Machine-readable diagrams for the VisionFlow estate. The primary topic directories cover nine repositories; estate topics also cover shared services and supporting repositories. Revision labels declare the source baseline and are not automatic semantic verification. The 2026-09-07 audit records source findings, working-tree hashes and evidence limits. Sequence diagrams first; no narrative —
every fact lives inside a diagram as a participant path:line, a message, or a Note. This tree lives in the
estate canon (VisionFlow) so that cross-repo edges are first-class; it was moved here from VisionClaw
docs/diagrams on 2026-09-07 (history there up to 4d1a698e7).
All sources: / governing: paths are relative to the VisionFlow repo root and reach sibling checkouts through
the local layout in docs/architecture/repository-map.md (../project,
../project/agentbox, ../solid-pod-rs, …). Citations inside diagrams stay short (basename or trailing
fragment) and resolve by suffix against the file's own sources:.
The pre-2026-09-05 technical diagrams and narrative docs are history only, kept in VisionClaw at
docs/archive/diagrams/2026-09-pre-overhaul/.
---
id: VC-03 # <AREA>-<NN>, unique
title: REST request lifecycle
area: visionclaw # = the directory name (see the table above)
governing: [../project/docs/IDENTITY-authority-chain.md]
adrs: [ADR-2009, ADR-2011]
sources: [../project/src/main.rs, ../project/src/middleware/rbac_gate.rs] # relative to VisionFlow root, must exist
verified_commit: b00c28a0d # one sha, or {visionclaw: …, agentbox: …} for a topic whose sources span repos
---
## VC-03.1 GET /api/graph/data — read path
```mermaid
sequenceDiagram
autonumber
participant RG as RbacGate<br/>src/middleware/rbac_gate.rs:122
...
```
Citations resolve by exact match first, then by /-suffix against sources:; a bare basename that matches
more than one entry is an ambiguous warning — qualify it (handlers/graph/mod.rs:40). A repo-root file that
shares a basename with a deeper one (README.md) is cited by its exact sources: path. A citation whose file
is not in sources: is an unresolvable warning: it was never checked. Never use ... inside a path.
A bare :NNN (no path) is a continuation and is checked too: it means the last path cited earlier on the same
line/label; in a sequence message X->>Y: … (:NNN) or Note over X: … :NNN, the file bound to participant X
(participant X as Label<br/>path:NN); otherwise the most recent path earlier in the diagram. A bare ref with
no path anywhere before it is a warning, and so is a bare ref on a message whose participant is declared
without a path (it would otherwise bind to the wrong file and pass). Comma lists :987,1053 check every number.
Ports are never written as bare :NNN — write port 8084.
--cite-check reads each cited file at the topic's declared verified_commit (git show <sha>:<path> in the
owning repo; the {repo: sha} map form by key), so a stamp means "true at that sha" and a sibling checkout's
uncommitted edits cannot flag a correct anchor; it falls back to the working tree only when the sha is unknown.
Every mermaid block sits under an ## <file-id>.<n> <title> heading; ids are unique tree-wide; at most
three prose lines per diagram. Notes use the prefixes INVARIANT:, DIVERGENCE: (governing-doc open
item), DOC-DRIFT: (doc says X, code does Y), EXTERNAL: (asserted by this repo about another repo),
see XX-NN.n (cross-reference).
node scripts/diagram-index-gen.cjs docs/diagrams --check # frontmatter, ids, paths, prose limit
node scripts/diagram-index-gen.cjs docs/diagrams --check --render # + parse every block with mmdc → rendered/
node scripts/diagram-index-gen.cjs docs/diagrams --check --cite-check # + resolve every path:line citation
node scripts/diagram-index-gen.cjs docs/diagrams --check --strict-citations # the gate: refuse anything unverified
node scripts/diagram-index-gen.cjs docs/diagrams # regenerate the index below + COVERAGE.md--strict-citations is a local gate, run before pushing. It resolves every citation with
git show <sha>:<path> against the revision its topic declares, refuses anything it could not verify, and
writes VERIFICATION.md recording what it actually resolved.
The sources: and governing: existence check follows the same rule. A path missing from the working
tree is checked with git cat-file -e <sha>:<path> in the repository that owns it, at the sha the topic
declares, and counts as present when it is there — a sibling checkout that is behind, or that has moved
on past a file an older topic legitimately cites, is not evidence the file does not exist. The run prints
N source(s) exist at the declared revision but not in the working tree per topic, so the fallback is
never silent, and a path that exists at neither is still an error.
