Lineage, Context Graph & Sidecar Reconstruction

2. The 10 Node Types & 21 Neo4j Indexes

graph_builder models the enterprise data and runtime estate across 10 canonical node types, ordered from finest subdocument granularity (Entity) to coarsest infrastructure granularity (Host) plus inline enforcement receipts (Redaction:OboRedaction):

Order	Node Label	Primary Key / ID Format	Core Properties & Architectural Semantics
1	:Entity	xxh3_64(norm(text)+":"+label)	Deduplicated named entity (label, raw_text, normalized_text, secret). Promoted to Neo4j only when promote_raw_entities = true (Decision E7).
2	:Edge	LNKD-<xor>-<count>	Reified similarity and chunk overlap carrier linking :Data or :Region artifacts sharing WRL fingerprints.
3	:Data	{sha256}-{nmers_1}-{nmers_2} or content_entity_sha256	Two tier content node: whole document (is_subdoc = false, keyed by <sha256>-<nmers_primary>-<nmers_total>) and sub document content part (is_subdoc = true, keyed by content_entity_sha256).
4	:Region	{region_id:016x}-{nmers}-{nmers}	Hierarchical subdocument structural span (region_id, data_id, content_preview, bytes, keypath, region.ner.labels, region.ner.entity_count).
5	:Object	CORI (<scheme>⋊⋉<container>⋊⋉<path>ⓥ<ts>)	Storage location and version instance (object_id, version_sequence, cluster_id, is_freshest). Multiple :Object nodes can point to the same content addressed :Data node.
6	:Bucket	Container / repository identifier	Storage bucket, SharePoint site, Git repository, or database instance containing :Object nodes ((:Object)-[:IN]->(:Bucket)).
7	:Service	Canonical principal or workload ID	Carries entity_type ("user" | "service" | "agent") and parent_id for hierarchical agent delegation chains.
8	:API	Endpoint or executable URI	Carries resource_type ("http-api" | "mcp" | "bash" | "script").
9	:Host	HOST-<blake2b>	Physical or virtual execution host (hostname, ip, cluster) where :Service and :API instances reside.
10	:Redaction:OboRedaction	Redaction event UUID	Materialized from runtime REDACT events via (:Data)-[:REDACTED_BY]->(:Redaction:OboRedaction), recording obo_user, policy_id, redacted_spans, and trace_id.

3. Structural ([:OF]) vs Behavioral ([:CALLS]) Topology Edges

3.1 Why Service -[:OF]-> Host <-[:OF]- API and Service -[:CALLS]-> API Coexist

• Structural Residency ((:Service)-[:OF]->(:Host) and (:API)-[:OF]->(:Host)): Records which physical or virtual host (HOST-<blake2b>) a client workload or server listener runs on. When a single process acts as both an outbound client (:Service) and an inbound server (:API), their shared [:OF]->(:Host) edges correlate the dual role identity without conflating caller and callee.
• Behavioral Invocation ((:Service)-[:CALLS]->(:API)): Records that a principal or agent actively invoked an endpoint or tool during a session trace. Collapsing [:OF] and [:CALLS] would make it impossible to distinguish "Service X is co located on the same host as API Y" from "Service X actually called API Y".

3.2 Same Host Tool Invocation (bash & script), MCP Single :API Rule & Direct open() Calls

1. Same Host Tool Invocation (resource_type: "bash" | "script"): When an agent or service spawns a local subprocess (such as /usr/bin/curl or python3 scripts/export.py), graph_builder mints an :API node whose identity is the canonical program path (with (:API)-[:OF]->(:Host) pointing to the same :Host as the calling :Service). Command line arguments and environment flags are recorded as invocation metadata on the [:CALLS] edge or audit event and never mint separate :API nodes per argument string.
2. MCP Server Single :API Node Rule (resource_type: "mcp"): An MCP server endpoint is represented as a single :API node (resource_type = "mcp"), regardless of how many distinct MCP tool names (tools/call) or resource URIs (resources/read) are invoked through it. Individual tool names are carried on the invocation edge properties.
3. Direct Runtime open() File Calls: When an instrumented Python or Rust process reads or writes a file directly via OS open() syscalls (rather than invoking an external tool or HTTP/MCP endpoint), graph_builder connects the :Service directly to the :Object / :Data node ((:Service)-[:READS|WRITES]->(:Data)) and never mints a synthetic pseudo tool :API node.