Polichinel · Aug 12, 2026 · Aug 4, 2026 · Aug 4, 2026 · Aug 4, 2026 · Aug 4, 2026
diff --git a/.github/workflows/run_pytest.yml b/.github/workflows/run_pytest.yml
@@ -27,36 +27,44 @@ jobs:
     # is normal. The consequence was that CI verified strictly LESS than a developer's
     # laptop, and precisely on the guards that matter most across a repo boundary.
     #
-    # Measured 2026-08-03 (402 collected in all three runs, so the delta is entirely
-    # skips):
-    #   local, all siblings present   362 passed / 40 xfailed /  0 skipped
-    #   CI, bare checkout             347 passed / 38 xfailed / 17 skipped
-    #   CI, with the checkout below   348 passed / 38 xfailed / 16 skipped
+    # WHICH siblings are checked out is NOT decided here. It is declared in
+    # `tests/conftest.py::SIBLINGS`, and `tests/test_ci_sibling_coverage.py` fails if
+    # this file and that declaration disagree — in either direction. ADR-016.
     #
-    # So this recovers exactly ONE test — the cross-seam consumer-name check for CRAF'd.
-    # That is worth having (it is the §4.1a pin, whose failure mode is a delivery nobody
-    # can find) but it is one, not seventeen. The other sixteen are below.
+    # The prose that used to live here said views-appwrite was PRIVATE. It went public
+    # on 2026-08-08 and the comment did not, so seven checks stayed dark for no reason.
+    # That is why the fact now lives in a declaration carrying the date it was checked,
+    # rather than in a paragraph.
     #
-    # Only views-crafdapi is checked out, and the choice is deliberate:
+    # `ref: main` is deliberate on every sibling and is not a default. Without it
+    # `actions/checkout` takes the sibling's OWN default branch — which for
+    # views-appwrite is `development` — while ADR-014 §3 says the authority for a claim
+    # about another repository is that repository's `main`. Two checks in
+    # test_env_declaration read the working tree and a third demands reachability from
+    # `main`; pointed at `development` they would eventually demand contradictory things.
     #
-    #   views-crafdapi   PUBLIC, and its check reads source text -> enabled here.
-    #   views-datafactory  PUBLIC, but its 8 tests need the producer's raw GAUL
-    #                    parquets (`data/raw/gaul_admin/*.parquet`), which are NOT in
-    #                    its git repository. Checking it out converts an honest skip
-    #                    into a FileNotFoundError. Measured, not assumed — it was tried.
-    #   views-appwrite   PRIVATE. The registry-drift detectors live here and are the
-    #   views-faoapi     most valuable of the lot; enabling them needs a token, which
-    #                    is an operator decision. Register C-46 and C-57 both carry
-    #                    that as their standing residual, and it is still open.
     # `actions/checkout` refuses a path outside $GITHUB_WORKSPACE, so the siblings go
     # inside it and are pointed at by the declared env vars instead of the conventional
     # `../<name>` location. `sibling_repo` checks $VIEWS_<NAME> first, precisely so the
-    # location can be declared rather than assumed.
-    - name: Checkout views-crafdapi (sibling)
+    # location can be declared rather than assumed. `_siblings/` specifically: it is
+    # excluded from ruff in pyproject.toml, and the Lint step reported 745 findings in
+    # someone else's test suite the first time a sibling landed outside it.
+    #
+    # No `token:` on any step below, and that is load-bearing rather than an omission:
+    # the default GITHUB_TOKEN is scoped to THIS repository, so a tokenless checkout of a
+    # private repository simply fails, loudly, at this step.
+    #
+    # An earlier version of this comment said that "verifies the `public` field". There is
+    # no such field: `public` was deleted from `SIBLINGS` on 2026-08-10 because nothing
+    # could verify it, and ADR-016 §4 now says so explicitly. A comment in THIS file
+    # asserting a fact about another repository that nothing checks is the founding
+    # incident of ADR-016 §3, and it had reappeared here.
+    - name: Checkout views-appwrite (sibling)
       uses: actions/checkout@v3
       with:
-        repository: views-platform/views-crafdapi
-        path: _siblings/views-crafdapi
+        repository: views-platform/views-appwrite
+        ref: main
+        path: _siblings/views-appwrite
         fetch-depth: 0
 
     - name: Set up Python
@@ -80,7 +88,7 @@ jobs:
 
