Carry per-field provenance to every displayed value

[jacobdrees]

Parent

CAN-17 v1: the walking skeleton in production, then the founding case

What to build

Every displayed value carries which Source it came from, at field granularity.

ADR-0014
Decision 9 — per-field provenance on every displayed value is the decision.

Provenance is not attribution

The two are separate obligations and this project has been carrying only one of them by name.
Attribution credits a Source. Provenance says which Source a particular field came from, and a
composed read mixes several.
CAN-105 Carry each Source's attribution obligation through to every surface that displays it
is the attribution ticket; this is the mechanism underneath it, and neither substitutes for the
other.

Three obligations, one mechanism

ADR-0014 records that one mechanism discharges three things that would otherwise need three:

1. TMDB §3 attribution — the logo plus the prescribed notice, a condition of the licence
   rather than a courtesy: §1.B lists it among the Additional License Conditions.
2. Licence obligations across the keyless Sources — including "none". TVmaze and the Grand
   Comics Database are CC BY-SA 4.0; tardis.wiki is CC BY-SA 3.0, licence-only since
   16 August; ISFDB is CC BY 4.0; Open Library and MusicBrainz core are CC0, requiring noattribution** (and Open Library's grant is unverifiable live). Attribution renders per
   source**, and provenance must record the licence identity so "none" is provable. Research
   §11 puts it plainly: per-record provenance is required by the licences, not merely convenient.
3. Cross-viewer misattribution.
   ADR-0003's
   Placements resolve against whichever records the viewer holds, so a published Ordering shows the
   reader values from the reader's own Sources. Without provenance on the value, an Ordering's author
   appears to have asserted something a stranger's Source actually said.

Why field granularity, and why it cannot be added later

Per record is not enough. The composed read picks field by field across Sources by configured
order (ADR-0004),
so a record-level credit is simply false for the fields the other Source won.

And it cannot be flattened later. Research §11 shows proprietary terms and CC BY-SA contradict
directly in one aggregate, and that segregation with per-record provenance is the only coherent
answer. ADR-0004's (record, source) key already provides the substrate — which is a reason not to
collapse the overlay for convenience, however much a single denormalised table would simplify the
read.

Prior art worth taking, from ADR-0014: Calibre-Web is the only surveyed product carrying
per-record provenance at all, as MetaSourceInfo(id, description, link).

Acceptance criteria

• Every value the composed read returns carries the Source it came from, at field granularity.
• A record composed from two Sources reports each field's own Source, not the record's dominant one.
• An owner-authored Override reports the owner as the origin, distinguishably from any Source.
• supersededValue is not treated as owner-authored, since ADR-0004 makes it by construction a verbatim copy of Source content.
• Provenance is available to the rendering layer, so CAN-105 Carry each Source's attribution obligation through to every surface that displays it can attribute per field rather than per page.
• A test asserts the cross-viewer case: a reader opening another person's public Ordering sees values attributed to the reader's own Sources, and the author is not shown as having asserted them.
• CONTEXT.md gains provenance as a defined term, distinct from attribution.

Blocked by

• CAN-7 Provider contract: define and publish it — a Source identity that means anything across Providers is contract state.

Amended 16 August 2026

Item 2's licence roster corrected — the previous wording (inherited from CAN-96 Record the architecture decisions of 15 August, and make the repository agree Record the architecture decisions of 15 August, and make the repository agree, and from ADR-0014 Decision 9 item 2, both being corrected) called every keyless Source share-alike; two are CC0. Under CAN-116 Make the tracker agree with the 16 August verification sweep Make the tracker agree with the 16 August verification sweep.