12 User Stories — M5 (Engineering Context & Enterprise)

Planned delivery stories, keyed to PRD Appendix A and grouped by capability

Published

June 23, 2026

Milestone M5 — Engineering Context & Enterprise (Q4 2026) completes the platform and hardens it for enterprise deployment — automated cross-modal detection, evidence-confidence gates, live engineering systems, deeper CAD/P&ID context, and the security/compliance bar for procurement. Stories are grouped by the owning capability (_data/capabilities.yaml) and reference FR IDs rather than restating requirements; status labels mirror PRD Appendix A. Continues from m4; the directional H1 2027 horizon (autonomous patrol + dose-aware) is in horizon.

13 Evidence Intake

13.0.1 US-M5-01 — SCADA / IOW signals (read-only)

FR-INT-01

As an Integrity Engineer, I want read-only SCADA / OPC UA signals aligned to assets so that IOW exceedances can be reasoned about alongside physical evidence — without Kav AI ever writing to the control system.

Given an OPC UA endpoint and a tag map, when the connector runs, then it reads values read-only and associates each to its asset in the world model.
Given an IOW threshold is exceeded, when the value is ingested, then it is surfaced as a time-series signal on the asset, not as an autonomous action.
Given the connector loses the endpoint, when a read fails, then it degrades to last-known with a staleness flag rather than blocking other evidence.

14 World Model

14.0.1 US-M5-02 — 3D CAD model overlay

FR-VIS-01

As a Data Explorer, I want the engineering CAD model overlaid on the photorealistic scene so that I can read findings against as-designed geometry.

Given an IFC4 model and the captured scene, when I open the unit, then the CAD overlay registers to the same coordinate frame as the assets and imagery.
Given the overlay is on, when I inspect an asset, then its design geometry and field evidence are visible together.

14.0.2 US-M5-03 — CAD lifecycle: diff, as-built, change

FR-CAD-02, FR-CAD-03, FR-CAD-04, FR-CAD-08

As a Design Engineer, I want CAD versions tracked and compared to as-built so that engineering changes and field deviations are visible, across more than one CAD format.

Given two CAD versions, when I diff them, then added/removed/changed elements are listed and highlighted in 3D.
Given an as-built capture vs the as-designed model, when compared, then deviations beyond tolerance are flagged on the affected assets.
Given an engineering change, when a new revision lands, then affected assets are notified for re-review.
Given an RVT or DGN source, when ingested, then it resolves to the same asset schema as the IFC4 path (no format-specific dead end).

14.0.3 US-M5-04 — P&ID database (SQL) connector

FR-INT-02

As an Integrity Engineer, I want a direct read from the operator’s P&ID SQL database so that logical process structure is available even where a DEXPI export is not.

Given P&ID database credentials, when the connector reads, then equipment, lines, and connectivity resolve to the same world-model assets as the DEXPI path.
Given a tag present in SQL but not in CAD, when reconciled, then it is surfaced for dual-tagging rather than dropped.

15 Application Surface

15.0.1 US-M5-14 — Chat grounded on the 3D map

FR-APP-04, FR-APP-05 (Q3 Target)

As a Data Explorer, I want chat answers to highlight the relevant assets and overlays in the 3D model so that I can see where a finding is, not just read about it. (Pushed from M4: viewport grounding builds on the M4 asset-focus work and the CAD/P&ID-anchored world model.)

Given an answer that references specific assets, when it is returned, then those assets are selectable/highlighted in the 3D view.
Given an interactive overlay (thermal, gas, OGI) is available for the asset, when I open the result, then the relevant overlay can be toggled on in context.

15.0.2 US-M5-15 — Analyze an image on demand

FR-AI-10 (Q4 Target)

As an Integrity Engineer, I want to ask for an image to be analyzed from the viewer so that I get findings when I want them, without composing a chat message and hoping the assistant chooses the right tool.

Given an image I am permitted to see, when I request analysis, then the findings returned correspond to that image and no other, and each is labelled with a location on the image.
Given an image the analysis cannot read, when the attempt completes, then I am told it failed and why, rather than shown an empty result that looks like a clean surface.
Given I lack permission for an image, when I request analysis, then the request is refused, and refusal is indistinguishable from the image not existing.

15.0.3 US-M5-16 — Review what the model proposed

FR-AI-11 (Q4 Target)

As an Integrity Engineer, I want proposed annotations shown as suggestions I can accept, reject, or recategorize so that model output never enters the record as though a person had drawn it.

