<a id="week-05-day-02"></a>

#### Day 22 — Give every graph edge a type, scope and evidence status

**Theory and mechanism.** An investigative graph represents claims and records, not just entities that look connected. Name the node layer—source record, session label, device label, application request or claimed job tag—and type the relationship. An edge should identify its source fields, namespace assumptions, time/scope and status. Equality is a comparison result; a validated correlation additionally needs a producer contract and trustworthy provenance; a causal claim needs a supported mechanism. Even a demonstrated technical mechanism would not automatically identify a human.

The following edge list is a precise graph representation. Each row defines its endpoints and relationship; it does not turn a dashed or missing relationship into an observed causal arrow.

| Endpoints | Edge type | Supplied evidence | Status / limit |
|---|---|---|---|
| C03 identity field ↔ C09 identity field | Literal session-value equality | Both supply `s-77` | Equality within supplied records; namespace/provenance still need validation |
| C05 application field ↔ C12 application field | Literal request-value equality | Both supply `q-144` | C12 supplements the application record; not independent proof of external origin |
| C09 client label ↔ C04 device label | Cross-source label similarity | Both display `runner-03` | No authenticated process-to-session relationship |
| C09 session ↔ C05 request | Proposed cross-source correlation | Application session field is blank | Direct join unavailable; neither cause nor unrelatedness is established |
| C12 claimed tag ↔ scheduler run | Claimed provenance | `batch-17` is self-reported | Actual run/source relationship not supplied |

**Worked contrast.** A path from “same account” through “same minute” to “same operation” silently changes edge type twice. Multiple weak similarities do not compose into a strong join. A better graph retains `s-77` and `q-144` as separate identifiers and records the custodian question that might supply a trustworthy cross-reference. If no such key exists, a direct identifier join is unavailable; a different corroboration method would need its own assumptions and limits.

**Offline W5-EDGE contract control.** This isolated Python 3 program tests declared comparison rules. CTN-looking rows reproduce bounded labels only; `TRAINING-KEY` is a separate synthetic positive control whose namespace contract is **assumed for the fixture**, not authenticated by the program. No network, files or real records are touched.

~~~python
def edge_status(left, right, left_ns, right_ns, contract_checked):
    if left is None or right is None or left == "" or right == "":
        return "UNKNOWN_MISSING_KEY"
    if left != right:
        return "UNEQUAL_VALUES_IN_THIS_TEST"
    if left_ns != right_ns:
        return "LABEL_EQUAL_NAMESPACE_UNVERIFIED"
    if contract_checked is not True:
        return "VALUE_EQUAL_SEMANTICS_UNVERIFIED"
    return "SCOPED_KEY_MATCH_NOT_CAUSATION"

examples = [
    ("IDENTITY", "s-77", "s-77", "idp", "idp", False),
    ("CLIENT-DEVICE", "runner-03", "runner-03", "idp-client", "endpoint-device", False),
    ("DIRECT", "s-77", None, "idp", "application", False),
    ("TRAINING-KEY", "train-q1", "train-q1", "training:req-v1", "training:req-v1", True),
    ("TRAINING-MISMATCH", "train-q1", "train-q2", "training:req-v1", "training:req-v1", True),
    ("TRAINING-EMPTY", "", "", "training:req-v1", "training:req-v1", True),
]
for name, *fields in examples:
    print(name, edge_status(*fields))
assert edge_status("x", "x", "a", "b", True) == "LABEL_EQUAL_NAMESPACE_UNVERIFIED"
~~~

**Executed output for these exact declarations:**

~~~text
IDENTITY VALUE_EQUAL_SEMANTICS_UNVERIFIED
CLIENT-DEVICE LABEL_EQUAL_NAMESPACE_UNVERIFIED
DIRECT UNKNOWN_MISSING_KEY
TRAINING-KEY SCOPED_KEY_MATCH_NOT_CAUSATION
TRAINING-MISMATCH UNEQUAL_VALUES_IN_THIS_TEST
TRAINING-EMPTY UNKNOWN_MISSING_KEY
~~~

The positive control returns a scoped key match rather than causation. The cross-namespace assertion shows why a declared checked flag cannot repair incompatible namespace labels. If someone falsely sets the identity contract flag to True, the classifier will trust that declaration; it cannot authenticate a custodian's evidence. The program assumes otherwise well-formed string identifiers and explicit namespace labels, and is not a general graph-validation service.

