TRACE: Trust-Ranked Adjudicated Corpus Engine

Version: v0.11 Draft

Status: Proposed protocol and reference architecture

Author: Timur Yusupov, PhD

Future project home, if implemented later: Agent Cognitive Enterprise / ACE-labs (Agent-Cognitive-Enterprise/trace)

This file is intentionally self-contained. It combines rationale, protocol semantics, implementation guidance, and acceptance tests so that a reader or coding agent can work from a single artifact.

A specification, cookbook, and quiet manifesto for building knowledge systems that earn trust rather than assume it.

This is an idea file and an implementation guide. Paste it into a coding agent and ask it to build the first version. Hand it to a product owner, a public-sector reviewer, a safety lead, or the tired engineer who has watched one too many "AI knowledge base" demos that were really just top-k retrieval in a nice coat.

Hand it especially to the procurement officer who keeps asking: "But how do we know the AI is right?" TRACE cannot prove the AI is right. It can prove what the system relied on, which policy it applied, and where uncertainty or conflict was recorded.

The premise is simple:

Retrieval finds text. TRACE records why a system is willing, unwilling, or unable to rely on that text under an explicit trust policy.

Most RAG systems answer this question:

"Which chunks are semantically close to the user's question?"

TRACE adds the missing questions:

"Who published this?" "Is it still current?" "Does a better source contradict it?" "Was this claim superseded?" "If a bad chunk enters an answer, do we expose that fact?" "Can we prove later why the system trusted or rejected it?"

If your corpus is recipes, movie trivia, or fan lore, plain RAG may be enough. If your corpus contains medical guidance, emergency procedures, legal rules, humanitarian protocols, engineering manuals, or anything people may act on under pressure, similarity is not a trust model. It is only a search primitive.

TRACE is a proposed protocol and reference architecture for building a Trust-Ranked Adjudicated Corpus Engine. It does not make models truthful. It makes trust posture explicit, reviewable, versioned, and visible at runtime.

Reader Map

TRACE.md is intentionally one file.

If you are evaluating the idea, read through Scope and Limits and The Core Idea.
If you are designing a system, continue through Architecture, Threat Model, and Pipeline Overview.
If you are implementing it, use Minimal Data Model, Cookbook, Acceptance Tests, and Implementation Plan.
If you are reviewing vendors, skip to What Managers Should Ask.

Executive Summary for Decision-Makers
Technical Summary for Engineers
The Problem TRACE Solves
Scope and Limits
The Core Idea
Load-Bearing Rules
Vocabulary
Trust Fields and Display Codes
Ordering, Ranking, and Contamination
What Users Should See
Architecture
Minimal Data Model
Threat Model and Tamper Evidence
Pipeline Overview
Cookbook
Triage
Supersession
Authority Correction
Worked Example
Acceptance Tests
Implementation Plan
Agent Instructions
Common Failure Modes
What Managers Should Ask
What Builders Can Claim
Change Log
Final Note

1. Executive Summary for Decision-Makers

TRACE turns a pile of documents into an accountable knowledge system.

It gives every retrieval chunk and high-stakes claim span explicit trust fields, with a compact display code for humans. The first character says who published it. The second character says how well the content survives comparison against the best available evidence.

It detects likely contradictions at corpus scale and routes them through cheap automated checks, LLM adjudication, or human triage depending on risk. Cheap tools do the bulk work: embeddings find related chunks, language detection handles multilingual corpora, NLI flags semantic disagreement, safety gates catch direct danger, and LLMs adjudicate only the ambiguous minority. Humans or authorized agents handle the cases too consequential for automatic final resolution.

It is audit-friendly. Every important decision is append-only: source rating, comparison baseline, NLI probability, LLM verdict, triage resolution, human override. No silent rewrites. No "the model said so." No trust laundering.

The result is not another chatbot. It is a controlled evidence system that can say: "Here is the answer, here is the weakest source used, here is the conflict history, and here is why we are willing or unwilling to stand behind it."

The uncomfortable question after reading this should be:

Why are we still serving high-stakes answers without this?

2. Technical Summary for Engineers

TRACE is an agentic pipeline for document adjudication:

Ingest documents and freeze source authority at ingestion time.
Split documents into paragraph-level retrieval chunks and extract claim spans where precision matters.
Detect language, embed chunks and claim spans, and cluster similar claims.
Select the best available comparison material per claim cluster.
Run cheap contradiction and danger gates before invoking expensive models.
Assign each adjudicated chunk or claim span explicit trust fields and a compact display code.
Append every adjudication decision to an append-only, tamper-evident evidence log.
Derive answer ratings and document-level floors from the weakest contributing chunk.
Route dangerous, contradictory, unsupported, or high-impact cases to triage.
Build runtime packs with precomputed ratings. The edge should serve trust, not invent it.

The system has one sacred rule:

Never let low-trust content hide inside a high-trust answer.

3. The Problem TRACE Solves

TRACE is a protocol for maintaining trust over a changing document corpus.

It is useful when:

documents come from sources with different authority levels;
guidance changes over time;
sources contradict each other;
documents exist in multiple languages;
some answers can cause harm if wrong;
you need an audit trail for why the system trusted a claim;
you want agents to do most of the work without giving them unchecked power.

TRACE is not:

a replacement for source acquisition;
a generic summarizer;
a chatbot prompt;
a magic truth oracle;
a reason to skip human review on life-critical conflicts;
an excuse to pretend all documents are equal because embeddings look similar.

Think of it as the boring institution that every exciting AI demo eventually needs if it wants to survive contact with reality. Demos do not need audit trails. Production systems that support decisions in field clinics do.

4. Scope and Limits

TRACE does not determine truth.

TRACE determines trust posture relative to:

the source policy you configured;
the current corpus state;
the comparison baselines available at adjudication time;
extraction quality;
model and threshold configuration;
adjudication rules;
human or authorized-agent review.

That distinction matters. A system that says "this is true" is overclaiming. A system that says "under policy version X, corpus state Y, and evidence trail Z, we are willing to rely on this chunk" is making an auditable operational decision.

TRACE is therefore not a truth machine. It is a receipt machine.

The receipt may still be wrong. But if it is wrong, you can inspect why, correct it by appending evidence, and improve the policy without pretending the old decision never happened.

5. The Core Idea

Every adjudicated unit has explicit trust fields. The two-character code is a compact display shorthand, not the ontology.

Minimum field model:

source_authority      = A
content_confidence   = B
validation_track     = official | community | mixed
invalidation         = false
display_code         = AB

The compact code is useful because humans can read AA, BC, and AX quickly. But implementations should store the fields separately.

Display shorthand:

AA
^^
||
|+-- content confidence: how well this chunk survives adjudication
+--- source authority: who published it

The first character is about the publisher. It is assigned at ingestion and then frozen.

The second character is about the content. It can change as the corpus grows, new evidence appears, old guidance is superseded, or contradictions are found. When content is invalidated, only the second character becomes X: AA becomes AX, BB becomes BX, and 90 becomes 9X. Adjudication never rewrites the first character or collapses the code to a bare X.

This separation is the heart of TRACE. Do not collapse it into one score.

A highly authoritative institution can publish outdated content. A minor local source can publish something correct. A community contributor can help validate material without becoming an official authority. These are different facts. TRACE keeps them different.

6. Load-Bearing Rules

If an implementation violates these rules, it is not TRACE.

MUST assign trust at chunk level, not only document level.
MUST freeze source authority at ingestion.
MUST NOT change the first character during adjudication; invalidation changes only the second character to X.
MUST NOT transfer source authority from one publisher to another.
MUST keep source authority and content confidence as separate axes.
MUST use X as the explicit invalidation marker.
MUST treat 0 as low confidence, not rejection.
MUST select comparison baselines dynamically per claim cluster.
MUST NOT treat baseline use as source promotion.
MUST treat no-baseline states as unverified by the corpus, not probably true.
MUST NOT count copied or lineage-dependent material as independent confirmation.
MUST propagate the weakest contributing rating into answers.
MUST block X chunks from normal operational answers.
MUST keep adjudication evidence append-only.
MUST preserve run configuration and tamper-evidence metadata.
MUST route high-impact unresolved conflicts to triage.
MUST NOT run final adjudication at the edge runtime.
MUST make ratings explainable to users and auditors.

The short version:

Authority does not launder content. Content does not launder authority.

