design: Provenance grading — assertion intent, S×D×V source grading, faceted computed credibility, mutability-aware contradiction

[NOVA-Openclaw]

Motivation

The testimony architecture treats every stored fact as attributed testimony, weighed at query time. What it lacks is a principled provenance grade: a formal way to encode whether a claim was even meant to be believed, how far the source stood from the subject, and how credible the source is in the relevant domain. This surfaced in a 2026-07-19/20 #edmunds-edification design discussion with I)ruid, motivated by the library-ingestion gap (Athena reading books produces catalog records, not memory), and generalizes to all extraction: fiction vs autobiography vs biography vs research paper are materially different provenance classes.

Research grounding: research project #37 ("Formalized Source-Grading Frameworks"), conclusion #675 — survey of NATO Admiralty (STANAG 2511), ICD 203/206, GRADE/Oxford CEBM, historiography (primary/secondary/tertiary), legal hearsay doctrine, journalism sourcing, WP:RS, W3C PROV, and truth-discovery literature (TruthFinder et al.). Key validated principles:

• Separate source reliability from claim credibility (Admiralty two-axis design).
• Reporting distance discounts claims (hearsay doctrine; primary/secondary/tertiary).
• Grade bodies of evidence dynamically, not statically (GRADE) — matches our query-time weighing.
• Source reliability and claim confidence should be computed jointly and iteratively (TruthFinder feedback loop).

Design

1. Assertion intent (enum, gates everything else)

New column on entity_facts (and applicable to other extracted memory records): assertion_intent:

• asserted — source intends the claim to be believed true (default for conversation, autobiography, research papers)
• speculative — source signals uncertainty ("I think...", "probably...")
• fictional — known-false by contract (novels, stories, RP). Reliably attributed, contractually non-factual.
• disclaimed — source explicitly flagged it as false ("people say X but it's not true")
• hypothetical — suppositions, thought experiments, sarcasm/jokes

The grading machinery (axes below) applies only to asserted and speculative. The other classes are stored with full provenance and remain queryable (fiction themes, disclaimed rumors) but never compete as truth claims. This prevents a character's worldview from laundering itself into an entity_fact about real people, while keeping "what Phèdre chose" retrievable.

Determination happens at ingestion/extraction time: Athena tags a work fiction/nonfiction/autobiography/biography/paper at catalog time; the extraction pipeline infers intent from conversational signals.

2. Three-axis provenance grade (asserted/speculative claims only)

Per-claim grade = S × D × V:

• S — Source credibility: computed per-entity (see §3). Never hand-assigned.
• D — Reporting distance: transmission hops from the subject. Self-report (autobiography, first person) = 1.0; direct observation ≈ 0.9; secondhand (biography, "Alice told me about Bob") ≈ 0.8; hearsay-of-hearsay decays further. Decay rate should be tunable per source type, not one global constant — a cited, well-researched biography does not decay like barroom gossip (legal doctrine's "exceptions under guarantees of trustworthiness").
• V — Verification quality: citation density, corroboration by independent sources, peer review, credential verification. Maps to existing research_citations.reliability (1–5 scale already in production — foothold for migration).

3. Faceted, computed entity credibility

Per I)ruid: credibility must be domain-scoped. A verified chemist's chemistry claims deserve more weight than their philosophy claims.

• Credibility is stored per (entity, domain) with a global fallback score. Domain taxonomy can start coarse (reuse existing subject/domain vocabulary; do not invent a new ontology up front).
• Computed, never assigned. No direct-edit path. Inputs to the algorithm:
  • Track record: fraction of the entity's past asserted claims in that domain that were later corroborated vs contradicted (facts already carry timestamps; longevity-as-true is available signal)
  • Verified credentials (V-axis events can feed S)
  • Recency weighting on the track record
• TruthFinder-style iteration: sources earn credibility from claims that hold up; claims gain confidence from credible sources. Recompute periodically (maintenance cron), auditable back to evidence.
• Complexity guard: start with a simple ratio + decay implementation. The literature's fixpoint algorithms are the ceiling, not the floor. Getting this "very complicated, very fast" is the known failure mode (I)ruid, 2026-07-20).

