No trusted edge without evidence
The rule is enforced by a database constraint, not a code review convention. Here is why that distinction decides whether an enterprise can say yes.
Every dependency graph is a claim about a system. Most of them are claims nobody can check. Ours carries a rule that is enforced one layer below the application: an edge cannot be marked trusted unless the evidence behind it exists.
A convention is not a control
Written as a guideline, "always attach evidence" survives until the first deadline. Written as a constraint trigger, it survives everything, including us. A migration that tried to promote an edge without its extractor output and hash would fail at the database, not at review.
That difference is the whole argument for why an auditor can accept the graph.
What counts as evidence
Evidence is the extractor that produced the edge, its version, and a hash of the input it read. Not a model's opinion. LLM output is never evidence in this system, which is a deliberate line: inference proposes, extraction proves.
What it buys at runtime
When a requirement resolves to an impacted set, every edge in that traversal can name what produced it. The set is not a guess with good branding. It is a query result, reproducible, and the same answer every time.