     - name: Run tests
       env:
-        VIEWS_CRAFDAPI: ${{ github.workspace }}/_siblings/views-crafdapi
+        VIEWS_APPWRITE: ${{ github.workspace }}/_siblings/views-appwrite
       run: |
         set -e
         poetry run pytest tests/
diff --git a/README.md b/README.md
@@ -50,7 +50,7 @@ Requires **Python 3.11–3.14**.
 | Package | Version | Why |
 |---------|---------|-----|
 | `views-pipeline-core` | `>=3.0.0,<4.0.0` (with the `appwrite` extra) | The framework: lifecycle base classes, data loader, dataset container, Appwrite/datastore tools |
-| `views-frames` | `>=1.10.2,<2` | The frame data contract — **the live delivery representation** since #126. pandas survives only in `contract/enrichment.py` (the build/verification path) |
+| `views-frames` | `>=1.10.2,<2` | The frame data contract — **the live delivery representation** since #126. There is no pandas in this package at all since #90 |
 | `pyarrow` | `>=16.1.0,<17.0.0` | The wire's serialisation. **Pinned deliberately** — the CVE fix past 17 changes delivered bytes (register C-72) |
 | *dev group* | `pytest`, `ruff` | Not installed by `pip install views-postprocessing`; `poetry install` includes them |
 
@@ -142,7 +142,6 @@ views-postprocessing/
     │   ├── historical.py            # the historical artifact, built pandas-free
     │   ├── gaul_lookup.py           # the GAUL asset: path, version, one read
     │   ├── gaul_schema.py           # the 9-column contract, declared as data
-    │   ├── enrichment.py            # GaulLookupEnricher (build/verification path)
     │   ├── source_metadata.py       # producer (datafactory) facts
     │   ├── store_metadata.py        # prediction-store facts
     │   └── launch_config.py         # the delivery mode the launcher must declare
@@ -220,7 +219,7 @@ only `.py`; it now scans markdown too.)*
 |-----|----------------|
 | [`docs/architecture/role_and_seams.md`](docs/architecture/role_and_seams.md) | **Start here** — role vs the sibling repos + internal seams |
 | [`docs/ADRs/`](docs/ADRs/) | Architecture decisions (esp. ADR-011 mapper→lookup; ADR-012 ontology) |
-| [`docs/CICs/`](docs/CICs/) | Class intent contracts (`UNFAOPostProcessorManager`, `GaulLookupEnricher`) |
+| [`docs/CICs/`](docs/CICs/) | Class intent contracts (`UNFAOPostProcessorManager`) |
 | `reports/technical_risk_register.md` | Tracked risks — C-40 (the remaining pipeline-core inheritance), C-30/C-15 (delivery guards), C-43 (enrichment value verification) |
 
 ---

diff --git a/docs/ADR-011_implementation_assessment.md b/docs/ADR-011_implementation_assessment.md
@@ -1,6 +1,14 @@
 # ADR-011 Implementation Assessment
 
 **Last updated:** 2026-06-12
+> **This is a dated snapshot (2026-06-12), not a description of the code today.** It is
+> kept as a record of what was known when ADR-011 was assessed. Several things it
+> describes as current have since been removed — notably the `.env` credential borrow
+> (killed by þing-01 #134; the environment is now declared and validated fail-loud in
+> each partner's `appwrite_env.py`) and `self.ensemble_path_manager`, which stopped
+> existing on 2026-08-05 when store construction moved off the manager class (register
+> C-40). Read §8 in particular as history.
+
 **Status:** Data prerequisites MET — see §10. Implementation unblocked on the data side; verification infrastructure (Appwrite, pipeline-core E2E) still required before switching the pipeline.
 
 ---

diff --git a/docs/ADRs/000_use_of_adrs.md b/docs/ADRs/000_use_of_adrs.md
@@ -3,7 +3,7 @@
 
 **Status:** Accepted  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 **Informed:** All contributors  
 
 ---

diff --git a/docs/ADRs/001_ontology_of_views_postprocessing.md b/docs/ADRs/001_ontology_of_views_postprocessing.md
@@ -3,7 +3,7 @@
 
 **Status:** Superseded by [ADR-012](012_revised_ontology.md) (2026-06-27)  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 
 ---
 

diff --git a/docs/ADRs/002_topology_and_dependency_rules.md b/docs/ADRs/002_topology_and_dependency_rules.md
@@ -2,7 +2,7 @@
 