4. Mutability-aware contradiction detection

Facts get a mutability class:

• immutable — birthdate, birthplace. Conflicting claims in this class are genuine contradictions → credibility hit for someone.
• slow_changing — profession, address. Conflict within a short window is suspicious; across years is probably drift.
• stateful — preferences, current projects, favorites. A new claim supersedes rather than contradicts. "Pizza favorite (2024)" and "cheeseburgers favorite (2026)" are consistent history — both true statements about their own moments. No credibility damage from drift.

Query-time behavior for stateful facts: compare all known values, prefer most recently asserted, keep the full trajectory (preference history is more informative than the snapshot). This is already consonant with the no-write-time-resolution directive — supersession is not deletion, and both records persist.

Contradiction → credibility feedback only fires when claims conflict within the same validity window on a fact class that cannot drift.

5. Library ingestion integration

Athena's ingestion pipeline gains a full-text extraction pass (relates to #502 — LangExtract evaluation) producing memory artifacts as if NOVA had read the work:

• Work-level provenance class set at catalog time (fiction / autobiography / biography / paper / reference)
• Extracted records inherit assertion_intent from the class (fiction → fictional; autobiography → asserted @ D=1.0 self-report; biography → asserted @ secondhand D; paper → asserted with V from citations/peer-review)
• Themes, authorial arguments, and NOVA's reactions extracted from fiction are first-class (attributed to the author/work), only in-narrative "events" carry the fictional tag

Relationship to existing work

• feat: Verdict system — first-class revisable judgment records for contradictory-testimony resolution #468 (Verdict system) — sibling and consumer: verdicts are the query-time judge; this issue defines the evidence weights the judge uses. evidence_fact_ids weighing would use S×D×V grades.
• Evaluate LangExtract as memory-extraction backend (source grounding, schema enforcement, local-model support) #502 (LangExtract) — candidate extraction backend for the library full-text pass.
• Add synthesis pass: separate episodic observations from inferred entity facts #248 (episodic vs inferred separation) — related synthesis-pass concern.
• Research: project [memory] Installer: create compatibility symlinks for legacy clawdbot paths #37, conclusion #675, findings on Admiralty/GRADE/hearsay/TruthFinder.

Open questions

1. Domain taxonomy for faceted credibility — reuse which existing vocabulary? How coarse to start?
2. Distance decay rates per source type — initial table? (self=1.0, observed=0.9, secondhand=0.8 as strawman)
3. Should S×D×V be materialized on rows or computed at query/maintenance time? (Grades change as S changes — materialization needs invalidation, mirrors feat: Verdict system — first-class revisable judgment records for contradictory-testimony resolution #468 staleness problem)
4. Mutability class assignment: per fact key (a fact_keys registry?) vs inferred per fact?
5. Backfill strategy for ~existing entity_facts (default asserted, distance from source field heuristics?)

Origin: I)ruid + NOVA design discussion, Discord #edmunds-edification, 2026-07-19/20. Research: Scout, project #37.

[NOVA-Openclaw]

Design rationale authored by Newhart (Database domain); posted by NOVA. Implementation PR: #505.

Schema Design: Provenance Grading (Newhart's consult reply)

Branch: feat/504-provenance-grading-schema
Migration: database/migrations/504-provenance-grading.sql (rollback included)

Architecture: where things live

What	Where	Why
assertion_intent	Column on entity_facts	Per-claim property; gates all downstream grading
mutability_class	Column on entity_facts	Per-claim; drives query-time resolution strategy
reporting_distance (D axis)	Column on entity_fact_sources	Per-source, not per-fact — Alice's self-report and Bob's secondhand mention are different sources with different distances
verification_quality (V axis)	Column on entity_fact_sources	Same reasoning — verification quality is a property of how a specific source obtained/reported the claim
Source credibility (S axis)	entity_credibility table	Computed per (entity, domain), looked up at query time
Composite S×D×V	Not materialized	Computed at query time via v_fact_grades view — three multiplications per row, avoids invalidation cascades
Corroboration independence	source_session_id on entity_fact_sources	Deduplicates sources from the same conversation

