The Interactive Prompt Engine

The Oracle is useful when it can say more than “validation failed.” It should be able to explain what kind of information is missing, show the source context that led to the question, and ask for one answer that can change the next candidate calculation.

Here, Oracle names a dialogue experience. It does not grant the software epistemic or governance authority.

Delivery status

Status	Boundary
Implemented	Active-canon review code can derive source-backed human-review questions from exact validation results while marking suggestions unselected, non-assertive, and unable to mutate source or canonical state. Model-aware brain-run questions also preserve question-not-assertion boundaries.
Bounded proof	The reference-document adapter answers deterministic human questions over its controlled source-local graphs, with exact span evidence.
Planned	A general interactive UI that combines note-ingestion candidates, typed calculus results, canonical gap records, source clusters, and user answers across repeated sessions.

last-validation.json is an input, not the whole inbox

The current workspace path includes validation/last-validation.json, but the dialogue design must respect its transaction semantics.

For an accepted write, that sidecar records the ChangeSet, base and candidate digests, passed status, and findings produced by the same typed calculus. For a rejected semantic transition, the current transaction performs no workspace writes. The typed violations and matching validation report are returned to the caller; the existing last-validation.json remains byte-identical.

Therefore a safe prompt engine cannot simply assume that the last persisted sidecar contains every rejected attempt. Its planned gap inbox should merge four explicitly identified sources:

1. the persisted validation sidecar for the accepted workspace snapshot;
2. a run-scoped, non-canonical rejection report retained by the calling tool;
3. canonical SemanticGap and ProvenanceGap records already present in the workspace; and
4. rebuildable search/cluster metadata that points back to exact canonical or source-local refs.

Each item must carry its graph or source digest so a stale question cannot be presented as current.

Question generation loop

typed finding or gap record
  -> hydrate affected refs and exact source spans
  -> group duplicates without merging their identities
  -> select a question pattern for the typed condition
  -> rank by blocking impact, answerability, and freshness
  -> present one source-backed question
  -> capture the answer as new source material
  -> rebuild the candidate and run validation again

The question pattern is selected by diagnostic type, not by unconstrained text generation. An optional language model may improve phrasing, but it cannot change the requested answer shape, hide evidence refs, select a repair, or write to canonical state.

Typed conditions produce targeted questions

Finding	Question goal
SemanticGap	Ask for the missing explicit interpretation or declared profile.
MissingIdentityRoot	Ask which Kind supplies identity for the Phase, Role, or SubKind.
DanglingMediation	Ask for the missing distinct participant in the Relator.
ProvenanceGap	Ask for a recoverable Artifact/span or an explicit gap declaration.
DisjointPhaseConflict	Ask whether the times differ, the phases are actually disjoint, or one membership is wrong.
RigidityViolation	Ask which explicit stereotype or generalization was intended; never silently reverse the relation.

Example dialogue prompts

Every prompt should expose the evidence basis and the consequence of leaving the question unanswered. Examples include:

XYZ appears in three source artifacts at the cited spans. Is XYZ an enduring object (Endurant), an occurrence (Perdurant), or still an unresolved source-local term?

Assigned Technician is proposed as a Role, but no Kind identity root is declared. Which explicit Kind supplies the identity retained while the Role is gained or lost?

Isolation Permit IP-9 is proposed as a Relator with only Pump P-17 as a live mediated participant. Which second distinct identity participates, or should the Relator interpretation be withdrawn?

The same asset is shown in Operating and Decommissioned at 2026-09-02T10:00:00Z, and those Phases are explicitly disjoint. Are the timestamps different, is the disjointness declaration wrong, or should one membership be removed from the proposal?

This Assertion has no recoverable Artifact/span. Can you identify the exact source passage, or should OntoGraph retain a blocking ProvenanceGap?

The first example may mention “three” only when the derived source index can return three distinct Artifact/span refs. A fluent sentence must not invent its own count.

Answers re-enter through the source boundary

A user's answer is not a direct patch to canonical.json. The dialogue client captures it as a new Artifact or response record with actor, time, question ref, and source context. An extractor or deterministic mapper may then prepare:

• a source-local Assertion candidate;
• Evidence binding the answer to its prompt and cited sources;
• a DerivationEvent naming the method and outputs;
• an updated semantic or provenance gap state; and
• a proposed ChangeSet for explicit canonical records.

The complete candidate is recalculated. If it passes, the governed write path may persist it; Review, Decision, and Promotion remain separate when accepted package meaning is at stake.

Interaction contract

The UI should make these fields visible rather than hiding them behind a chat bubble:

Field	Why it matters
Question ref and diagnostic code	Makes reruns and audits deterministic.
Source quotes and Artifact/span refs	Shows why the question was asked.
Expected answer shape	Prevents free-form text from silently becoming a structural declaration.
Candidate consequence	Explains which proposed records would be recalculated, not automatically written.
Staleness/digest	Prevents an answer against an old graph from mutating a new one.
“Question is not an assertion” boundary	Keeps dialogue output non-authoritative.

What this direction does not claim

The current product does not provide a general chat interface that scans validation/last-validation.json and resolves raw-note gaps automatically. Questions do not validate a model, create or approve Evidence, choose a repair, issue a Decision, or perform a Promotion. A retained rejection report is a non-canonical run artifact unless and until a separate contract says otherwise.