It is local because it cannot honestly be anything else. sources: reach sixteen repositories at forty-one
declared revisions; checking a citation on a hosted runner would mean checking each of them out at the exact
sha. Measured on 2026-09-21, two cannot be fetched at all: jjohare/visionGraph is private, and the RuView
sha the corpus declares exists only in a local clone. A runner has no clone of either to read, so every
citation into them is unverifiable there and --strict-citations refuses it; the revision fallback above
does not help, because it too needs the repository on disk. A runner-side strict gate would be red from
its first run. The only way to green it is a second, weaker
definition of "verified" that only CI uses — which is precisely the thing a corpus whose claim is this line
was read at this commit cannot afford.
So CI gates the freshness of the local run instead. --check-verification recomputes the declared
revisions from the topics' frontmatter — no source access needed — and refuses a VERIFICATION.md written
against a different set. A topic that is re-stamped without its citations being re-resolved cannot reach main.
The workflow is .github/workflows/diagram-index.yml.
A handful of citations can never resolve at any declared revision, because the file they name exists in no
commit. Today that is nine, all gitignored build artefacts: website/build-receipt.json (VF-02) and
texput.log (VF-07). Refusing them forever keeps the strict gate permanently red; ignoring them silently is
the failure this checker exists to prevent. So each one is named in
citation-allowlist.json with a reason, and strict mode passes it while counting and
printing it separately as allowlisted (unverifiable) — never as verified.
An entry waives the revision requirement for exactly the citation it names (topic, diagram, path, line); the line checks still run against it. An entry that stops matching anything is stale and fails the run, which is what stops the file rotting into a blanket waiver. Adding one is a reviewable act: the reason must say why the citation can never be verified, not why verifying it is inconvenient.
--cite-check resolves each path:line inside a diagram against the file's own sources: list, asserts the
file is long enough, warns when the anchor line is blank or a lone closing brace, and — for a participant
labelled with a function name — warns when the cited line falls outside that function's body. On its own it
warns, never fails; under --strict-citations every one of those warnings is a refusal. Unresolved and
ambiguous citations warn the same way. The generated ADR index qualifies numbers by repository; estate-unresolved means ownership still needs resolution.
That last check exists because relocating a citation by diff, however carefully, preserves whatever the
citation meant: if it was already pointing at the wrong line, a re-anchoring pass moves the error and stamps a
fresh verified_commit on it. Re-derive a citation from the SYMBOL (grep -n the name, then read the body),
never from a computed offset.
Its blind spots: a bare :NNN continuation (Dockerfile.unified:255<br/>… ENTRYPOINT:340), an extensionless
path (Makefile:12, Dockerfile:40 — the matcher requires a .ext), a basename two sources: entries share
(ci.yml), a governing: doc that is not also a source, and — unfixably — a citation that resolves to a real,
non-blank line describing behaviour that has since been deleted. Those still need a human reading the code at
each cited line.
One rule follows from all of it: verify a landing line by reading it, never by adding a shift to the old
one. A diff shift tells you where a line moved, not whether the citation was pointing at the right line
before it moved — and a wrong citation plus a correct shift is still a wrong citation, now wearing a fresh
verified_commit.
--check --cite-check passing is not sufficient: --render catches grammar defects the checker cannot see, so
re-render after EVERY edit, including a one-line note. Traps measured on 2026-09-07 across ~1,300 diagrams (each
cost a lane a render cycle):
| Breaks | Where | Do instead |
|---|---|---|
bare ; (and HTML entities such as <, which contain one) |
sequenceDiagram message text and Note over X: |
plain prose, commas, <br/>; quoted flowchart labels and note … end note blocks are safe |
:: or a quote (Foo::bar) |
stateDiagram-v2 transition labels | Foo.bar |
{ } in a member line (Replayed { ttl }) |
classDiagram | drop the braces |
escaped \" |
flowchart node labels | reword |
&&, ` |
, >` |
sequence messages |
call as a classDef name |
flowchart | another name |
mindmap, timeline |
anywhere | rejected by the generator as low-density kinds; use flowchart |
a wide erDiagram, an LR subgraph of many unconnected nodes, an unwrapped note for |
render > 4500 px | flowchart TB with subgraphs, wrap notes at ~55 chars with <br/>, flip TD↔LR |
mmdc is the Nix-installed Mermaid CLI (11.16). For a visual check, copy an SVG from rendered/ to
/home/devuser/gui-tools/ and open file:///home/devuser/exchange/<name>.svg in the browsercontainer
sidecar (chrome-devtools MCP browser-gpu); agentbox/scripts/mmdc-sidecar.sh renders through the same
sidecar. Hero images regenerate with hero/src/batch-generate.sh (Nano Banana Pro, GOOGLE_API_KEY).
