feat: keep architectural declarations traceable to exact boundaries

docs/README.md

@@ -41,7 +41,7 @@ Resource contracts and acceptance:
 
 - [Architecture resource coverage](reference/architecture-resource-coverage.md)
 - [Domain-scoped listing](reference/domain-scoped-listing.md)
-- [System relationship contract proposal](reference/system-relationship-contracts.md)
+- [System relationship contracts](reference/system-relationship-contracts.md)
 - [System relationship acceptance requirements](reference/system-relationship-acceptance.md)
 - [Channel and DataStore contracts](reference/channel-and-datastore-contracts.md)
 - [Channel and DataStore acceptance fixture](reference/channel-and-datastore-acceptance.md)

docs/explanation/architecture-resource-roadmap.md

@@ -124,15 +124,16 @@ selectors require explicit rebinding. The
 typed boundary and read-only review surface.
 Remote connectors and additional format compilers remain separate milestones.
 
-## Proposed system relationship layer
+## Native system relationship layer
 
-The [system relationship proposal](../reference/system-relationship-contracts.md)
+The [system relationship contract](../reference/system-relationship-contracts.md)
 builds on existing Component and ExternalSystem boundaries. Its
 [acceptance requirements](../reference/system-relationship-acceptance.md)
 keep authored declarations distinct from checked behavioral paths and runtime
-evidence. This is a specification milestone, not native implementation or
-completed acceptance. Richer grouping and actor-interaction boundaries remain
-explicit in the proposal.
+evidence. Native schema, admission, exact occurrence identity, authoring and
+inspection are implemented. The acceptance reference links executable coverage
+without claiming exhaustive or deployed acceptance. Richer grouping and
+actor-interaction boundaries remain explicit in the contract.
 
 ## Atlas Linter comes after the architecture resources
 

docs/reference/architecture-resource-coverage.md

@@ -10,7 +10,7 @@ relationship, executable behavior, or a passing client workflow. See the
 | Resource | Supported fields and selections | Contract and executable coverage |
 | --- | --- | --- |
 | Strategic scope | Project, Domain, Subdomain and BoundedContext records; project/domain references, realized subdomains and directed context agreements. | [Strategic schema](../../proto/trogonatlas/eventmodel/v1alpha1/strategic.proto), [reference extraction](../../rsworkspace/crates/trogon-atlas-core/src/refs.rs). |
-| Component and ExternalSystem | Component technology and curated exact entity membership; external boundary descriptions, ReadModel external-source links and Processor calls. | [Infrastructure schema](../../proto/trogonatlas/eventmodel/v1alpha1/infrastructure.proto), [reference extraction](../../rsworkspace/crates/trogon-atlas-core/src/refs.rs). |
+| Component and ExternalSystem | Component technology and curated exact entity membership; external boundary descriptions, ReadModel external-source links and Processor calls; identified directed architectural declarations between exact boundaries. | [Infrastructure schema](../../proto/trogonatlas/eventmodel/v1alpha1/infrastructure.proto), [reference extraction](../../rsworkspace/crates/trogon-atlas-core/src/refs.rs), [relationship contract](system-relationship-contracts.md) and [acceptance](system-relationship-acceptance.md). |
 | Channel | Address parameters, protocols, delivery declarations, optional broker and bindings to exact AutomationSlice observation occurrences. | [Contract](channel-and-datastore-contracts.md), [acceptance](channel-and-datastore-acceptance.md). |
 | DataStore | Store class, technology, purpose, authority, access mode, classification, residency, retention and identified ReadModel attachments. | [Contract](channel-and-datastore-contracts.md), [acceptance](channel-and-datastore-acceptance.md). |
 | Specification | Retained artifacts, schema/message/operation members, individual message mappings, operation roles, provider exposures and usages. | [Contract](specification-and-api-contracts.md), [acceptance](specification-and-api-acceptance.md). |
@@ -31,7 +31,7 @@ version strings do not replace these selectors. See
 | Area | Existing representation | Remaining boundary |
 | --- | --- | --- |
 | Strategic membership | Domain project, Subdomain domain and context realizations are native references. [Domain-scoped listing](domain-scoped-listing.md) preserves exact strategic versions and considers every realization; ordinary entity scope remains namespace-derived. | Arbitrary domain nesting and shared authored system/service membership have no dedicated fields. Listing does not establish authored membership, change project-validation scope or add a Domain version selector to Studio. |
-| System and service relationships | Component members can select other Components and ExternalSystems, with ordinary reference discovery. | The [system relationship proposal](system-relationship-contracts.md) and [acceptance requirements](system-relationship-acceptance.md) specify a bounded declaration layer; they do not establish implemented support. Dedicated grouping levels and system-level actor interactions remain separate boundaries. Containment is Component-owned; ExternalSystem has no members field, so external-system-owned membership also remains outside current support. |
+| System and service relationships | Component members can select other Components and ExternalSystems. Both boundary kinds support [identified directed architectural declarations](system-relationship-contracts.md), exact subject selection and reference discovery; [acceptance](system-relationship-acceptance.md) separates executable coverage from runtime claims. | Dedicated grouping levels and system-level actor interactions remain separate boundaries. Containment is Component-owned; ExternalSystem has no members field, so external-system-owned membership also remains outside current support. Labels establish no containment, message flow or runtime dependency. |
 | Communication | API roles/providers/usages, Processor calls and Channel bindings to actual observations are supported. | General authored send/receive and conditional-trigger declarations before behavioral mapping have no native relationship contract. Retained source declarations do not establish executable paths. |
 | Metadata and agents | Registered annotations include links, code repository/path/symbol/ref provenance, tags and lifecycle status. | Lifecycle effective dates and agent model/tool declarations need dedicated contracts. Arbitrary metadata references are not recursively indexed. See [annotations](../../proto/trogonatlas/annotation/v1alpha1/annotations.proto). |
 | Business data | Schema fields, nested shapes, schema type references and identity-derivation annotations are available. | Business identifier roles, foreign entity/property selections, relationship labels and general aggregate intent are not supplied by type reuse. See [field schema](../../proto/trogonatlas/eventmodel/v1alpha1/fields.proto). |

