{"slug":"object-ledger-evidence-graph-spec","verification":{"valid":true,"entries":26,"head":"fea3721ead2dfe68cd28e8323bd7e6c4408c1e9489cfa314ef66bdef917f160e"},"count":26,"sources":[{"id":"p1","type":"reference","title":"W3C PROV-DM: The PROV Data Model","publisher":"W3C","url":"https://www.w3.org/TR/prov-dm/","quote":"PROV-DM is a data model for provenance that describes the entities, activities and agents involved in producing a piece of data or thing in the world.","summary":"Solves: naming entities, activities, and responsible agents, and the relations between them. Does not solve: a declared population to check completeness against, or a per-object graph of competing, revisable assertions.","accessed_at":"2026-07-28T00:00","claim_ids":["c30"],"prev":"genesis","hash":"5703436a0b8989333a79ace7190fd9324df8a10ce0450ba82ae6294e25256d52"},{"id":"p2","type":"reference","title":"OpenTelemetry tracing specification","publisher":"OpenTelemetry","url":"https://opentelemetry.io/docs/specs/otel/trace/api/","summary":"Solves: recording operations and their causal relationships across services, at low overhead, in production. Does not solve: retention beyond a sampling/expiry window, or any concept of a required population.","accessed_at":"2026-07-28T00:00","claim_ids":["c30"],"prev":"5703436a0b8989333a79ace7190fd9324df8a10ce0450ba82ae6294e25256d52","hash":"46ff3cfc3d5b37c453b25038dbb77a01ecc77d3dbca942fc334776bc40a5ea0a"},{"id":"p3","type":"reference","title":"OpenLineage object model","publisher":"OpenLineage","url":"https://openlineage.io/docs/spec/object-model","summary":"Solves: tracking which job read and wrote which dataset, across pipeline tools. Does not solve: row-level or record-level coverage — lineage is at dataset granularity.","accessed_at":"2026-07-28T00:00","claim_ids":["c30"],"prev":"46ff3cfc3d5b37c453b25038dbb77a01ecc77d3dbca942fc334776bc40a5ea0a","hash":"225b03f1d82dc848bc333e37c73edcfaf1f30ec9ba4e47b441979a6dc63ba9fb"},{"id":"p4","type":"reference","title":"Event Sourcing","publisher":"Martin Fowler","url":"https://martinfowler.com/eaaDev/EventSourcing.html","quote":"Capture all changes to an application state as a sequence of events.","summary":"Solves: reconstructing any past state from an append-only event log, and never discarding a mutation. Does not solve: attributing a judgment's reliability, or representing disagreement between two events about the same fact.","accessed_at":"2026-07-28T00:00","claim_ids":["c31"],"prev":"225b03f1d82dc848bc333e37c73edcfaf1f30ec9ba4e47b441979a6dc63ba9fb","hash":"bec9a091a1777f4208bebd65cf7f2255211fd1722072cc0ba3c197c1384aa9c5"},{"id":"p5","type":"reference","title":"in-toto attestation framework","publisher":"in-toto / GitHub","url":"https://github.com/in-toto/attestation","summary":"Solves: a signed statement binding a predicate to a subject identified by cryptographic digest — the shape a pass record needs. Does not solve: aggregating many such statements into a belief about the subject, or declaring a population.","accessed_at":"2026-07-28T00:00","claim_ids":["c20","c30"],"prev":"bec9a091a1777f4208bebd65cf7f2255211fd1722072cc0ba3c197c1384aa9c5","hash":"dfa5c3919558554ce02ce4da7da0e74c66dcf9988163c53b8dd56d892f87d7ec"},{"id":"p6","type":"reference","title":"SLSA v1.0 provenance specification","publisher":"slsa.dev","url":"https://slsa.dev/spec/v1.0/provenance","quote":"The provenance attestation describes how an artifact was produced, including the builder identity, the build definition, and the resolved dependencies.","summary":"Solves: binding a build artifact to the identity and inputs that produced it. Does not solve: this outside the build/CI domain, or coverage over a declared