1.3 KiB
ADR 0004: Separate active and audit views
Status: Accepted, 2026-09-13.
Normal export contains only selected, nonrejected facts. Audit export preserves active, superseded, and rejected facts with an explicit state and rejection reason. Neither export bypasses resolver policy.
Operational consumers need an unambiguous current evidence view, while investigators and publishers need conflicting and superseded evidence. One ambiguous export could be mistaken for an approved route list.
Version 0.4 keeps the complete audit history inside each generation so rollback, diff, and incident inspection remain self-contained. Separating a compact runtime projection from content-addressed cold audit bundles is deferred to v0.5 until size and latency measurements justify the extra recovery surface.
Rejected alternatives
Deleting superseded facts loses conflict and replacement evidence. Shipping only the audit view makes accidental use as current state too easy. Splitting storage before authenticated bundle verification exists risks publishing a runtime index whose supporting evidence cannot be recovered.
Compatibility
The normal JSONL envelope is v2 and contains active assertions only. Audit mode uses the same envelope version with explicit active, superseded, rejected, and tombstoned rows. V1 consumers must reject the new schema and migrate explicitly.