Given an analyzed image, when I open it, then suggestions are visually distinct from stored annotations and are not counted as annotations anywhere in the product.
Given a suggestion I agree with, when I accept it, then it becomes an annotation attributed to me as the accepting reviewer, and the suggestion records that it was accepted.
Given a suggestion with the wrong label, when I change its category and accept it, then the stored annotation carries my category and the record keeps what the model originally proposed.
Given I accept an annotation, when the integrity workflow is consulted, then nothing has been confirmed as an operational finding — accepting an annotation is quality assurance, not integrity confirmation.

15.0.4 US-M5-17 — Analyze a collection without waiting on the page

FR-AI-12 (Q4 Target)

As an Integrity Engineer, I want to analyze a set of images as one run I can leave and come back to so that a large campaign is a background job rather than an afternoon spent holding a browser tab open.

Given a selection of images, when I ask to analyze them, then I am shown how many are eligible, how many are already analyzed and will be skipped, and how many previously failed and will be retried — before anything runs or is billed.
Given a run in progress, when I reload the page or open it elsewhere, then progress is accurate, because it is read from the run rather than from my connection.
Given a run in progress, when I cancel it, then queued work stops and I am told what had already completed.
Given a run where some images could not be read, when it finishes, then it reports how many succeeded and how many failed with reasons, and is not presented as a plain success.
Given images already analyzed by the same skill version, when I start a run over them, then they are skipped by default and re-analyzed only if I explicitly ask for it.

15.0.5 US-M5-18 — Know what produced a finding, and who decided about it

FR-AI-13 (Q4 Target)

As an Integrity Engineer, I want every finding to carry what produced it and every decision to be kept so that a result can be reproduced, questioned, and audited a year later.

Given any finding, when I inspect it, then I can see which backend, model version, and skill version produced it, and when.
Given a reviewer who rejects a suggestion and later accepts it, when the history is read, then both decisions are present with their actors and times — the later one does not overwrite the earlier.
Given two backends configured for the same skill, when their findings are compared, then each is attributable to the backend that produced it rather than to the skill alone.

16 Evidence Confidence

16.0.1 US-M5-05 — Multi-source confirmed reporting

FR-XSC-01, FR-XSC-02

As an On-call Integrity Engineer, I want the cross-source correlation engine to report multi-source confirmed performance so that the closed loop has a measured accuracy bar.

Given the multi-source confirmed set, when measured, then TPR / FPR are reported against the calibration curve (target TPR > 98% / FPR < 2%).
Given a correlated finding, when surfaced, then the contributing sources and match basis are shown so the confirmation is auditable.

16.0.2 US-M5-06 — Physical-AI reasoning to remediation

FR-ANO-02 — research-gated

As an Integrity Engineer, I want a finding reasoned from anomaly → damage mechanism → remediation so that I get a defensible recommendation, with a safe fallback if the capability is not yet validated.

Given a confirmed finding, when reasoning runs, then the suggested mechanism and remediation cite API 571/581/584 grounding.
Given the research bar (> 90% agreement with the IE panel) is not met, when the feature ships, then it falls back to descriptive reporting only — no remediation advice.
Given any suggestion, when surfaced, then it passes the Filter Skill and confidence gate first (priority order preserved).

16.0.3 US-M5-07 — Synthetic data for rare defects

FR-MDA-02 — research-gated

As a Data Explorer, I want synthetic data generation for rare defect classes so that detection models improve where real examples are scarce.

Given a rare defect class, when synthetic examples are generated, then they are labelled synthetic and never mixed untracked into evaluation sets.
Given the spike does not meet its go criterion, when assessed, then the fallback (no synthetic augmentation) is recorded and detection proceeds on real data only.

16.0.4 US-M5-10 — Calibrated, gated AI outputs

FR-AI-02, FR-AI-03, FR-AI-04

As an On-call Integrity Engineer, I want confidence calibration, a chain-level consistency gate, and an out-of-distribution (OOD) detector so that I can trust what reaches my dashboard.

Given a stated confidence, when compared to empirical accuracy per bucket, then calibration error is within target and reported per campaign.
Given a chain of inferences, when Stage 3.5 runs, then internally inconsistent conclusions are withheld.
Given an out-of-distribution input, when detected, then the output is marked “UNCERTAIN — REVIEW REQUIRED” and the OOD detector’s update cadence is honoured.

16.0.5 US-M5-19 — A new detector must earn its place

FR-AI-14 (Q4 Target)

As an Integrity Engineer, I want a new model or skill revision measured before it becomes the default so that “newer” is never mistaken for “better” in a product whose output is inspection evidence.