158 topic files, 1494 diagrams. Regenerate with node scripts/diagram-index-gen.cjs docs/diagrams.
| ID | Topic | Diagrams | Kinds | Governing | ADRs |
|---|---|---|---|---|---|
| VC-01 | Server boot, AppState construction and the full route table | 13 | sequenceDiagram, flowchart | BASELINE-architecture.md | ADR-2004, ADR-2005, ADR-2007, ADR-2008, ADR-2026, ADR-2037, ADR-2038, ADR-2045, ADR-2053, ADR-2091 |
| VC-02 | Actor supervision tree, GraphServiceSupervisor routing and peer actor surfaces | 14 | flowchart, sequenceDiagram, stateDiagram-v2, classDiagram | BASELINE-architecture.md | ADR-2005, ADR-2007, ADR-2045 |
| VC-03 | Request lifecycle, identity and the RBAC lattice | 14 | sequenceDiagram, flowchart | IDENTITY-authority-chain.md, SECURITY-profiles.md, BASELINE-architecture.md | ADR-2002, ADR-2003, ADR-2009, ADR-2010, ADR-2011, ADR-2012, ADR-2013, ADR-2026, ADR-2039, ADR-2043, ADR-2044 |
| VC-04 | Handler internals — graph, state, and domain route families | 23 | sequenceDiagram, flowchart | BASELINE-architecture.md | ADR-2005, ADR-2007, ADR-2011, ADR-2111 |
| VC-05 | Governance and identity handler families | 15 | sequenceDiagram, flowchart | BASELINE-architecture.md, IDENTITY-authority-chain.md | ADR-2006, ADR-2010, ADR-2011, ADR-2013, ADR-2016, ADR-2020, ADR-2058, ADR-2067, ADR-2075, ADR-2090, ADR-2091, ADR-2093, ADR-2094, ADR-2116 |
| VC-06 | Settings round trip — REST, actors, SQLite adapter and generated client types | 8 | flowchart, sequenceDiagram | BASELINE-architecture.md | ADR-2005, ADR-2011, ADR-2041, ADR-2046, ADR-2047, ADR-2080, ADR-2115 |
| VC-07 | Hexagonal ports, adapters, the CQRS application layer and the crate split | 9 | flowchart, sequenceDiagram, classDiagram | BASELINE-architecture.md | ADR-2004, ADR-2005, ADR-2016 |
| VC-08 | Observability, liveness canaries, health composition and the dev/production build loop | 9 | sequenceDiagram, flowchart | BASELINE-architecture.md, SECURITY-profiles.md | ADR-2008, ADR-2026, ADR-2037, ADR-2038, ADR-2049 |
| VC-09 | Configuration loading, boot-time profile assertion and the environment-flag register | 15 | sequenceDiagram, flowchart, classDiagram | BASELINE-architecture.md, SECURITY-profiles.md | ADR-2012, ADR-2026, ADR-2037, ADR-2038, ADR-2039, ADR-2041, ADR-2043, ADR-2046, ADR-2094, ADR-2114, ADR-2115, ADR-2119 |
| VC-10 | GPU supervision and context bus | 7 | flowchart, sequenceDiagram, stateDiagram-v2 | BASELINE-architecture.md, GPU-wire-abi.md | ADR-2007, ADR-2053 |
| VC-11 | Physics step and force channels | 8 | sequenceDiagram, flowchart, classDiagram, stateDiagram-v2 | GPU-wire-abi.md, BASELINE-architecture.md | ADR-2007, ADR-2028, ADR-2029, ADR-2055, ADR-2060 |
| VC-12 | SimParams ABI, GPU buffers and PTX | 7 | classDiagram, sequenceDiagram, flowchart | GPU-wire-abi.md | ADR-2028, ADR-2030, ADR-2054, ADR-2055, ADR-2056 |
| VC-13 | Position broadcast pipeline and WebSocket | 8 | sequenceDiagram, stateDiagram-v2 | PROTOCOL-registry.md, BASELINE-architecture.md | ADR-2003, ADR-2018, ADR-2009, ADR-2002 |
| VC-14 | Wire frames and tag registry | 9 | classDiagram, flowchart, sequenceDiagram | PROTOCOL-registry.md, GPU-wire-abi.md | ADR-2018, ADR-2019, ADR-2020, ADR-2024, ADR-2057, ADR-2060 |
