Auditor submits links ONLY — the edges argument is gone (owner, 2026-09-28 evening)

Hypothesis under test by the owner: coherent extractions turn to mush
after merging because the auditor minted too many bridging edges of its
own — inference, not identity, and out of the auditor's scope. The graph
now connects across sources solely through identified equivalences;
relations between propositions come from the extractor alone.

- auditSchema drops 'edges' (submit_review = links only); the submit-seam
  required-field doctrine reworded per tool
- AUDITOR_INSTRUCTIONS: the BRIDGING EDGES section dies; deliverable is
  the identity verdicts only
- AuditVerdicts drops edges; ExtractedEdge endpoints are extractor-local
  ids only; mergeFindings stops consuming verdict edges and its resolve()
  drops the raw-node-id branch (dead — the extractor never sees graph ids)
- extractor untouched: submit_findings keeps propositions + follows/
  supports edges, required as before
- tests: 17 submit fixtures + 9 typed verdict literals slimmed to links
- docs: architecture.md division-of-trust + pipeline diagram updated

src/core/contracts/graph.ts

@@ -36,9 +36,7 @@ export interface EmissionStats {
 
 /** One provenance point — message-granular (DECIDED 2026-09-02): nodes and
  *  edges record every (chat, message) where they came up, deep-linkable to
- *  the exact transcript point. Auditor-drawn bridging edges carry the chat
- *  but NO message anchor (nothing in the transcript asserts them — the
- *  auditor is the asserter); messageId is "" there. */
+ *  the exact transcript point. */
 export interface ProvenancePoint {
 	/** The chat this point anchors to — or a notes source id ("src_…"):
 	 *  imports carry no message anchors (provenance is the file itself,
@@ -211,14 +209,12 @@ export interface ExtractedProposition {
 }
 
 /** One proposed relation. Endpoints are extractor-local proposition ids
- *  ("p1", …); the AUDITOR may also emit bridging edges whose from/to is an
- *  EXISTING graph node id (connecting the new content to what the graph
- *  already holds) — the merger resolves both. */
+ *  ("p1", …) — the extractor is the ONLY stage that ever proposes edges
+ *  (the auditor's edges argument is gone, owner 2026-09-28 evening). */
 export interface ExtractedEdge {
-	/** Proposition id (or, for auditor-drawn bridges, a graph node id)
-	 *  that is followed / supported. */
+	/** Proposition id that is followed / supported. */
 	from: string;
-	/** Proposition id (or graph node id) that follows / is supported. */
+	/** Proposition id that follows / is supported. */
 	to: string;
 	type: EdgeType;
 }
@@ -244,14 +240,13 @@ export interface IdentityLink {
 /** The auditor's output — VERDICTS ONLY (owner, 2026-09-28): the auditor
  *  never alters the extractor's findings, so it does not restate them;
  *  the deterministic merger joins findings + verdicts. `links` = the
- *  identity verdicts (local id ⇄ existing node); `edges` = BRIDGING
- *  edges the auditor draws from existing graph nodes to the batch's
- *  propositions (endpoints: existing node ids and/or local proposition
- *  ids). No drop channel — the auditor never rejects; the extractor is
- *  fully trusted (2026-09-27). */
+ *  identity verdicts (local id ⇄ existing node) — the auditor's ENTIRE
+ *  deliverable (owner, 2026-09-28 evening: the edges argument is GONE —
+ *  the auditor never mints edges; the graph connects across sources
+ *  solely through identified equivalences). No drop channel — the
+ *  auditor never rejects; the extractor is fully trusted (2026-09-27). */
 export interface AuditVerdicts {
 	links: IdentityLink[];
-	edges: ExtractedEdge[];
 }
 
 /** The GET /api/graph payload — everything the home view's PURE renderer needs. */

src/core/graph.ts

@@ -11,10 +11,11 @@
  *                      from the source ALONE (whole session as markdown,
  *                      or raw notes). Fully trusted: no stage re-checks it.
  *   auditor (LLM)    → AuditVerdicts: identity links (local id → an existing
- *                      node, or create) via graph-exploration tools, plus
- *                      any BRIDGING edges it draws between existing graph
- *                      nodes and the new propositions. Never sees the
- *                      source; never drops.
+ *                      node, or create) via graph-exploration tools —
+ *                      links ONLY (owner, 2026-09-28 evening: the auditor
+ *                      never mints edges; cross-source connection happens
+ *                      solely through identified equivalences). Never sees
+ *                      the source; never drops.
  *   merger (HERE)    → mergeFindings(): deterministic ledger appends
  *
  * The merger is deliberately the ONLY stage that touches the ledgers, and it
@@ -199,8 +200,9 @@ export function mergeFindings(
 		if (line.provenance.some((pt) => pt.chatId === chatId)) assertedByChat.add(key);
 	}
 	const emitEdge = (edge: ExtractedEdge): void => {
-		const resolve = (endpoint: string): string | undefined =>
-			mapping.get(endpoint) ?? (existingIds.has(endpoint) ? endpoint : undefined);
+		// Extractor-local ids only — the auditor's bridging edges are gone
+		// (owner, 2026-09-28 evening), so raw node-id endpoints no longer occur.
+		const resolve = (endpoint: string): string | undefined => mapping.get(endpoint);
 		const from = resolve(edge.from);
 		const to = resolve(edge.to);
 		if (!from || !to || from === to) return; // unresolvable endpoint — skip
@@ -210,8 +212,7 @@ export function mergeFindings(
 		assertedByChat.add(key);
 		stats.edges++;
 	};
-	for (const edge of findings.edges) emitEdge(edge);
-	for (const edge of verdicts.edges) emitEdge(edge);
+	for (const edge of findings.edges) emitEdge(edge); // the extractor's edges — the ONLY edge source
 
 	// 3. Checkpoint — THE COVERAGE DISCIPLINE (vision-extraction-coverage.md):
 	//    only now, after every append succeeded, is the batch covered. The