MODEL · STRUCTURE & LINEAGE
One chain, six objects. Every judgement can name its ancestors.
A judgement is admissible only if it walks back to signed words. Each link carries what the built system learned, and how it would be shaped on a clean slate.
BREAK ANY LINK AND THE JUDGEMENT BELOW IT IS WITHOUT STANDING
THE CHAIN · SELECT A LINK
01 · COUNTERPARTY
LINK 1 OF 6
WHAT IT CARRIES
Legal identity, jurisdiction, and the agreements in force with them. Nothing else — trust scores, history and intel are derived views, not part of the party.
AS BUILT
Party and supplier grew as separate ideas; the supplier record accreted contacts, trust scores and spend history as features demanded them. Identity and reputation live in one object.
CLEAN SLATE
One party object, identity only. Reputation, spend and history hang off it as derived, dated views. A counterparty is who you agreed with, not what you think of them.
counterparty
02 · AGREEMENT
LINK 2 OF 6
WHAT IT CARRIES
The document of record, its parties, its effective window and its amendment chain. An amendment is a new document citing the old — the agreement is the chain, not the latest file.
AS BUILT
Agreements and their documents arrived together; amendments were layered on later, so current terms are computed by application code walking versions.
CLEAN SLATE
Amendment-first: the agreement is an append-only chain of documents from day one. Current terms is a materialised view of the chain at a date — the same shape as the ledger.
counterparty → agreement
03 · CLAUSE
LINK 3 OF 6
WHAT IT CARRIES
The quoted words, the page and reference they came from, the effective window, extraction confidence, and who — holding what delegation — authorised the reading.
AS BUILT
Extraction confidence and human approval were bolted on after the first misread taught the lesson: a clause nobody authorised is an opinion.
CLEAN SLATE
A clause is inadmissible until authorised — not a flag, a state. Unauthorised extractions live in a separate staging object and can never be cited by a rule.
counterparty → agreement → clause §ref
04 · RULE
LINK 4 OF 6
WHAT IT CARRIES
The predicate and verdict, a version, and a pointer to exactly one clause. A rule with no clause behind it is policy invented by the machine — forbidden.
AS BUILT
Rules began as an authority policy blob — caps, ceilings, condition lists — one object holding many rules. Versioning and per-rule clause pointers came later.
CLEAN SLATE
No policy blob. Every rule is its own versioned object with one clause pointer; the policy is just the set of rules in force. All money in minor units from line one.
counterparty → agreement → clause §ref → rule vN
05 · JUDGEMENT
LINK 5 OF 6
WHAT IT CARRIES
The event as presented, the rule version that fired (if one did), the verdict — ALLOW · ESCALATE · DENY · HELD — exposure, and the trace that lets anyone replay it.
AS BUILT
Evaluations record the fired rule, if any, and the agreement plus a matched-rules audit blob: enough to reconstruct, but reconstruction is work. Human decisions live in a parallel object.
CLEAN SLATE
One judgement object for machine and human alike — a human decision is a judgement whose actor is a person holding a delegation. One verdict vocabulary, closed, everywhere.
… → rule vN → judgement · verdict · trace
06 · ENTRY
LINK 6 OF 6
WHAT IT CARRIES
The judgement, appended after the entry before it. Corrections are new entries citing old ones. Entries are appended, never edited.
AS BUILT
Timeline events and the audit log grew side by side: one for showing people, one for proving. Two histories that must be kept honest against each other.
CLEAN SLATE
One ledger. The timeline people read is a projection of the chain, never a second record. If a surface needs a friendlier shape, it derives it — it never writes it.
… → judgement → entry #n · follows #n−1
The chain is the product. Surfaces come and go; an unbroken line from signed words to written entry is what a counterparty cannot argue with.
A MODEL, NOT A SCHEMA · NOTHING HERE BINDS A COLUMN NAME