---
title: "Interveil Engine — Alpha Product Specification"
owner: "Interveil Labs"
version: "1.0"
date: "2026-08-18"
status: "Build-backed specification"
---

# Interveil Engine — Alpha Product Specification

## Decision summary

The first product is an inspectable evidence instrument, not a truth oracle. It must let a person move from a rendered sentence to the atomic claims, evidence bearings, independent roots, losses, provenance frontiers, assessments, and revision that support it. It must also let a person bring new source material into a local proposal-and-review loop without granting a model canonical authority.

The Alpha implements that contract over the Trinity packet: 114 nodes, 40 claim-family records, seven assessment dimensions, three independence clusters, five loss events, two provenance frontiers, and no truth score.

## Product promise

For every answer, Interveil shows:

- what is being claimed;
- what directly supports, partially supports, contradicts, or merely contextualizes it;
- how many independent roots remain after repetition is collapsed;
- what is missing and what was attempted;
- which lens and packet revision produced the rendering; and
- whether a human reviewed any model-assisted proposal.

Interveil does not certify truth, infer deception from missing provenance, or promote consensus into referent-level evidence.

## Users and jobs

### Investigator

Needs to inspect a claim without reconstructing its entire source history manually. Success means reaching the relevant source, dependency cluster, counterline, and retained unknown from one rendered sentence.

### Encoder or reviewer

Needs to turn source material into atomic, typed records while preserving attribution, access mode, exact selectors, uncertainty, and revision history. Success means every accepted node can be traced to a bounded source location and a named human action.

### Reader

Needs a useful narrative that does not hide how it was assembled. Success means context stays at the edge until requested, then unfolds without changing the underlying record.

### Integrator

Needs an API response that can be reproduced and audited. Success means prose never arrives without its packet revision and subgraph receipt.

## System boundaries

| Layer | Responsibility | Must not do |
|---|---|---|
| Interveil Engine | Maintain the typed, append-only record; validate invariants; compute dependency-aware views | Decide truth or personalize the record |
| Authentic Intelligence | Govern capture, consent, disclosure, sovereignty, and human authorship | Convert engagement into undisclosed extraction |
| Instruments | Render the packet for a declared purpose and audience | Become canonical or write into the Record Plane |
| Standards substrate | Supply asset provenance, derivation, packaging, and receipts | Be interpreted as claim correctness |

## Architecture

### Record Plane

Append-only, content-addressed, and typed. Corrections arrive as new nodes with supersession edges. Minimum Alpha concepts are:

- referent;
- artifact;
- actor;
- instrument;
- context;
- transformation;
- observation;
- claim;
- counterclaim;
- hypothesis;
- interpretation;
- evidence bearing;
- independence cluster;
- loss event;
- provenance frontier;
- consensus record; and
- revision.

Assessment remains a structured, attributed vector. It may be implemented as a node or embedded record until the third independent packet resolves the vocabulary choice.

### Lens Plane

A deterministic or model-assisted renderer reads one named packet revision and declares:

- audience and purpose;
- lens identifier and version;
- selection and omission rules;
- model, prompt, and tool receipts where applicable;
- human reviewer, if any; and
- generation timestamp.

The Lens Plane cannot write observations or other canonical records.

### One-way membrane

An observation may inform an interpretation. An interpretation may not be re-ingested as an observation. This rule is enforced by endpoint types and validator failures.

## Required refusals

1. Interpretation cannot become observation.
2. Signature validity cannot raise claim truth or evidentiary fit.
3. Repetition cannot increase corroboration unless a distinct independent root is established.
4. Missing provenance cannot be rendered as concealment or deception without a separate supported claim.
5. Revision cannot overwrite its predecessor.
6. Consensus about a claim cannot serve as evidence for that same referent-level claim.
7. Partial support cannot be aggregated or rendered as full support.
8. Missing context cannot be treated as neutral context.
9. No aggregate truth score may exist in the core schema.
10. No model may perform an autonomous canonical write.

## Alpha instrument

### Summary

Seven bounded sentences unfold into their atomic claims and a four-part why chain: mapped records, evidence and artifacts, independent roots, and retained loss.

### Claims and inspector

Users can search and filter claim-family records, select one, and inspect attribution, referent, derivation, evidence bearings and rationales, seven-dimensional assessment, and related loss.

### Source genealogy

Shows artifacts and transformations from the earliest located root forward. It is a derivation view, not an evidentiary view.

### Independence and echoes

Shows dependency clusters, members, roots, and assessability. Counts use roots, never publication totals.

