feat(banker): Banker QA workflow + KG edge waves + IC Pyramid — integrated with main 8.0.2 (wrapped subagents, dormant flag-off)

.claude/skills/client-audit-export/SKILL.md

@@ -52,9 +52,37 @@ The skill reuses `_shared/gcp-fleet-discover.sh` for multi-client discovery when
 | `source_writes` | upstream API source provenance (Wave 2) | safe |
 | `citation_verdicts` | per-footnote G5 verification verdicts (v6.8.6 T1) — CONFIRMED/UNCONFIRMED/ERROR/SKIP/PASS_WITH_NOTE + verification method + paywalled flag + notes | safe |
 | `citation_verification_certificate` | full G5 certificate markdown (the canonical proof artifact for Art. 13 query reconstruction) | safe |
+| `kg_nodes`, `kg_edges`, `kg_provenance`, `kg_evolution` | Knowledge Graph audit chain — every fact/risk/recommendation node, every relationship between them, the agent + tool + raw text that produced each, and the chronological discovery timeline. Edge-type-agnostic export captures all 11 edge types (see table below). | safe — contains no PII; entity names are deal-public |
 
 `pii_mappings.encrypted_value` is **never** included in the bundle. The query in `range-query.py` selects only `pseudonym_id`, `created_at`, and `pii_type` — never the encrypted payload.
 
+### KG Edge Types in the Export (v6.16.0 Waves 1-4)
+
+The `kg_edges` export captures rows across all edge types present in the client's sessions during the export window. As of v6.16.0, eleven edge types are possible (subject to which `KG_*` flags were active for the client at session-time):
+
+| Edge type | Source → Target | Wave | Activation flag | Extraction tier |
+|---|---|---|---|---|
+| `CITES` | report → citation | pre-Wave | always on | Phase 1c regex |
+| `GROUNDED_IN` | question → section | pre-Wave (banker mode) | `BANKER_QA_OUTPUT` | Phase 1c § ref matcher |
+| `INFORMS` | question → question | 3 | `KG_QA_INFORMS_EDGES` | Phase 1c regex (`Q\d+` refs) |
+| `MIRRORS_RISK` | precedent → risk | 1 | `KG_SEMANTIC_EDGES` | Phase 4d embedding cosine ≥ 0.70 |
+| `RELATED_RISK` | risk ↔ risk | 1 | `KG_SEMANTIC_EDGES` | Phase 4d embedding cosine ≥ 0.80 |
+| `CONVERGES_WITH` | fact ↔ fact | 1 + 4 reinforce | `KG_SEMANTIC_EDGES` (+ `KG_CONTRADICTION_EDGES` for numeric reinforcement) | Phase 4d embedding cosine ≥ 0.85 (W1), Phase 12 numeric ±20% (W4 reinforces to weight 1.0) |
+| `MITIGATED_BY` | risk → recommendation | 2 | `KG_SEMANTIC_EDGES` | Phase 4d embedding cosine ≥ 0.70 |
+| `QUANTIFIES_COST` | recommendation → financial_figure | 2.1 | `KG_SEMANTIC_EDGES` | Phase 4d embedding cosine ≥ 0.75 |
+| `ANALYZES` | question → risk | 3 | `KG_SEMANTIC_EDGES` | Phase 4d embedding cosine ≥ 0.65 |
+| `EXPOSED_TO` | risk → financial_figure | 2.2 | `KG_NUMERIC_EXPOSURE` | Phase 11 numeric tolerance ±15% |
+| `CONTRADICTS` | fact ↔ fact | 4 | `KG_CONTRADICTION_EDGES` | Phase 12 numeric ratio ≥ 3× (HIGH false-positive risk; 7-day soak required pre-flip) |
+
+Plus pre-v6.16.0 cross-link edge types (CROSS_REFS, CONTAINS, SUPPORTS, SOURCED_FROM, PRODUCED_BY, etc.) — see `kg_edges.edge_type` distinct values for the full set in any given session.
+
+**Audit completeness check for v6.16.0+ clients**: when the regulator queries a banker-mode session with all four KG flags ON, the export should contain rows from at least 9–11 of the above edge types (CONTRADICTS may be absent if the session has no divergent same-metric pairs — not a fault). Use the per-edge-type breakdown query in `.claude/skills/session-diagnostics/scripts/queries/04-kg-counts.sql` to validate completeness before handoff.
+
+**Provenance distinction (Wave 4)**: a `CONVERGES_WITH` edge may carry one of two `evidence.extraction_method` values:
+- `embedding_cosine` (or absent — Wave 1 emission default)
+- `numeric_reinforce` (Wave 4 — present in the `kg_provenance` row with `extraction_method='phase12_numeric_reinforce'`)
+
+The regulator can distinguish embedding-tier vs numeric-tier reinforcement post-hoc from the `kg_provenance` join. Both tiers are legitimate evidence for the same fact-pair convergence claim.
 ## Filesystem artifact source (Art. 12 — PR #182)
 