Design decisions on the four open points

1. NULL vs 0 on verification_quality:

• NULL = "not yet assessed" → query-time computation treats as neutral 0.5 (source participates but doesn't boost or drag)
• 0.0 = "assessed and FAILED verification" → actively drags down the composite
• Stated in CHECK, COMMENT, and the v_fact_grades view logic (COALESCE(verification_quality, 0.5))

2. Mutability class drift across rows:

• Resolution rule: strictest class wins for the (entity_id, key) group. immutable > slow_changing > stateful
• Implemented as get_strictest_mutability(entity_id, key) helper function
• Extraction pipeline carries key-pattern hints in code (versioned in nova-mind), not a DB registry — no migration needed when patterns evolve

3. v1 contradiction detector:

• Corroboration = independent sources. Independence keyed on source_session_id — two facts extracted from the same conversation are one witness
• Contradiction in v1: differing values on the same (entity_id, key) where get_strictest_mutability() returns immutable. Simple, deterministic, no false positives on preferences
• Verdict outcomes from feat: Verdict system — first-class revisable judgment records for contradictory-testimony resolution #468 wire in as v2 signal (the computation_version column on entity_credibility supports phased upgrades)

4. Recompute cron: script owns the writes.

• Daily maintenance script writes entity_credibility directly — deterministic SQL, not an agent-turn prompt
• Agent involvement limited to reading results and flagging anomalies
• evidence_snapshot JSONB provides full audit trail of what fed each computation
• computation_version column allows v1 → v2 algorithm upgrades without losing history

New objects created

• 2 enum types: assertion_intent_enum, mutability_class_enum
• 2 columns on entity_facts: assertion_intent, mutability_class
• 3 columns on entity_fact_sources: reporting_distance, verification_quality, source_session_id
• 1 table: entity_credibility
• 2 views: v_fact_grades (query-time S×D×V), v_current_stateful_facts (latest stateful value per entity+key)
• 1 function: get_strictest_mutability()
• 5 indexes (including partial indexes on the gradable subset and low-credibility entities)
• Backfill: 4,217 existing entity_fact_sources rows populated with source_session_id

Backfill defaults (existing ~4,724 facts)

Column	Default	Rationale
assertion_intent	'asserted'	All existing facts came from conversation (the asserted default)
mutability_class	'slow_changing'	Safe middle ground; pipeline refines going forward
reporting_distance	1.0	Existing facts are overwhelmingly self-reported in conversation
verification_quality	NULL	Not yet assessed — neutral 0.5 at query time

What's NOT in this migration (intentionally)

• Write-protection trigger on entity_credibility (TBD: domain-protect to newhart or leave open for the recompute script's DB user)
• The recompute script itself (belongs in scripts/, not a migration)
• TruthFinder-style iterative computation (v2 ceiling, not v1 floor)
• Integration with verdict system (feat: Verdict system — first-class revisable judgment records for contradictory-testimony resolution #468) — that wires in when verdicts ship
• Distance decay rate lookup table — extraction pipeline handles this in code for v1

Relationship to existing work

• feat: Verdict system — first-class revisable judgment records for contradictory-testimony resolution #468 (Verdict system): Consumer of S×D×V grades via evidence_fact_ids. Verdicts judge; this defines evidence weights.
• Evaluate LangExtract as memory-extraction backend (source grounding, schema enforcement, local-model support) #502 (LangExtract): Extraction backend for library full-text pass. Extracted records will inherit assertion_intent from Athena's catalog-time provenance class.
• research_citations.reliability: The foothold. verification_quality on entity_fact_sources maps to the same 0–1 scale.