 **Status:** Accepted — amended 2026-06-27 (see [Amendment](#amendment-2026-06-27))  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 
 ---
 

diff --git a/docs/ADRs/003_authority_of_declarations_over_inference.md b/docs/ADRs/003_authority_of_declarations_over_inference.md
@@ -3,7 +3,7 @@
 
 **Status:** Accepted  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 
 ---
 

diff --git a/docs/ADRs/005_testing_as_mandatory_critical_infrastructure.md b/docs/ADRs/005_testing_as_mandatory_critical_infrastructure.md
@@ -3,7 +3,7 @@
 
 **Status:** Accepted  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 
 ---
 

diff --git a/docs/ADRs/006_intent_contracts_for_non_trivial_classes.md b/docs/ADRs/006_intent_contracts_for_non_trivial_classes.md
@@ -3,7 +3,7 @@
 
 **Status:** Accepted  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 
 ---
 

diff --git a/docs/ADRs/007_silicon_based_agents_as_untrusted_contributors.md b/docs/ADRs/007_silicon_based_agents_as_untrusted_contributors.md
@@ -3,7 +3,7 @@
 
 **Status:** Accepted  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 
 ---
 

diff --git a/docs/ADRs/008_observability_and_explicit_failure.md b/docs/ADRs/008_observability_and_explicit_failure.md
@@ -3,7 +3,7 @@
 
 **Status:** Accepted  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 
 ---
 

diff --git a/docs/ADRs/009_boundary_contracts_and_configuration_validation.md b/docs/ADRs/009_boundary_contracts_and_configuration_validation.md
@@ -2,7 +2,7 @@
 
 **Status:** Accepted  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 
 ---
 

diff --git a/docs/ADRs/010_technical_risk_register.md b/docs/ADRs/010_technical_risk_register.md
@@ -2,7 +2,7 @@
 
 **Status:** Accepted  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 
 ---
 

diff --git a/docs/ADRs/011_replace_runtime_mapper_with_precomputed_lookup.md b/docs/ADRs/011_replace_runtime_mapper_with_precomputed_lookup.md
@@ -1,8 +1,10 @@
 # ADR-011: Replace Runtime Spatial Mapper with Precomputed Lookup Table
 
+<!-- legacy-ok-file: this ADR IS the decision to retire the runtime mapper. `PriogridCountryMapper`, `mapping.py`, `geopandas` and the cache machinery are its subject, named throughout and correctly. Marking the document once says that where a reader sees it; marking fourteen lines would be noise pretending to be rigour. -->
+
 **Status:** Accepted  
 **Date:** 2026-06-02  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 **Consulted:** FAO-FSFC (via Pre-release Note 02 and Release Note 02 confirmation)  
 **Informed:** All contributors, UN FAO operational team  
 

diff --git a/docs/ADRs/012_revised_ontology.md b/docs/ADRs/012_revised_ontology.md
@@ -2,7 +2,7 @@
 
 **Status:** Accepted  
 **Date:** 2026-06-27  
-**Deciders:** Project maintainers (PRIO MD&D Team)  
+**Decider:** Simon Polichinel von der Maase  
 **Supersedes:** [ADR-001](001_ontology_of_views_postprocessing.md)
 
 ---
@@ -14,7 +14,7 @@ a **runtime spatial-mapping engine** and **bundled shapefiles** as the authorita
 stable core. That architecture no longer exists:
 
 - [ADR-011](011_replace_runtime_mapper_with_precomputed_lookup.md) replaced the runtime
-  geopandas mapper with a **precomputed GAUL lookup table** (`GaulLookupEnricher`).
+  geopandas mapper with a **precomputed GAUL lookup table**. <!-- legacy-ok: records what ADR-011 replaced; the mapper is the predecessor, not the present -->
 - The mapper, shapefiles, and caching machinery were deleted (C-39 / PR #42).
 - Input-integrity invariants and structured delivery were added (epic #51).
 
