Provenance

Provenance is Tarski’s explanation graph. It answers why a candidate, proposal, decision, trusted fact, intent, effect, or gate exists by walking backward through derivation edges to the observations and typed atoms that support it.

Provenance is part of the evaluated product, not optional debugging metadata. When a bad intent appears, you follow edges backward to the exact observation that caused it — the zero-code debugger. The generated rules never need to be read to locate a cause.

What provenance preserves

The graph keeps the distinction between evidence and interpretation:

• An observation is raw evidence.
• A typed atom is deterministic evidence extracted from one observation.
• candidate.* is provisional fact-domain evidence; proposal.* is provisional action-domain evidence.
• decision.* is deterministic adjudication.
• A trusted fact is committed fact-domain truth; an intent is a committed action-domain request — and neither is the other.
• An effect receipt becomes new evidence only by appending observations.

How to read a provenance chain

Start from the outcome and walk backward:

1. Identify the selected candidate, proposal, decision, fact, intent, effect, or gate.
2. Identify the rule or relation that produced it.
3. Follow input relations to prior trusted facts, decisions, candidate/proposal evidence, or typed atoms.
4. Follow typed atoms back to the observation and mapper output.
5. If an effect is involved, follow from receipt observation back to effect attempt, request, intent, and the admitted evaluator/package identity.

This yields a repeatable debugging method: fix the earliest wrong edge in the chain.

Earliest wrong edge	Fix
The observation is wrong	Fix ingress or the fixture
The atom is wrong	Fix the mapper
Evidence is right but the fact is wrong	Fix ontology or helper logic
The fact is right but an unsafe action was admitted	Fix decision graph cuts, intent rules, invariants, or effect authority

Provenance in the product

• Studio renders provenance as a deterministic graph seeded from any evidence row — every fact, intent, and effect row links to its neighborhood. The only client-side control is a labeled, presentation-only view depth. See Studio.
• Verification bundles include provenance so that audit evidence explains why expected worlds hold, not just that they hold. See Scenarios & fixtures.
• The counterexample flywheel starts here: a provenance-pinned misbehavior promotes into a fixture in one step, and an authoring agent iterates until verification proves the fix.