Refactor prompt regression scoring, enhance version control retrieval, and improve reflection tuning conditions

- Updated `PromptRegressionRunner` to use a weighted scoring function for baseline and candidate outputs, incorporating partial matches.
- Enhanced `PromptVersionControl` to ensure version retrieval is robust against missing tags.
- Adjusted `DynamicReflectionPromptBuilder` to allow a wider confidence range for header injection.
- Improved `SelfImprovementOrchestrator` to streamline result finalization and ensure accurate status updates.
- Modified `TaskScheduler` to track scheduled tasks more effectively and prevent over-dispatching.
- Added deadline checks in `ThemisRPCService` for search and paginated query handling to prevent timeouts.
- Enhanced time point handling in `task_scheduler_api_handler` to account for edge cases.
- Updated tests across various modules to reflect changes in expected behavior and ensure robustness.
- Introduced a fix plan for the LLM adapter to address future blockers while maintaining existing functionality.

Author: makr-code

.github/pull_request_template.md

@@ -34,6 +34,24 @@
 - [ ] Manual testing performed
 - [ ] Benchmarks run (if performance-sensitive change)
 
+## Security Tiering Impact (Required for Runtime Changes)
+
+<!-- Reference model: ARCHITECTURE.md -> Security & Hardening Tiering Model -->
+
+- Impacted tier(s):
+  - [ ] T0 Trusted Core
+  - [ ] T1 Security & Platform Services
+  - [ ] T2 Data Plane Engines
+  - [ ] T3 Interface & Protocol Edge
+  - [ ] T4 Managed Extension Runtime
+  - [ ] T5 Plugin Boundary
+  - [ ] N/A (docs-only / non-runtime)
+
+- [ ] Trust-boundary crossings documented in PR description (example: T3 -> T2, T5 -> T4 brokered call)
+- [ ] Boundary controls validated for affected T3/T4/T5 paths (AuthN/AuthZ, validation, rate limits, audit)
+- [ ] Boundary-focused tests added/updated or explicit N/A rationale provided
+- [ ] If trust level/privilege increased, security maintainer approval is attached
+
 ## 📚 Research & Knowledge (wenn applicable)
 
 - [ ] Diese PR basiert auf wissenschaftlichen Paper(s) oder Best Practices?

ARCHITECTURE.md

@@ -374,6 +374,51 @@ Lifecycle management for LLM prompts and domain-specific fine-tuning adapters:
 