| VC-15 | GPU analytics kernels and pathfinding | 12 | sequenceDiagram, classDiagram, flowchart | GPU-wire-abi.md | ADR-2007, ADR-2053, ADR-2054, ADR-2061 |
| VC-16 | Interaction — drag, pin, layout, constraints and agent beams | 8 | sequenceDiagram, flowchart | BASELINE-architecture.md, PROTOCOL-registry.md | ADR-2020, ADR-2029, ADR-2035, ADR-2055 |
| VC-17 | XR presence crate and co-presence | 4 | sequenceDiagram, classDiagram | PROTOCOL-registry.md, XR-client.md | ADR-2019, ADR-2020 |
| VC-18 | Analytics support handlers and the analytics WebSocket | 9 | flowchart, sequenceDiagram, classDiagram | PROTOCOL-registry.md, GPU-wire-abi.md | ADR-2007, ADR-2009, ADR-2059 |
| VC-20 | Ontology pipeline - OWL extraction, Oxigraph, Whelk reasoning, governed mutation | 11 | sequenceDiagram, erDiagram, classDiagram | BASELINE-architecture.md | ADR-2004, ADR-2071, ADR-2064, ADR-2066, ADR-2068, ADR-2114, ADR-2116, ADR-2125, ADR-2147, ADR-OM-009 |
| VC-21 | Corpus ingest (CorpusSource port, ADR-2114) and the frontmatter inclusion gate | 5 | sequenceDiagram, flowchart | VAULT-corpus-format.md, BASELINE-architecture.md | ADR-2014, ADR-2040, ADR-2070, ADR-2112, ADR-2113, ADR-2114 |
| VC-22 | Data authority, provenance and erasure | 11 | flowchart, erDiagram, sequenceDiagram | DATA-authority-erasure.md, BASELINE-architecture.md | ADR-2004, ADR-2015, ADR-2016, ADR-2017, ADR-2069, ADR-2070 |
| VC-23 | Identifier taxonomy — typed URN, did:nostr, sha256-12, federation crossing, wire node-id | 10 | classDiagram, sequenceDiagram, flowchart | IDENTIFIER-taxonomy.md | ADR-2021, ADR-2022, ADR-2023, ADR-2024, ADR-2025, ADR-2070, ADR-2072 |
| VC-24 | ACSP — governed decision/elevation pipeline | 11 | stateDiagram-v2, sequenceDiagram, flowchart | BASELINE-architecture.md | ADR-2006, ADR-2101 |
| VC-25 | Insight loop, KPI, briefing, NLQ and semantic classification | 11 | sequenceDiagram, flowchart | BASELINE-architecture.md | ADR-2014, ADR-2040, ADR-2004, ADR-2063, ADR-2065 |
| VC-26 | Solid Pod integration — embedded pod, proxy, client stack | 13 | flowchart, sequenceDiagram | DATA-authority-erasure.md, IDENTITY-authority-chain.md | ADR-2067, ADR-2068, ADR-2070, ADR-2098, ADR-2106 |
| VC-27 | Agent estate integration — MCP relay, discovery, monitoring, ingest | 10 | sequenceDiagram, classDiagram | BASELINE-architecture.md, IDENTIFIER-taxonomy.md | ADR-2025, ADR-2058, ADR-2090, ADR-2091, ADR-2094 |
| VC-28 | External services — outbound integrations | 8 | sequenceDiagram, flowchart | BASELINE-architecture.md | ADR-2066, ADR-2115 |
| VC-30 | React client boot sequence and state layer | 12 | sequenceDiagram, classDiagram, flowchart | BASELINE-architecture.md | ADR-2074, ADR-2077 |
| VC-31 | R3F/Three.js graph render pipeline and WASM scene effects | 11 | flowchart, sequenceDiagram, classDiagram | BASELINE-architecture.md | |
| VC-32 | Client WebSocket transport and binary position protocol | 13 | sequenceDiagram, classDiagram, flowchart | PROTOCOL-registry.md, BASELINE-architecture.md | ADR-2002, ADR-2019, ADR-2020, ADR-2047, ADR-2057, ADR-2078, ADR-2080 |