set.","accessed_at":"2026-07-28T00:00","claim_ids":["c20","c30"],"prev":"dfa5c3919558554ce02ce4da7da0e74c66dcf9988163c53b8dd56d892f87d7ec","hash":"55dc0791855c84e91ede6b504b032c5a25096503338150d5245527cd5db1607e"},{"id":"p7","type":"reference","title":"C2PA technical specification 2.1","publisher":"Coalition for Content Provenance and Authenticity","url":"https://c2pa.org/specifications/specifications/2.1/index.html","summary":"Solves: attaching a tamper-evident manifest of edits and tool identities to one piece of media. Does not solve: cross-media relationships, or a declared population of media to check.","accessed_at":"2026-07-28T00:00","claim_ids":["c30"],"prev":"55dc0791855c84e91ede6b504b032c5a25096503338150d5245527cd5db1607e","hash":"8a44d23541aa088171b88fc45068ec18254a2acc265a42a0bbb6182a8f0a1ac8"},{"id":"p8","type":"reference","title":"Certificate Transparency (RFC 6962)","publisher":"IETF","url":"https://www.rfc-editor.org/rfc/rfc6962","summary":"Solves: an append-only, publicly auditable, cryptographically verifiable log where deletion or backdating is detectable by anyone who recomputes the tree. The chain construction in this spec's pass ledger borrows this idea directly, at far smaller scale (per-object hash chain vs. a public Merkle log).","accessed_at":"2026-07-28T00:00","claim_ids":["c21"],"prev":"8a44d23541aa088171b88fc45068ec18254a2acc265a42a0bbb6182a8f0a1ac8","hash":"0ca5bbed26350b72d91a4eb3b6eb7fa817e7893c9464d959460fbe5d95f1ccc3"},{"id":"p9","type":"reference","title":"LangGraph persistence and checkpoints","publisher":"LangChain","url":"https://langchain-ai.github.io/langgraph/concepts/persistence/","summary":"Solves: checkpointing an agent's own execution state so a run can pause, resume, or roll back. Does not solve: sharing state across independent agents as canonical objects, or recording disagreement between agents about the same object.","accessed_at":"2026-07-28T00:00","claim_ids":["c32"],"prev":"0ca5bbed26350b72d91a4eb3b6eb7fa817e7893c9464d959460fbe5d95f1ccc3","hash":"75ed5dcd76b7f6d42da1aae57fff683595d7c5bf7a6fb97af6cea0a84c6e61a7"},{"id":"p10","type":"reference","title":"Palantir Foundry Ontology overview","publisher":"Palantir","url":"https://www.palantir.com/docs/foundry/ontology/overview","summary":"Solves: unifying enterprise data into typed objects, links, and actions with permissions, at production scale, across large organizations. Does not solve (as documented): a public conformance spec that a third party could implement independently, or per-examination model attestation as a first-class primitive.","accessed_at":"2026-07-28T00:00","claim_ids":["c33"],"prev":"75ed5dcd76b7f6d42da1aae57fff683595d7c5bf7a6fb97af6cea0a84c6e61a7","hash":"8e567c8990f6fdbed1e31ab37e668d3b6c5af437ceba1419b8df222f864990d5"},{"id":"p11","type":"reference","title":"Fellegi–Sunter record linkage / entity resolution survey","publisher":"Wikipedia — Record linkage","url":"https://en.wikipedia.org/wiki/Record_linkage","summary":"Solves: the statistical theory of deciding whether two records from different sources refer to the same real-world entity, going back to 1969. Does not solve: what to do with the resulting object afterward — linkage ends at a match decision, not a durable graph.","accessed_at":"2026-07-28T00:00","claim_ids":["c9","c10"],"prev":"8e567c8990f6fdbed1e31ab37e668d3b6c5af437ceba1419b8df222f864990d5","hash":"d3291720b008bbecea9ad489faa12f0e5b04d3b66e4f79e54073c0ec8c43ebaf"},{"id":"p12","type":"reference","title":"A Practitioner's Guide to Evaluating Entity Resolution Results","publisher":"arXiv","url":"https://arxiv.org/abs/1509.04238","summary":"Practical measurement of entity-resolution error rates. Used here to source the claim that entity resolution has a nonzero, measurable error rate at any scale — the reason identity conflicts must be recorded, not silently