The Foundation Triad. Algorithms, Data, and Compute are co-equal load-bearing pillars — a weakness in any one collapses the system. Every AI capability audits all three: algorithm reliability and safety, data intelligence and veracity, compute latency and concentration risk. Live scorecard: /scs-admin/developer-os. Doctrine: mem://doctrine/ai-triad.
The Four V's of Data. Volume, Velocity, Variety, and Veracity. Volume and Velocity are capacity questions; Variety is a schema question; Veracity is a trust question and is the only one that can silently poison downstream outputs. Because of that, every persisted memory row carries a veracity_score (0–100), a confidence_band (low / medium / high / verified), and provenance metadata. No AI output ships without them — the veracity gate is enforced at write time and read time (mem://rules/veracity-gate, src/lib/veracity-gate.ts).
The Analytics Ladder. Every insight is tagged one of four tiers: Descriptive (what happened), Diagnostic (why it happened), Predictive (what will happen), Prescriptive (what to do). The WebCore Assistant auto-tags each finding and reports ladder health per run — balanced / shallow (descriptive-heavy) / action-heavy (prescriptive without diagnosis). A report weighted only toward Descriptive is a warning, not a win.
Compute concentration is a real risk, not a footnote. TSMC in silicon, NVIDIA in GPU, one model vendor at the top of the routing table — any of these is a single point of failure. The Compute & Provider Risk Register (src/lib/developer-os-compute-risk.ts) scores every upstream substrate on concentration percentage, substitutability (hot / warm / cold / none), and mitigation gaps, and computes a Herfindahl-style concentration index. High-tier gaps become roadmap items automatically.
How to apply when adding a new AI feature: (1) name the algorithm, data source, and compute path explicitly; (2) attach veracity_score + provenance + confidence_band to anything the feature writes to memory; (3) tag every output with its Analytics Ladder tier; (4) check the feature does not deepen an existing compute concentration without a warm-standby plan. If any of those four steps is skipped, the feature is not enterprise-ready regardless of how well it demos.