Return engineering constraints relevant to a scope. Inputs: scope (providers, resource_types, environments, repos, relationship), optional version (bundle id; defaults to latest). resource_types use Terraform resource identifiers, e.g. 'aws_s3_bucket' (NOT 's3_bucket'); repos are tags like 'tag:data-plane'. If unsure of valid values, call describe_scope first, or simply omit a dimension (omitted dimensions are 'don't care' and broaden the match rather than excluding). Output: {available, bundle_id, constraints[]}. Fails open: on any error returns available=false with an empty constraints list so you can proceed.

Discover the selector vocabulary present in the registry so you can build a correct scope instead of guessing. Output lists the distinct providers, resource_types (Terraform resource identifiers, e.g. 'aws_s3_bucket' not 's3_bucket'), environments, repos (tags like 'tag:data-plane'), categories, severities, sources, and relationship layers/interactions. Call this first if unsure of valid scope values.

Validate a candidate artifact against in-scope constraints by delegating to enforcement engines. Inputs: artifact (object), scope, optional version. Output: {bundle_id, passed, results[]} where each result has constraint, severity, kind, verdict, violations, guidance.