7. Vocabulary

Term	Meaning
Document	A source item: PDF, HTML page, EPUB, DOCX, markdown, transcript, scan, etc.
Chunk	A retrieval and evidence unit, usually a paragraph.
Claim span	An atomic claim inside a chunk; the adjudication target when paragraph-level precision is not enough.
Claim cluster	A group of chunks or claim spans that appear to discuss the same claim, rule, dose, procedure, or fact.
Source authority	The credibility of the publisher or origin of the document.
Content confidence	How well the chunk holds up against comparison material.
Comparison baseline	The best available non-invalidated material for judging a claim cluster in the current run.
Adjudication	The process of assigning or updating content confidence.
Invalidation	Explicit rejection, retraction, danger, or material supersession.
Contamination	The rule that the weakest contributing chunk controls the answer's displayed trust.
Triage	A work queue for conflicts or risks that should not be resolved silently.
Edge pack	A runtime bundle with precomputed ratings; it serves decisions but does not make them.

8. Trust Fields and Display Codes

Letter Track

Use letters for official or institutionally managed adjudication fields.

Letter	Meaning
A	Highest authority or confidence
B	High
C	Moderate
D	Low
E	Minimal or unknown
X	Rejected, invalid, dangerous, retracted, or materially superseded

X may appear only as content_confidence, never as source_authority. Invalidation preserves the first character: AA -> AX, BC -> BX, 90 -> 9X.

Examples:

Code	Meaning
`AA`	Top authority, content confirmed.
`AB`	Top authority, content plausible but not fully confirmed.
`AD`	Top authority, content contradicted but not necessarily invalidated.
`AX`	Top authority, content explicitly invalidated, dangerous, retracted, or superseded.
`BA`	B-tier source, content confirmed against stronger material.
`BC`	B-tier source, moderate confidence.
`EX`	Unknown/weak source, content explicitly rejected.

Number Track

Use numbers for community or user-pack source reputation and sign-off confidence.

Number	Meaning
8-9	Highest community confidence
6-7	High
4-5	Moderate
2-3	Low
0-1	Minimal
X	Rejected or invalidated

Examples:

Code	Meaning
`99`	Highly trusted community source, highly trusted sign-off.
`09`	Unknown source, strong community validation.
`00`	User or unknown source, no meaningful validation.
`9X`	Highly trusted community source, content rejected.
`A9`	A-tier source in a user pack, accepted by a reputation-9 signer.

A9 is not an official pipeline confidence grade. It means:

source_authority    = A
content_confidence = 9
validation_track   = mixed or community
invalidation       = false
display_code       = A9

The source was recognized as A-tier, but the second character came from a community/user-pack signer, not from official pipeline adjudication.

Equivalence Table

Use this when letter-track and number-track material must be ranked together.

Letter	Number	Confidence
A	8-9	Highest
B	6-7	High
C	4-5	Moderate
D	2-3	Low
E	0-1	Minimal
X	none	Rejected

Community material may outrank lower official material only when no applicable A-tier official chunk covers the claim. It cannot outrank applicable A-tier official material.

9. Ordering, Ranking, and Contamination

TRACE does not require source authority and content confidence to collapse into one universal scalar.

For operational retrieval ranking, a deployment MAY prefer source authority before content confidence:

Exclude invalidated material.
Prefer active source-policy status.
Prefer higher source authority.
Prefer higher content confidence.
Prefer newer, more specific, independent material.

For risk display, a deployment SHOULD show source authority and content confidence separately.

Example:

BC = B-tier source, moderate content confidence
DA = D-tier source, confirmed content

A policy may rank BC above DA for operational retrieval because the source is more accountable. Another policy may surface DA as supporting evidence because the content has stronger confirmation. TRACE requires the policy to be explicit; it does not pretend there is one universal ordering for every domain.

Document Rating, Adjudication Floor, and Answer Rating

Documents have a frozen ingestion rating. Adjudication does not update the document row. It appends chunk or claim-span adjudication rows, then may append a document-level floor snapshot for filtering, review, and pack projection.

AB/AC
^^ ^^
|| ||
|| ++-- adjudication floor: weakest effective chunk or claim-span projection
++---- ingestion rating: frozen document rating

At ingestion, the document receives a first pass rating based on source authority and default content prior. After adjudication, TRACE does not mutate that rating; it derives the floor of the document's adjudicated chunks or claim spans.

Examples:

Compound	Meaning
`AA/AA`	Ingested as AA; all chunks remain AA.
`AB/AB`	Ingested as AB; all chunks hold at AB.
`AB/AC`	Ingested as AB; weakest adjudicated chunk projects to AC.
`AA/AX`	Ingested as AA; at least one chunk was invalidated.
`DD/DA`	Low-authority document; some content confirmed strongly.

This matters because documents are messy. A long field manual may contain excellent water-treatment guidance, outdated dosage tables, and unrelated appendices. TRACE does not pretend the whole document is one truth blob.

The Contamination Rule

The rating shown to a user for an answer is the minimum rating of the chunks used to produce that answer. It is not a mutation of any source document's ingestion rating. In normal operational answer mode, chunks with second character X are excluded before answer generation.

If an answer uses chunks:

AA, AA, AC

the answer displays at most:

AC

The documents those chunks came from keep their frozen ingestion ratings. The answer inherits AC because AC is the weakest supporting chunk in that answer path.

If an answer uses:

AA, AX

the operational answer should be blocked, not merely marked.

Operational answer blocked.
Reason: matched material is invalidated, dangerous, retracted, or superseded.
Available actions: show audit history, escalate, or request current source.

This is not pessimism. It is accounting.

In high-stakes domains, a single unsafe instruction can ruin an otherwise good answer. Surrounding a bad clinical paragraph with five accurate paragraphs does not make it safe. Trust does not average out like soup seasoning.

10. What Users Should See

A user does not need the whole protocol. They need clear trust signals.

Example answer display:

Answer rating: AB
Weakest supporting chunk: AB
Review type: AI + human
Sources:
  - Global Health Agency field guide, chunk 18, rating AA
  - Regional manual, chunk 44, rating AB
Notes:
  - No invalidated chunks used.
  - One related lower-rated source was excluded because stronger material exists.

If invalidated material is the only match:

Operational answer blocked.
Reason: only invalidated or superseded material matched this query.
Available actions: show audit history, escalate, or request current source.

The system should not bury this in metadata. Trust belongs in the user experience.

11. Architecture

TRACE has five layers.

Raw sources
    immutable documents and acquired files

Source registry
    source IDs, authority tiers, publication dates, content hashes

Build-side adjudication store
    chunks, embeddings, adjudication rows, triage queue, resolutions

Adjudication agent
    runs the pipeline, appends evidence, writes document-level outcomes

Runtime pack
    precomputed ratings, provenance, and retrieval indexes for serving answers

Use any storage stack that preserves the semantics:

object storage or filesystem for raw source artifacts;
structured registry for source metadata;
relational database for append-only adjudication evidence;
vector index for chunk similarity;
compact runtime database for serving precomputed results.

Postgres plus pgvector is a good default. It is not a requirement. The protocol requires the behavior, not the vendor.

12. Minimal Data Model

This is intentionally generic. Rename tables if you want, but preserve the semantics.

documents (
    id                    TEXT PRIMARY KEY,
    source_id             TEXT NOT NULL,
    source_authority_code CHAR(1) NOT NULL, -- ingested authority, frozen
    current_source_policy_status TEXT NOT NULL,
    source_policy_status_reason TEXT,
    document_date         TEXT,
    ingested_at           DATE NOT NULL,
    content_hash          TEXT NOT NULL,
    ingestion_rating      CHAR(2) NOT NULL
);

chunks (
    id                  UUID PRIMARY KEY,
    document_id         TEXT NOT NULL,
    chunk_position      INTEGER NOT NULL,
    chunk_text          TEXT NOT NULL,
    extraction_confidence FLOAT,
    detected_language   TEXT,
    language_confidence FLOAT,
    prev_chunk_id       UUID,
    next_chunk_id       UUID,
    created_at          TIMESTAMPTZ NOT NULL
);

claim_spans (
    id                  UUID PRIMARY KEY,
    chunk_id            UUID NOT NULL,
    span_start          INTEGER NOT NULL,
    span_end            INTEGER NOT NULL,
    claim_text          TEXT NOT NULL,
    claim_type          TEXT,
    extraction_confidence FLOAT,
    created_at          TIMESTAMPTZ NOT NULL
);

chunk_triage_signals (
    id                  UUID PRIMARY KEY,
    sequence_number     BIGINT NOT NULL, -- monotonic; use for ordering, not created_at alone
    chunk_id            UUID NOT NULL,
    signal_type         TEXT NOT NULL,
    signal_value        TEXT,
    detector_name       TEXT NOT NULL,
    detector_version    TEXT NOT NULL,
    confidence          FLOAT,
    created_at          TIMESTAMPTZ NOT NULL
);

