See what changed before you activate it.

The eight clauses

DEMONSTRATED

Built and shown on a declared sample or controlled path; not a production qualification.

DIRECTION

An intended property of the compiler contract. Not offered as a shipped capability in TAVONEL today.

No clause on this page is marked QUALIFIED. That state requires a named corpus and a receipt, and TAVONEL publishes neither — the measurements it does publish are in the research notes.

1. 01

   Evidence-preserving

   DEMONSTRATED

   Every promoted fact names the exact source version it was read from, and every region names its page and its box.

   Explanation and evidence

   Every relation is typed and carries the evidence that justifies it, and a claim reaches that evidence through a supported_by relation to one exact document version — identified by the sha256 of the bytes that were read, not by a filename. The coordinates live on the region: each retrieval unit names a bounding box on a numbered page of that version and lists the claims and entities found inside it, so a changed region can be read back to what stands on it. Where an anchor is missing the compiler abstains rather than inventing one — a document version whose regions fail validation stops the compile with OCR_BINDING_INVALID, and a document read without regions emits no retrieval unit rather than a guessed page or box. Resolving every evidence reference in a finished package, and reporting EVIDENCE_DANGLING where one does not, is an offline check anyone holding the package can run — and the compiler runs the same check over the package before it emits, so a package that fails it arrives as review_required with the failing codes named, for a person to look at, rather than as a candidate that could be promoted.

   WHERE TO CHECK ITOpen any compiled package: rag/chunks.jsonl carries pageNumber1, bbox1000 and sourceVersionId on every unit, and provenance/evidence.jsonl resolves each one. The compiled sample at /explore publishes the same binding without an account — every region it opens names its page and its box. To check a package yourself, tavonel-verify-package.mjs at /developer/tavonel-verify-package.mjs reports EVIDENCE_DANGLING for a reference that does not resolve; its sha256 is pinned in /developer/channel.json.

2. 02

   Stable semantic identity

   DIRECTION

   The same thing named four ways is one object, or it is left unresolved.

   Explanation and evidence

   FP-200, Feedwater Pump 200, Pump FP200 and P-200 are one piece of equipment in the plant and four strings in the corpus. An object here carries a stable key derived from content, so recompiling the same source lands on the same object rather than a new one. Merging two different strings into one object is the part TAVONEL does not do automatically: where the evidence does not settle identity, the compiler is required to leave it unresolved for a person rather than guess, and automatic resolution across sources is a direction.

   WHERE TO CHECK ITcanonical/model.json in a package carries the stable key on every object, so recompiling the same source and diffing the two files shows the key holding. The sample at /explore is the readable version of the same thing. What is not there is an automatic merge across sources, which is why this clause is a direction rather than a demonstration.

3. 03

   Typed dependencies

   DEMONSTRATED

   The edges between knowledge units are typed and carry their own evidence.

   Explanation and evidence

   Every edge is typed and carries the evidence ids that justify it, and which types you get depends on which engine compiled: the fallback compiler emits three — a document discusses_topic, a document mentions_entity, and a claim is supported_by the evidence for one exact document version — while Core V2, the engine TAVONEL runs, has no topic object at all and emits three of its own: a claim supported_by its evidence, a claim mentions an entity, and one claim contradicts another. They are written as graph/relationships.csv under the header id, subject_id, predicate, object_id, evidence_ids, so a relation naming no evidence is not a row either emitter can produce, and the predicate list an artifact advertises is computed from the edges that artifact contains rather than copied from the blueprint. Where a type is a heuristic rather than read semantics, that is said and not softened: the fallback's topic edge comes from a small set of keyword rules and its entity edge from a capitalised-token scan, which makes those two document-level co-occurrence, and Core V2's entity mention is a regular-expression scan over the same text. A contradicts edge is a candidate, not a verdict — the compiler flags a pair whose numbers or whose polarity disagree inside one topic and one time reference, sends the candidate to review rather than resolving it, and knows nothing about jurisdiction, units or exception clauses; two claims phrased with different dates are never compared. A retrieval unit names the claims and entities found inside its own region, and the gate in front of retrieval rejects a unit with nothing bound to it; the unit carries no relation id. Projecting a relation into the retrieval unit an answer is built from is the rung TAVONEL does not build.

   WHERE TO CHECK ITgraph/relationships.csv in a package, whose header is id, subject_id, predicate, object_id, evidence_ids: a row with an empty evidence_ids column is one neither emitter can write. The predicate set an artifact advertises is in its own ontology/knowledge.ttl rather than in a blueprint, so the file and the claim are the same file. /docs/ontology-output publishes the per-predicate table with the engine that produced each edge.