 Wrapped subagents (permanent mode, PR #182) write **filesystem-only** transcript artifacts that no database table holds, so the DB queries above miss them. `collect-transcripts.sh` folds them into the bundle as a single `wrapped-subagent-transcripts.tar.gz` (hashed into `manifest.txt` like every other file). Per session, per agent, under `<reports-dir>/<sessionId>/wrapped-subagent-transcripts/`:

.claude/skills/client-offboarding/SKILL.md

@@ -47,7 +47,7 @@ bash /Users/ej/Super-Legal/.claude/skills/client-offboarding/scripts/offboard-cl
 
 ### Phase 2: Data Archive (non-destructive)
 
-**Step 4**: Archive Cloud SQL database — `gcloud sql export sql` to a GCS backup file. Full database dump including schema, data, and extensions. Stored at `gs://super-legal-worm-{client_id}/archive/db-final-{date}.sql.gz`.
+**Step 4**: Archive Cloud SQL database — `gcloud sql export sql` to a GCS backup file. Full database dump including schema, data, and extensions. Stored at `gs://super-legal-worm-{client_id}/archive/db-final-{date}.sql.gz`. **v6.16.0 coverage note**: the SQL dump captures `kg_edges` rows for ALL 11 edge types regardless of which `KG_*` flags were active for the client (CITES, GROUNDED_IN, INFORMS, MIRRORS_RISK, RELATED_RISK, CONVERGES_WITH, MITIGATED_BY, QUANTIFIES_COST, ANALYZES, EXPOSED_TO, CONTRADICTS, plus pre-Wave types CROSS_REFS / CONTAINS / SUPPORTS etc.). `kg_provenance` rows are also dumped — including the `extraction_method='phase12_numeric_*'` entries that distinguish Wave 4 numeric-tier reinforcements from Wave 1 embedding-tier emissions on the same edge. No additional export step is required for KG wave coverage; the full SQL dump is edge-type-agnostic by design.
 
 **Step 5**: Archive reports directory — if the GCE instance still has local `/reports/` data, tar + upload to `gs://super-legal-worm-{client_id}/archive/reports-final-{date}.tar.gz`. **PR #182**: this tree includes the wrapped-subagent transcript artifacts (`reports/<session>/wrapped-subagent-transcripts/*.{jsonl,full.jsonl,sidecar.json}` — EU AI Act Art. 12 records). The script now counts `wrapped-subagent-transcripts/` entries in the produced tarball and reports the count; if zero on a client known to have wrapped sessions, investigate the tar step **before** any deletion (these are filesystem-only and unrecoverable once the instance is gone). If no instance is running, the step emits a hard compliance warning to confirm a prior archive exists.
 

