Change the source. Trace every consequence.
Model derived context as a dependency graph, then compute invalidation, stale deletion, reprocessing order, and permission broadening.
Reprocessing order
incident → extractor → summarizer → ticket_facts → incident_summary → context_bundle
Topological order keeps dependencies ahead of their outputs. Deleted canonical input is not rebuilt.
Permission evidence
context_bundle exposes roles beyond incident_summary's security-only access.
The bundle needs partitioned retrieval or the strict intersection of upstream permissions.
Boundary. This audits graph contracts. It does not run CocoIndex, measure recovery time, propagate real ACLs, or prove storage transaction safety.