Rules, and what a derived fact is
patternif A consumes X and B exposes Xderivethen A depends_on B, dashed, with its premisespatterna decision with no documentfindingflagged with a severity; blocking stops the buildA rule is declared like a class, with a reason and a place for who confirmed it, and versioned in the same lock. derive rules are positive conjunctive patterns over nodes, their declared attributes and edges, with one action: an edge or an attribute.
policyrules may negate and produce findings. A where condition may name a declared attribute or one of the node's own fields (status, as_of, valid_from, valid_to, source_doc), and a date may be compared with $today or $today-<n>d.
The rules stage runs forward chaining to a fixpoint over current facts on every build; a policy also sees intended facts, which is how the core's rule intended-fact-overdue flags a plan nobody has checked in ninety days, while a derivation never rests on one.
A derived fact never enters graph.json: it lives in derived.json and the store, marked with its rule and its premises, so every answer shows [derived by <rule>], kg_explain walks the chain down to document evidence, and superseding a premise retires the derivation at the next build.
An asserted fact always wins over a derived one. Policy findings appear in oto curate check (blocking or gap by severity), oto ontology check, kg_policy and the overview.