The Governed Causal Graph
The causal graph is the workspace's owned theory of how its world works — and humans own it. Agents and algorithms only propose nodes and edges, with rationale and evidence attached. Nothing downstream — no identification, no estimate, no simulation — runs on an edge a human hasn't approved.
Humans own truth
propose_edge() lands at status=proposed, with the claimed mechanism and the evidence behind it. A human reviews and approves — or doesn't (invariant I5). The graph that the analytics trust is therefore never the model's intuition; it is the team's accepted causal theory, versioned and inspectable.
The identification gate
Before any effect is quoted, identify() walks the strategy tree on the approved subgraph — randomized, backdoor, frontdoor, IV or DiD where declared — and either returns a review (the adjustment set, the forbidden controls, the assumptions doing the work) or says not identifiable. estimate() refuses to run without that review id (invariant I3). In the worked example, discount → win_rate is identifiable by backdoor, adjusting for {segment, rep_experience}.
Estimates that face a skeptic
estimate() builds its dataset as-of (no future rows), hashes it, runs the estimator, then runs deterministic skeptic checks — lookahead, post-treatment controls, overlap, sample size, regime nonstationarity, multiple testing. Blockers abort with an explanation. Methods the system can't run honestly are registered interface_only and never faked.