docs/reference/system-relationship-acceptance.md

@@ -1,9 +1,10 @@
 # System relationship acceptance requirements
 
-Status: proposed executable acceptance requirements for the
-[contract](system-relationship-contracts.md), not implemented and not run.
-Logical fixture notation below is not current manifest syntax or an available
-RPC payload. No backend, CLI/MCP, Studio or runtime acceptance is claimed.
+Status: native support for the [contract](system-relationship-contracts.md) is
+implemented. This reference defines acceptance requirements and links executable
+coverage below. Logical fixture notation is not verbatim manifest syntax or an
+RPC payload. Linked service, client and component tests establish different
+boundaries; they do not establish deployment or runtime behavior.
 
 ## Fixture and evidence
 
@@ -140,3 +141,24 @@ Studio inspection/browser evidence, when supplied, must identify the native
 backend, fixture and exact selectors. Mocked transport does not establish native
 persistence. Runtime observations require separate deployment/instrumentation
 evidence; no runtime proof is needed or supplied by this declaration contract.
+
+## Executable coverage inventory
+
+The implementation fixtures below exercise different boundaries. A fixture's
+presence is source evidence; its test result must be recorded separately.
+
+| Fixture | Covered boundary |
+| --- | --- |
+| [Core relationship tests](../../rsworkspace/crates/trogon-atlas-core/tests/architectural_relationships.rs) | Value validation, exact typed endpoints, occurrence inventory and lifecycle, retargeting, subject resolution and Source ownership restrictions. |
+| [Backend relationship tests](../../rsworkspace/crates/trogon-atlas-server/tests/system_relationship_backend.rs) | Service persistence, atomic final-overlay admission, reference provenance, safe/force deletion, branch lifecycle and nested discovery budgets. |
+| [Authenticated composed fixture](../../rsworkspace/crates/trogon-atlas-server/tests/system_relationship_acceptance.rs) | Public gRPC with a real Store, parallel declarations alongside raw membership, forward/reverse provenance and exact Document/Person subjects preserved through reorder and wording edits. |
+| [Source backend tests](../../rsworkspace/crates/trogon-atlas-server/tests/source_integration_backend.rs) | Native-only isolation during Source creation and updates, with retained local relationships. |
+| [Client manifest tests](../../rsworkspace/crates/trogon-atlas-client/tests/architectural_relationship_manifest.rs) | Explicit endpoint shape, native manifest decoding and preservation. |
+| [CLI integration tests](../../rsworkspace/crates/trogon-atlas-cli/tests/architectural_relationship_cli_integration.rs) | Native manifest authoring through the CLI. |
+| [MCP integration tests](../../rsworkspace/crates/trogon-atlas-mcp/tests/mcp_integration.rs) | Native tool authoring and exact query selectors through MCP. |
+| [Studio declaration tests](../../tsworkspace/webapps/studio/src/components/ArchitecturalRelationshipDetails.test.tsx) | Loaded-view declaration inspection, exact endpoint navigation and parallel occurrences, using component fixtures. |
+
+These fixtures do not add abstract grouping, ExternalSystem-owned membership
+or actor aggregation. Studio component fixtures do not establish a deployed
+browser workflow or native persistence. Their aggregate presence does not
+establish that every requirement above has been executed.