### Loss ledger and frontiers

Shows typed loss, affected records, recoverability, the last verified provenance node, and resolution attempts.

### Revision

Shows supersession without erasure and explains why the later state exists.

### Capture workbench

The Alpha performs deterministic sentence segmentation in the browser. Source text is not uploaded. Candidate records remain proposals until the user accepts them, and export creates a local, non-canonical JSON-LD draft.

## Capture and review flow

```text
select source → record access mode → create exact segments
→ propose atomic roles / claims / links → show uncertainty and omissions
→ human accept / edit / reject → run invariants
→ create attributed revision → optionally sign and register
```

### Canonical-write rule

Only a human acceptance action can initiate a canonical revision. A model output is always marked `proposal`, carries a model receipt, and cannot traverse the Record Plane write boundary directly.

### Access modes

- attributed report;
- direct inspection;
- instrument output; and
- model-assisted extraction.

Access mode is never inferred silently. It controls the default candidate role and epistemic status but remains editable by the reviewer.

## Data boundaries and consent

| Data class | Default location | Product use | Consent |
|---|---|---|---|
| Source content and personal annotations | User device or user-controlled packet | Proposal generation and review | Explicit action; external processing requires a separate disclosure |
| Canonical packet | Versioned packet store | Query, rendering, export | Authored acceptance and packet governance |
| Product-improvement signal | Separate telemetry store | Alpha usability analysis | Explicit opt-in after payload preview |

The Alpha improvement payload contains only:

```json
{
  "packetRevision": "trinity-alpha-0.2.0",
  "surface": "capture-workbench",
  "helpful": true,
  "issueType": "none",
  "candidateCount": 2,
  "acceptedCount": 1,
  "comment": "",
  "consentVersion": "alpha-feedback-v1"
}
```

It excludes source labels, pasted text, accepted statements, identity, email, and browsing history. The optional comment warns against including personal or source information. Consent is unchecked by default and the exact payload is visible before submission.

## Evidence API contract

```json
{
  "answer": "bounded natural-language response",
  "packetRevision": "stable identifier",
  "claimIds": ["..."],
  "supportIds": ["..."],
  "dependencyClusters": ["..."],
  "assumptions": ["..."],
  "losses": ["..."],
  "frontiers": ["..."],
  "renderReceipt": {
    "model": "...",
    "lens": "...",
    "reviewedBy": "...",
    "generatedAt": "..."
  }
}
```

An API answer is invalid if the packet revision cannot be retrieved, a sentence lacks mapped claims, or a source-count operation ignores dependency clusters.

## Validation and acceptance criteria

### Packet validator

The Beta merge target must machine-check:

- globally unique identifiers and valid endpoints;
- node-type and relation allowlists;
- the one-way membrane and all forbidden collapses;
- sentence-to-claim receipts;
- exact selector presence for accepted extracted claims;
- symmetric or explicitly directed independence relationships;
- all seven assessment dimensions and rationales;
- required consensus facets;
- preserved superseded revisions; and
- evaluation coverage.

### Product go/no-go

- at least 90% user trace accuracy across the six core questions;
- no critical forbidden-collapse failure;
- median completion time no more than 1.5 times a conventional summary;
- at least 95% of accepted summary sentences carry complete claim traces;
- zero autonomous canonical writes; and
- no user-source content in product telemetry by default.

## Metrics

Track claim-trace completeness, forbidden-collapse rate, dependency-detection precision and recall, reviewer agreement, adjudication time, frontier resolution, correction latency, and user accuracy.

Do not treat raw node count, graph density, pages ingested, citations displayed, or unqualified agreement counts as success metrics.

## Threat model

The product must be tested against citation cascades, prompt injection inside source material, synthetic source swarms, false independence, reputation laundering, tendentious lenses, omission attacks, hostile packet merges, abusive dossiers, feedback-payload leakage, and model-output re-ingestion.

## Delivery sequence

1. Merge the two Alpha vocabularies and port Packet B's validator.
2. Run the twelve-participant comparative usability study.
3. Encode two cross-domain packets with blind dual review.
4. Add exact selectors, C2PA import, content-addressed snapshots, RO-Crate export, and SCITT-compatible receipts.
5. Add model-assisted proposals in shadow mode, then reviewed authoring.
6. Ship the packet registry, Evidence API, embeddable inspector, and federation profile.

## Non-goals for Alpha

- truth certification;
- autonomous investigation;
- automated source-independence verdicts;
- universal ontology design;
- engagement optimization;
- public identity dossiers; and
- production-scale model inference.

---

*Preserve the thing. Expose the chain. Version the meaning.*