| VC-33 | Browser-client identity — NIP-07, NIP-98, passkeys, RBAC gating | 8 | sequenceDiagram, classDiagram | IDENTITY-authority-chain.md, SECURITY-profiles.md | ADR-2002, ADR-2009, ADR-2011, ADR-2012, ADR-2074, ADR-2075 |
| VC-34 | Client feature directories — API and WebSocket surface | 20 | sequenceDiagram, flowchart | BASELINE-architecture.md | ADR-2041, ADR-2115, ADR-2006, ADR-2074, ADR-2077 |
| VC-35 | Voice end to end — PTT, STT, intent, TTS | 12 | stateDiagram-v2, sequenceDiagram, flowchart | BASELINE-architecture.md, IDENTITY-authority-chain.md | ADR-2002, ADR-2039, ADR-2075 |
| VC-36 | Godot + gdext OpenXR immersive client | 26 | sequenceDiagram, flowchart, stateDiagram-v2, classDiagram | XR-client.md, BASELINE-architecture.md | ADR-2032, ADR-2033, ADR-2034, ADR-2035, ADR-2036, ADR-2039, ADR-2076, ADR-2079, ADR-2107, ADR-2108, ADR-2109, ADR-2133, ADR-2134, ADR-2135 |
| VC-37 | Browser XR surface and desktop spatial input | 10 | sequenceDiagram, flowchart, stateDiagram-v2 | BASELINE-architecture.md, XR-client.md | ADR-2032, ADR-2081 |
| VC-38 | XR memory cloud internals - snapshot, route, query, beat and semantic encoding | 19 | flowchart, sequenceDiagram, classDiagram, stateDiagram-v2 | XR-client.md | ADR-2107, ADR-2133, ADR-2134, ADR-2135, ADR-2136 |
| VC-39 | Codescape - the separate code-graph section, its crates, wire reuse, voice and proxy trust | 7 | flowchart, sequenceDiagram, classDiagram | BASELINE-architecture.md, PROTOCOL-registry.md | ADR-2143, ADR-2018, ADR-2019, ADR-2024, ADR-2141 |
| VC-40 | XR client on two backends - the capability table, the request gate, the switch and the Codescape palette (ADR-2143 A6) | 3 | flowchart, sequenceDiagram | XR-client.md, ADR-2143-codescape-section-separate-workspace-and-port.md | ADR-2143, ADR-2134, ADR-2108 |
| ID | Topic | Diagrams | Kinds | Governing | ADRs |
|---|---|---|---|---|---|
| AB-01 | Nix flake composition and apply-class gates | 10 | flowchart, stateDiagram-v2, sequenceDiagram, classDiagram | BASELINE-container.md | ADR-2003, ADR-2006, ADR-2029, ADR-2039, ADR-2080 |
| AB-02 | Boot sequence, supervision tree and readiness | 21 | sequenceDiagram, flowchart, stateDiagram-v2 | BASELINE-container.md | ADR-2003, ADR-2007, ADR-2028, ADR-2029, ADR-2034, ADR-2063, ADR-2080, ADR-2092, ADR-2104, ADR-2122 |
| AB-03 | Management API request lifecycle and route table | 17 | sequenceDiagram, flowchart | BASELINE-container.md, INGRESS-identity.md | ADR-2005, ADR-2013, ADR-2003 |
| AB-04 | Five-slot adapter spine, dispatch middleware and connect lifecycle | 15 | flowchart, classDiagram, sequenceDiagram, stateDiagram-v2 | BASELINE-container.md | ADR-2004, ADR-2005, ADR-2035, ADR-2036, ADR-2037, ADR-2064 |
| AB-05 | Manifest gate catalogue, vault path authority and the agentbox.sh CLI | 15 | sequenceDiagram, flowchart, stateDiagram-v2 | BASELINE-container.md | ADR-2003, ADR-2028, ADR-2029, ADR-2034, ADR-2036, ADR-2037, ADR-2038, ADR-2039, ADR-2080, ADR-2091, ADR-2092, ADR-2093, ADR-2094, ADR-2095, ADR-2107, ADR-2108, ADR-2110, ADR-2116, ADR-2118, ADR-2122 |
| AB-06 | Compose overlays, sidecar topology and the loopback-publish invariant | 13 | flowchart, sequenceDiagram | BASELINE-container.md | ADR-2013, ADR-2003, ADR-2040, ADR-2094, ADR-2118, ADR-2122 |