resolved.","accessed_at":"2026-07-28T00:00","claim_ids":["c10"],"prev":"d3291720b008bbecea9ad489faa12f0e5b04d3b66e4f79e54073c0ec8c43ebaf","hash":"8c04986e98164c0a26df30bdff96f34508cc9177892b2acd044c4b073be1958f"},{"id":"p13","type":"reference","title":"Schema matching","publisher":"Wikipedia","url":"https://en.wikipedia.org/wiki/Schema_matching","summary":"Solves: automatically or semi-automatically proposing correspondences between two schemas. Does not solve: what happens to fields that have no correspondence — that is a design decision this spec makes explicit (kept as unmapped_fields, never dropped).","accessed_at":"2026-07-28T00:00","claim_ids":["c8"],"prev":"8c04986e98164c0a26df30bdff96f34508cc9177892b2acd044c4b073be1958f","hash":"3faefe6b3be98ddf45c41cc3ebb3662a33ee8673105f6a600534fddc62ad09c1"},{"id":"p14","type":"reference","title":"Belief revision","publisher":"Wikipedia","url":"https://en.wikipedia.org/wiki/Belief_revision","summary":"The formal problem of updating a set of beliefs when a new, possibly contradicting fact arrives. Cited for the AGM postulates this spec's belief-aggregation problem inherits and does not solve.","accessed_at":"2026-07-28T00:00","claim_ids":["c17","c18"],"prev":"3faefe6b3be98ddf45c41cc3ebb3662a33ee8673105f6a600534fddc62ad09c1","hash":"47260d8fe50302487b7560e1e802a72d8dfbebf1a8402068a9ac5814a29e79c5"},{"id":"e1","type":"reference","title":"FTC order prohibits X-Mode/Outlogic from selling sensitive location data","publisher":"Federal Trade Commission","url":"https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-x-mode-social-outlogic-selling-sensitive-location-data","summary":"First FTC order banning the sale of sensitive location data outright, over data that could reveal visits to medical clinics, places of worship, and shelters. Used here as evidence that fragmented commercial location data is already being fused and sold at a scale regulators consider unfair.","accessed_at":"2026-07-28T00:00","claim_ids":["c26"],"prev":"47260d8fe50302487b7560e1e802a72d8dfbebf1a8402068a9ac5814a29e79c5","hash":"eca25d1e62a7ff88f9318d1a0ba648738cac385c8b90107e48ff4ec9379a3ebc"},{"id":"e2","type":"reference","title":"FTC action against Mobilewalla for selling sensitive location data","publisher":"Federal Trade Commission","url":"https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-mobilewalla-collecting-selling-sensitive-location-data","summary":"A second, separate 2024 order over the same underlying practice — buying real-time bidding data never meant for resale and reselling location tied to homes and sensitive sites.","accessed_at":"2026-07-28T00:00","claim_ids":["c26"],"prev":"eca25d1e62a7ff88f9318d1a0ba648738cac385c8b90107e48ff4ec9379a3ebc","hash":"098888ab6da66f34a4a2bd5fc431738111a9153a19fe086ad46b53a68936d4ea"},{"id":"e3","type":"reference","title":"GAO-23-105607: Facial Recognition Services — federal law enforcement training and civil-liberties gaps","publisher":"U.S. Government Accountability Office","url":"https://www.gao.gov/products/gao-23-105607","summary":"Found that seven DHS/DOJ law-enforcement components ran roughly 60,000 facial-recognition searches with no training requirement in place, and that most lacked a specific civil-rights policy for the technology. Cited here as documented evidence of exactly the missing artifact this spec calls a coverage and procedure record — searches ran with no stored rule and no stored count.","accessed_at":"2026-07-28T00:00","claim_ids":["c25"],"prev":"098888ab6da66f34a4a2bd5fc431738111a9153a19fe086ad46b53a68936d4ea","hash":"0d55ab2a1f0e9d39c3a922e23afabc2cd82f8ed6a0ddcbe39e80677477b11a6a"},{"id":"e4","type":"reference","title":"GAO-24-107372: Facial Recognition Technology — federal agency follow-up on civil-rights training","publisher":"U.S. Government Accountability Office","url":"https://www.gao.gov/products/gao-24-107372","summary":"The 