experiment_id: EXP-CALM-2
title: "CALM flow <-> PathwayRun / Trust Key provenance binding"
hypothesis: H-HG-2
channel: djat-poc-hypergraph-20260716
status: designed

premise: >
  A CALM flow and the cryptographic evidence of the process it describes should be
  two views of one artifact. Each vulnerability-lifecycle transition names a pathway
  and a Trust Key deep link; executing them should reconstruct the flow.

inputs:
  calm_flow: ../flows/vulnerability-lifecycle.flow.calm.json
  pathways_dir: ../../hypergraph-pathways/pathways/
  trust_key_issue: ../../trust-key/pathways/Pathways.TrustKey.Issue@v1.yaml

method:
  - "For each transition (sequence-number order), launch the named Hypergraph.* pathway."
  - "Bind each run's Aqua stub into a Trust Key root (Pathways.TrustKey.Issue@v1)."
  - "Emit the transition's trust_key_deep_link from the root and confirm it resolves back to the transition."
  - "Reconstruct the transition graph from the runs and compare to the CALM flow."

metrics:
  - name: graph_isomorphism
    target: "reconstructed graph == CALM flow transitions"
  - name: deep_link_offline_verify_rate
    target: "1.00"

success_criteria: >
  Reconstructed transition graph is isomorphic to the CALM flow and every deep link
  verifies offline against the trust card.

pathways:
  - Hypergraph.Incident.PrivateReport@v1
  - Hypergraph.Incident.HonorResponse@v1
  - Hypergraph.Map.EmergeIntersection@v1
  - Hypergraph.Underwrite.ThreatProfile@v1
  - Pathways.TrustKey.Issue@v1
  - Pathways.TrustKey.Verify@v1
provenance:
  trust_key_dimension: "calm_flow + pathway + run_id"