4. 04

   Temporal integrity

   DEMONSTRATED

   A fact that has been replaced cannot be served as current.

   Explanation and evidence

   A compile produces a candidate version. A person activates it, and the version it replaced stays intact and readable rather than being overwritten. The gate in front of retrieval rejects any unit belonging to a superseded world version, so a superseded fact cannot reach an answer even if it is the closest match. Reading the world as it stood on a past date, and classifying which authority governed a fact at that date, are directions: the gate checks the active version, not a point in time.

   WHERE TO CHECK ITEvery World revision keeps its own manifest digest, and the Change act at /explore compares two of them side by side. In the API, a read of a superseded revision answers SUPERSEDED_WORLD_VERSION rather than returning the unit — /docs/world-api and /docs/errors document the code and when it is returned.

4 clauses in, and every one of them is checkable on a World that is already compiled. Open the public Compiled World and follow a fact back to the page it was read from, or request access to compile your own sources.

5. 05

   Selective recompilation

   DIRECTION

   Two changed pages rebuild what depends on them, not the corpus.

   Explanation and evidence

   Two pages change in a corpus of five thousand documents. The units that depend on those pages are rebuilt and everything else is carried over untouched, which is the economic argument for compiling knowledge rather than re-indexing it. Demonstrated on the public sample. Selective recompilation is on the roadmap and is not available today: a compile rebuilds the collection it is given.

   WHERE TO CHECK ITEach package's provenance/events.jsonl records what the compile actually did, so you can check this yourself. The capability grid on /security labels this row Direction.

6. 06

   Full-rebuild equivalence

   DIRECTION

   A selective result must match a full rebuild, or it does not publish.

   Explanation and evidence

   An incremental update that is merely fast is dangerous, because nothing announces the moment it starts diverging from what a full rebuild would have produced. The contract is that the two are compared and that a mismatch refuses to publish rather than shipping a world that looks finished. The equivalence check is built and enforced; it has nothing to compare until selective rebuilds ship.

   WHERE TO CHECK ITEach package's provenance/events.jsonl carries the equivalence field, so the value is checkable rather than asserted.

7. 07

   Multi-model verification

   DIRECTION

   A reader's own confidence is not evidence that it read the page correctly.

   Explanation and evidence

   A single OCR or vision model grading itself is the failure this clause exists to prevent: it is most confident exactly where a degraded scan has misled it. The contract asks for an independent second read, explicit disagreement detection between the two, escalation to a stronger reader where they disagree, and one canonical result at the end. Reading is single-pass today; low-confidence regions are carried forward and arrive in review rather than being re-read by a second model.

   WHERE TO CHECK ITOne read per document version, visible in the package: provenance/events.jsonl records a single read event per version, and a low-confidence region arrives in the review queue rather than in a second read. /docs/review documents the four decisions a person takes there.

8. 08

   Portable World

   DEMONSTRATED

   A compiled World leaves as a signed package you can verify without us.

   Explanation and evidence

   The canonical model leaves as JSON, the ontology as Turtle and JSON-LD, the graph as CSV, the retrieval corpus and the provenance events as JSON Lines, and the sources as Markdown for reading. The archive carries a signed file inventory — every listed file checked by sha256, then those exact manifest bytes signed with Ed25519 — and the public key the signature was made with, so the check is an offline comparison of two files in the archive against a key fingerprint obtained from somewhere other than the archive: GET /api/export/trust publishes that fingerprint, and a download with no signing key configured refuses with EXPORT_SIGNER_NOT_CONFIGURED rather than handing over an unsigned archive. The package still does not carry the verifier inside itself, because a checker shipped inside the thing it checks proves nothing. What changed is where the reference verifier lives: tavonel-verify-export.mjs and tavonel-verify-package.mjs are published downloads on the Developers page, each pinned by sha256 in the distribution channel, each a single file that imports nothing but the Node standard library. The algorithm and the two files to compare are still named here, so a holder who would rather trust their own program than ours can still write one — and now does not have to in order to check a download at all. Knowledge that can only be read inside the tool that made it is not an asset.

   WHERE TO CHECK ITmanifest/export-manifest.json and signatures/export-manifest.ed25519.json are in the archive; the public key fingerprint to check them against is served by GET /api/export/trust, which is outside the archive on purpose. The two reference verifiers are downloads — /developer/tavonel-verify-export.mjs and /developer/tavonel-verify-package.mjs — each a single file importing nothing but the Node standard library, each pinned by sha256 in /developer/channel.json. A download with no signing key configured answers EXPORT_SIGNER_NOT_CONFIGURED rather than handing over an unsigned archive.

What a source change does

Leaving the compiler