Provenance-First, Fail-Forward Editorial Pipeline for the InternationalIntelligence.org Daily Brief

Full report

On this page

Executive recommendation, scope, and recent context

Recommendation. Rebuild the Daily Brief workflow around an immutable candidate evidence ledger, not around successive provider responses. Research outputs should be normalized into stable candidate, claim, and source records immediately; every subsequent stage should consume those records by identifier. Accepted evidence must survive failed supplementation, composition, translation, validation, publication, and process restarts.

The resulting system should have five governing properties:

1. Provenance before prose. Claims, sources, retrieval observations, transformations, and validation decisions are persisted before narrative generation.
2. Fail forward rather than restart. A failure quarantines the smallest defective unit—claim, source binding, candidate, language rendering, package, or publication pointer—while retaining all validated work.
3. Claim-level evidence control. An event does not merely have “sources”; each publishable factual clause must bind to one or more specific source records.
4. One semantic edition, two language renderings. English and Spanish are generated from the same immutable event-and-claim records and then checked for semantic parity.
5. Atomic, idempotent publication. Readers see either the complete validated bilingual edition or the prior state, never a partially promoted edition.

This report assumes the publication characteristics and failure possibilities stated in the supplied project brief. It does not assume access to or inspection of source code, repositories, prompts, credentials, production records, operator interfaces, or private candidate data. The previously described fourteen-candidate/ten-event pattern is treated as an example capacity contract, not a universal editorial optimum.

The design is grounded in several complementary traditions. W3C PROV distinguishes entities, activities, and agents, with explicit derivation and generation relationships; that is a suitable conceptual model for connecting retrieved sources, research passes, candidate records, compositions, and editions. The Berkeley Protocol emphasizes professional identification, collection, preservation, verification, analysis, and documentation of digital open-source information. IPTC NewsML-G2 provides established patterns for provider identity, item metadata, versioning, event status, packages, and controlled news vocabularies.

Recent LLM research also shows why retrieval alone is insufficient. ALCE found substantial gaps in citation completeness even among strong systems; FActScore demonstrated the value of decomposing prose into atomic factual claims; and RAGTruth documented that retrieval-augmented models can still produce unsupported or contradictory statements. NIST’s Generative AI Profile accordingly emphasizes lifecycle risk management, evaluation, documentation, and testing rather than reliance on a single model response.

Key stakeholders are the research provider, local ingestion and normalization services, editorial policy owners, validators, English and Spanish compositors, professional language reviewers, publication infrastructure, correction administrators, and ultimately readers. Responsibilities should be recorded by component or service identity; human reviewers should be recorded by role and review action without exposing unnecessary personal data.

timeline
    title Relevant methodological and standards developments
    2020 : Berkeley Protocol establishes professional digital open-source investigation principles
    2021 : C2PA begins standardizing signed content provenance
    2023 : NewsML-G2 adds generative-AI source metadata
         : ALCE and FActScore formalize citation and atomic-fact evaluation
    2024 : NIST publishes its Generative AI Risk Management Profile
         : RAGTruth benchmarks hallucination in retrieval-augmented systems
    2025 : NewsML-G2 2.35 adds explicit event status
         : C2PA 2.2 strengthens manifest validation and ingredient models
    2026 : C2PA 2.3 expands provenance support to text and live video
         : Berkeley research emphasizes power, ethics, and methodological humility

The timeline reflects official releases and peer-reviewed work from 2020 through 2026. C2PA 2.3, released in late 2025 and publicly launched in 2026, added support including unstructured text, richer editing history, and improved validation; IPTC’s latest documented NewsML-G2 version is 2.35, approved in May 2025.

Comparison of principal source frameworks

The source comparison is based on the relevant standards and institutional guidance. Reuters states that accuracy and balance take precedence over speed and requires transparent corrections and honest sourcing; AP and AFP likewise emphasize named sources, extra corroboration for anonymous claims, and visible evidence trails.

Evidence model, controlled states, and canonical schemas

The canonical data model should separate four objects:

• Candidate event: the editorial unit being considered.
• Atomic claim: one independently assessable factual proposition.
• Source record: one retrieved or provider-referenced evidence object.
• Binding: an assertion that a source supports, contradicts, contextualizes, or merely attributes a claim.

A source is not “evidence for the whole event” by default. A government announcement can prove that the government announced something, but not necessarily that the announced underlying condition is true. Likewise, an analyst article may support interpretation but cannot silently be promoted into proof of an underlying fact.

Controlled evidence vocabulary

The distinction between a fact and an attributed statement reflects standard journalism practice: AP requires disputable secondhand facts to be attributed and generally requires additional independent confirmation for anonymous sourcing; AFP requires at least two independent information sources for the central claim of a fact-check.

