Provenance and freshness

Provenance records where a statement came from, separately from whether it is a fact, a preference or a temporary state.

• declared: the person entered or explicitly confirmed the exact statement, and confirmed_at records when.
• observed: a sourced observation or inference, with the source's identity, when it occurred and was ingested, a confidence, and a validity that ends no later than 90 days after ingestion.
• derived: computed from other entries, naming every input's ID and version and the actual field and level used.

A fourth kind, attested, is reserved for future credential verification and is withheld from recipients in this version.

Source identity is evidence of origin, not truth. Reviewing a contribution does not relabel it as declared: becoming declared needs the person's confirmation of the exact value. Special-category and safety-critical keys cannot be observed or inferred at all, and a key the vocabulary marks not inferable cannot be inferred whatever a domain setting says. Confidence is not consent.

Derived context can be shared only when the grant permits each actual input field and level. Permission for a broad domain does not permit deriving from hidden identifiers. A separately confirmed preference can be shared without its raw source history, and source evidence stays protected either way.

Freshness

An entry whose confirmation is older than 365 days, or 90 days for a safety-critical key, is marked stale. Staleness prompts review; it never makes an allergy disappear. Several safety requirements can coexist, and replacing one cannot remove another.

Written against edition 1.0-draft-1: A4 Data model