Grounding a claim to a document
A claim in this practice can name the document it rests on, and the words it rests on can be checked against that document by a machine. That is what the middle trust grade is made of, and it is worth building properly, because it converts trust in an assistant's reading into trust in a string search. What follows is the machinery in buildable detail: the store of originals, the record a claim carries, the comparison itself, and the rule about who may run it. Every part is ordinary. The design is in where each part sits, not in what it is.
The store
The store holds original documents, unchanged: regulation as published, bought and open standards, official guidance, research. The test for admission is strict in one specific way. The file must be the official published artefact, the thing the issuer put its name on. A page saved from a browser is not that. Neither is the payload a site's scripts assembled, nor a machine translation. Those can be kept, but not here, because the store's contents back a promise: that the exact words a claim quotes exist in an authority's own document.
One consequence is worth stating because it surprises. Some sources have no ownable form at all. A consolidated law text maintained as a living web page is one. There is no published file to hold, so a claim about the current consolidated state can never rise above the floor grade. It verifies against the live page at the moment of checking, and that is all it can earn.
The catalogue makes the store usable. One row per document: what it is, where it sits, its version, and a checksum of the file. The checksum is what lets a later check confirm the file is still the one that was admitted, before any words are compared against it. The catalogue is version-controlled alongside the notes. The documents themselves are not. They are large, they never change, and the checksum row is their representation in the record. Paths are part of the contract too: a claim points at a document by its path, so the naming scheme is fixed up front, a class, an issuer, a file, even though folders appear only as documents land. A path that moves breaks every claim that cites it.
Keeping the documents locally is not archival habit. A link can rot, a page can be revised in place, and a check against either inherits that instability. A held file with a checksum resolves the same way every time, which is what lets the verification further down this page be mechanical.
The claim record
A note that carries facts names its ground in its own header, in fields a script can read. A grade is never stored directly. It is read off these fields, which is what keeps a grade from drifting apart from the thing it grades.
The pointer field names the held document by its path in the store, and there is deliberately only one. A note resting on several sources still names a single primary anchor there and lists the rest in its body beside the claims they support, because a single field cannot grade a mixture. Tools read the field, people read the body. The pointer is also the middle grade itself: a claim whose header carries it is asserting that its quoted words were matched against that document. The rule that makes the assertion mean something is that the pointer is set only after the comparison below has run and passed. Set any other way, it is exactly the drift the census at the end of this page exists to count.
The status field carries maturity. A note is born a draft and says so. The one flip that matters is the top grade: a person checked the facts against the source by eye and endorsed the reasoning as their own. Two acts, one flip. Beside that status sit two evidence fields, who validated and when, and a top-grade note missing them is a contradiction a script can catch.
A claim still waiting for judgment carries one more field: where it came from. Model memory, the web and a held document are different starting points with different failure modes, and the tag is honest about which one produced the claim. It drops at promotion. A validated note no longer needs to confess its origin.
Nothing here needs tooling to adopt. Five header fields and the discipline of setting them at the moments named carry the whole grading story, and everything later on this page is either a check of those fields or a read over them.
The match
The comparison is two checks and a disposition, and the order is fixed. First the file: the held document's checksum is computed and compared against its catalogue row. That settles that the file is still the one that was admitted, and every later step assumes it. Then the words: each claim is carried as a verbatim quote with a locator, and each quote is searched for in the file as literal bytes. A string search is indifferent to fluency, has no prior to prefer, and returns found or not found.
The quote requirement upstream is what makes the search possible, and it is the interface rule everything else leans on: quote, do not paraphrase. A paraphrase cannot be searched for. Asking for the literal string also has a second effect worth as much as the search itself. Exact bytes are hard to produce from memory. An assistant that read the source can quote it. One completing from prior knowledge produces something quote-shaped instead, and the failed match is the tell that the source was never read.
The obvious cheaper design is to have the assistant read the source again and confirm. It does not work, and the reason is structural. A model has no internal switch between reading the bytes in front of it and completing from what it already believes, and no way to report which one it did. A corrupted reading re-confirms itself, fluently. So the one step that cannot be faked is the step that does not involve the faculty being audited at all. The byte appears in the file or it does not.
The disposition is binary and forced. Every quote found: the pointer lands in the claim record and the run is recorded. Any quote missing: no pointer, the gap is flagged, and the claim stays at the floor, marked. A quote that fails the search means the reading was wrong or the claim was a paraphrase after all. Both are exactly what the machinery exists to catch, and neither is an emergency, because a claim at the floor is allowed to exist. Only the unearned grade is barred.