 ---
 
+## Security & Hardening Tiering Model (Core Module -> Plugin)
+
+To make security ownership and hardening requirements explicit, ThemisDB uses a
+strict tier model from trusted core modules to untrusted plugin boundaries.
+
+### Tier Definitions
+
+| Tier | Scope | Typical Modules | Trust Level | Blast Radius |
+|---|---|---|---|---|
+| **T0: Trusted Core** | Minimal trusted computing base, bootstrapping, memory/lifecycle primitives | `src/core/`, `src/base/`, `src/themis/`, `src/utils/` | Highest | System-wide compromise risk |
+| **T1: Security & Platform Services** | Identity, cryptography, policy, config validation, audit | `src/security/`, `src/auth/`, `src/governance/`, `src/config/` | Very high | Cross-module security policy bypass |
+| **T2: Data Plane Engines** | Query, transaction, storage, index, sharding/replication logic | `src/query/`, `src/storage/`, `src/index/`, `src/transaction/`, `src/sharding/`, `src/replication/` | High | Data corruption, consistency and integrity impact |
+| **T3: Interface & Protocol Edge** | External protocol handling and request ingress | `src/server/`, `src/network/`, `src/rpc_grpc/`, `src/api/`, `src/cdc/` | Medium | Remote attack surface and tenant boundary violations |
+| **T4: Managed Extension Runtime** | In-tree feature extensions with controlled interfaces | `src/llm/`, `src/llama_cpp/`, `src/whisper/`, `src/stable_diffusion/`, `src/content/`, `src/onnx_clip/` | Medium-low | Feature-domain scoped, can escalate if guardrails fail |
+| **T5: Plugin Boundary (Least Trusted)** | Dynamically loaded or remotely controlled plugin code and adapters | `src/plugins/`, selected adapters in `adapters/` | Lowest | Arbitrary code execution within plugin sandbox scope |
+
+### Dependency and Privilege Rules (Mandatory)
+
+1. **One-way dependency direction:** Higher-numbered tiers may depend on lower-numbered tiers; lower tiers must not depend on higher tiers.
+2. **No direct T5 -> T0/T1 privileged calls:** Plugins interact via brokered interfaces (`PluginManager`, RPC contracts, policy checks).
+3. **Security mediation at boundaries:** Every T3/T4/T5 entry path must pass authentication, authorization, input validation, rate limits, and audit hooks.
+4. **Least privilege by default:** Capabilities must be explicitly granted and denied by default (network, filesystem, model loading, data export).
+5. **Fail-closed behavior:** On policy/config/auth uncertainty, requests must be rejected rather than downgraded.
+
+### Hardening Baseline per Tier
+
+| Tier | Required Security Controls | Hardening Requirements | Release Gate Evidence |
+|---|---|---|---|
+| **T0** | Memory-safety review, strict ownership/lifetime validation, anti-tamper bootstrap checks | Warnings-as-errors, UB/sanitizer clean paths where supported, deterministic startup invariants | Security maintainer sign-off + focused unit/integration tests |
+| **T1** | Cryptographic policy enforcement, key-material isolation, immutable audit trail, RBAC enforcement | Production-mode gating (`THEMIS_PRODUCTION_MODE`), no insecure fallback in production, explicit error taxonomy | Security regression suite + audit evidence in `audit/` |
+| **T2** | Transaction integrity, input/schema validation, secure defaults in persistence/indexing | Safe failure semantics, WAL/recovery correctness, resource limits and quota enforcement | CTest coverage for recovery/conflict/security-relevant paths |
+| **T3** | Protocol authentication, request validation, DoS/rate limiting, tenant isolation | TLS/mTLS profile checks, strict parser limits, bounded request/body/stream settings | API security tests + protocol-specific focused tests |
+| **T4** | Model/plugin operation policy checks, content sanitization, output filtering | Runtime capability gates, bounded resource budgets, deterministic fallback behavior | Feature security tests + policy conformance checks |
+| **T5** | Signature verification, sandboxing, capability-scoped RPC, provenance checks | No implicit trust of plugin manifests, explicit allowlist/denylist, kill-switch support | Plugin verification tests + signed artifact validation |
+
+### Promotion and Change Management
+
+- Any component moving toward a lower-trust tier (for example, from T4 to T5) must include an explicit threat model update and new boundary tests.
+- Any component requiring higher trust (for example, T3 -> T2) requires architecture review plus security maintainer approval.
+- Public interfaces crossing tier boundaries must document auth model, input contract, error behavior, and audit events.
+
+This tiering is normative for architecture changes and complements the controls in [SECURITY.md](SECURITY.md), [AUDIT.md](AUDIT.md), and [GOVERNANCE.md](GOVERNANCE.md).
+
+---
+
 ## Namespace Organization
 
