Every box on this page runs in production. Components that were designed, measured, and rejected are listed at the bottom — absent from the product, so absent from the diagram.
The wrong-version twin must be excluded before ranking. Ranking it high and filtering after is the incumbent failure mode with an extra step.
entity → version → scope. Declared aliases and family aliases, never inferred. Dictionary-word names require a second signal before a recipe is served — a coincidence is not a name.
Version binds from evidence: exact match, else a single agreeing major, else nothing — ambiguity never picks. No scoping evidence → abstention, with what would resolve it. Never a ranked guess over the whole corpus.
Dependency closure defines the candidate set — a filter, never a fused score. BM25 ranks within it. Scope is carried inside the index and matched as phrases at weight 0: a filter expressed in the index, never a ranking signal.
Token budget honored per call. Citations, provenance and receipts are never truncated; long bodies degrade behind a self-describing cursor, never disappear.
No package, no local process, nothing to update. /mcp — free, no key, ever. /mcp/oauth — GitHub sign-in, free, 10× daily budget. A token on the free route is refused, never silently honored.
Durable Object limiter. A refusal is a typed answer naming which window blocked and what raises it — never a transport 429 that kills the whole exchange.
Five primitives, small schemas by rule. The surface is an eval subject. No meta-tools, no dynamic tool discovery.
Every unit labelled project@version with as_of. Superseded APIs may appear — only with their version label beside them. Disagreements are stated, never reconciled silently.
Sources cite immutable refs — commit SHAs, version-locked registry artifacts. A citation that cannot be re-fetched is treated as a defect, not a style choice.
Recipes validated by a person against live chains, served with transaction hashes anyone can check by RPC. The stamp attests the integration ran; the receipts are how you check it.
Dependency graph (WITH RECURSIVE, depth-capped) · identifier index · version predicates · typed tables (addresses / ABIs / EIPs) · recipes. No virtual tables — stays exportable. Read replication on from day one.
FTS5 with verbatim compounds + camelCase/snake subtokens — the identifier gap closes at ingest, not at query time. Rebuild-from-source is the recovery path.
Content-addressed bodies · response cache keyed on the deployed code version — a deploy invalidates by construction, because a cache key that omits the code is a wrong answer with good latency.
gated behind an ablation it has not won
precision measured above the threshold that would justify one
measured to hurt code; never on the hot path
waits for real traffic to tune against