2024 follow-up confirming DHS and DOJ began issuing department-wide policy after the 2023 findings — evidence that the gap was real and that closing it took an external audit, not a voluntary internal one.","accessed_at":"2026-07-28T00:00","claim_ids":["c25"],"prev":"0d55ab2a1f0e9d39c3a922e23afabc2cd82f8ed6a0ddcbe39e80677477b11a6a","hash":"9da56a89748dcf6a763adc151d1423712461e95974627dffd6de3f695aefc954"},{"id":"e5","type":"reference","title":"Federal regulators limit location brokers from selling your whereabouts: 2024 in review","publisher":"Electronic Frontier Foundation","url":"https://www.eff.org/deeplinks/2024/12/federal-regulators-limit-location-brokers-selling-your-whereabouts-2024-review","summary":"Independent civil-liberties summary of the same 2024 FTC actions, useful as the counter-institutional read: the enforcement exists because no inspectable record of who examined whose location data existed before the complaints.","accessed_at":"2026-07-28T00:00","claim_ids":["c26","c34"],"prev":"9da56a89748dcf6a763adc151d1423712461e95974627dffd6de3f695aefc954","hash":"0464fd9aa31a33997bce085322a146e36a171674bf085325714896b1c887e484"},{"id":"m1","type":"model","model":"GLM 5.2","surface":"Cloudflare AI Gateway","vendor":"Z.ai","object":"spec:pass-ledger-at-1e9-scale","passes":1,"title":"GLM 5.2 on the hot-object failure mode","quote":"Append-only signed records make per-object assertion resolution depend on the object's full history, not current state — superseded examinations can't be compacted. A hot object with 100k examinations forces a 100k-record scan per resolution; global integrity is O(10B) signature verifications — ~115 days single-threaded, no compaction path.","verdict":"Confirmed defect — needs a compaction/snapshot layer above the raw chain","accessed_at":"2026-07-27T00:00","claim_ids":["c22"],"prev":"0464fd9aa31a33997bce085322a146e36a171674bf085325714896b1c887e484","hash":"a1ef2052747cae43ba892d7370257f21c0a43a44216170df39e175415cc8e53e"},{"id":"m2","type":"model","model":"Grok 4.5","surface":"Cloudflare AI Gateway","vendor":"xAI","object":"spec:first-buyer-and-abuse","passes":1,"title":"Grok 4.5 on who buys this first, and how they'd abuse it","quote":"Regulated enterprises with multi-vendor data stacks — hospitals, insurers, banks — buy first: they need one object grammar across EHRs, claims, and core systems, plus a signed ledger of every model touch for audit. The abuse is selective ledgering: the buyer runs competing assertions through the protocol, then cites only the signed examinations that favor denial, underwriting, or liability shifting while burying rival assertions in the same object as 'considered.'","verdict":"Names the buyer and the specific abuse mechanism","accessed_at":"2026-07-27T00:00","claim_ids":["c27","c34"],"prev":"a1ef2052747cae43ba892d7370257f21c0a43a44216170df39e175415cc8e53e","hash":"8bacce69881d49358f7410471980897d6c29faef59dae9be3ed2eaa7f9b07be0"},{"id":"m3","type":"model","model":"Kimi K3","surface":"Cloudflare AI Gateway","vendor":"Moonshot","object":"spec:belief-aggregation-rule","passes":1,"title":"Kimi K3 on the belief rule and its failure mode","quote":"Rule: per assertion, select the highest-value signed record by (recency rank) × (model trust-weight) × (independence factor, penalizing records from models trained on shared corpora or derived from earlier records on the same object). Failure mode: adversarial recency-inflation — a low-trust or self-derived model submits a later record; because recency dominates, a stale, higher-quality consensus is displaced by one recent weak assertion, and independence penalties cannot catch undisclosed derivation.","verdict":"Names a concrete belief-aggregation rule and its concrete