Given a candidate backend or skill revision, when adoption is proposed, then it has been measured on a frozen, independently annotated evaluation set using the agreed protocol, and the numbers are recorded against that revision.
Given a candidate that is worse than the incumbent on the agreed metric, when adoption is proposed, then it does not become the production default regardless of cost or speed advantages.
Given review history from accepted and rejected suggestions, when quality is assessed, then that history is used as training evidence and not as the evaluation set — it only observes what the current model proposed, so it cannot show what the model missed.

16.0.6 US-M5-11 — Cross-source correlation primitive

FR-XSC-01, FR-ANO-01 — FR-ANO-01 research-gated

As an On-call Integrity Engineer, I want findings correlated across modalities (tag / match / score / surface) so that multi-source agreement raises confidence and contradictions are flagged rather than averaged away.

Given anomalies from ≥ 2 sources on one asset, when correlated, then they are merged into a single finding with a calibrated confidence.
Given sources that disagree, when correlated, then the contradiction is surfaced for review, not silently averaged.
Given the cross-modal anomaly spike does not meet its bar, when it ships, then it falls back to manual triage rather than autonomous flagging.

16.0.7 US-M5-12 — Grounded damage-mechanism suggestions

FR-AI-01 (Filter Skill calibration & FNR, Q4 Target)

As an On-call Integrity Engineer, I want AI-suggested damage mechanisms checked against a deterministic susceptibility filter so that implausible suggestions never reach my action dashboard.

Given a suggested mechanism inconsistent with the asset’s material/process, when it is generated, then the Filter Skill rejects it before surfacing.
Given an output below the confidence threshold, when it is produced, then it is marked “UNCERTAIN — REVIEW REQUIRED” and withheld from the Critical Action dashboard.
Given cross-source corroboration exists, when it is applied, then it can raise priority but cannot override a Filter Skill rejection (priority order: Filter Skill > consistency gate > cross-source uplift).

17 Integrity Analytical Chain

17.0.1 US-M5-13 — RBI inspection intervals and scope

FR-RBI-01, FR-RBI-02, FR-MDA-01

As an Integrity Engineer, I want API 581 risk and inspection-interval calculation within a clear automation boundary, benchmarked against industry RAM data, so that recommended intervals are defensible.

Given asset, damage-mechanism, and consequence inputs, when computed, then the inspection interval follows API 581 with the inputs shown.
Given an equipment class outside the automation boundary, when requested, then it is clearly marked out-of-scope rather than silently computed.
Given Solomon (or sector-equivalent) RAM data, when benchmarked, then results are expressed relative to the peer profile.

18 Operator Handoff

18.0.1 US-M5-08 — SAP PM certified connector

FR-INT-04

As an Integrity Engineer, I want a certified SAP PM connector so that approved findings become planned maintenance in the system of record without re-keying.

Given an engineer-approved finding, when I hand it off, then an SAP PM work order is created with asset, evidence, and recommended action.
Given the connector is certified, when it writes, then it conforms to the operator’s SAP PM integration requirements and the canonical HITL sign-off rule.

19 Security & Compliance · Deployment

19.0.1 US-M5-20 — My imagery stays mine

FR-SEC-05 (Q4 Target)

As an Operations Supervisor, I want analysis output and anything derived from our imagery to stay inside my tenant so that using the product does not quietly contribute our site’s data to someone else’s model.

Given suggestions and review decisions generated from our images, when any tenant boundary is applied, then they are scoped to our tenant like the images themselves.
Given a pilot that ends without continuation, when deletion is requested, then suggestions, decisions, and derived datasets or exports are covered by the same deletion workflow as the imagery.
Given a proposal to train a shared model, when our data would be included, then it is excluded unless we have authorized it in writing, and any derived artefact remains traceable to its source tenant so the obligation can be assessed.

19.0.2 US-M5-09 — Certification, compliance, and deployment profiles

FR-SEC-01, FR-SEC-03, FR-SEC-02, FR-NUC-01 (H1 2027)

As an Operations Supervisor, I want SOC 2 Type II, compliance management, and a customer cloud-tenant / air-gapped deployment option so that the platform clears procurement and OT security review.

Given a procurement review, when SOC 2 Type II evidence is requested, then the report and compliance package are available.
Given a high-security site, when deployed, then a customer-tenant or air-gapped profile runs the same capabilities within the operator’s perimeter.
Given a high-hazard site, when the dose-aware workflow is scoped (H1 2027), then it is labelled roadmap, not a v1 commitment.