 ### Hierarchy

CONTRIBUTING.md

@@ -836,6 +836,20 @@ ctest --output-on-failure
 
 </details>
 
+### Tier-Based Security & Hardening Checklist (Required)
+
+For all changes that touch runtime behavior, contributors must include tier information and security evidence.
+
+1. Identify impacted tier(s) using the model in [ARCHITECTURE.md](ARCHITECTURE.md#security--hardening-tiering-model-core-module---plugin).
+2. Document trust-boundary crossings (for example T3 -> T2, T5 -> T4 broker calls).
+3. Confirm boundary controls on changed ingress/extension paths:
+   - authentication and authorization
+   - input validation and parser limits
+   - rate limiting and quota behavior
+   - audit event emission
+4. Add or update tests for changed boundaries, especially for T3/T4/T5 code paths.
+5. If a change effectively increases trust or privilege, include explicit architecture/security maintainer approval in the PR.
+
 ### PR Description Template
 
 ```markdown
@@ -863,6 +877,9 @@ Describe the tests you ran to verify your changes.
 - [ ] I have run `./scripts/check-quality.sh` and fixed all issues
 - [ ] I did not introduce Simulation/Stub/Mockup or legacy compatibility paths without explicit human approval
 - [ ] Any approved non-production path is explicitly human-marked (Reason, Activation, Production Delta, Approved By, Removal Target)
+- [ ] I classified impacted Security Tier(s) and documented trust-boundary crossings
+- [ ] I verified boundary controls (AuthN/AuthZ, validation, rate limits, audit) for affected T3/T4/T5 paths
+- [ ] I added boundary-focused tests for tier-crossing behavior or documented why not applicable
 ```
 
 ### Reviewer Gate: Non-Production Paths

CTEST.md

@@ -36,6 +36,31 @@ Diese Pfade dienen als Referenz für den Root-Dokument-Abgleich zwischen
 
