A777ance · localDNS · governance

Provenance — governing epistemic inheritance

Every claim in this repo arrived from somewhere. This page defines the tiers a claim can hold, the rules that move it between them, the gates that check it before it reaches anything irreversible, and the script that enforces all three.

The one law: nothing here gets truer by being copied. Transmission — quoting, summarising, reformatting, publishing, agreeing — preserves or lowers a claim's tier. Only fresh contact with the origin raises it.

1The defect: epistemic inheritance

An artifact's authority is inherited from whatever it was made from. That is normally invisible, because the inheritance is fine — a config read off the running box inherits the box's authority. The defect appears when a step in the chain looks like verification but is only transmission, and the artifact ends up cited at a tier its source never held.

Two cases from this repo, months and three orders of magnitude apart, with identical structure:

Case	The loop	What made it invisible
The jury menu 2026-08-07	A kept transcript supplied the four candidate labels for a later run, because it was the "reference". Nobody had ever chosen those four labels on the merits — their only provenance was an earlier copy of themselves.	The second run agreed with the first, and agreement reads as confirmation. It wasn't: a shared option set correlates the draws, and correlated jurors agree because they're correlated.
The reconstructed configs ongoing	Docs were written from the live box. Configs were later rebuilt from those docs. Those configs are the repo's rollback target — so if one is ever deployed unverified, the box takes its state from a description of itself.	The files are real, syntactically valid, and sit in the same directory as configs that were read off the box. Nothing in the filesystem distinguishes them.

Same shape both times: a claim rose a tier by being moved. That is the thing this page governs. It is not a documentation problem — it is a problem of what the repo is for, since a rollback target that can't tell you where it came from is not a rollback target.

Why a page is not enough, and why this one ships with a script. The root-cause finding that produced this page was that doctrine in prose is advisory: runs inherit their behaviour from the file that executes them, so an invariant living only in a briefing gets re-broken by the next operator following that briefing faithfully. A page about epistemic governance that is only a page would be the same defect wearing its own uniform. The enforceable half is tools/check-provenance.py (§6).

2The Ladder

Five tiers, highest first. The tier answers one question — what did this come from, and is that thing the origin or a description of it?

Tier	Means	Licensed to	Example here
M Measured	A number this stack actually produced, with the command that produced it. The only tier that may carry a figure.	Print on a customer Statement · size a jury · close an issue	The `/diet` table (120 questions, seed 7) in the jury reference session
O Observed	Read off the source of truth — the live t630 — rather than off a description of it. Not a metric; a state.	Deploy · be cited in the briefing as fact · overwrite a repo file	A config `diff`ed against `192.168.1.118` and dated
D Derived	Follows deterministically from stated M/O inputs. Never higher than its weakest input — cite them.	Whatever its weakest input is licensed to	"85 Mbit is 85% of the measured downlink" — D over an M
R Reconstructed	Rebuilt from a description of the thing rather than the thing. Plausible, often correct, and structurally unable to certify itself.	Be reviewed · be staged in the deploy queue. Never deployed undiffed, never quoted as fact	`local-records.conf`, the console units, the LiteLLM front door
A Asserted	Design intent, plan, or lore. No origin outside the author. Legitimate — just never mistaken for the other four.	Be argued with	The Odin roster; anything in `docs/chronikonomicon/`

R is the dangerous rung, and it is dangerous precisely because it is useful. Reconstruction is how this repo got back a rollback target for services whose configs were never snapshotted. The tier is not a criticism of the work; it is the label that keeps the work from being mistaken for a reading.

3The physics

The asymmetry is the whole system: moving a claim is free and never promotes it; promotion costs a trip to the origin.

1 · Transmission never promotes. Copying, quoting, summarising, reformatting, publishing, and voting all preserve or lower a tier. If you cannot name what new contact with the origin occurred, no promotion happened.

2 · Agreement is not provenance. Five sources agreeing is one source if they share an ancestor. This is the jury result generalised: at rho=0.9 a vote's lift is Δ=+0.00 while per-draw accuracy is unchanged — unanimity is equally the signature of a strong panel and a collapsed one. Independence is a property of origins, not of counts.

3 · A derived claim is as strong as its weakest input. D over an R is an R. One unverified input taints the conclusion, no matter how sound the reasoning on top of it.

4 · Age is not verification. An R-tier file does not become O-tier by surviving in git for six months. Conversely an O-tier reading decays — the box drifts — so a stale observation must be re-taken, not re-labelled. Staleness never lowers a recorded tier; it invalidates its currency.

5 · Format is not evidence. Rendering a claim as a table, a rendered page, a PDF, or a customer Statement changes nothing about where it came from. The most dangerous promotion in this portfolio is R → "printed on a document a customer keeps".