.claude/skills/client-provisioner/SKILL.md

@@ -113,7 +113,16 @@ The script executes 16 steps. If it fails at any step, it reports which step fai
 - Boot disk: 30GB SSD, COS (Container-Optimized OS)
 - Container image from step 10
 - Environment variables injected:
-  - All feature flags from `flags.env` (51 entries, full platform for all clients). Includes v6.5.0 additions: SDK_STREAMING, CITATION_DEEP_VERIFICATION, FILES_API_CHART_EXTRACTION, CHART_PERSISTENCE, PRESERVE_GRACE_PERIOD, EXTENDED_CONTEXT, SCOPED_MCP_SERVERS
+  - All feature flags from `flags.env` (50+ entries, full platform for all clients). Includes v6.5.0 additions: SDK_STREAMING, CITATION_DEEP_VERIFICATION, FILES_API_CHART_EXTRACTION, CHART_PERSISTENCE, PRESERVE_GRACE_PERIOD, EXTENDED_CONTEXT, SCOPED_MCP_SERVERS. **v6.16.0 banker-centric KG edge waves** (default OFF; ops opt-in per client per the staggered-soak schedule below):
+    - `KG_SEMANTIC_EDGES` — Waves 1+2+2.1+ANALYZES from 3. Phase 4c (node embeddings) + Phase 4d (6 semantic edge specs). Most-verified; broadest reuse. Enable on **day 0** (immediately after merge) for any new client provisioned post-v6.16.0.
+    - `KG_NUMERIC_EXPOSURE` — Wave 2.2. Phase 11 (EXPOSED_TO risk→financial_figure). Pure CPU, no Gemini cost. Enable on **day 2** after `KG_SEMANTIC_EDGES` has been live with zero KG alerts.
+    - `KG_QA_INFORMS_EDGES` — Wave 3. Phase 1c (INFORMS Q→Q via regex). Banker-mode-only signal. Enable on **day 2** alongside `KG_NUMERIC_EXPOSURE` for banker-deployment clients; leave OFF for non-banker clients (no value without `BANKER_QA_OUTPUT=true`).
+    - `KG_CONTRADICTION_EDGES` — Wave 4. Phase 12 (CONTRADICTS fact↔fact + CONVERGES_WITH numeric reinforcement). **HIGHER FALSE-POSITIVE RISK.** Enable per-client only on **day 7+** after the soak in `docs/runbooks/wave-4-contradiction-soak.md` clears all four activation gates. Spot-check a recent session of that client's data (Section 4.3 of the runbook) before flipping.
+    - `KG_PROBABILISTIC_VALUE` — v6.17.0 Wave 5. Phase 13 (probabilistic_value node + QUANTIFIES_OUTCOME + WEIGHTS_RECOMMENDATION). Tier A direct JSONB parse — extracts p10/p50/p90 outcome distributions from risk-summary. Pure CPU, no Gemini cost. Enable on **day 0** alongside `KG_SEMANTIC_EDGES` (Day-0 safe per `docs/runbooks/wave-5-6-rollout.md` §1). Banker-mode-only signal — leave OFF for non-banker clients (no risk-summary content to parse).
+    - `KG_PRECEDENT_BENCHMARKS` — v6.17.0 Wave 6. Phase 14 (BENCHMARKS precedent → financial_figure via numeric tolerance matching on parsed multiples). Tier A deterministic. Enable on **day 0** alongside Wave 5. The `ELIGIBLE_PRECEDENT_TYPES = ['benchmark_transaction']` filter structurally prevents false-positive edges from regulatory_citation precedents; if a client's sessions only contain regulatory citations (e.g., Cardinal-shape sessions where Phase 10 doesn't pick up deal-name precedents), Phase 14 will emit 0 BENCHMARKS — this is the correct architectural outcome.
+    - `KG_DEAL_THESIS` — v6.18.0 Wave 7 + v6.18.1 audit follow-up. Phase 15 (`deal_thesis` L0 anchor node + RECOMMENDS edges to every recommendation). Tier A direct property read — no JSONB parse, no embeddings, no LLM. Pure CPU, <0.2s phase cost. Enable on **day 0** alongside Wave 5/6 (Day-0 safe per `docs/runbooks/wave-7-rollout.md` §1). Banker-mode-only signal — leave OFF for non-banker clients (no Phase 10 recommendation nodes to anchor). One `deal_thesis` node per session (cardinality flat); RECOMMENDS edge weight = `0.5 + 0.4 * priority_score + 0.1 * confidence` (range 0.5–1.0) — Flow renderer can rank recommendations top-to-bottom by edge weight. v6.18.1 audit follow-up adds 6 enrichment properties on the node (verdict / verdict_condition_count / scenarios[] / expected_value_per_share / nominal_value_per_share / intrinsic_gap_pct) extracted from executive-summary scenario table; backfill script provided for clearing stale embeddings (`scripts/backfill-deal-thesis-embedding.mjs`) on pre-existing sessions so Phase 4c re-embeds with the new property content.
+    - `KG_SENSITIVITY_EDGES` — v6.18.0 Wave 8 + v6.18.1 audit follow-ups #1/#2. Phase 16 (multi-source SENSITIVE_TO edges across 5 scannable node types: recommendation/financial_figure/scenario/risk/question — all target `fact` node). Tier B prose+numeric — 10 sensitivity-prose patterns (P1-P10) with weighted bands + numeric augmentation via Wave-5 probabilistic_value spread (≥ 0.40 relative spread). Token-overlap matching with ≥2-hit threshold + conservative plural-only stemming. Pure CPU, ~0.3-0.6s phase cost on Cardinal-class sessions (~310 facts × ~150 phrases). Enable on **day 0** alongside Wave 5/6/7 (Day-0 safe — Tier B deterministic with multiple FP-control layers). Banker-mode-only signal. Populates the IC Triptych "Would Change" slot in the frontend renderer. Evidence JSON carries `source_node_type` + `source_node_id` so consumers can distinguish prose-extraction origin. Fanout cap 12 per source. Cardinal yield: ~38 SENSITIVE_TO edges spread across 5 source types (recommendation=15, financial_figure=12, scenario=8, risk=2, question=1).
+    - Per-client override mechanism: `client-provisioner --update-flag <flag>=<value>` flips a single flag and restarts the MIG (~2 min recovery time). Document the flip date + the operator who authorized it in the client's onboarding record.
   - `SKIP_SECRET_MANAGER=true` (secrets pre-injected, no runtime SM dependency)
   - `PG_CONNECTION_STRING` (from step 4) — pool config: idleTimeoutMillis=600000 (10min), connectionTimeoutMillis=10000, statement_timeout=120000 (2min)
   - `JWT_SECRET` (from step 7)