The same comparison runs at two moments. When a claim's pointer is first set, and again at the boundary when work carrying the claim is about to leave for an audience. One mechanism, two firing points. The early firing is what keeps the late one small.
Run from outside
Who runs the comparison matters as much as what it compares. The rule is that the party that produced the claim never runs its own check. In practice that means a separate session or a reader spawned for that one purpose, holding nothing of the work that made the claim, fed only the note and the file.
The reason is that self-certification is invisible. A pointer set on the strength of the tagging work's own reading looks identical, in the record, to one set after an independent run. Nothing in the output distinguishes them, so the discipline has to live in the process. The drift signal is visible, though: a check that closes with "reading confirmed" and no quoted bytes attached is the old, fakeable form reappearing, and it should never close a row.
The same rule extends upward. The top grade's judgment cannot be delegated, but its preparation can: an independent reader may assemble the evidence for a long source, each claim beside its verbatim quote and locator, with the disagreements flagged. What it may never do is flip the status. The evidence arrives, the person rules. That boundary is the top grade's whole meaning, and a tool that crossed it would quietly turn the human act into a rubber stamp.
The ledger and the census
A run that passes leaves two marks. The pointer lands in the claim record, and the run itself is recorded: which claims, against which file, with what outcome. The record of the claim and the record of the check are kept apart on purpose. A grade readable in a note is an assertion. The run records are where the assertion's evidence lives.
The census closes the loop. At the start of every working session a script reads the header of every fact-carrying note and prints the state of the base: how many notes stand at each grade. It is nothing but a header scan, which is the payoff of the claim record's design, and it costs nothing to run. No database, no dashboard, no ceremony. The state of trust in the base appears in front of the operator at every session start.
Two further lines in that printout are staleness signals, and their honest strength matters. The first counts top-grade notes missing their evidence fields: trust claimed with nothing attached. It should read zero, and a rising count is the signal to act. The second counts middle-grade pointers with no recorded run behind them. That line says the evidence is missing, not that the check never ran, and certainly not that it did. It is a pointer at where to look, and reading more into it than that would be dressing a staleness count as a verdict.
The census gates nothing. It refuses no write and blocks no commit, and that is deliberate: the base is allowed to be mostly unchecked, because checking follows use. What is not allowed is for the unchecked surface to be invisible. The census exists so that the unchecked share is a number anyone can read at any time.
The case that shaped it
One case is worth telling in full, because it shows the failure class the string search exists for, and how gently the system catches it.
Early notes summarising an owned policy document carried two claims that read perfectly well. One expanded an acronym into its component principles. The other described the document's structure as a set of named pillars. Both were fluent, specific and plausible, and both were wrong. The expansion was not the document's, and the pillars did not exist in it at all. The assistant had met a real document and completed it from prior knowledge of how documents like it usually look.
Nothing about the notes flagged them. They sat at the floor grade, honestly tagged, doing no harm. The failure surfaced only when the claims were promoted: checked against the held document, there was nothing in it to support them. The promotion attempt was the detector. No suspicion was involved, and re-reading by the instance that wrote them would not have surfaced them. They were caught because a grade was asked for, and the grade has a mechanical price.
The second lesson in the case: caught on the way up, not barred at the door. The wrong claims entered the base at the floor and lived there safely. A system that tried to stop them at capture would need the check to run at the moment of writing, which is exactly when volume is highest and attention is elsewhere. Grades that promote let the checking happen at the moment someone wants to rely on the claim, which is the only moment it matters.
What the match cannot settle
The machinery on this page closes exactly one question: does the document say it. It cannot close the next one: does the conclusion drawn from it hold. An assistant can quote a source perfectly and then reason away from it, and every check described here passes while that happens. That residual is not a defect in the match. It is the boundary of what mechanical checking can be. The factual half of trust is closeable by machinery, and this page is that machinery. The interpretive half is closed only by the top grade's human act, which is why that act exists and why nothing on this page is allowed to perform it.
Stated as what the system buys: above the floor, every grade leaves a trail behind it, and below the top, no claim can pretend to a grounding it does not have. What no grade short of the top asserts is that the thinking is right.
The grades themselves are on the trust page. How checking is allocated across a working week is on where attention goes. The procedure for auditing a finished piece of work is the audit recipe.