| AB-07 | Daemon classes, argv-boundary reaping, cron and backups | 11 | flowchart, stateDiagram-v2, sequenceDiagram | BASELINE-container.md | ADR-2032, ADR-2003, ADR-2039, ADR-2040, ADR-2118 |
| AB-08 | Claude Code hook pipeline and its handlers | 12 | flowchart, sequenceDiagram | BASELINE-container.md | ADR-2015, ADR-2026, ADR-2007, ADR-2068, ADR-2090, ADR-2091, ADR-2093, ADR-2094, ADR-2121 |
| AB-09 | MCP registry, boot projector and the server catalogue | 7 | flowchart, sequenceDiagram, stateDiagram-v2 | BASELINE-container.md | ADR-2008, ADR-2003, ADR-2039, ADR-2034, ADR-2082, ADR-2085, ADR-2086 |
| AB-10 | Ingress — nip98-proxy and the AoE door | 13 | flowchart, sequenceDiagram, stateDiagram-v2 | INGRESS-identity.md, SECURITY-profiles.md | ADR-2002, ADR-2009, ADR-2010, ADR-2011, ADR-2013, ADR-2047, ADR-2080 |
| AB-11 | Identity — DID, URN, mandate, authority | 16 | classDiagram, sequenceDiagram, flowchart, stateDiagram-v2 | INGRESS-identity.md, PROTOCOL-registry.md | ADR-2011, ADR-2025, ADR-2027, ADR-2064, ADR-2087 |
| AB-12 | tab0-bridge and the interaction plane | 11 | sequenceDiagram | INGRESS-identity.md, GOVERNANCE-capabilities.md | ADR-2009, ADR-2010, ADR-2011, ADR-2047, ADR-2088 |
| AB-13 | Nostr — relay, gateway, pod bridge, session mirror | 16 | flowchart, sequenceDiagram, classDiagram, stateDiagram-v2 | INGRESS-identity.md, SECURITY-profiles.md, PROTOCOL-registry.md | ADR-2012, ADR-2025, ADR-2026, ADR-2061, ADR-2085, ADR-2105 |
| AB-14 | Governance — journal, action pipeline, approvals | 15 | flowchart, stateDiagram-v2, sequenceDiagram | GOVERNANCE-capabilities.md, SECURITY-profiles.md | ADR-2022, ADR-2027, ADR-2041, ADR-2071, ADR-2085, ADR-2087, ADR-2108, ADR-2122 |
| AB-15 | Capability gating, spend caps and consultants | 14 | flowchart, sequenceDiagram, stateDiagram-v2 | GOVERNANCE-capabilities.md, SECURITY-profiles.md | ADR-2020, ADR-2031, ADR-2033, ADR-2080 |
| AB-16 | Secrets custody, seccomp and runtime profiles | 14 | flowchart, classDiagram, sequenceDiagram, stateDiagram-v2 | SECURITY-profiles.md, INGRESS-identity.md | ADR-2007, ADR-2026, ADR-2027, ADR-2033, ADR-2046, ADR-2122 |
| AB-17 | Agent events and the BC20 provenance bridge | 8 | classDiagram, sequenceDiagram | PROTOCOL-registry.md, INGRESS-identity.md | ADR-2011, ADR-2022, ADR-2025, ADR-2061, ADR-2085 |
| AB-20 | RuVector memory path — every MCP memory tool end to end | 13 | sequenceDiagram, flowchart, stateDiagram-v2, erDiagram | LEARNING-memory.md | ADR-2014, ADR-2018, ADR-2019, ADR-2051, ADR-2082 |
| AB-21 | Learning loop — capture, judge, distil, consume | 10 | sequenceDiagram, classDiagram, stateDiagram-v2, flowchart | LEARNING-memory.md | ADR-2015, ADR-2016, ADR-2017, ADR-2018, ADR-2051, ADR-2052 |
| AB-22 | Skills estate — discovery, lint gate, the live router, harness and colloquy MCP bridges | 12 | sequenceDiagram, stateDiagram-v2, flowchart | GOVERNANCE-capabilities.md | ADR-2020, ADR-2021, ADR-2028, ADR-2056, ADR-2057, ADR-2083, ADR-2085, ADR-2086, ADR-2089, ADR-2090, ADR-2091, ADR-2092, ADR-2095, ADR-2110, ADR-2116 |
| AB-23 | Dream machine — the adapter, the extracted core and the nightly path | 20 | stateDiagram-v2, sequenceDiagram, flowchart, classDiagram | GOVERNANCE-capabilities.md | ADR-2024, ADR-2053, ADR-2071, ADR-2081, ADR-2084, ADR-2087, ADR-2114, ADR-2115, ADR-2122, ADR-2141 |