A concise canonical record could be represented as follows. Production implementation should use a versioned JSON Schema, database constraints, controlled enumerations, and immutable append-only audit records.

candidate_event:
  candidate_id: "cand_2026-08-01_7f43c2"
  target_date: "2026-08-01"
  research_pass_id: "rp_20260801T041500Z_02"
  research_request_fingerprint: "sha256:..."
  created_at: "2026-08-01T04:18:43Z"

  event_time:
    value: "2026-07-31T18:30:00Z"
    precision: "hour"          # exact|minute|hour|day|month|range|unknown
    timezone_basis: "UTC"
    uncertainty:
      status: "bounded"
      earliest: "2026-07-31T18:00:00Z"
      latest: "2026-07-31T20:00:00Z"
      note: "Official release gave local evening only"

  editorial:
    headline_fact_pattern: "Organization announced action affecting country"
    factual_summary: "Canonical, language-neutral proposition set"
    countries: ["ISO-3166 code"]
    regions: ["controlled-region-code"]
    organizations: ["entity_id"]
    people: []                 # only when editorially necessary
    topic_tags: ["controlled-topic-code"]
    geographic_representation:
      primary_region: "..."
      secondary_regions: []
      cross_border: true

  claims:
    - claim_id: "clm_..._01"
      proposition: "Atomic normalized proposition"
      evidence_state: "official_statement"
      materiality: "headline"
      uncertainty: "The implementation date has not been confirmed"
      source_bindings:
        - binding_id: "bind_01"
          source_id: "src_01"
          relation: "supports_statement_occurrence"
          locator: {paragraph: 4}
          support_scope: "full"
      corroboration:
        independent_group_count: 1
        weighted_score: 1.0

  sources:
    - source_id: "src_01"
      title_observed: "Observed title at access time"
      publisher_observed: "Publisher"
      url_observed: "https://..."
      canonical_url: "https://..."
      publication_time: "2026-07-31T18:15:00Z"
      access_time: "2026-08-01T04:17:00Z"
      source_class: "official_release"
      primary_secondary: "primary"
      language: "en"
      redirect_chain: []
      provider_citation_reference: "provider-ref-7"
      claim_bindings: ["bind_01"]
      correction_update_status: "unchanged"
      independence_group: "ig_official_org_release_20260731"
      content_fingerprint: "sha256:..."
      archive_reference: "archive-id-or-null"

  validation:
    evidence_status: "conditionally_selectable"
    corroboration_count: 1
    source_independence_assessment: "single interested-party origin"
    duplicate_fingerprint: "sha256:normalized-event-key"
    near_duplicate_fingerprint: "simhash:..."
    editorial_risk_flags: ["official_only"]
    language_status:
      canonical_terms_ready: true
      english: "not_composed"
      spanish: "terminology_review_required"
    retention_status: "accepted_with_condition"
    rejection_reason: null
    validation_version: "validation-policy-3.2.0"
    correction_status: "none"

The research request fingerprint should hash a canonical representation of the target date, research window, region and topic requirements, excluded candidate IDs, deficit specification, source-policy version, and provider configuration. It prevents accidental replay from masquerading as a new pass and makes cost attribution auditable.

Claim-to-source binding model

A binding needs more than a boolean:

{
  "binding_id": "bind_01",
  "claim_id": "clm_01",
  "source_id": "src_02",
  "relation": "supports",
  "support_scope": "partial",
  "supported_elements": ["actor", "action", "date"],
  "unsupported_elements": ["reported_magnitude"],
  "contradiction": false,
  "source_locator": {
    "section": "Results",
    "paragraph": 6,
    "quoted_span_hash": "sha256:..."
  },
  "validator": "claim-binding-validator-2.1",
  "validated_at": "2026-08-01T04:25:00Z",
  "confidence": "high",
  "audit_note": "Magnitude appears only in involved-party statement"
}

The prose compositor should receive normalized claim objects, not full unbounded source pages. This reduces the opportunity to import extraneous details. Atomic-claim decomposition is consistent with FActScore’s finding that long-form text often mixes supported and unsupported information and therefore cannot safely be assessed with one binary document judgment.

flowchart LR
    S1[Source record src_01] -->|supports statement occurrence| C1[Claim clm_01]
    S2[Source record src_02] -->|corroborates action| C2[Claim clm_02]
    S3[Source record src_03] -->|contradicts magnitude| C3[Claim clm_03]
    RP[Research pass] -->|generated| E[Candidate event]
    C1 --> E
    C2 --> E
    C3 --> E
    E -->|validated by policy version| V[Validation record]
    V -->|selected into| ED[Edition event]
    ED --> EN[English rendering]
    ED --> ES[Spanish rendering]
    EN --> PKG[Immutable publication package]
    ES --> PKG
    PKG -->|revision of, if corrected| PKG2[Correction revision]

This graph follows the W3C PROV principle that derived entities, generating activities, and responsible agents or systems remain explicitly connected rather than being overwritten during transformation.

Source independence and URL-to-citation reconciliation

Independence grouping

The system should count independent evidence origins, not URLs or articles. Every source belongs to an independence_group representing the earliest identifiable reporting or evidence origin on which it materially depends.

Use two outputs:

• A categorical origin_relationship.
• A numerical independence_weight used for portfolio diagnostics, never as a substitute for a mandatory corroboration gate.

