@spec auth_contract_truth() :: [map()]

Returns the canonical auth contract truth for Sigra's SessionAuthorityLane surface.

Companion-sourced fields (telemetry event names, metadata keys, forbidden metadata keys, denial codes, and safe detail keys) are populated at runtime via the :companions registry using the denial_codes/0 optional callback. No companion function is called at module-evaluation time (DECOUPLE-03 / T-136-03 stale-beam fix).

Callers that need populated denial_codes / safe_detail_keys should use Doctor.phase_46_auth_findings/1 which fills these sentinels at runtime.

@spec commerce_corridor_prerequisite_taxonomy() :: [atom()]

Returns the canonical taxonomy of prerequisite classes that may be referenced by commerce corridor entries. Every prerequisite_classes value on a commerce corridor entry must be drawn from this set so doctor/support/guides taxonomy stays parity-locked.

@spec commerce_corridor_proof_classes() :: %{
  required(String.t()) => %{
    proof_class: :merge_blocking | :advisory,
    advisory_provider_proof: boolean()
  }
}

Returns the canonical commerce corridor proof-class mapping.

Every commerce corridor declares whether its hermetic Phoenix-owned contract proof is :merge_blocking (core route/manifest/denial truth that must pass before merge) and whether it also carries an advisory_provider_proof flag for storefront/simulator evidence (StoreKit, Play Billing) that stays advisory in v3.2.

@spec gating_truth() :: [map()]

Returns a runtime snapshot of gate state for every registered companion.

Reads Application.get_env(:crosswake, :companions, []) at call time (NOT compile_env) so test fixtures can register companions via Application.put_env/3 and production callers see live runtime-registered companions.

Each entry is a map with:

• :companion_id — the atom id from companion.companion_id()
• :gate_state — one of "gated", "rolling_out (N%)", "killed", or nil (nil means the companion's gate is inactive or unconfigured)

Kill-switch status overrides gate_status — if the kill switch is active, the entry shows "killed" regardless of gate_status.

The :gate_state values are D-08 locked display strings. "rolling_out (N%)" is never equivalent to "supported" — the gating_truth_label/0 column heading reinforces this distinction.

@spec gating_truth_label() :: String.t()

Runtime gate-state label.

Returns the column label for the gating-truth section of the support matrix, deliberately runtime-distinct from build-proof posture. This label must never be misread as "supported" — a route in "rolling_out (10%)" state is gated, not supported, and the column label makes that explicit.

D-08: "Runtime Gate State — not build-proof posture."

@spec notification_support_truth() :: [map()]

Returns the canonical notification support truth for the Chimeway companion surface.

Companion-sourced telemetry fields (event_names, metadata_keys, forbidden_metadata_keys) are [] sentinels filled by callers at runtime via the :companions registry. No companion function is called at module-evaluation time (DECOUPLE-03 / T-136-03 stale-beam fix).

@spec rebuild_decision_table() :: [Crosswake.Manifest.Types.RebuildDecisionEntry.t()]

Canonical axis→change-kind→rebuild-class decision table.

Returns a list of RebuildDecisionEntry structs encoding the D-09 axis mapping. This is the single authoritative source for rebuild cost per axis/change-kind; all consumers (renderer, doctor, compatibility guide) derive from this table.

Key asymmetry (D-09): native_runtime_version additive bumps map to "native or companion rebuild required" — unlike manifest_schema_version and bridge_protocol_version which are "compatibility-bump only" for additive moves. This holds because floor semantics (>=) absorb protocol/schema additive bumps without a binary rebuild, but native_runtime changes live in the binary itself.