embeddings (
    id                  UUID PRIMARY KEY,
    target_type         TEXT NOT NULL, -- chunk | claim_span
    target_id           UUID NOT NULL,
    model_name          TEXT NOT NULL,
    model_version       TEXT NOT NULL,
    embedding           VECTOR NOT NULL,
    created_at          TIMESTAMPTZ NOT NULL
);

adjudication_runs (
    id                  UUID PRIMARY KEY,
    policy_version      TEXT NOT NULL,
    source_registry_version TEXT NOT NULL,
    pipeline_version    TEXT NOT NULL,
    model_version       TEXT,
    prompt_version      TEXT,
    threshold_config_hash TEXT NOT NULL,
    previous_log_hash   TEXT,
    current_log_hash    TEXT NOT NULL,
    created_at          TIMESTAMPTZ NOT NULL
);

adjudications (
    id                  UUID PRIMARY KEY,
    adjudication_run_id UUID NOT NULL,
    sequence_number     BIGINT NOT NULL,    -- monotonic; use for ordering, not created_at alone
    chunk_id            UUID NOT NULL,
    claim_span_id       UUID,
    source_authority_code CHAR(1) NOT NULL,
    content_confidence_code CHAR(1) NOT NULL,
    validation_track    TEXT NOT NULL,
    invalidation        BOOLEAN NOT NULL,
    adjudication_code   CHAR(2) NOT NULL, -- display shorthand
    baseline_target_type TEXT,
    baseline_target_id   UUID,
    source_independence FLOAT,
    source_lineage_refs JSONB,
    pre_llm_status      TEXT,
    verdict             TEXT,
    confidence          FLOAT,
    model_agreement     FLOAT,
    model_used          TEXT,
    notes               TEXT,
    created_at          TIMESTAMPTZ NOT NULL -- retained for audit display; order by sequence_number
);

document_adjudication_floors (
    id                  UUID PRIMARY KEY,
    adjudication_run_id UUID NOT NULL,
    sequence_number     BIGINT NOT NULL, -- monotonic; use for ordering, not created_at alone
    document_id         TEXT NOT NULL,
    adjudication_floor  CHAR(2) NOT NULL,
    weakest_target_type TEXT NOT NULL, -- chunk | claim_span
    weakest_target_id   UUID NOT NULL,
    invalidated_target_count INTEGER NOT NULL,
    reviewed_at         TIMESTAMPTZ NOT NULL,
    notes               TEXT,
    created_at          TIMESTAMPTZ NOT NULL
);

triage_queue (
    id                  UUID PRIMARY KEY,
    chunk_id            UUID NOT NULL,
    claim_span_id       UUID,
    adjudication_id     UUID NOT NULL,
    reason              TEXT NOT NULL,
    created_at          TIMESTAMPTZ NOT NULL
);

triage_resolutions (
    id                         UUID PRIMARY KEY,
    queue_id                   UUID NOT NULL,
    resolved_by_actor_id       TEXT NOT NULL,
    resolved_by_actor_type     TEXT NOT NULL, -- human | agent | committee | external_authority
    resolution_authority_level TEXT,
    resolution_signature_hash  TEXT,
    resolution                 TEXT NOT NULL,
    notes                      TEXT,
    created_at                 TIMESTAMPTZ NOT NULL
);

This schema shows protocol semantics, not production DDL. Real implementations should add foreign keys, indexes, constraints, enum tables, access controls, and migration/versioning rules.

Implementation rule:

Do not update adjudication history. Append a new row and derive current state from the latest row.

If your database makes append-only hard, your database is arguing with the audit trail. The audit trail should win.

13. Threat Model and Tamper Evidence

TRACE is a trust protocol, so it needs a threat model.

Assume these can happen:

malicious PDFs or HTML snapshots;
prompt injection hidden inside documents;
forged or missing metadata;
compromised source mirrors;
copied material masquerading as independent confirmation;
poisoned community packs;
OCR, table extraction, and PDF conversion errors;
stale or partial translations;
model drift;
threshold and configuration drift;
insider overrides;
tampering with adjudication logs.

Append-only rows are necessary but not sufficient. Each adjudication run should record:

adjudication_run_id
policy_version
source_registry_version
pipeline_version
model_version
prompt_version
threshold_config_hash
previous_log_hash
current_log_hash

Hash-linking the run log makes tampering visible. It does not prevent every attack, but it changes the failure mode from "quietly altered history" to "evidence of alteration exists."

14. Pipeline Overview

Document ingestion
    -> normalize text and metadata
    -> assign source authority
    -> chunk at paragraph level
    -> detect language
    -> insert complete chunk rows
    -> detect claim-span need using cheap signals
    -> extract candidate claim spans where justified
    -> apply optional parser or NLI validation where configured
    -> reject low-confidence or excessive spans; fall back to chunk-level
    -> embed chunks and confirmed claim spans
    -> cluster related claims
    -> select comparison baseline per claim cluster
    -> run safety, numeric, unit, and scope gates
    -> run NLI contradiction pass across baseline candidates
    -> invoke LLM only on flagged edge cases
    -> assign chunk adjudication code
    -> append document-level floor snapshot from chunk or claim-span ratings
    -> append evidence and triage entries
    -> build runtime pack with precomputed ratings

The pipeline is cheap-to-expensive:

Deterministic metadata: cheap and reliable.
Language detection: cheap.
Embeddings: cheap relative to LLMs.
NLI: more expensive but still manageable.
LLM adjudication: expensive and reserved for the ambiguous minority.
Human or expert triage: rare, costly, and reserved for cases that matter.

Do not start with the LLM. The LLM is the judge of hard cases, not the janitor for every paragraph.

15. Cookbook

Step 1: Define Source Authority

Create an authority registry. This is the first trust decision TRACE makes, so it must not be vibes in YAML form.

Source authority is domain-scoped. Rate the publisher for the claim domain, not for reputation in general.

Good question: "Is this publisher accountable for water-treatment guidance?"
Bad question:  "Have I heard of this organization?"

The authority letter answers:

How institutionally accountable is this publisher for this kind of claim?

It does not answer whether this particular claim is correct. Correctness is the second character's job.

At minimum, record:

source ID;
publisher name;
publisher domain or origin;
authority tier per domain;
evidence explaining why the tier was assigned;
confidence in the proposed rating;
date the assignment was verified;
current source policy status.

Example:

sources:
  who:
    publisher_name: World Health Organization
    publisher_domain: who.int
    current_source_policy_status: active
    authority_by_domain:
      public-health:
        code: A
        rating_confidence: high
        confidence_basis: Treaty/public-health mandate; official domain.
        last_verified: 2026-04-26
      home-electrical-repair:
        code: C
        rating_confidence: medium
        confidence_basis: Credible health publisher, not accountable for wiring standards.
        last_verified: 2026-04-26
    mandate_evidence:
      - type: official_domain
        url: https://www.who.int/
        evidence_text: Official publisher domain verified during source review.
        collected_at: 2026-04-26

  local-blog-example:
    publisher_name: Local Preparedness Blog
    publisher_domain: local-preparedness.example
    current_source_policy_status: active
    authority_by_domain:
      emergency-preparedness:
        code: D
        rating_confidence: medium
        confidence_basis: Identifiable local source; weak institutional accountability.
        last_verified: 2026-04-26
    mandate_evidence:
      - type: attribution
        url: https://local-preparedness.example/about
        evidence_text: Named author and local scope found during source review.
        collected_at: 2026-04-26

Rules:

The first character comes from this registry.
The first character is frozen at ingestion.
Later registry changes apply to new ingestions, not old historical rows.
Do not let an LLM invent authority tiers from memory. It may extract evidence from fetched pages and propose; a policy owner or approved registry process decides.
Do not transfer authority through mirrors, reposts, screenshots, summaries, citations, or copied text.
Domain scope always matters. A publisher can be A in one domain and C in another.

Authority Assignment Workflow

Use this flow whenever a new publisher or new domain relationship appears:

New source
  -> identify publisher domain
  -> check authority registry
     -> known source/domain: apply registry value
     -> unknown: continue
  -> check domain authority map
     -> clean primary-authority match: propose A with evidence
     -> no clean match: continue
  -> fetch homepage plus about/legal/mandate/governance pages
  -> extract mandate signals from fetched text
  -> cross-check against known A-tier sources in the same domain
  -> produce proposed code, confidence, evidence, and stop-condition state
  -> route to operator spot-check, formal review, or triage
  -> freeze the confirmed first character at ingestion

Every new source researched once should improve the registry permanently. In a healthy corpus, the research path becomes rarer over time because the registry and domain maps absorb the work.

