l2_session, and current trace tables are useful evidence but are tech-debt-adjacent because they live in ENGINE-side OpsLayer.
Do not turn ENGINE-side Agent Monitor/tender UI into core ontology roots.
Procurement/tender concepts should later become a domain ontology package, not a core root.

Do not add new heavy custom product UI directly into ENGINE core.
Future automation UI should live in a dedicated interface layer/service.
ENGINE nodes may emit data/control bindings for that layer, but the layer owns views, widgets, dashboards, maps, forms, and control panels.
Assistant-built interfaces must use ontology-backed meanings, not hardcoded one-off field guesses.
Current tender/Agent Monitor UI is evidence of need and tech debt, not the target architecture.

Assistant is not the same as Gateway identity.
Codex, browser ChatGPT, MCP tool, local executor, and OPS Gateway are different execution surfaces.
Ontology Core should help resolve target context before selecting grant/tool/workflow, especially for:
- OPS user asks to inspect or switch an Engine workflow.
- Engine user asks to create/update OPS cards.
- Assistant needs to choose project/workflow/card context by human-readable name.
Browser ChatGPT can propose RFCs, but source evidence and accepted docs remain on disk.

Do not read or copy env files, secrets, database dumps, storage, runtime buffers, logs, caches, build outputs, node_modules, or archives into ontology docs.
Do not delete files unless explicitly asked by the user.
Do not edit application source code from the ontology workspace.
Do not run Docker/build/install/test for docs-only ontology work.