4The gates

Tiers only matter where a claim crosses into something you can't take back. Four crossings in this stack, each with a minimum tier:

Gate	Crossing	Minimum	Mechanism
Deploy	repo → the live t630	O	DEPLOY-PROTOCOL: diff before overwrite, validate before reload, verify the effect. An R-tier file must be staged in DEPLOY-QUEUE and diffed on the box — that diff is the promotion.
Print	repo → a customer Statement	M	The honesty invariant: omit the section rather than print an unsupported figure. People keep these documents.
Brief	a session's inference → CLAUDE.md	O / label it	The seed is read as authority by every future session. An inference written into it unlabelled is laundered into fact on the next `/clear`.
Verdict	model draws → a decision	M to certify	§G: a keyless plurality certifies that the elicitation converged, not that the answer is right. Measured `p̂` or it stays unpriced.

These are Bifrost *() gates in the command schema: * cuts the road into dispensations and () states what must hold before the next opens. Provenance is what goes inside the parentheses. The lazy anchor is affordable precisely because the irreversible steps ride past a light — and "what tier is this?" is what the light checks.

5Marking

One tag, in whatever comment syntax the file speaks. It records what the artifact came from — not what it describes.

<!-- provenance: R · rebuilt from docs/architecture/network-context.md "Step 12" · 2026-08-07 · verify: DEPLOY-QUEUE Stage 12 -->

# provenance: M · python3 …/jury_claude.py diet (120 q, seed 7) · 2026-08-07

Fields, ·-separated: tier · source · date the claim was made · optional verify: — the route back to an origin outside the loop. R and A tiers must carry verify:; a tier with no promotion path is a dead end that quietly ages into assumed truth.

Untagged is not a tier. An untagged file is unknown provenance, which the gates treat as R until someone establishes otherwise. Coverage is reported, not assumed — today 2 of 48 deploy targets carry a tag, and the checker prints that ratio on every run rather than hiding it behind a green tick.

6Enforcement

python3 tools/check-provenance.py — standard library only, same house pattern as tools/check-docs.py. It fails on:

a tier letter not on the ladder, a missing source, a malformed or future-dated claim;
an R- or A-tier tag with no verify: route;
an R- or A-tier deploy target that is not staged in docs/DEPLOY-QUEUE.md — the specific path by which a description of the box becomes the box.

And reports, as warnings, M/O observations older than --stale-days (180 by default) — re-observe, don't re-label. --strict promotes staleness to a failure and additionally requires every deploy target to be tagged; the default is adoptable today, and --strict is where this ends up once the box is reachable and the reconstructed set has been diffed.

$ python3 tools/check-provenance.py
R    01-core-network/unbound/local-records.conf  ←  rebuilt from CLAUDE.md § D …  (2026-08-07)
M    …/examples/workout-bootstrap-paradox-session.md  ←  two juror panels + diet …  (2026-08-07)
…
Deploy-target coverage: 2/48 tagged  (run --strict to require full coverage)

All 5 provenance tag(s) valid.

Where a rule has to live to bind anything is a separate question from what tier a claim holds, and it has its own audit: warrant-sites.md. The short of it: this ladder governs artifacts, and a ladder that lives only in a briefing governs nothing — which is why the checker above is a commit-time hook and not a habit.

7Laundering — the failure catalogue

Named so they can be called out in review. Every one of these is a tier rising without contact with an origin.

Name	The move	Tell
Reconstruction loop	Docs written from the thing; the thing rebuilt from the docs; the rebuild treated as the thing.	You cannot name a date on which anyone looked at the original.
Consensus laundering	Multiple outputs of one prior counted as multiple sources of evidence.	The sources would have agreed even if the fact were false.
Format laundering	A guess acquires authority by being rendered — a table, a published page, a kept document.	The claim got more confident and nothing new was learned.
Briefing capture	A session writes its own inference into the seed; the next session reads it as standing fact.	The briefing asserts something no commit or command ever established.
Lore bleed	A-tier narrative (rosters, names, mythology) restated as configuration.	"Snapshot it from the live box, don't fabricate it from lore."
Staleness promotion	An old reading treated as current because nothing contradicted it.	The date on the claim predates changes to the thing it describes.

8Field procedure

The one question, asked of any claim about to cross a gate:

Where did this enter from outside the loop? If the answer is "an earlier copy of itself", it has no origin — you are about to deploy, print, or believe a bootstrap paradox.

Promoting R → O

Fetch the live artifact from 192.168.1.118 — the actual file, not its documentation.
diff it against the repo copy. Reconcile toward the box; the box is the source of truth.
Update the tag: tier O, source = the command you ran, date = today, drop verify:.
Commit the diff resolution and the tag in the same change, so the promotion has a record.

Steps 1–2 are the promotion. Steps 3–4 are what stop the next session from re-deriving it — RCPS: root-cause and record, interleaved, neither counting alone.

Reviewing someone else's claim

Ask for the tier, not for reassurance. "How confident are you?" invites transmission; "what did that come from, and when?" cannot be answered by repetition.

9Revision log

Date	Change
2026-08-07	Page created. Ladder (M/O/D/R/A), five physics rules, four gates, tag grammar, `tools/check-provenance.py`, laundering catalogue. Prompted by the root-cause finding behind the jury honesty flags — that doctrine in prose is advisory — and by the reconstructed-config set, which is the same defect at deploy scale.