| AB-24 | Ontology Loom facade and the model-swap seam | 13 | flowchart, sequenceDiagram, stateDiagram-v2 | GOVERNANCE-capabilities.md | ADR-2023, ADR-2053, ADR-2055, ADR-2075, ADR-2084, ADR-2122 |
| AB-25 | Ontology tools and governed writes | 5 | sequenceDiagram, stateDiagram-v2, classDiagram, flowchart | GOVERNANCE-capabilities.md | ADR-2022, ADR-2023, ADR-2028, ADR-2054 |
| AB-26 | Headroom compression, the beads work-DAG, typed spawn and RuvNet grounding | 9 | sequenceDiagram, classDiagram, stateDiagram-v2, flowchart | GOVERNANCE-capabilities.md, LEARNING-memory.md | ADR-2004, ADR-2005, ADR-2020 |
| AB-27 | Media and GPU capability services — manifest-gated dispatch | 13 | sequenceDiagram, flowchart, classDiagram | BASELINE-container.md, GOVERNANCE-capabilities.md | ADR-2006, ADR-2020, ADR-2040, ADR-2057 |
| AB-28 | Agentbox service crates and the manifest binary | 10 | flowchart, sequenceDiagram, classDiagram | BASELINE-container.md | ADR-2030, ADR-2031, ADR-2032, ADR-2084, ADR-2085, ADR-2086, ADR-2104, ADR-2116, ADR-2118, ADR-2134, ADR-2139 |
| AB-29 | Metaharness router console — AoE dispatch plane phase 0 | 9 | flowchart, sequenceDiagram, stateDiagram-v2 | GOVERNANCE-capabilities.md | ADR-2079, ADR-2080 |
| AB-30 | Supporting services — secret-backup, setup server, https-bridge | 3 | flowchart, sequenceDiagram | BASELINE-container.md | legacy-ADR-024, ADR-2027 |
| AB-31 | Sovereign settlement over sidestr sidechains — the PRD-024 design and its eight decisions | 7 | flowchart, stateDiagram-v2, sequenceDiagram | BASELINE-container.md, INGRESS-identity.md, GOVERNANCE-capabilities.md, PROTOCOL-registry.md | ADR-2096, ADR-2097, ADR-2098, ADR-2099, ADR-2100, ADR-2101, ADR-2102, ADR-2103, ADR-2105 |
| AB-32 | The first seal — sidestr:dreamlab, its sealed document, key custody, block file and parent node | 5 | flowchart, sequenceDiagram | BASELINE-container.md, PROTOCOL-registry.md | ADR-2096, ADR-2101, ADR-2103, ADR-2106 |
| AB-33 | sidestr crates moved to sidestr-rs — the pointer, the AGPL consumption boundary, and the chain instance agentbox keeps | 2 | flowchart | BASELINE-container.md | ADR-2106, ADR-2112 |
| AB-34 | The supervised producer, mirror and faucet — announce, the mirror trust rule, and relays as the registry | 6 | flowchart, sequenceDiagram | PROTOCOL-registry.md, BASELINE-container.md | ADR-2098, ADR-2101, ADR-2103, ADR-2105, ADR-2112, ADR-2122 |
| AB-35 | Level 2 — q against k, authorise then finalise, and the signer service outside the restore domain | 5 | flowchart, sequenceDiagram | INGRESS-identity.md, PROTOCOL-registry.md | ADR-2098, ADR-2101, ADR-2105 |
| AB-36 | Role isolation and the identity port | 7 | flowchart, sequenceDiagram | ADR-2122-role-service-accounts-run-secrets-and-the-identity-port.md, SECURITY-profiles.md | ADR-2122, ADR-2027, ADR-2101, ADR-2078, ADR-2064 |
| ID | Topic | Diagrams | Kinds | Governing | ADRs |
|---|---|---|---|---|---|
| VW-01 | Crate composition, modules and the WASM boundary | 6 | flowchart, sequenceDiagram, classDiagram | README.md | |