Domain Authority Maps

For each domain, maintain a short list of known primary authorities. This is the fast path, not a replacement for evidence.

Example:

domain: water-treatment
a_tier:
  - publisher_domain: who.int
    scope: global public-health and WASH guidance
  - publisher_domain: national-water-regulator.example
    scope: national drinking-water regulation
  - publisher_domain: relief-agency.example
    path_prefix: /wash
    scope: WASH field guidance

path_prefix limits the match. In the example above, only URLs under /wash qualify for that domain-map entry. Do not promote an entire publisher domain when only one program or department is authoritative.

Mandate Signals

An agent may fetch a publisher's homepage, about page, legal notice, charter, standards page, or governance page and extract evidence.

Useful signals:

Signal found in fetched text or URL	Mandate indicator
`.gov`, `.int`, official treaty-body domain	Strong structural signal
"established under [Act/Treaty/Convention]"	Statutory or treaty mandate
"standards are required by law"	Regulatory authority
"reports to Parliament/Congress/Assembly"	Public accountability
"chartered by", "licensed by", "authorized by"	Delegated authority
Named in official guidance by a confirmed A-tier source	Secondary mandate signal

Structural signals are supporting evidence, not automatic A qualifiers. Mandate in the relevant domain and jurisdiction still applies.

LLMs are useful here as extractors. They can read fetched text and say:

This page states the publisher was established under a named act.

They must not say:

I know this organization, so it is A-tier.

Memory is not evidence. Fetched text, registry entries, formal citations, and operator decisions are evidence.

Decision Tree

Use the first matching answer, then lower confidence if evidence is weak.

Question	Proposed code
Is the publisher the primary official authority for this domain and jurisdiction?	`A`
Is it a strong official or institutional source, but not primary for this exact scope?	`B`
Is it a credible expert or public-interest source without governing authority?	`C`
Is it identifiable but weak, narrow, commercial, local, or lightly accountable?	`D`
Is it unknown, mirrored, unattributed, unverifiable, or provenance-poor?	`E`

If two rows seem plausible, choose the lower one unless evidence clearly supports the higher rating.

Source Authority Examples

These examples are illustrative. A deployment should verify mandate evidence against current official sources before freezing authority codes.

Publisher	Domain	Proposed rating	Why
World Health Organization	international public health, infectious disease, medicine	`A`	WHO's constitution establishes it as an international health body with global public-health functions.
International Committee of the Red Cross	humanitarian law, conflict medicine, field protection	`A`	ICRC describes its mandate under the Geneva Conventions and Additional Protocols for people affected by armed conflict and violence.
Federal Emergency Management Agency	US emergency preparedness and federal disaster response	`A`	FEMA identifies the Stafford Act as statutory authority for most federal disaster response activities; Post-Katrina reforms gave FEMA additional authority.
Australian Red Cross	first aid, community disaster preparedness, humanitarian services in Australia	`B`	Strong recognized humanitarian institution with emblem/legal standing, but not the primary statutory emergency-management regulator.
European Medicines Agency	EU medicines evaluation, supervision, pharmacovigilance	`A`	EU Regulation 726/2004 establishes EMA and assigns it coordination responsibilities for evaluation, supervision, and pharmacovigilance of medicinal products.

The Australian Red Cross case is the useful one. Recognized, trusted, and officially connected to the Red Cross/Red Crescent system does not automatically mean primary statutory authority for every emergency-management claim. That is why it can be B for community first aid or preparedness while a state or national emergency-management agency may be A for operational disaster response in the same jurisdiction.

Example evidence records:

examples:
  who-public-health:
    publisher_name: World Health Organization
    publisher_domain: who.int
    domain: international-public-health
    proposed_source_authority_code: A
    confidence_basis: WHO Constitution and official governance page.
    evidence_url: https://www.who.int/about/governance/constitution

  icrc-conflict-humanitarian:
    publisher_name: International Committee of the Red Cross
    publisher_domain: icrc.org
    domain: conflict-humanitarian-guidance
    proposed_source_authority_code: A
    confidence_basis: Mandate described under Geneva Conventions and Additional Protocols.
    evidence_url: https://www.icrc.org/en/our-mandate-and-mission

  fema-us-disaster-response:
    publisher_name: Federal Emergency Management Agency
    publisher_domain: fema.gov
    domain: us-disaster-response
    proposed_source_authority_code: A
    confidence_basis: FEMA disaster authorities page cites Stafford Act and Post-Katrina authority.
    evidence_url: https://www.fema.gov/disaster/authorities

  australian-red-cross-first-aid:
    publisher_name: Australian Red Cross
    publisher_domain: redcross.org.au
    domain: first-aid-community-preparedness
    proposed_source_authority_code: B
    confidence_basis: Recognized humanitarian body; not primary emergency-management regulator.
    evidence_url: https://www.redcross.org.au/globalassets/cms/governance/rules.pdf

  ema-medicines:
    publisher_name: European Medicines Agency
    publisher_domain: ema.europa.eu
    domain: eu-medicines-evaluation
    proposed_source_authority_code: A
    confidence_basis: EU Regulation 726/2004 establishes EMA responsibilities.
    evidence_url: https://eur-lex.europa.eu/legal-content/-EN/TXT/?uri=CELEX%3A32004R0726

Cross-Validation

Citation from a confirmed A-tier source can support authority classification, especially for delegated, regional, or technical bodies. But citation is not automatic promotion.

Weak evidence:

the candidate source appears in an A-tier bibliography;
an A-tier page links to it as related material.

Strong evidence:

an A-tier source formally delegates to it;
an A-tier source names it as the responsible authority;
law, treaty, regulation, or standards text assigns it responsibility.

Over time, a deployment may build a "cited as authoritative by" graph. That graph is useful, but it still needs policy. A citation graph without judgement is just reputation laundering with edges.

Proposal Output

Every researched authority proposal should be structured:

publisher_name: Example Water Utility
publisher_domain: utility.example
domain: water-treatment
proposed_source_authority_code: B
rating_confidence: high
confidence_basis: Official domain verified; public utility charter found.
rating_rationale: Strong institutional source in scope, not primary regulator.
stop_condition_triggered: false
last_verified: 2026-04-26
evidence:
  - type: delegated_authority
    url: https://utility.example/charter
    evidence_text: Publisher is chartered as a public water utility.
    collected_at: 2026-04-26

Confidence is routing metadata:

Confidence	Meaning	Route
`high`	Registry/map match or clear mandate evidence with no conflict	Operator spot-check, or approved automation if allowed
`medium`	Plausible authority with partial evidence	Operator review before freeze
`low`	Weak evidence, unclear scope, or mixed signals	Human triage
`insufficient`	Publisher, mandate, or domain cannot be established	Human triage; do not freeze new authority

Stop conditions override confidence. Stop and route to review when:

the publisher cannot be identified;
the source is a mirror but an official original may exist;
the source has mixed public/private authorship;
the domain scope is unclear;
assigning A would rely on reputation rather than mandate;
fetched mandate evidence is missing, contradictory, or not from the official publisher;
domain-map evidence and decision-tree evidence disagree.

Freezing ingestion authority is not the same as trusting the source forever. Keep a current policy overlay:

ingested_source_authority     = A
current_source_policy_status  = active | suspended | deprecated | compromised | withdrawn
source_policy_status_reason   = optional explanation

Do not rewrite history when a source is later suspended or compromised. Also do not force runtime systems to keep treating old authority as active. Historical authority and current policy status answer different questions.

Step 2: Ingest Documents

For each document:

Store the original artifact or stable source reference.
Extract canonical text.
Compute content hash.
Preserve publication date at known precision.
Assign source_authority_code.
Write ingestion_rating.

Do not invent missing dates. If a document only says 2024, store 2024, not 2024-01-01.

Date precision matters for supersession. A document dated only 2024 should not automatically be treated as older than a document dated 2024-03-15 unless you have stronger evidence.

Step 3: Chunk Documents and Extract Claims

Chunk at paragraph level by default for retrieval and evidence display.

Why paragraph level?

It is small enough to isolate bad claims.
It is large enough to preserve local meaning.
It maps well to user-facing explanations.
It allows prev/match/next retrieval windows.

But paragraphs are not always the adjudication unit.