@@ -58,9 +58,9 @@ described the cut-a-repo case; it now says which is which.
 | Category | Purpose | Authority | Stability |
 |----------|---------|-----------|-----------|
 | **Delivery Invariants** | Representation-free rules over primitives that a delivery must satisfy: coverage, no-collapse, gid parity, observed-range, provenance. Live in `delivery/` — **nothing there imports pandas or views_frames**. *Forecast identity was one of these until 2026-07-31 — see the amendment below.* | Authoritative — they define what a valid delivery is | Stable — changes are governance decisions |
-| **Representation Seam** | `contract/frame_extraction.py` — turns a `views_frames` frame into the primitives the invariants consume. **One seam.** Its pandas sibling `unfao/extraction.py` was deleted in #151 once the pandas delivery was retired; the two ran as deliberate WET siblings through the migration. | Derived — isolates the representation so invariants stay representation-free | Evolving |
+| **Representation Seam** | `contract/frame_extraction.py` — turns a `views_frames` frame into the primitives the invariants consume. **One seam.** Its pandas sibling `unfao/extraction.py` was deleted in #151 once the pandas delivery was retired; the two ran as deliberate WET siblings through the migration. | Derived — isolates the representation so invariants stay representation-free | Evolving | <!-- legacy-ok: states that the pandas sibling WAS deleted in #151 — the retirement is the claim -->
 | **Wire Mechanism** | `contract/wire/` — the ADR-013 contract: header, shard, sidecar, run manifest, sink, source selection. Partner-neutral: it takes its consumer name and collapse floor as **arguments** (#153). | Authoritative — the contract with the consumer | Stable — changes are contract amendments |
-| **Enrichment Asset** | The precomputed GAUL lookup (`data/gaul_lookup.parquet`), its identity in `contract/gaul_lookup.py`, its schema in `contract/gaul_schema.py`, and the keyed gather that joins it (`contract/enrichment.py`, the build/verification path — numpy/pyarrow since #89; see register **C-75** on whether that class should survive at all). | Authoritative for geographic metadata | Stable — rebuilt only when the producer releases new GAUL data |
+| **Enrichment Asset** | The precomputed GAUL lookup (`data/gaul_lookup.parquet`), its identity in `contract/gaul_lookup.py`, its schema in `contract/gaul_schema.py`, and the keyed gathers that join it — `contract/historical.py` for the actuals artifact and `contract/wire/sidecar.py` for the §5 sidecar. *(A second gather lived in `contract/enrichment.py` with no production caller; retired in #90, register **C-75**.)* | Authoritative for geographic metadata | Stable — rebuilt only when the producer releases new GAUL data | <!-- legacy-ok: records the second gather that was retired in #90 -->
 | **Artifact Builders** | `contract/historical.py` — turns a frame plus the lookup into the partner-facing artifact. | Derived | Evolving |
 | **External Facts** | Facts read from systems this repo does not own: the producer's (`contract/source_metadata.py` — `last_valid_month_id`, D-07) and the store's (`contract/store_metadata.py`). | Authoritative (the owning system is the source of truth) | Evolving |
 | **Launch Declarations** | `contract/launch_config.py` — the delivery mode the launcher must declare. Omitting a key is **refused by name**, never inferred (ADR-003, register C-63). | Authoritative | Stable |
@@ -70,10 +70,10 @@ described the cut-a-repo case; it now says which is which.
 
 **Two claims this ADR made until 2026-08-01, both now corrected rather than quietly dropped**
 (register C-67). It called the manager *"the **thin** `UNFAOPostProcessorManager`"* when it was
-636 lines holding two of everything, and it called `unfao/extraction.py` *"the **single**
+636 lines holding two of everything, and it called `unfao/extraction.py` *"the **single** <!-- legacy-ok: quotes the false claim this ADR was written to correct -->
 pandas-aware module"* when pandas lived in three. Both drifted the same way: the ADR described
 the intended end state of a migration that then stopped one step short. Both are now true —
-pandas has **zero runtime importers** (#89 made `contract/enrichment.py`'s a type-only import under `if TYPE_CHECKING` — pandas is in that class's interface, not its implementation) — and the load-bearing ones are
+pandas is **absent from the package entirely** (#89 reduced the last one to a type-only import; #90 retired the module that held it — register C-75) — and the load-bearing ones are
 **mechanically checked** by `tests/test_doc_accuracy.py`, so the next drift fails CI instead of
 waiting for an audit.
 
@@ -129,7 +129,7 @@ Seam" wording will need a light touch (the seam stays; its internals change).
 
 ## Amendment 2026-07-31 — forecast identity re-homed to the wire layer (#150, epic #148)
 
-**`views_postprocessing/delivery/identity.py` is retired.** The "Delivery Invariants" row
+**`views_postprocessing/delivery/identity.py` is retired.** The "Delivery Invariants" row <!-- legacy-ok: the amendment recording that identity.py is retired -->
 above listed *forecast identity* among the authoritative rules; that module no longer
 exists, and this amendment records where the rule went so a reader of the row is not
 looking for deleted code.