| VW-02 | OWL parse → graph model | 6 | sequenceDiagram, flowchart, classDiagram, stateDiagram-v2 | README.md | |
| VW-03 | Force layout — Barnes-Hut, SIMD and CSR simulation lifecycle | 9 | sequenceDiagram, flowchart, stateDiagram-v2 | README.md | |
| VW-04 | JS API surface, examples and downstream consumers | 6 | classDiagram, flowchart, sequenceDiagram | README.md | |
| VW-05 | Build, test, bench and the npm publish pipeline | 5 | flowchart, sequenceDiagram | README.md |
| ID | Topic | Diagrams | Kinds | Governing | ADRs |
|---|---|---|---|---|---|
| KG-01 | Repo composition and the three-way data/pipeline/explorer licensing boundary | 2 | flowchart | BASELINE-narrativegoldmine.md | ADR-2001, ADR-2002 |
| KG-04 | Explorer — NGG1 tier reader, worker transport, React SPA, and the externalised WASM crate | 5 | flowchart, sequenceDiagram | BASELINE-narrativegoldmine.md | ADR-2001 |
| KG-05 | CI/CD and publish — build.yml archived, visionGraph's vault build is the sole producer | 2 | sequenceDiagram, flowchart | build-and-gates.md | ADR-2003 |
| KG-06 | Consumers — VisionClaw ingest, agentbox Loom grounding, vowl-wasm, OntoCast (archived) | 3 | flowchart, sequenceDiagram | ecosystem.md | |
| KG-07 | Invariants register — the 11 baseline invariants and the open items they qualify | 3 | flowchart, stateDiagram-v2 | BASELINE-narrativegoldmine.md | ADR-2001, ADR-2002, ADR-2003, ADR-2004 |
| ID | Topic | Diagrams | Kinds | Governing | ADRs |
|---|---|---|---|---|---|
| VG-01 | Vault structure and the publication contract — frontmatter gate, inclusion divergence | 6 | flowchart | PUBLICATION-contract.md | ADR-VG-001, ADR-VG-002, ADR-VG-003, ADR-VG-004 |
| VG-03 | publish.yml — vault build, Quartz notes, and the React/vowl-wasm explorer build | 4 | flowchart, sequenceDiagram | PUBLICATION-contract.md | ADR-VG-004 |
| VG-04 | Downstream contracts — VisionClaw's pull model, and knowledgeGraph as deploy target | 2 | sequenceDiagram, flowchart | PUBLICATION-contract.md | ADR-VG-002 |
| VG-05 | Invariants register — vault contract facts vs the proposed, inactive closeout ADRs | 4 | flowchart | PUBLICATION-contract.md | ADR-VG-001, ADR-VG-002 |
| VG-06 | publishing-tools/WasmVOWL — the tree that actually ships, and how it has drifted from its sibling | 5 | flowchart | PUBLICATION-contract.md |
| ID | Topic | Diagrams | Kinds | Governing | ADRs |
|---|---|---|---|---|---|
| DE-01 | The extracted dream-engine repository — crate DAG, licence boundary and estate status | 2 | flowchart | repository-map.md | ADR-DE-001, ADR-DE-002, ADR-DE-005, ADR-DE-006, ADR-DE-007 |
For a source-accessible closeout checkout, run node scripts/diagram-index-gen.cjs docs/diagrams --check --strict-citations --worktree-citations. Unlike advisory --cite-check, this rejects every citation diagnostic and cannot be combined with --no-source-paths. Passing still establishes citation hygiene only; retain source hashes and claim-level review evidence.
--worktree-citations explicitly checks current source bytes. The default citation reader prefers declared revisions and falls back to working files when that revision/path cannot be read; its success must not be labelled current-worktree verification.