04 — Classification Engine Completeness

Class assignment (every source class mapped)

DOT_CONTAINED, AUTO_MULTI_STEP, HUMAN_IN_LOOP, JOB_QUEUE, APPROVAL_GOVERNANCE, EVENT_DRIVEN, TRIGGER_FUNCTION, SCHEDULER_TIMER, DOCUMENT_DEFINED, EXTERNAL_SERVICE, UNKNOWN_ORPHAN — all 11 classes have at least one live source mapped (see 03). class_rule is stored per source in workflow_discovery_source_registry.

Evidence level distribution (DB process-definitions)

• STRUCTURAL_ONLY: ~371 (most DOTs/workflows — structure known, no runtime)
• SIMULATED_OBSERVED: dot:kg lineage (earlier)
• DRY_RUN_OBSERVED: dot:kg (correlated dry-run; not verified)
• REAL_RUN_OBSERVED: 0
• VERIFIED_CANDIDATE: 1 (job:cut, 8 members)
• BIRTH_READY: 1 (job:cut, owner-gated)
• GOVERNED_ACTIVE: 0

Gap labels present (live)

missing_runtime (REAL_RUN=0 system-wide), missing_correlation (17 gaps), missing_owner (gov_ownership=0), missing_birth, missing_rp_visibility (rp_assigned=0 → applies to ALL 373), source_not_scanned (6 host sources), event_inactive (7 process.*), scheduler_missing (no schedule in dot_tools for cron-run DOTs), duplicate_risk (IU-command vs DOT overlap), false_positive_risk (triggers/functions as processes).

Unclassified with exact reason

• kb_sop_docs: UNCLASSIFIED — no KB extraction adapter; count unknown.
• host_crontab/systemd/fs/containers: classified as SCHEDULER_TIMER/EXTERNAL_SERVICE by type, but per-OBJECT classification not possible from DB (no adapter).