A dense paragraph can contain a warning, a dosage, a contraindication, an exception, and a table reference. One sentence can be wrong while the rest is useful. For high-stakes domains, TRACE SHOULD extract claim spans inside paragraphs and adjudicate those spans separately.

Rule of thumb:

paragraph chunk = retrieval/evidence window
claim span      = adjudication target when precision matters

TRACE SHOULD prefer chunk-level adjudication by default.

Claim-span extraction is a precision tool, not a storage default. It SHOULD be triggered only when paragraph-level adjudication is likely unsafe and the extracted spans are few, meaningful, and above confidence threshold.

If uncertain whether claim spans are required, TRACE SHOULD store routing signals rather than writing low-confidence claim spans.

TRACE SHOULD NOT decide claim-span extraction from English keywords alone. High-stakes and dense chunks are routed through an explicit detector that records append-only signals before extraction. TRACE SHOULD use a cheap density gate before invoking heavier extraction: sentence/clause structure, semicolon boundaries, lists, tables, numeric/unit density, exception markers, identifiers, and risk lexicons produce a routing score. Low-score chunks remain chunk-level only. Medium-score chunks may receive claim_span_candidate and keep chunk-level adjudication. Only high-score chunks should receive claim_span_required and proceed to extraction.

Implementations SHOULD make claim-span extraction deliberately hard to trigger. Multiple independent signals SHOULD be required before extraction proceeds.

Implementations SHOULD reject claim-span extraction for a chunk when:

extracted span count exceeds a configured maximum;
extracted spans are disproportionately dense relative to chunk length;
extraction confidence is below threshold;
spans are not semantically meaningful, for example fragments without actionable or adjudicable content.

In such cases, TRACE SHOULD fall back to chunk-level adjudication. If in doubt, store a signal, not a span.

Sentence and claim-unit boundaries SHOULD be conservative: do not split decimal numbers, common abbreviations such as "vs.", or code-like fragments merely because they contain punctuation.

Implementations MAY use dependency parsing, predicate graphs, or NLI-style parent-span support checks as additional validation signals for candidate claim spans. These signals SHOULD remain advisory unless a deployment has calibrated them for the relevant language, domain, and extraction quality.

A failed parser check or NLI non-confirmation SHOULD lower extraction confidence, route the candidate to chunk-level adjudication, or create a triage signal rather than silently deleting the candidate. Note that valid claims frequently have an implied subject (imperatives: "Patch vulnerable systems immediately.") or arrive as OCR or Markdown fragments; parser strictness must be calibrated before any automatic rejection is applied.

TRACE SHOULD reject candidate claim spans automatically only when cheap, inspectable rules or well-calibrated validators strongly indicate the span is not meaningful, not adjudicable, or too noisy to store.

The detector may use:

language-agnostic structure signals: bullet lists, numbered steps, semicolon-separated clauses, table-like rows, many sentence boundaries, dense punctuation;
language-agnostic precision signals: numeric values, units, percentages, thresholds, CVEs, IP addresses, legal section markers, regulation identifiers;
density/routing score: multiple independent signals combine; two or more claim units carrying independent precision signals are a strong route-to-extraction signal, while one weak signal such as a lone identifier or high-stakes domain label is not enough by itself;
domain context: medicine, water treatment, emergency response, security, engineering, legal, or another explicitly configured high-stakes domain;
language-specific risk lexicons selected by detected language.

Domain context is evidence, not a verdict. A heading inside a medical or security document should not become a claim span merely because the document is high-stakes. A claim span is required when domain context combines with a specific structural, numeric, identifier, legal, or risk-language signal.

If the chunk language is unsupported by the lexical detector, TRACE records that coverage gap as a signal and continues with language-agnostic structure and unit detection. Unsupported lexical coverage routes ambiguous chunks toward triage; it must not silently downgrade or skip them.

Example signal rows:

numeric_unit          5 mg/kg
security_identifier   CVE-2021-44228
table_like            pipe-delimited table structure
semicolon_clause_boundary  1 semicolons
multi_claim_sentences 2 claim units with independent precision signals
contrast_exception_marker  unless
risk_lexicon          uk:попередження
lexical_coverage_unsupported  sw
claim_span_candidate  medium density
claim_span_required   high density

Each chunk should know:

document ID;
position in document;
previous chunk ID;
next chunk ID;
raw text;
extraction confidence;
detected language;
language confidence.

Compute language before inserting the chunk row. Do not insert empty chunk rows and patch them later unless your transaction model still commits them as one complete ingestion event.

Step 4: Detect Language

Use a fast local detector. Do not use an LLM for ordinary language detection.

Good default behavior:

def detect_language(text):
    cleaned = " ".join(text.split())
    if len(cleaned) < 40:
        return None, None
    return language_code, confidence

Practical rules:

Very short chunks are hard to classify. Inherit from document or neighbor context and mark low confidence.
Numeric tables, formulas, and boilerplate may have no meaningful language.
If language_confidence < 0.80, send the chunk to triage or mark it unverifiable for cross-language adjudication.
Store language per chunk because documents can be multilingual.

Step 5: Embed and Cluster

Use a multilingual embedding model if your corpus may contain more than one language.

Embedding similarity is not truth. It is a candidate finder.

A claim and its opposite often sit close together:

"Use 1 tablet per liter."
"Do not use 1 tablet per liter."

They share words and concepts. Embeddings will likely place them near each other. That is useful: it tells you they should be compared. It does not tell you whether they agree.

Step 6: Select Comparison Baseline

For each claim cluster, choose the best available non-invalidated comparison material.

Selection order:

Exclude chunks with second character X.
Prefer applicable A-tier official chunks.
If no A-tier chunk covers the claim, rank remaining official and community chunks using the equivalence table.
If ratings are equivalent, prefer newer, more specific, non-superseded, independent material.

Baseline use is not promotion.

A BA chunk may be used as comparison material when no stronger chunk exists. It does not become A-tier. Its first character remains B.

Cold Start and Baseline Bootstrap

Early corpora are dangerous because they can look more certain than they are.

Rules:

No baseline means "unverified by the corpus", not "probably true".
Consensus among weak sources does not become strong evidence by repetition.
Copied text does not count as independent confirmation.
Translations, mirrors, excerpts, and republications should carry lineage references.
Baseline selection should consider source independence, publication chain, translation chain, and known copying.
A cluster with many near-duplicates from the same origin is one evidence family, not ten independent witnesses.

This prevents trust laundering with extra steps.

Anti-Laundering Rules

Anti-laundering rules prevent TRACE from mistaking repetition, copying, or local reuse for independent evidence.

These rules are load-bearing. If an implementation violates them, its adjudication result is not trustworthy.

Self-confirmation is prohibited.

A target chunk or claim span must not be confirmed by itself, by its parent document, or by another span extracted from the same source passage. When the baseline and hypothesis share the same document or source passage, source_independence = 0.0, and the pair must be excluded from independent confirmation.

Copy-family material is one witness.

Mirrors, reposts, translated copies, excerpts, summaries, scraped duplicates, and republications of the same origin are one evidence family. They may preserve lineage, context, or translation history, but they do not provide independent corroboration. A cluster of near-duplicates from one origin is one data point, not many.

Independent confirmation requires independent lineage.

Only material with source_independence = 1.0 qualifies as independent confirmation. Any lower value means a known copy, translation, excerpt, republication, shared source chain, or unresolved dependency exists. Such material may be used as context, but it must not by itself write a confirmed verdict.

Unknown lineage is not independent by default.

Unknown lineage means "not determined", not "independent". In high-stakes domains, material with unknown source family or unknown publication chain must not count as independent confirmation unless a written policy explicitly allows that risk. The conservative default is:

unknown lineage -> context or triage, not confirmation

Baseline use is not promotion.

Using a chunk as comparison material does not raise its source authority or extend its trust scope. A B-tier source used as an interim baseline remains B-tier. A locally rated user claim used as a baseline remains local.

Consensus among dependent sources is not authority.

Ten mirrors, translations, or local adjudications against the same underlying origin do not become ten independent confirmations. Repetition can make a claim easier to find; it does not make the claim more authoritative.

No baseline means unverified.

If no qualifying independent baseline exists, the correct posture is unverified by the corpus. It is not "probably true" and should not be silently upgraded because nothing contradicted it.

Record the evidence.

Every adjudication row that relies on a baseline should record the selected baseline target, source lineage, and source-independence decision. An auditor must be able to reconstruct why the system treated two pieces of text as independent or dependent.

Step 7: Run Safety, Numeric, Unit, and Scope Gates

Before general semantic adjudication, run deterministic checks for direct danger and structured mismatch.

