> > > SpecAdr012FactEnvelopeSourceSequencing

ADR-012: Fact Envelope Source Sequencing and Fact Kinds

Status

Proposed

Context

ADR-008 defines bitemporal auditing and hash binding. ADR-009 defines logical correction through corrects. The working model still needs two additional capabilities:

source-side loss detection in remote or relayed deployments;
explicit separation between observational facts and interpretive facts.

Ledger seq is assigned at append time. It proves tape order, not source emission completeness. If a source emits facts 5, 6, and 8, but fact 7 never arrives, Akasha's ledger sequence remains contiguous. A reader cannot detect the source gap without source-side sequence metadata.

Decision

The fact envelope has two kinds:

observational - a recorded phenomenon or testimony without authority or jurisdiction;
interpretive - an authoritative ruling about a question over one or more observations.

The envelope reserves source-side reliability fields:

stable_id - stable per logical occurrence, assigned by the source;
source_id - emitting system, actor, adapter, or source stream;
source_seq - monotonic sequence number per source_id, assigned by the source.

stable_id is not a content hash. Two legitimately identical events must not collapse into one occurrence merely because their payloads match.

source_id and source_seq are distinct from ledger seq. Ledger seq records arrival/append order. Source sequencing records emitter order and makes transport gaps observable to reader-side lenses.

occurred_at remains a declared belief: when the emitter claims the event happened. recorded_at is Akasha's witness time: when the tape recorded the fact.

Rationale

Akasha itself remains dumb, but readers need enough metadata to reason about duplicates, gaps, and source order. That intelligence belongs in the envelope and reader layer, not in the tape's write path.

Fact kind is required because an observation and an authoritative interpretation have different lifecycles. Observations may remain unjudged. Interpretations can be superseded by later interpretive facts.

Consequences

Positive

Remote-source gap detection becomes possible.
Deduplication can be done by readers without changing Akasha.
Authority and jurisdiction have a schema home.
Claimed domain time remains auditable as a claim.

Negative

Source adapters must eventually provide stable IDs and source sequencing.
Envelope versioning becomes a public compatibility concern.

Neutral or Operational

source_id and source_seq can be nullable until remote audit integration requires them.
The Fact envelope should become a first-class versioned schema rather than an implicit writer implementation detail.

Alternatives Considered

Use Ledger Sequence Only

Rejected. Ledger sequence records arrival order and cannot reveal a source event that never reached the tape.

Use Content Hash as Dedup Key

Rejected. Content hashes can collapse distinct occurrences with identical payloads.

Migration or Adoption

Introduce the versioned envelope with reserved source fields early. Local audit milestones may leave source_id and source_seq empty. Remote audit adapters must populate them.

SOTER