**Practice and limit.** Complete [EX022](#exercise-ex022), retaining C5/C5X outputs and adding W5-EDGE. Explain one missing and one cross-namespace edge, then compare the [worked answer](#answer-ex022). None of these fixtures validates the producer contract or demonstrates the missing CTN session-to-request join.

**Continue studying — course Day 22:** [Previous: Day 21](#week-05-day-01) · [Week 5 index](#ch-05) · [Course index](../SUBJECTS.md) · [Next: Day 23](#week-05-day-03).

### Exercise for this lesson

<a id="exercise-ex022"></a>
**EX022 — Join audit.** Objective: type graph edges and distinguish equal labels from demonstrated correlation. Input: C03–C05/C09/C12, C5/C5X and Day 22's W5-EDGE control. Give an edge list or graph among the supplied session, device, request and tag records; label source fields, namespace/scope assumptions and evidence status. Identify the missing session-to-request relationship and a permitted producer-contract/known-good trace check that could test it. Reproduce all three offline transcripts, separating declared inputs from authenticated evidence. Rubric: 0 = causal/human attribution or fabricated key; 1 = correct equalities but incomplete types, namespace limits or controls; 2 = traceable typed edges, unknown missing join, correct outputs and a source-specific validation request. [Worked answer](#answer-ex022).

## Worked answers

<a id="answer-ex022"></a>
**EX022 — Model join audit.** Supported **within supplied records**: C03 and C09 both report `s-77`; C09 associates that session with client `runner-03`; C04 independently reports a browser on `runner-03`. C05/C12 bind `q-144` to an S42 edit and a self-reported `batch-17` tag. **Unsupported:** direct `s-77`→`q-144` causal link, C04 process→IdP session, tag→validated job run, or any human attribution. Ask the application/identity custodians whether a trustworthy common session or request ID exists across the relevant sources, and test its semantics on an authorized known-good transaction. If no common key exists, state that a direct join is unavailable.

**Additional worked reasoning (EX022 — Exact-field join reasoning.):** C03/C09 share `s-77` in identity fields; C05/C12 share `q-144` in application fields. C09's `runner-03` client matches a *label* in C04 but not an authenticated process/session join. C05 has no session ID, so `s-77` cannot be directly joined to `q-144`. Request producer documentation or an approved known-good trace where the same explicit transaction/session identifier is emitted across both sources. The original C5 and new C5X lab are equality demonstrations; neither identifies a person or proves that batch-17 truly ran.

**Week 5 Day 22 — worked typed graph.** Record C03↔C09 `s-77` as literal identity-field equality, C05↔C12 `q-144` as application-field equality, C09↔C04 `runner-03` as cross-source label similarity, and C09 session↔C05 request as an unavailable direct join. C12 tag↔scheduler is a claimed-provenance lead, not an observed run. A proposed known-good trace must identify source namespaces, uniqueness/reuse scope, complete field path and a permitted transaction whose source receipts can be checked; the trace is not supplied by CTN. C5 prints three lines, C5X five and W5-EDGE six. W5-EDGE's synthetic checked-namespace positive control yields SCOPED_KEY_MATCH_NOT_CAUSATION, while the missing key remains UNKNOWN_MISSING_KEY and equal client/device labels remain LABEL_EQUAL_NAMESPACE_UNVERIFIED. Its Boolean contract flag is a supplied premise, not authentication. Equality edges cannot be composed through a shared account and minute into a causal path. An unavailable join is also not proof the events are unrelated.