Examples:

forbidden medical dosage patterns;
known unsafe substitutions;
retracted emergency procedures;
explicit toxic or harmful instructions;
5 mg/kg vs 5 mg total;
1 tablet per liter vs 1 tablet per 500 ml;
for children under 5 vs not for children under 5;
table-cell value changes;
domain-specific red flags.

If a high-confidence safety gate fires:

pre_llm_status = dangerous
adjudication_code = ?X
triage_queue entry created
LLM not required

General NLI is brittle around numbers, units, negation, tables, and scope conditions. Extract and compare those deterministically where possible. The LLM may still emit dangerous later for novel or ambiguous cases.

Step 8: Run NLI

Natural Language Inference classifies the relationship between two chunks or claim spans:

NLI label	Meaning
entailment	The chunks agree.
neutral	Same topic, no clear conflict.
contradiction	The chunks conflict.

Starter thresholds:

Parameter	Default
Similarity gate	>= 0.75
Near duplicate	>= 0.90
NLI ambiguous range	>= 0.60 and < 0.85
Same-language contradiction	>= 0.85
Cross-language contradiction	>= 0.90
Language confidence floor	>= 0.80

Thresholds are starter configuration, not protocol constants. Calibrate them per domain, language pair, extraction pipeline, and model family.

Same-language contradiction at high confidence can set a pre-LLM flag:

pre_llm_status = contradicted

That is a flag, not a final trust decision. Ambiguous cases and high-impact contradictions go to LLM or triage according to domain policy.

Step 9: Handle Cross-Language Claims

TRACE should adjudicate across languages by default.

This matters because serious corpora are multilingual. Public health guidance, humanitarian guidance, civil protection manuals, and field instructions often exist in many languages. If your system cannot compare them, it cannot maintain global trust.

Required semantics:

chunk languages match
    -> run same-language or multilingual NLI

chunk languages differ
    -> run multilingual NLI or controlled translate-then-NLI

same-language contradiction probability >= 0.85
    -> pre_llm_status = contradicted

cross-language contradiction probability >= 0.90
    -> pre_llm_status = contradicted
    -> LLM adjudication or triage required before final X

unsupported language pair
    -> pre_llm_status = unverifiable
    -> enter triage

language_confidence < 0.80
    -> pre_llm_status = unverifiable
    -> enter triage

Cross-language confirmation does not transfer authority. A translated community chunk that agrees with an A-tier official chunk can gain content confidence, but it does not become an A-tier source.

Step 10: Invoke LLM Only When Needed

LLM adjudication is for hard cases.

Invoke it when:

NLI contradiction probability is ambiguous;
NLI says contradiction and the consequence is high;
cross-language divergence needs semantic judgment;
baseline material is close but not exact;
the safety gate cannot decide;
the domain requires narrative reasoning.

Do not invoke it when:

no baseline exists and the correct status is simply unverifiable;
a high-confidence safety rule already assigned X;
NLI returns a clean low contradiction probability;
the chunk is a near duplicate of stronger material.

Decision flow:

For each chunk:
    Select comparison baseline.

    If no baseline:
        pre_llm_status = unverifiable
        write adjudication row
        stop

    If language pair unsupported:
        pre_llm_status = unverifiable
        write adjudication row
        enter triage
        stop

    If safety gate fires:
        pre_llm_status = dangerous
        content_confidence_code = "X"
        invalidation = true
        adjudication_code = source_authority + "X"  # display shorthand
        write adjudication row
        enter triage
        stop

    If NLI contradiction probability < 0.60:
        pre_llm_status = clean
        write adjudication row
        stop

    If NLI contradiction probability >= 0.60:
        pre_llm_status = contradicted or unverifiable
        invoke LLM
        write adjudication row with verdict
        route to triage if required

LLM is the final automated adjudicator. Triage can override it by appending a new corrected adjudication row.

Step 11: Assign the Second Character

Map outcomes to content confidence.

Example policy:

Outcome	Second character
confirmed by strong comparison material	A
plausible from A-tier source but not directly confirmed	B
lower-tier source, weak or missing comparison material	C
contradicted but not dangerous	D
minimal confidence, no baseline, unverifiable	E
dangerous, retracted, materially superseded, or explicitly rejected	X

This mapping should be calibrated per domain. Medical dosage, bridge load limits, and gardening advice do not deserve identical risk thresholds.

Step 12: Append Document-Level Floor Snapshot

The document's ingestion rating does not change during adjudication. If a document-level summary is useful, append a floor snapshot derived from the latest effective chunk or claim-span ratings.

INSERT document_adjudication_floors:
    document_id = document.id
    adjudication_floor = min(effective_adjudication_code for document)
    weakest_target_type = chunk | claim_span
    weakest_target_id = target that produced the floor
    reviewed_at = adjudication run timestamp

Use the deployment's explicit ranking policy consistently. X sorts below everything for operational use.

If any chunk in an A-tier document becomes AX, the latest document-level floor snapshot should carry that invalidation signal. That does not mean the entire document is wrong. It means the document contains at least one chunk that cannot remain silently trusted.

Step 13: Build Runtime Packs

The runtime should not adjudicate.

It should receive:

chunks;
retrieval indexes;
precomputed chunk and claim-span ratings;
frozen document ingestion ratings and latest document-level floor snapshots;
contamination rules;
provenance needed to explain ratings;
supersession and invalidation flags.

At query time, retrieval ranks high-trust chunks first. If only weak chunks answer the question, show that weakness clearly.

If only invalidated or superseded material matches, block the operational answer:

Operational answer blocked.
Reason: only invalidated or superseded material matched this query.
Available actions: show audit history, escalate, or request current source.

Use separate modes:

Mode	`X` chunks allowed?	Purpose
operational answer	no	normal user-facing answers
audit history	yes	show why material was rejected
conflict review	yes	compare disputed evidence
historical research	yes, clearly marked	study old or superseded material

Do not give users a fake confidence slider. Give them the trust evidence.

16. Triage

Triage exists because some decisions should not be made silently by an algorithm.

Auto-entry conditions:

dangerous safety gate;
verdict = dangerous;
model agreement below threshold;
language confidence below threshold;
unsupported language pair;
two A-tier sources contradict each other;
any A-tier chunk assigned X;
high-impact cross-language contradiction;
human or policy rule requests review.

Triage rows are append-only. A worker claims an item, processes it, and appends a resolution.

Resolution values:

Resolution	Meaning
accepted	The adjudication stands.
rejected	The adjudication is overridden by appending a corrected row.
escalated	This worker cannot decide; route to a higher authority.

Do not mutate old triage rows. The history is the point.

17. Supersession

Old documents are not simply deleted when new editions appear.

A superseded manual may contain:

unchanged content that remains valid;
reorganized content that moved elsewhere;
outdated content that should be invalidated;
removed content that may or may not have been rejected.

Run chunk-level supersession analysis, using claim spans where paragraph-level precision is not enough:

For each chunk in old document:
    Find nearest neighbors in newer documents.

    If newer material confirms it:
        retain current rating

    If newer material contradicts it:
        send to LLM or triage

    If newer replacement materially removes or rejects the claim:
        assign X

    If no evidence exists:
        do not invent invalidation

The key principle:

Supersession is surgical. Do not burn down a whole document because one room has bad wiring.

18. Authority Correction

If an A-tier official document's latest appended floor snapshot ends in X, trigger authority correction.

This does not mean "punish the source." It means:

remove invalidated chunks from normal baseline use;
preserve the evidence;
mark the document as requiring authority review;
route the issue to a responsible authority if a channel exists;
prefer erratum, replacement, retraction, or updated edition before restoring full baseline use.

TRACE cannot force an institution to retract a document. It can make the problem impossible to miss.

That is already a large upgrade over most knowledge systems.

19. Worked Example

This is the class of problem TRACE was designed to prevent. The failure mode is real. The consequence of getting it wrong is real. The institution names and clinical parameters below are fictional.

The following uses recognizable institution types to illustrate realistic failure modes. The specific source texts, dosages, and clinical distinction are not medical guidance.

The corpus is used by field health workers during an emergency response. It contains:

A Global Health Agency oral rehydration therapy guideline, source authority A.
International Field Relief Committee emergency field medical protocols, source authority A.
A community translation of the Global Health Agency guideline, source authority 7.

The Global Health Agency guideline chunk says:

Mix one ORS packet in 1 litre of clean water.

The International Field Relief Committee protocols chunk says:

Dissolve one ORS sachet in 500 ml of boiled water.

