docs consolidation work

docs/modules/graph/README.md

@@ -60,3 +60,31 @@ Graph Indexer + Graph API build the tenant-scoped knowledge graph that powers bl
 ## Epic alignment
 - **Epic 5 – SBOM Graph Explorer:** Graph Indexer, Graph API, saved queries, overlays, Console/CLI experiences, Offline Kit parity.
 - Cross-epic ties: Policy reasoning (explain overlays), Scheduler recompute, Notify/Task Runner integration for graph incidents.
+
+## Implementation Status
+
+### Delivery Phases
+- **Phase 1 – Graph Indexer foundations:** Stand up Graph Indexer service, node/edge schemas, ingestion from SBOM/Concelier/Excititor events, identity stability, snapshot materialisation
+- **Phase 2 – Graph API service:** Expose search, query, path, impact, diff, and overlay endpoints with RBAC, cost controls, streaming responses
+- **Phase 3 – Console & CLI experiences:** Ship Graph Explorer UI (WebGL canvas, filters, diff mode, overlays) and CLI for automation pipelines
+- **Phase 4 – Advanced analytics:** Implement clustering, centrality, saved queries, overlay caching, Policy Engine explain integration
+- **Phase 5 – Exports & offline:** Deliver GraphML/CSV/NDJSON exports, Offline Kit bundles with deterministic manifests
+- **Phase 6 – Observability & hardening:** Complete dashboards, alerts, runbooks, load/perf testing, a11y review
+
+### Acceptance Criteria
+- Graph Indexer ingests SBOM/advisory/VEX events deterministically with tenant isolation and append-only provenance
+- Graph API serves endpoints within budgeted latency and enforces cost limits + RBAC
+- Console explorer visualises topology, overlays, diffs; CLI commands mirror functionality for automation
+- Exports and Offline Kit bundles reproduce snapshots and overlays with signed manifests
+- Observability dashboards/alerts detect ingest lag, query failures, cache churn, memory pressure; runbooks guide remediation
+- Policy/VEX overlays align with Policy Engine explain traces and VEX suppressions
+
+### Key Risks & Mitigations
+- **Graph scale/complexity:** Adopt adjacency compression, cached overlays, streaming pagination, enforced query budgets
+- **Tenant bleed:** Strict tenant filters, fuzz tests, data masking, compliance reviews
+- **Runaway queries/visualization:** Cost planner, query timeout, UI hints, safe mode renders
+- **Cache poisoning:** Input validation, schema versioning, eviction policies
+- **Offline parity gaps:** Deterministic export pipeline, integration tests for Offline Kit import
+
+### Current Active Sprint
+- Runtime & Signals 140.A: Clustering/centrality jobs, incremental/backfill pipeline, determinism tests, packaging