03 / What the model must preserve
Separate the reporting channel from the evidence origin.
A provenance model needs to describe more than which database contained a record or which agency delivered it. It must preserve the relationship between a claim, the report carrying it, the source through which it arrived, and the underlying observation or prior account on which it may depend. These are related but not interchangeable objects.
| Record type | Proposed responsibility |
| Claim | An identifiable assertion with scope, time, attribution, and an explicit evidentiary status. |
| Report | The artifact that conveys one or more claims, including its author, collection time, revision, and distribution history. |
| Source / channel | The person, device, organization, publication, or route through which the report became available; channel identity is not evidence independence. |
| Origin event | The observation, utterance, document, or other originating circumstance known or believed to underlie the claim. |
| Dependency link | An explicitly attributed relationship such as direct observation, quotation, hearsay, citation, derivative summary, possible shared origin, or unknown. |
| Assessment | An analytic judgment about the claim and the degree to which supporting accounts add genuinely distinct evidence. |
The model must distinguish documented dependencies from inferred ones. “Report B cites Report A” can be a recorded relationship. “Report B probably derives from Report A because two unusual details match” is a hypothesis, not an established lineage fact. Confidence about the dependency itself has to be explainable.
Lineage must survive synchronization and summarization
As reports travel among applications, a downstream system may retain only a paragraph of the original or a machine-generated summary. If that transformation removes its source links, subsequent analysis may treat the output as a fresh origin. A proposed Command-1 service should maintain stable record identifiers, explicit derivation links, and version information across import, export, summarization, and disconnected synchronization.
04 / Independence as an analytical question
Corroboration is not a count.
There is no universal formula that converts the number of reports into a defensible probability of truth. Source reliability, observation quality, timing, collection conditions, copying, incentives, and opportunity for independent knowledge all matter. A single high-quality direct observation can sometimes be more informative than many derivative accounts; in other situations, multiple genuinely independent observations materially strengthen an assessment.
The proposed system should make the basis for a corroboration judgment visible. It should not silently deduct a fixed percentage for similar wording, nor should it sum channel-level credibility scores into a claim-level certainty number. When a dependency assessment changes, any affected corroboration view should be reviewable and recalculated without erasing the original judgments.
Three different questions
- Do the reports agree? Compare the claims and their specificity, including important disagreements.
- Do the reports derive from different origins? Establish or qualify their evidentiary independence using traceable lineage.
- Do the reports support the conclusion? Evaluate whether the underlying observations justify the actual assessment, rather than a related but stronger claim.
This paper addresses the second question in depth. WP-002 addresses the third by preventing an observation, inference, and assessment from becoming indistinguishable.
05 / Proposed engineering requirements
Make dependence visible and auditable.
The following are research requirements for a prospective information-integrity implementation. They do not describe a completed or validated Aerellus product.
- Separate identities. Maintain distinct identifiers for the underlying claim, individual reports, delivery channels, and known source-origin events.
- Typed lineage. Record direct observation, direct quotation, indirect account, derivative citation, transformed summary, suspected common origin, and unresolved provenance as different relationships.
- Attributable dependencies. Each dependency assertion records its basis, author or process, time, and whether the relation is observed, documented, or inferred.
- No automatic independence. An unknown or undiscovered origin is not automatically categorized as independent.
- No automatic deception. Similarity, common origin, or temporal proximity cannot alone classify reporting as intentionally coordinated or false.
- Derivative-aware corroboration. Reporting views distinguish the number of artifacts from the number of defensibly distinct evidentiary origins.
- Transformation traceability. Summaries, extracts, merged reports, and forwarded products retain references to material source records.
- Revision propagation. A corrected or withdrawn origin can trigger a transparent review of dependent assessments without erasing historical states.
- Analyst override with rationale. Qualified users can contest or revise dependency judgments, preserving who changed what and why.
- Mission-aware presentation. Dependency warnings remain available without promoting every possible shared origin into a new investigative workstream.
06 / Proposed validation
Test both false confidence and false suppression.
A synthetic evaluation should contain true independent observations; verbatim copies; paraphrases; translated summaries; chains of hearsay; shared public material repeated in multiple channels; and unrelated witnesses who coincidentally use similar language. The evaluator would know the underlying origin graph even when the prototype sees only incomplete report metadata.
One test condition would present the system with no additional lineage annotations. A second would provide partial lineage, and a third would introduce corrections after assessments had already been produced. Reviewers would compare a conventional feed against a lineage-aware presentation using matched scenarios.
| Measure | Evaluation question |
| False corroboration | How often are derivative accounts incorrectly presented as independent support? |
| False suppression | How often are truly independent accounts mistakenly grouped as one origin? |
| Unknown handling | Does the interface preserve uncertainty instead of inventing a settled dependence status? |
| Lineage recovery | Can a reviewer reconstruct the evidentiary path behind a claim across multiple products? |
| Correction response | Can dependent assessments be identified when an originating record is revised or withdrawn? |
| Decision latency | Does the benefit of lineage awareness justify the time and attention required to use it? |
Performance must be assessed against both classes of error. A system that eliminates false corroboration by treating every report as a duplicate is not useful. Neither is a system that avoids false suppression by accepting every report as independent.
07 / Limits and governance
A provenance graph is not an oracle.
Real-world source histories are often incomplete. Security restrictions can prevent full lineage disclosure. Human sources may unknowingly repeat the same narrative; different channels can have hidden common dependencies. Some dependency judgments will remain indeterminate, and the system must communicate those boundaries honestly.
There are also privacy, security, and governance implications. Source identifiers and provenance details may require compartmented access, pseudonymization, or role-based disclosure. A reviewer may need to know that two reports share an origin without being entitled to the identity of that origin. Design should support that distinction rather than sacrificing source protection for interface convenience.
Finally, genuine shared origin is not synonymous with adversarial activity. Public circulation of an accurate statement is normal. The purpose of source-independence analysis is to prevent unwarranted evidentiary inflation, not to presume coordination or manufacture a separate mission to investigate it.
Count the evidence. Not the echoes.
Publication statusWP-003 is a public, unclassified discussion draft (revision 0.2). All examples are synthetic. Proposed lineage records, corroboration controls, performance measures, and future system behavior describe research requirements rather than tested or deployed functionality. No operational case details, classified material, or sponsorship claims are presented.