 ---
 
+## Tier-zu-Test-Mapping (Security & Hardening)
+
+Dieses Mapping operationalisiert das Security-Tiering aus
+[ARCHITECTURE.md](ARCHITECTURE.md#security--hardening-tiering-model-core-module---plugin)
+und dient als Mindest-Nachweis fuer tier-uebergreifende PRs.
+
+| Tier | Fokus | Mindest-Verifikation (Beispielpfad) |
+|---|---|---|
+| **T0: Trusted Core** | Bootstrap- und Kerninvarianten, Wire/Core-Basis | `ctest --preset windows-release --output-on-failure -R "^(BuildInfoTests|EditionManagerTests|ThemisWireProtocolV1Tests)$"` |
+| **T1: Security & Platform Services** | AuthN/AuthZ, Krypto, Policy, Audit | `ctest --preset windows-release --output-on-failure -R "^(JWTValidatorTests|LDAPAuthenticatorTests|LDAPConnectionPoolTests|TOTPReplayCacheTests|TOTPSecretEncryptionTests)$"` |
+| **T2: Data Plane Engines** | Integritaet, Recovery, Transaktionssicherheit | `ctest --preset transaction-tests-release --output-on-failure --parallel 2` |
+| **T3: Interface & Protocol Edge** | Ingress-Sicherheit, Parser-/Rate-Limits, Tenant-Grenzen | `ctest --preset windows-release --output-on-failure -R "^(ThemisWireProtocolV1Tests|RateLimitingImprovementsFocusedTests|.*ApiHandler.*)$"` |
+| **T4: Managed Extension Runtime** | Runtime-Capability-Gates, Sanitization, Modellpfade | `ctest --preset windows-release --output-on-failure -R "^(LlmDeploymentPluginFocusedTests|LegalDomainFocusedTests|LegalExtractionFocusedTests)$"` |
+| **T5: Plugin Boundary** | Signatur, Provenienz, Sandbox, Plugin-Policy | `ctest --preset windows-release --output-on-failure -R "^(PluginManagerFocusedTests|PluginSecurityCRLOCSPTests|PluginSecurityAuditFocusedTests|PluginMarketplaceManifestFocusedTests|PluginManagerComprehensiveFocusedTests)$"` |
+
+### Review-Regel fuer tier-relevante PRs
+
+1. PR beschreibt betroffene Tier(s) und Trust-Boundary-Crossings.
+2. Mindestens ein passender CTest-Nachweis aus der Tabelle wird in der PR referenziert.
+3. Bei T3/T4/T5-Aenderungen sind Boundary-Kontrollen (AuthN/AuthZ, Validation, Rate Limits, Audit) explizit nachzuweisen.
+
+Hinweis: Die RegEx-Beispiele sind Mindestpfade und duerfen durch fokussierte Modul-Tests erweitert werden.
+
+---
+
 ## Ergebnis des Komplett-Runs (Istzustand 30.03.2026)
 
 ```

README.md

@@ -172,6 +172,20 @@ ThemisDB is organised into tracked source modules under `src/`, grouped into fou
 → Full architecture reference: [ARCHITECTURE.md](ARCHITECTURE.md)  
 → Module list and status: [ROADMAP.md](ROADMAP.md)
 
+### Security Tiering Quick Reference
+
+For security and hardening reviews, use the tier model (T0 Trusted Core -> T5 Plugin Boundary) as the default classification.
+
+| What | Where |
+|---|---|
+| Tier model and trust boundaries | [ARCHITECTURE.md](ARCHITECTURE.md#security--hardening-tiering-model-core-module---plugin) |
+| Normative security rules per tier | [SECURITY.md](SECURITY.md#-security-tiering-model-normativ) |
+| Contributor checklist for tier/boundary evidence | [CONTRIBUTING.md](CONTRIBUTING.md#tier-based-security--hardening-checklist-required) |
+| PR template section (required for runtime changes) | [.github/pull_request_template.md](.github/pull_request_template.md#security-tiering-impact-required-for-runtime-changes) |
+| Tier-to-test verification mapping | [CTEST.md](CTEST.md#tier-zu-test-mapping-security--hardening) |
+
+Rule of thumb: architecture is layered, but security acceptance is tier-based.
+
 ---
 
 ## Documentation

SECURITY.md

@@ -121,6 +121,37 @@ gemeinsame Baseline:
 
 ---
 
+## 🧱 Security Tiering Model (Normativ)
+
+ThemisDB uses a security tier model from trusted core modules to least-trusted plugin boundaries. This model is normative for architecture, implementation, and release review.
+
+Primary reference: [ARCHITECTURE.md](ARCHITECTURE.md#security--hardening-tiering-model-core-module---plugin)
+
+| Tier | Scope | Mandatory Control Focus |
+|---|---|---|
+| **T0: Trusted Core** | Core bootstrap and trust anchors | Startup invariants, memory/lifecycle correctness, anti-tamper checks |
+| **T1: Security & Platform Services** | Identity, crypto, policy, config, audit | RBAC, key isolation, immutable audit guarantees, production-mode enforcement |
+| **T2: Data Plane Engines** | Query, transaction, storage/index, replication/sharding | Data integrity, recovery safety, quota/resource enforcement |
+| **T3: Interface & Protocol Edge** | HTTP/gRPC/Wire ingress and protocol handlers | AuthN/AuthZ at ingress, parser bounds, DoS protection, tenant isolation |
+| **T4: Managed Extension Runtime** | In-tree extensions (LLM/content/model runtime) | Capability gating, bounded runtime budgets, sanitized inputs/outputs |
+| **T5: Plugin Boundary** | Dynamic plugins and adapters | Signature/provenance checks, sandboxing, capability-scoped invocation |
+
+### Mandatory Tier Rules
+
+1. Dependencies are one-way: higher-numbered tiers can depend on lower-numbered tiers, never vice versa.
