[scbrown]

What

Adds shapes/legacy-work-item.shapes.ttl, a compatibility set that restores the aegis:WorkItem constraints core dropped in #141 (aegis-452, option A).

Core no longer targets aegis:WorkItem; work items are schema:Action under the Seeds profile. The tracker projection still writes WorkItem records, though, so with core alone an invalid record validates clean. Loading this set next to core keeps them validated until the projection moves to schema:Action (tracked separately).

The set carries only what core dropped:

• sourceKind in observed|declared|inferred, at most one;
• exactly one string rdfs:label;
• outcome in done|abandoned|superseded|failed.

It keeps the shape IRI aegis:CamayocWorkItemShape, which validation reports already name. inWorkflowRun and blockedOn stay with core's targetSubjectsOf shapes and are not repeated.

Evidence

• tests/test_legacy_work_item_compat.py runs the real quipu validate:
  • core alone accepts each of three invalid records (the defect this set exists for);
  • core plus the set refuses all three and accepts a valid record;
  • structural checks: the set adds only the three dropped paths, and core still covers inWorkflowRun and blockedOn.
• Passes with quipu 0.14.1 and 0.16.1. Sabotage (removing the outcome constraint) turns two tests red.
• Full suite: 1316 tests, 0 skipped.

Not in this PR

This PR does not load anything, change a pin, or migrate data. Moving the deployed core pin and loading this set is a separate infrastructure change. It has its own acceptance probe and rollback (re-pin core, remove the set).

🤖 Generated with Claude Code

https://claude.ai/code/session_0185RxTpLsPCQFB9ni72Nzac

[scbrown]

Ian — SOURCE APPROVE, one non-author post-green review of exact 9f8218a, base 3e55363.

Read both changed files in full and compared the restored constraints with pinned 8dcd971. The compatibility set restores only WorkItem sourceKind, label and outcome; core continues to cover blockedOn and inWorkflowRun. Optional sourceKind matches the existing debt posture; this change does not claim to make it mandatory. No loader, pin or runtime behavior is changed by the source alone.

Independent real-CLI validation: all five tests passed with zero skips, including core-alone acceptance of three invalid records, core+compat refusal of those records and valid-record acceptance. HOME guard clean (157 paths, five resources). Fresh exact-head hosted CI 40047958465 is complete 7/7 success. Native T2 e7f45ece / reviewer receipt 219a3285 accepted for this exact head/base.

Normal landing remains with the queue owner. Production acceptance remains separate: load compatibility before or atomically with the core pin change; validate the complete loaded profile union in the records graph, verify valid storage and invalid refusal/absence, and retain the existing debt profile. Keep the current core pin as rollback and retire compatibility only with the separately tracked projection migration. This approval authorizes no production profile load or rollout timing.