SAFE CORE ADOPTION
Compare the current pipeline with Core without changing authority
assemble --architecture-mode shadow runs an observational Core pass after legacy validation and writes evidence, claims, the canonical contract, policy decision, workflow/events, and a comparison under <run-dir>/core/. The legacy result, score, approval, Foundry state, and exit code stay authoritative; the default mode creates no core/.
assemble --architecture-mode strict is the blocking candidate path: a passing legacy run must re-prove every supported material claim against exact evidence before it writes an unapproved Core release. Evidence gaps fail the run, and Foundry rechecks the strict execution record before any human approval; strict itself never publishes or changes Foundry.
Its claim-level ledger records explicit_support, derived_support, contradicts, or insufficient from each material claim path to an exact typed fragment and source artifact. Optional v1 evidence[] references re-materialize before a run exists and verify source identity, locator, digest, and claim path. Prose without a parsed scalar can support only its one exact bound claim; versioned OpenAPI structural derivations are allowlisted and recomputed with every required local-reference context fragment. Runtime confidence never decides support, and a whole-document legacy citation remains unverified. Inspect relationships.json and projections/provenance.json for the exact trace.
Core retains tested, pure GraphQL/AsyncAPI compiler seams, but exposes no CLI or run workflow for either format until a named downstream consumer supplies a real source set and acceptance contract. Format fixtures prove compiler testability, not product demand or end-to-end grounding.