What the graph carries

A workflow spec says call these, in this order. On a program that is not enough — so every node also says where it came from and what would prove it wrong.
surface
program id · instructions · intents
what can be called at all
derive plan  (per account)
seed recipe  ·  dependency order
role  ·  writable  ·  signer
originextracted recovered flagged
the artifact declared it → theirs. It was silent → ours.
They disagree → neither.
chain  (the lifecycle)
steps · links · basis · refuted by
every edge argues for itself and names its own counterexample
receipt  (before it counts)
status · compute units · revert class
binding — the exact bytes, hashed
expires with its blockhash, ~1 minute
the real answer, from the live surface
// find_start("buy water at the bar") → the start it chose
"program": "let_me_buy",
"instruction": "make_purchase",
"why": ["buy", "storefront"],

"chain": { "name": "sell_and_deliver",
  "verdict": "NOT_EVALUATED",
  // the plan is reported, never claimed executable
  "links": [{
    "account": "receipts", "kind": "produces",
    "provenance": "extracted",
    "basis": "…account 0 of BOTH instructions,
      so the two calls address one account…",
    "refuted_by": "a mark_as_delivered that
      settles a receipt_id no make_purchase wrote"
  }] },

"derive_plan": [
  { "account": "receipts", "provenance": "extracted" },
  { "account": "sender_token_account", … },
  // …7 more, dependency-ordered
],
"gaps": []  // flagged honestly when they exist
NOT_EVALUATED is the interesting field. Nothing here pretends the chain was verified against landed transactions — because it was not. A graph that only ever says yes tells you nothing about when to trust it.
GECKO • CHECK THE CALL BEFORE IT COUNTS mcp.geckovision.tech/orquestra/mcp · keyless, control-plane only