The embedding model places these two chunks in the same claim cluster. Same clinical concept, overlapping vocabulary, similar vector neighborhood. NLI flags a contradiction. The LLM confirms: the difference in water volume is clinically significant and could affect electrolyte balance in a dehydrated patient.

Both sources are A-tier.

TRACE cannot safely assign X to either. Removing the wrong chunk could eliminate life-saving guidance from the corpus. This is exactly the kind of case that should not be decided silently by an algorithm at three in the morning.

Both chunks enter triage with reason = "two A-tier comparison chunks contradict each other". A clinician reviewer claims the item. She discovers that the Global Health Agency document targets a general population using standard-strength sachets, while the International Field Relief Committee protocol addresses severe acute dehydration with a half-strength preparation for a specific weight range. She appends:

resolution = accepted
notes = "Not a generic contradiction. Different clinical scope.
         Global Health Agency chunk = standard treatment, general population.
         Field Relief Committee chunk = severe acute dehydration, weight-range specific.
         Preserve both chunks with scope annotation."

No chunk receives X. Both remain in the corpus with their original ratings. The resolution note is now part of the permanent audit trail — readable by any future reviewer, any compliance check, any court.

A naive RAG system retrieves one of the chunks and answers with false confidence. The user on the other end may be a nurse in a field clinic with no internet access and a child in front of her.

TRACE forces the system to notice that the answer depends on a clinical scope distinction that changes outcomes, and it ensures that distinction is documented — even if the system is the only one in the room watching.

That is the whole game.

20. Acceptance Tests

Use these as implementation tests. A coding agent should be able to turn this section into unit tests and integration tests.

Rating Tests

Given source_authority = A, content_confidence = B, validation_track = official, display code is AB.
Given source_authority = 9 and invalidation = true, display code is 9X.
Given code A0, system treats it as low confidence, not rejection.
Given code AX, system excludes the chunk from baseline use.
Given code BA and invalidation, system emits BX, not AX, XA, or bare X.
Given document chunks AA, AB, AX, appended document-level floor ends in X.

Authority Tests

A B-tier source copying A-tier content remains first character B.
A community source confirmed by A-tier material does not become letter-track official material.
Registry authority changes do not rewrite already ingested first characters.
A source later marked current_source_policy_status = suspended is restricted at runtime without rewriting historical ingestion authority.

Baseline Tests

If an applicable non-X A-tier chunk exists, it is selected before lower material.
If no A-tier chunk exists, the system ranks official and community material using the equivalence table.
A chunk used as interim baseline is not promoted by that use.
Copied or lineage-dependent chunks do not count as independent confirmation.
No baseline produces unverifiable, not "probably true".

Contamination Tests

An answer using chunks AA, AB, BC displays no stronger than BC.
Operational answer mode excludes ?X chunks.
If only ?X chunks match, operational answer mode blocks the answer and offers audit/escalation options.
High-rated chunks do not average away a low-rated chunk.

Pipeline Tests

No baseline -> pre_llm_status = unverifiable, no LLM call.
Safety gate hit -> pre_llm_status = dangerous, X assigned, triage entry.
NLI contradiction probability below 0.60 -> no LLM call.
NLI ambiguous range -> LLM call.
Numeric/unit/scope mismatch -> deterministic gate flag before general NLI.
Unsupported language pair -> triage entry.
Cross-language contradiction above threshold -> LLM or triage before final X.
Dense high-stakes paragraph -> claim spans extracted and adjudicated separately.

Append-Only Tests

Re-adjudication appends a new row instead of updating the previous one.
Triage resolution appends a row instead of mutating queue state.
Current rating is derived from latest adjudication row.
Adjudication run records policy/model/prompt/threshold versions and log hashes.

If your system passes these tests, it is starting to behave like TRACE.

21. Implementation Plan

This section is for builders. It is intentionally practical and may be treated as implementation guidance rather than normative protocol language.

Build this in thin slices.

Slice 1: Ratings Without AI

Create source registry.
Ingest documents.
Chunk text.
Store explicit trust fields separately from display code.
Assign first character.
Assign default second character.
Build runtime output showing chunk ratings, frozen document ingestion ratings, and appended document-level floors.

Goal: prove the rating surface exists.

Slice 2: Embeddings and Baselines

Embed chunks and claim spans where available.
Cluster similar claims.
Select comparison baseline.
Store baseline_target_type and baseline_target_id.
Record source lineage and independence.

Goal: prove every adjudication can explain what it compared against.

Slice 3: NLI Contradiction Detection

Add deterministic numeric/unit/scope extraction for high-risk domains.
Run NLI on candidate pairs.
Store probability and label.
Route ambiguous or contradictory cases to adjudication.

Goal: catch semantic disagreement without invoking LLM on everything.

Slice 4: LLM Adjudication

Invoke LLM only on flagged cases.
Store verdict, confidence, model name, notes.
Assign second character from verdict.

Goal: reserve expensive reasoning for cases that need it.

Slice 5: Triage

Add append-only triage queue.
Add claim/resolution workflow.
Allow corrected adjudication rows.
Add adjudication run metadata and hash-linked log evidence.

Goal: make unresolved high-impact cases operationally manageable.

Slice 6: Runtime Projection

Build compact runtime pack.
Precompute contamination.
Block X chunks in operational answer mode.
Show ratings and provenance in answers.

Goal: make trust visible to users without running pipeline logic at runtime.

Slice 7: Re-Review

Re-run adjudication on schedule.
Skip unchanged content extraction by content hash.
Recompare against newer claim clusters.
Append a new document-level floor snapshot.

Goal: trust maintenance, not one-time labeling.

22. Agent Instructions

If you are a coding agent implementing this, follow these instructions exactly.

Do not start with UI.
Do not start with a chatbot.
Build the data model first.
Store explicit trust fields; treat compact codes as display shorthand.
Make all adjudication history append-only.
Implement rating comparison before retrieval ranking.
Extract claim spans for dense high-stakes paragraphs.
Write tests for the load-bearing rules.
Treat every threshold as configuration.
Never silently discard provenance.
Never overwrite source authority.
Never let a high-rated answer hide a low-rated chunk.
Never serve X chunks in normal operational answer mode.

When uncertain, choose the behavior that preserves evidence and forces the uncertainty to be visible.

That one rule will save you from most bad implementations.

23. Common Failure Modes

Failure 1: "We already have RAG"

RAG retrieves. It does not adjudicate.

If your system cannot explain why it trusts one source over another, it does not have TRACE. It has search plus vibes.

Failure 2: One Score to Rule Them All

Do not collapse source authority and content confidence into a single number. That destroys the distinction the system exists to preserve.

Failure 3: Automated Truth Claims

TRACE records trust posture under policy. It does not certify universal truth. If the documentation or UI says "true" where it means "trusted under current policy and evidence", fix the wording.

Failure 4: LLM as Judge of Everything

LLMs are expensive, non-deterministic, and not needed for obvious cases. Use cheap gates first.

Failure 5: Copy-Paste Consensus

Ten mirrors of the same source are not ten independent confirmations. Record lineage or the system will mistake repetition for corroboration.

Failure 6: Silent Supersession

Deleting old documents destroys history. Mark superseded chunks precisely and preserve the evidence.

Failure 7: Trust Averaging

Do not average ratings across chunks in an answer. The weakest included chunk is the risk the user inherits.

Failure 8: Mutable History

If a bad adjudication happened, it happened. Correct it by appending a new row. Do not rewrite the past.

Failure 9: Edge-Time Adjudication

The runtime should serve precomputed ratings. It should not decide source authority or run last-minute trust logic under user-query pressure.

24. What Managers Should Ask

If a vendor or internal team claims to have a trustworthy document AI system, ask:

Do you rate chunks or only documents?
Do you extract claim spans inside dense high-stakes paragraphs?
Can source authority and content confidence differ?
How do you detect contradiction between sources?
What happens when two top-tier sources disagree?
Can low-trust chunks contaminate high-trust answers?
Are invalidated chunks blocked from operational answers?
Do you preserve append-only, tamper-evident adjudication history?
How do you handle copied sources and source independence?
How do you handle superseded guidance?
Can you adjudicate across languages?
What runs at build time vs query time?
Can you show me why the system trusted this answer?

If the answer to most of these is "the LLM handles it," you do not have a trust architecture. You have a prompt.

25. What Builders Can Claim

If you implement TRACE properly, do not write:

Built a RAG chatbot.