attack","accessed_at":"2026-07-27T00:00","claim_ids":["c18"],"prev":"8bacce69881d49358f7410471980897d6c29faef59dae9be3ed2eaa7f9b07be0","hash":"93b22e192d8ee7ea96f4a64845912c3bcdd229330d4861db349af3e20d3a8205"},{"id":"m4","type":"model","model":"MiniMax M3","surface":"Cloudflare AI Gateway","vendor":"MiniMax","object":"spec:72-hour-multi-system-ingest","passes":1,"title":"MiniMax M3 on what breaks first at 72 hours","quote":"Video (frame-level, bit-oriented), access control (event logs, hash chains), payments (transactional, idempotent), messaging (header-typed, reference-graph), and HR (relational, soft-deletable) have no shared identity model, so mapping them into one object grammar forces impossible joins. Every downstream guarantee — proven examination, per-object assertion graph, signed ledger — collapses onto that broken schema; the 'every record examined' claim is false on its face if this step is faked.","verdict":"Names schema reconciliation, not storage or model cost, as the true bottleneck","accessed_at":"2026-07-27T00:00","claim_ids":["c8","c9"],"prev":"93b22e192d8ee7ea96f4a64845912c3bcdd229330d4861db349af3e20d3a8205","hash":"ef261f4c7c1954aa72a8891eb9dd16be58721ab8c05c52ead6627a9afdc94810"},{"id":"m5","type":"model","model":"Kimi K2.6","surface":"Cloudflare AI Gateway","vendor":"Moonshot","object":"spec:institutional-adoption-cost","passes":1,"title":"Kimi K2.6 on what an organization loses by adopting this","quote":"They lose plausible deniability. Every signed record is an immutable, attributable receipt of exactly which model configuration examined which input at what time, removing the post-hoc defense that a bad output was a transient glitch or uninspectable black-box behavior. The specific thing they sacrifice is the liability shield of algorithmic opacity.","verdict":"Names the real cost of adoption, which is why adoption is not automatic","accessed_at":"2026-07-27T00:00","claim_ids":["c28"],"prev":"ef261f4c7c1954aa72a8891eb9dd16be58721ab8c05c52ead6627a9afdc94810","hash":"8346dd4e5f8bcd7e08f6f04bb9b397014eeea865e5770810df14763a93fc0e50"},{"id":"m6","type":"model","model":"GLM Flash","surface":"Cloudflare AI Gateway","vendor":"Z.ai","object":"spec:highest-value-query","passes":1,"title":"GLM Flash on the query that is impossible today","quote":"The most valuable query: show me all signed records where a higher-trust model later disagreed with and overrode a lower-trust model that had already influenced a downstream decision — the claim and its full lineage, so I can identify exactly where consensus fragmented and track the causal history. This is impossible today because no queryable system links per-examination rows to the downstream decisions they influenced.","verdict":"Names the specific query this architecture is built to make answerable","accessed_at":"2026-07-27T00:00","claim_ids":["c19"],"prev":"8346dd4e5f8bcd7e08f6f04bb9b397014eeea865e5770810df14763a93fc0e50","hash":"682d4dce3f37de651486bf2b931d3cd2891c3a3a2001ee1a5b044b0cd3b06d98"},{"id":"a1","type":"model","model":"Claude Opus 5","surface":"Claude Code","vendor":"Anthropic","authority":"miscsubjects build","object":"article:object-ledger-evidence-graph-spec","passes":1,"title":"Claude Opus 5, writing and ledgering this specification","quote":"This article is itself an instance of the system it specifies: its claims are objects, its sources are evidence objects, the six model passes above are signed pass objects attached to specific claims, and this sentence is a pass over the article-object recorded at publish time.","verdict":"Disclosed — self-authored, self-signed, and demonstrated inline","accessed_at":"2026-07-28T00:00","claim_ids":["c35"],"prev":"682d4dce3f37de651486bf2b931d3cd2891c3a3a2001ee1a5b044b0cd3b06d98","hash":"fea3721ead2dfe68cd28e8323bd7e6c4408c1e9489cfa314ef66bdef917f160e"}]}