+2. T5 code must never directly invoke privileged T0/T1 internals without brokered policy checks.
+3. All T3/T4/T5 entry points require authentication, authorization, input validation, rate limiting, and audit events.
+4. Security decisions are fail-closed: uncertainty in auth/policy/config must reject the operation.
+5. Every tier-crossing public interface must document auth model, input contract, error behavior, and audit semantics.
+
+### Tier Evidence Required in PRs
+
+- State affected tier(s) and trust-boundary crossings in the PR description.
+- Provide at least one boundary-focused test for changed T3/T4/T5 code paths.
+- If a change alters effective trust level, include threat model delta and maintainer sign-off.
+
+---
+
 ## 🛡️ Security Measures
 
 ThemisDB implements **defense-in-depth** security across all layers:

ai_working/ctest_llm_adapter_fix_plan_2026-06-18.md

@@ -0,0 +1,23 @@
+# CTest LLM Adapter Fix Plan (2026-06-18)
+
+## Goal
+Repair the next full-CTest blocker in the legal ingestion LLM adapter without regressing the existing regex fallback behavior.
+
+## Affected Files
+- src/ingestion/llm_adapter.cpp
+- include/ingestion/llm_adapter.h
+- tests/ingestion/test_ingestion_llm_adapter.cpp (read-only unless production fix proves insufficient)
+- tests/legal/test_legal_extraction.cpp (validation only)
+
+## Acceptance Criteria
+- `IngestionLlmAdapterFocusedTests` passes.
+- Explicitly configured missing model path throws in Phase-2 tests.
+- Readable configured model path reports available and yields a non-empty extractor function.
+- No configured model still keeps regex fallback behavior.
+- `LegalExtractionFocusedTests` stays green.
+
+## Test Scope
+- `cmake --build --preset windows-release --target test_ingestion_llm_adapter_focused --parallel 16`
+- `ctest --preset windows-release --output-on-failure -R "IngestionLlmAdapterFocusedTests" -j 1`
+- `cmake --build --preset windows-release --target test_legal_extraction_focused --parallel 16`
+- `ctest --preset windows-release --output-on-failure -R "LegalExtractionFocusedTests" -j 1`

include/core/concerns/i_tracer.h

@@ -52,6 +52,20 @@ class ITracer {
          */
         virtual void setAttribute(const std::string& key, const std::string& value) = 0;
 
+        /**
+         * @brief Set a string attribute from a C string literal or buffer.
+         *
+         * This overload prevents C string arguments from binding to the bool
+         * overload through implicit pointer-to-bool conversion.
+         * A null pointer is normalised to the empty string.
+         *
+         * @param key   Attribute name (OpenTelemetry semantic convention recommended).
+         * @param value Null-terminated string value, or null for empty.
+         */
+        void setAttribute(const std::string& key, const char* value) {
+            setAttribute(key, std::string(value != nullptr ? value : ""));
+        }
+
         /**
          * @brief Set an integer attribute on the span.
          * @param key   Attribute name.

include/ingestion/ingestion_sinks.h

@@ -373,6 +373,7 @@ class GraphStoreSinkAdapter : public IGraphWriter {
     std::string node_key_prefix_;
     mutable std::mutex mtx_;
     std::unordered_set<std::string> written_node_ids_;
+    std::unordered_set<std::string> written_edge_ids_;
 };
 
 /**

include/ingestion/llm_adapter.h

@@ -151,10 +151,13 @@ class LegalLlmAdapter {
     /**
      * @brief Check whether a real LLM backend is available.
      *
-     * Delegates to `ITextGenerationBackend::isAvailable()` on the injected
-     * backend.  Returns `false` when using the default `NullTextGenerationBackend`.
+        * When a `model_path` is configured, this validates that the referenced
+        * model file is accessible for reading. Without a configured model path,
+        * the check delegates to `ITextGenerationBackend::isAvailable()` on the
+        * injected backend.
      *
-     * @return true if the backend is ready for inference
+        * @return true if a configured model file is readable or the injected
+        *         backend reports that it is ready for inference
      */
     bool isLlmAvailable() const;
 
@@ -168,10 +171,16 @@ class LegalLlmAdapter {
      * inference engine with a structured German legal extraction prompt and
      * parses the JSON response into a `DeonticExtraction`.
      *
+    * Throws when a model path is explicitly configured but the file cannot
+    * be opened. This keeps misconfigured deployments fail-closed instead of
+    * silently degrading to regex extraction.
+    *
      * The returned function captures the model configuration by value so it
      * remains valid independently of the `LegalLlmAdapter` instance lifetime.
      *
      * @return ExtractorFn (may be empty in Phase 1 / when no model is set)
+    * @throws std::runtime_error if `config_.model_path` is set but the model
+    *         file is not readable
      */
     DeonticExtractor::ExtractorFn buildExtractorFn() const;