docs/reference/system-relationship-contracts.md

@@ -1,9 +1,10 @@
 # System and service relationship contracts
 
-Status: proposed native contract, not implemented. This reference specifies
-backend requirements; it supplies no schema changes, executable acceptance
-results or runtime evidence. [Acceptance requirements](system-relationship-acceptance.md)
-remain unrun. Existing capabilities below are grounded in current source.
+Status: native relationship support is implemented in the schema, core, backend,
+CLI/MCP authoring and Studio inspection. The
+[infrastructure schema](../../proto/trogonatlas/eventmodel/v1alpha1/infrastructure.proto)
+is the wire contract. [Acceptance requirements and executable coverage](system-relationship-acceptance.md)
+distinguish service, client and component fixtures from deployment/runtime evidence.
 
 ## Scope and existing representations
 
@@ -23,7 +24,7 @@ and other implementation boundaries, with shared exact members remaining shared.
 It does not establish exclusive ownership, runtime hosting, arbitrary abstract
 system containment, a business hierarchy or transitive membership. A reference
 to an ExternalSystem does not mean the Component deploys that third party.
-This proposal does not change membership shape, admissible kinds, ordering,
+This layer does not change membership shape, admissible kinds, ordering,
 duplicate handling or existing validation. It adds no membership ConnectionRef.
 
 | Boundary | Disposition |
@@ -34,14 +35,13 @@ duplicate handling or existing validation. It adds no membership ConnectionRef.
 | System-level human interactions | Deferred. Existing slice occurrences can ground human behavior, but raw membership cannot identify which hosting assertion supports an interaction. A new aggregation/interaction selector and its lifecycle need a separate contract. |
 | General send/receive, conditional triggers and agent/tool communication | Deferred. A label may retain architectural intent but does not declare message flow, processor execution or event production. Existing typed API/observation paths retain their own meanings. |
 
-## Proposed wire shape
+## Wire shape
 
-The following names and tags are proposed implementation input, not current
-protobuf fields. Extend existing Component with `relationships` at field 8 and
-ExternalSystem with `relationships` at field 7. Both are repeated
+Component carries `relationships` at field 8 and ExternalSystem at field 7.
+Both are repeated
 `ArchitecturalRelationship` values. Existing fields retain their meanings.
 
-| Proposed message/field | Type and value contract |
+| Message/field | Type and value contract |
 | --- | --- |
 | `ArchitecturalRelationship.connection_id = 1` | Existing `ConnectionId`; required in persisted state, omitted for assignment as described below. |
 | `ArchitecturalRelationship.target = 2` | Required `ArchitecturalEndpoint`. |
@@ -129,7 +129,7 @@ reported independently, with ordinary edited-owner reference admission retained.
 