For a complete implementation, write:

Designed and implemented a trust-ranked adjudicated corpus engine: append-only
adjudication evidence with tamper-evident run logs, chunk-level trust ratings
across orthogonal source authority and content confidence axes, multilingual
claim clustering with vector search, NLI contradiction detection with calibrated
thresholds, deterministic numeric/unit/scope gates for structured mismatch,
LLM adjudication gated behind cheap pre-filters, human/AI triage with
claim/resolution workflow, surgical supersession analysis, cold-start
anti-laundering rules, and precomputed runtime trust projection into compact
offline packs.

For an implementation that has only built the early control-plane pieces, use more precise language:

Designed and began implementing a trust-ranked adjudicated corpus engine with
append-only adjudication evidence, chunk-level trust ratings, orthogonal source
authority and content confidence axes, a multilingual embedding model in place,
deterministic claim-span routing signals, and DB-backed runtime trust projection
groundwork.

That is not buzzword soup. That is a real system with a threat model.

When an interviewer asks — and you will have answers:

"How did you prevent one bad source from contaminating an answer?" — Minimum rating propagation on contributing chunks; operational answer mode blocks X chunks before generation; precomputed at pack build time; visible at UI level.
"How do you handle conflicting guidance from two trusted institutions?" — Automatic triage entry with append-only reason record; worker claims the item; clinician or authorized agent appends a corrected adjudication row with scope annotation. The resolution is permanent evidence, not a configuration toggle.
"How does the system know it is comparing related claims, not just similar words?" — Vector similarity gate finds candidate pairs; NLI classifies the semantic relationship. Embeddings find. NLI decides. Numbers, units, and negation get their own deterministic gate because NLI is brittle there.
"Can you adjudicate multilingual corpora?" — Language detected per chunk before insert; multilingual NLI or translate-then-NLI for supported pairs; unsupported pairs route to triage rather than silently failing.
"What is your audit trail for a trust decision?" — Every adjudication is an append-only insert linked to a versioned run record carrying policy, model, prompt, and threshold hash. Current state = latest adjudication row by monotonic sequence, with created_at retained for audit display. No silent rewrites. The record of what the system believed and when is always recoverable.

These are knowledge infrastructure questions, not chatbot questions. The conversation goes differently.

26. Change Log

This is a version-level change log, not a commit log. It records the protocol shape a reader should notice.

v0.11 Draft

Added explicit anti-laundering rules for baseline use, independent confirmation, copy families, unknown lineage, self-confirmation, and local rating reuse.
Clarified that unknown lineage is not independent by default and that no qualifying baseline means unverified by the corpus, not "probably true".
Required adjudication evidence to record baseline target, source lineage, and source-independence decisions so trust-laundering checks remain auditable.

v0.10 Draft

Clarified that dependency parsing and NLI MAY be used as additional validation signals for candidate claim spans but SHOULD remain advisory unless calibrated for the deployment language and domain. A failed check SHOULD lower confidence or route to chunk-level adjudication, not silently delete the candidate.
Added explicit note that valid claims frequently have an implied subject (imperatives, OCR fragments, Markdown bullets) and that parser strictness must be calibrated before any automatic rejection is applied.
Simplified pipeline overview: validation steps are configurable, not a fixed prescribed stage order.
Renamed extraction step to "extract candidate claim spans" to distinguish it from any downstream validation passes.

v0.9 Draft

Kept sparse claim-span extraction as a protocol guardrail while removing implementation-specific numeric thresholds from the generic TRACE methodology.
Added explicit "prefer chunk-level adjudication by default" wording.
Added rejection guardrails for excessive, dense, low-confidence, or semantically weak extracted spans.
Clarified that dependency or predicate-graph parsing may be used as optional second-stage routing evidence, not as mandatory adjudication truth.

v0.8 Draft

Made claim-span extraction sparse by default: medium-density chunks now emit claim_span_candidate only, while deterministic extraction requires claim_span_required.
Added explicit no-span, candidate-only, and extraction paths.
Added span count and density guardrails so over-extracted chunks fall back to chunk-level adjudication.

v0.7 Draft

Added language-agnostic multi_claim_sentences routing for chunks containing two or more claim units with independent precision signals.
Added semicolon clause boundaries to the cheap claim-density gate.
Clarified that safer sentence/claim-unit boundaries should avoid splitting decimals or common abbreviations.

v0.6 Draft

Added the claim-density gate before claim-span extraction.
Clarified that TRACE routes chunks to claim-span extraction only after multiple cheap structural, numeric, lexical, identifier, or risk signals cross a configured threshold.
Added claim_span_required as the explicit routing signal produced by that gate.

v0.5 Draft

Clarified that the long builder/CV claim describes a complete TRACE implementation.
Added a narrower claim for early implementations that have built only the control-plane foundations.

v0.4 Draft

Added multilingual-safe claim-span need detection before claim-span extraction.
Introduced append-only chunk_triage_signals for auditable routing signals.
Clarified that high-stakes domain context alone is not enough to require a claim span; it must combine with structural, numeric, identifier, legal, or risk-language evidence.
Required language-agnostic detectors to continue working when lexical support for a chunk language is unavailable.

v0.3 Draft

Publication polish: replaced local-looking placeholder domains in the source authority examples with reserved .example domains.

v0.2 Draft

Added a generic source authority assignment method to the cookbook.
Defined domain-scoped authority ratings, domain authority maps, mandate-signal extraction, cross-validation, confidence routing, and stop conditions.
Added illustrative source-authority examples for international, national, and delegated-authority cases.
Clarified that LLMs may extract authority evidence from fetched text but must not assign final authority from memory.
Kept source authority, content confidence, and current source policy as separate trust surfaces.

v0.1 Draft

Initial self-contained TRACE reference architecture.
Defined two-axis trust fields, display codes, contamination rules, append-only adjudication evidence, triage, supersession, authority correction, acceptance tests, and implementation guidance.

27. Final Note

The hard part of knowledge systems is not storing text. We solved that decades ago.

The hard part is maintaining trust as the corpus grows, changes, contradicts itself, crosses languages, and gets used by people who may act on the answer.

TRACE is a way to make that maintenance explicit.

It does not ask the model to be a god. It asks the system to keep receipts.

Co0olCat/TRACE.md

TRACE: Trust-Ranked Adjudicated Corpus Engine

Reader Map

Table of Contents

1. Executive Summary for Decision-Makers

2. Technical Summary for Engineers

3. The Problem TRACE Solves

4. Scope and Limits

5. The Core Idea

6. Load-Bearing Rules

7. Vocabulary

8. Trust Fields and Display Codes

Letter Track

Number Track

Equivalence Table

9. Ordering, Ranking, and Contamination

Document Rating, Adjudication Floor, and Answer Rating

The Contamination Rule

10. What Users Should See

11. Architecture

12. Minimal Data Model

13. Threat Model and Tamper Evidence

14. Pipeline Overview

15. Cookbook

Step 1: Define Source Authority

Authority Assignment Workflow

Domain Authority Maps

Mandate Signals

Decision Tree

Source Authority Examples

Cross-Validation

Proposal Output

Step 2: Ingest Documents

Step 3: Chunk Documents and Extract Claims

Step 4: Detect Language

Step 5: Embed and Cluster

Step 6: Select Comparison Baseline

Cold Start and Baseline Bootstrap

Anti-Laundering Rules

Step 7: Run Safety, Numeric, Unit, and Scope Gates

Step 8: Run NLI

Step 9: Handle Cross-Language Claims

Step 10: Invoke LLM Only When Needed

Step 11: Assign the Second Character

Step 12: Append Document-Level Floor Snapshot

Step 13: Build Runtime Packs

16. Triage

17. Supersession

18. Authority Correction

19. Worked Example

20. Acceptance Tests

Rating Tests

Authority Tests

Baseline Tests

Contamination Tests

Pipeline Tests

Append-Only Tests

21. Implementation Plan

Slice 1: Ratings Without AI

Slice 2: Embeddings and Baselines

Slice 3: NLI Contradiction Detection

Slice 4: LLM Adjudication

Slice 5: Triage

Slice 6: Runtime Projection

Slice 7: Re-Review

22. Agent Instructions

23. Common Failure Modes

Failure 1: "We already have RAG"

Failure 2: One Score to Rule Them All

Failure 3: Automated Truth Claims

Failure 4: LLM as Judge of Everything

Failure 5: Copy-Paste Consensus

Failure 6: Silent Supersession

Failure 7: Trust Averaging

Failure 8: Mutable History

Failure 9: Edge-Time Adjudication

24. What Managers Should Ask

25. What Builders Can Claim

26. Change Log

v0.11 Draft