29 lines
1.3 KiB
Markdown
29 lines
1.3 KiB
Markdown
# ADR 0004: Separate active and audit views
|
|
|
|
Status: Accepted, 2026-09-13.
|
|
|
|
Normal export contains only selected, nonrejected facts. Audit export preserves
|
|
active, superseded, and rejected facts with an explicit state and rejection
|
|
reason. Neither export bypasses resolver policy.
|
|
|
|
Operational consumers need an unambiguous current evidence view, while
|
|
investigators and publishers need conflicting and superseded evidence. One
|
|
ambiguous export could be mistaken for an approved route list.
|
|
|
|
Version 0.4 keeps the complete audit history inside each generation so rollback,
|
|
diff, and incident inspection remain self-contained. Separating a compact runtime
|
|
projection from content-addressed cold audit bundles is deferred to v0.5 until
|
|
size and latency measurements justify the extra recovery surface.
|
|
|
|
## Rejected alternatives
|
|
|
|
Deleting superseded facts loses conflict and replacement evidence. Shipping only
|
|
the audit view makes accidental use as current state too easy. Splitting storage
|
|
before authenticated bundle verification exists risks publishing a runtime index
|
|
whose supporting evidence cannot be recovered.
|
|
|
|
## Compatibility
|
|
|
|
The normal JSONL envelope is v2 and contains active assertions only. Audit mode
|
|
uses the same envelope version with explicit active, superseded, rejected, and
|
|
tombstoned rows. V1 consumers must reject the new schema and migrate explicitly.
|