 | Surface | Required extension |
 | --- | --- |
-| Native authoring | Exact reads, guarded put/batch, validation, diff, branch operations, preview, native manifest/export and snapshot recovery preserve the proposed fields and returned identities. Advertise a new writer contract revision and mutation floor before admitting fields older writers could drop; no revision number is allocated here. |
+| Native authoring | Exact reads, guarded put/batch, validation, diff, branch operations, preview, native manifest/export and snapshot recovery preserve the fields and returned identities. Contract revision and mutation floors are 16; older writers are refused before they can drop relationships. |
 | Outgoing/incoming references | Add explicit extraction for `relationships[i].target.component` or `.external_system`, and return existing [Reference](../../proto/trogonatlas/api/eventmodel/v1alpha1/graph.proto) fields `from`, `from_uid`, `connection_id`, `from_field`, `to`. Preserve parallel occurrences and multiplicity. A path is diagnostic only. |
 | Subject discovery | ListSubjectAssignments, ListSubjectDecisions and ListSubjectDocuments match full ConnectionRef, preserving owner UID, occurrence ID and unchanged selector. Existing namespace visibility/budgets apply. New shapes must be explicitly included in scan/index provenance enrichment, not assumed indexed from protobuf reflection. |
 | Impact | Include declared target references with full occurrence provenance on returned paths. Existing owner-level reachability/one-path-per-owner behavior is not exhaustive parallel-path enumeration or a runtime dependency classifier. |
@@ -162,7 +162,7 @@ in the same store is not proof of portable migration.
 
 ## Admission, visibility and bounds
 
-All following rules are proposed requirements for this slice. Backend authority,
+The following rules govern this native slice. Backend authority,
 existing namespace access, write guards, metadata and entity size/RPC limits
 remain applicable. No catalog label or assignment grants security authority.
 
@@ -196,7 +196,7 @@ Repeated equal ReadModel edges must remain distinct; repeated storyboard moments
 must retain authored order and recurrence without invented moment IDs.
 
 Component membership alone cannot choose an interaction occurrence or prove
-hosting, a human's permissions or runtime execution. This proposal adds no
+hosting, a human's permissions or runtime execution. This layer adds no
 Persona-to-system link, interaction message, inferred actor or behavioral query.
 The absent aggregation/hosting occurrence contract is the reason for deferral;
 existing exact slice inspection remains available. UI navigation and Screen

proto/trogonatlas/eventmodel/v1alpha1/infrastructure.proto

@@ -5,6 +5,24 @@ package trogonatlas.eventmodel.v1alpha1;
 import "google/protobuf/any.proto";
 import "trogonatlas/type/v1alpha1/id.proto";
 import "trogonatlas/eventmodel/v1alpha1/identity.proto";
+import "trogonatlas/eventmodel/v1alpha1/reliability.proto";
+import "trogonatlas/eventmodel/v1alpha1/decision_document.proto";
+import "trogonatlas/type/v1alpha1/connection_id.proto";
+
+message ArchitecturalEndpoint {
+  oneof target {
+    ComponentRef component = 1;
+    ExternalSystemRef external_system = 2;
+  }
+}
+
+message ArchitecturalRelationship {
+  trogonatlas.type.v1alpha1.ConnectionId connection_id = 1;
+  ArchitecturalEndpoint target = 2;
+  CatalogTitle label = 3;
+  CatalogText doc = 4;
+}
+
 // A Component is a living implementation unit: the deployable thing that
 // hosts processors, serves UIs, projects read models, exposes APIs, and owns
 // its technology choices -- including the messaging it relies on (Kafka
@@ -20,6 +38,7 @@ message Component {
   repeated EntityRef members = 5;  // what it hosts (processors, UIs, read models, ...)
   repeated google.protobuf.Any metadata = 6;
   trogonatlas.type.v1alpha1.Id supersedes = 7;
+  repeated ArchitecturalRelationship relationships = 8;
 }
 
 // An ExternalSystem is a living third-party boundary: the APIs and webhooks
@@ -33,6 +52,7 @@ message ExternalSystem {
   repeated string tech = 4;  // e.g. "webhook", "rest", "kafka"
   repeated google.protobuf.Any metadata = 5;
   trogonatlas.type.v1alpha1.Id supersedes = 6;
+  repeated ArchitecturalRelationship relationships = 7;
 }
 
 // Delivery status of a tracked item. Lives ONLY in Trackers -- design