.claude/skills/deploy/references/deployment-config.md

@@ -42,6 +42,28 @@
 - `KNOWLEDGE_GRAPH=true`
 - `LOG_LEVEL=info`
 
+### v6.16.0 KG Wave Flags (Staggered Rollout)
+
+The v6.16.0 banker-centric KG edge wave series adds 4 additional KG flags. **DO NOT** enable all four at deployment time — follow the staggered schedule below to allow each wave to soak independently. All four default `false`; opt in via `flags.env` on the schedule documented in `docs/runbooks/wave-4-contradiction-soak.md`.
+
+| Flag | Wave(s) | Activate on | Risk profile |
+|---|---|---|---|
+| `KG_SEMANTIC_EDGES` | 1, 2, 2.1, 3 (ANALYZES) | **Day 0** — immediately after merge; broadest reuse, most-verified extraction tier (embedding cosine) | LOW |
+| `KG_NUMERIC_EXPOSURE` | 2.2 | **Day 2** — after `KG_SEMANTIC_EDGES` has 48h of zero KG alerts | LOW (pure CPU, no API cost) |
+| `KG_QA_INFORMS_EDGES` | 3 (INFORMS) | **Day 2** — banker-mode tenants only (`BANKER_QA_OUTPUT=true`); leave OFF for non-banker tenants (no value without Q-nodes) | LOW |
+| `KG_CONTRADICTION_EDGES` | 4 | **Day 7+** — **per-tenant flip only after manual spot-check** on Cardinal AND one other live session per the runbook. Higher false-positive risk than other waves. | **MEDIUM** — requires soak |
+
+**Operator action items at deploy time:**
+
+1. Leave all four flags commented out in `flags.env` on initial deploy. The default-`false` behavior in `featureFlags.js` provides safety net.
+2. On Day 0 post-merge, uncomment `KG_SEMANTIC_EDGES=true` in `flags.env` and restart the MIG (~2 min).
+3. Monitor `claude_circuit_breaker_state{breaker="KG-Phase4c"}` and `{breaker="KG-Phase4d"}` for 48h. Both must remain `0`.
+4. On Day 2, uncomment `KG_NUMERIC_EXPOSURE=true` (all tenants) and `KG_QA_INFORMS_EDGES=true` (banker tenants only). Restart.
+5. On Day 7+, after running the spot-check procedure in §4 of the soak runbook AND confirming zero FPs, uncomment `KG_CONTRADICTION_EDGES=true` **per tenant**. This flag should be flipped one tenant at a time, not globally.
+6. Document the flip date + authorizing operator in each tenant's onboarding record.
+
+**Reference**: `docs/runbooks/wave-4-contradiction-soak.md` is the operator playbook for the Day 7+ flip — read it before flipping `KG_CONTRADICTION_EDGES` for any tenant.
+
 ## Known Gotchas
 
 1. **Phantom MIG in us-east1-b** — size 0, leftover from early provisioning. Always use ZONE=us-east1-d.