[devashridatta-dotcom]

Summary

Proposes a first-class safety-assertion graph model for maintainer review before generated database, backend, GraphQL, parser, and certifier code is added.

This revision incorporates the direction discussed during the 12 October 2026 GUAC maintainer meeting and complements the standalone parser prototype in #3271.

Proposed model

The proposal separates ingestion from graph resolution:

source document -> assertion -> declared target -> resolved binding

• The declared target retains product and component identities even when either package version has not yet been ingested.
• A GUAC certifier later creates an idempotent typed binding to the resolved product and component package versions.
• The externally authored decision state is kept separate from GUAC's correlation state.
• Evidence references and document provenance remain queryable.

Implementation boundary

• Define the ontology and client queries first.
• Add GraphQL and backend interfaces before parser integration.
• Use Ent/PostgreSQL as the proposed first persistence implementation, without parser-owned SQL and while preserving GUAC's backend abstraction.
• Rework feat: add SRAC document validation foundation #3271 to emit the first-class assertion input after the model is agreed.
• Add the out-of-order reconciliation certifier as a separate reviewable slice.

Review requested

Please confirm or redirect:

1. the first-class noun and relationship names;
2. the document -> assertion -> declared target -> resolved binding split;
3. whether evidence should be reusable graph nodes or normalized assertion records;
4. whether Ent/PostgreSQL is sufficient for the first implementation behind GUAC's backend interfaces;
5. whether one assertion may intentionally cover multiple product/component versions;
6. the GraphQL-first scope; and
7. whether feat: add SRAC document validation foundation #3271 should be rebased after this model is accepted.

The document is a design proposal, not a claim that the model or implementation sequence has already been approved.

Related to #3256 and #3271.

[devashridatta-dotcom]

@gaganhr94 I opened this design-first draft based on your feedback in #3256. It proposes the dedicated database/GraphQL safety-assertion model that would replace the temporary HasMetadata representation in #3271. Could you please review the proposed predicate, endpoint types, and GraphQL-first MVP scope before I generate the backend implementation?