feat: add GEWU installer and service contracts

pipelines/curate.md

@@ -4,8 +4,9 @@ Version 0.1.0. Host-executed procedure for `kb-curate`.
 
 1. Define collection, audit type and budget. Record whether the requested output is a report or a contribution.
 2. Retrieve candidate records and their exact revisions; inspect evidence and existing relations.
-3. Classify stale, duplicate-candidate, contradiction, missing-link or insufficient-context findings. Explain the proposed change and its evidence. Similarity alone cannot decide a merge.
-4. For report-only work, stop with findings and coverage. For authorized contributions, build separate typed proposals with expected revisions and affected policy domains.
-5. Resolve validation findings and inspect receipts. A held merge or promotion is a pending exception; it is not permission to copy/delete records manually.
+3. Classify stale, duplicate-candidate, contradiction, missing-link or insufficient-context findings. Explain the proposed change and its evidence. Exact name/alias matches are review candidates only; verify identity and preserve each source's provenance before proposing a relationship. Similarity alone cannot decide a merge.
+4. Preserve claims that disagree. Propose a typed `contradicts` relationship with evidence or explicitly labeled interpretation rationale; do not collapse either claim. For substantive relationships, include the supporting evidence or rationale and record material conditions such as population, time period or setting. Record assumptions and limitations as separately assessed node claim groups with assertion paths `assumptions[n].text` and `limitations[n].text`; do not treat edge conditions as a substitute for those claims.
+5. For report-only work, stop with findings and coverage. For authorized contributions, build separate typed proposals with expected revisions and affected policy domains.
+6. Resolve validation findings and inspect receipts. A held merge or promotion is a pending exception; it is not permission to copy/delete records manually.
 
 Checkpoint candidate IDs, inspected revisions, findings, proposed changes and receipts. After another agent changes a candidate, re-inspect before resuming its proposal. Keep completed findings and unexamined coverage distinct.

pipelines/ingest.md

@@ -1,15 +1,16 @@
 # Ingestion pipeline
 
-Version 0.1.0. Host-executed procedure for `kb-ingest`; not a background scheduler. Follow the contribution protocol for budgets, checkpoints and retry identity.
+Version 0.2.0. Host-executed procedure for `kb-ingest`; not a background scheduler. Follow the contribution protocol for budgets, checkpoints and retry identity.
 
 | Stage | Input | Output / checkpoint | Gate |
 | --- | --- | --- | --- |
-| Context | User-selected material and explicit project | Objective, lens, scope, run identity and pinned pack versions | Required tools/schema are available; otherwise report blocked. |
-| Capture | Selected bytes/URL and source candidates | Verified upload/capture IDs, archive/extraction availability | Upload is staged; retain exact source revision/map. |
+| Context | User-selected material, explicit project and `get_project_context` lens | Objective, authorized project lens, scope, run identity and pinned pack versions | Required tools/schema are available; otherwise report blocked. |
+| Capture | Explicitly selected local files, user-pasted text or an allowlisted public URL | Verified artifact digest, stable source ID, content-bound revision ID, metadata candidate and extraction availability | Use the connector for local files, `source_capture_text` for explicitly supplied UTF-8 text/Markdown (maximum 1 MB), or `source_capture_url` for a configured public host. Pasted text requires a stable capture ID and source key, and returns an archived artifact, extraction and candidate marked `pasted-text`; retry with the same ID and identical inputs after uncertainty, since changed inputs conflict. The service retains at most 1,024 private capture receipts. The capture does not register the source. The connector returns a typed `source_candidate`; `.vtt` and `.srt` files are parsed into cue-timed blocks and tagged `transcript`. Cite the precise cue times together with the quote span. The connector can record a declared NotebookLM export provenance for supported text, Markdown or PDF files, but does not verify that provenance; omit `source_revision_id` to derive a revision from file identity, content digest and its durable retry checkpoint, or supply a stable revision ID when resuming an existing workflow. Submit candidates through `proposal_submit`; staging alone does not register a source. Failed fetches return a `capture-failed` candidate without artifact bytes; register it only when a bookmark is useful. PDF extraction currently requires the supported Linux sandbox. HTML citations refer to visible extracted text, not markup-byte offsets. |
 | Triage | Source plus project lens | Included sections and skip/defer reasons | Bound the batch; preserve coverage. |
 | Extract | Included sections and immutable maps | Atomic proposal draft with field-level evidence | Exact quotes/locators; no invented revisions. |
 | Assess | Assertion/evidence bindings | Support judgments, assessor/run and rationale | Unsupported/unavailable claims remain drafts. |
-| Submit | Complete bounded bundle and base revision | Proposal identity, validation findings and eventual receipt | Every affected domain's policy applies; protected decisions remain external. |
-| Report | Receipts and coverage records | Accepted/held work, index state, limitations and resume point | Never equate partial acceptance or upload with complete processing. |
+| Evaluate | Complete bounded bundle and base revision | `proposal_evaluate` findings and eligible status | Evaluation is read-only; it does not reserve an ID or store the proposal. |
+| Submit | Evaluated bounded bundle and stable proposal identity | `proposal_submit` outcome and eventual receipt | Every affected domain's policy applies; protected decisions remain external. |
+| Report | `proposal_status`, receipts and coverage records | Accepted/held work, index state, limitations and resume point | Never equate upload, evaluation or partial acceptance with complete processing. |
 
-Resume inspects service status and retained output hashes before returning to a stage. Changed assertion/evidence invalidates assessment and later stages. Correct only actionable findings; repeated identical failure stops for diagnosis. Pipeline instructions may be replaced independently of the skill's extraction criteria if these input/output and recovery obligations remain valid.
+Resume calls `source_upload_status` or `proposal_status` using the exact checkpointed ID and revision before returning to a stage. Changed assertion/evidence invalidates assessment and later stages. Correct only actionable findings; repeated identical failure stops for diagnosis. Pipeline instructions may be replaced independently of the skill's extraction criteria if these input/output and recovery obligations remain valid.

pipelines/query.md

@@ -3,7 +3,7 @@
 Version 0.1.0. Read-only host-executed procedure for `kb-query`.
 
 1. Establish question, explicit scope and answer budget; inspect actual service availability.
-2. Retrieve accepted candidates with complete citation groups, scope and index metadata. Preserve degraded-mode and freshness warnings.
+2. Retrieve accepted candidates with complete citation groups, scope and index metadata. Use node-type and stale-only facets to narrow the search when useful; keep the filters in the saved URL/request context. Browse source metadata with `list_sources` under the same explicit scope. Preserve degraded-mode and freshness warnings.
 3. Inspect decisive nodes/source locations and bounded typed neighbors. Keep suggestions and established relationships distinct.
 4. Compose an answer with citations near factual claims, relevant conditions, disagreements and as-of dates. Report insufficient evidence without filling gaps from memory as if retrieved.
 5. Record the retrieved revision IDs and omissions when a resumable local work record is needed. Do not create a server mutation merely to log a read-only query.