The grouping algorithm should extract explicit attribution phrases, bylines, wire labels, canonical links, text similarity, named documents, quoted-source overlap, publication chronology, and source URLs embedded in the article. It should then create a dependency graph and select the earliest disclosed origin. Text similarity alone may detect syndication, but it cannot prove independence; unknown lineage should remain independence_uncertain.

AFP’s published methodology requires at least two independent information sources for a central fact-check claim and records links, screenshots, photographs, and archived evidence so readers can reproduce the process. Reuters warns against plural sourcing when there is only one source, while AP says reports from other news outlets based on anonymous sources require particularly careful scrutiny and, where possible, confirmation through the newsroom’s own reporting.

An official statement and an independent report can belong to different groups, but their evidentiary roles differ:

• The official source supports “the ministry announced X.”
• The independent report may support “X occurred.”
• Ten articles repeating the ministry’s announcement still provide only one origin for the underlying claim.

URL and citation reconciliation

URI standards permit some syntax normalization—such as lowercasing scheme and host and normalizing unreserved percent encodings—but warn that apparent URL differences cannot always be resolved by string comparison alone. Google likewise identifies HTTP/HTTPS, mobile, regional, and other variants as common duplicate-page patterns but treats canonical declarations as signals rather than infallible proof.

HTTP redirect status classes identify that additional action is required, but the pipeline should preserve every hop rather than retaining only the destination. The Internet Archive’s own guidance notes that Save Page Now captures a specific page and may not preserve all linked or embedded resources, so an archive reference should complement—not replace—locally stored retrieval metadata and hashes.

Fail-forward retention, deficit calculation, and supplemental research

The durable unit of progress should be the accepted candidate, not a provider response or a complete edition attempt.

flowchart TD
    R[Initial research request] --> N[Normalize candidates and sources]
    N --> LV[Local deterministic and editorial validation]
    LV -->|accepted or conditional| L[(Immutable candidate ledger)]
    LV -->|rejected| Q[Rejected-candidate audit store]
    L --> D[Compute explicit portfolio deficits]
    D -->|no material deficits| S[Select candidate IDs]
    D -->|repairable deficits| SR[Targeted supplemental request]
    SR --> M[Idempotent merge and duplicate detection]
    M --> LV
    S --> C[Constrained bilingual composition]
    C --> FV[Final clause, parity, and package validation]
    FV -->|isolated defect| TR[Targeted repair or candidate quarantine]
    TR --> FV
    FV -->|pass| P[Atomic publication]
    C -->|provider failure| RC[Retry composition from ledger without web research]
    RC --> FV

Retention rules

• Persist the raw provider payload, normalized records, source observations, bindings, and validation results as separate versioned objects.
• Once a candidate passes mandatory local gates, mark it accepted, accepted_with_condition, or accepted_pending_portfolio; do not return it to an unvalidated state when new research arrives.
• Supplemental results are merged by stable candidate ID where supplied, then by exact duplicate fingerprint, then by near-duplicate review. Merge is idempotent: replaying the same result produces no new candidate or source.
• New evidence may upgrade or downgrade a candidate, but it must append a new validation decision; prior decisions remain visible.
• Composition failure changes only composition-attempt state. It must never delete research, source mappings, or candidate validation.
• A restart resumes from persisted stage checkpoints and idempotency keys. No stage assumes that an in-memory response is authoritative.
• An old event cannot satisfy a current deficit merely because its topic or geography fits. Date relevance is a mandatory event-level gate, not a portfolio preference.

Measurable deficit model

Thresholds should be policy-configurable by target date and edition size. A reasonable initial policy for a routine edition of N = 10 events is shown below.

Supplemental prompts should be generated from a structured deficit object:

{
  "target_date": "2026-08-01",
  "deficit_id": "def_missing_corrob_04",
  "need": "independent corroboration",
  "claim_ids": ["clm_cand43_02"],
  "existing_candidate_ids": ["cand_43"],
  "excluded_duplicate_fingerprints": ["sha256:..."],
  "acceptable_source_classes": [
    "independent_original_reporting",
    "primary_public_record",
    "direct_observation",
    "original_dataset"
  ],
  "do_not_return": [
    "press-release repetitions",
    "wire republications",
    "search snippets",
    "previously accepted sources"
  ],
  "max_results": 4
}

This prevents the supplemental stage from rediscovering the entire day’s news. Cost and latency should be tracked per deficit and per accepted evidence increment: for example, “one new independent corroboration group added,” rather than “provider call succeeded.”

Quality gates, composition contract, and bilingual parity

The system should reject the idea of one opaque quality score. A candidate with an unsupported headline cannot compensate by having excellent regional diversity; an edition with perfect citations cannot compensate for English–Spanish factual divergence.

Gate matrix

Reuters’ standards make accuracy and balance prior to speed, while AP requires fair efforts to obtain responses from parties portrayed negatively and transparent correction of mistakes. The Berkeley Protocol and subsequent guidance also emphasize ethical, legal, physical, and psychosocial risks, making safety review more than a purely factuality-oriented gate.

Bilingual architecture

Use a hybrid structured approach:

1. Build one language-neutral canonical event record containing atomic claims, source bindings, evidence states, numbers, dates, actors, uncertainties, and correction status.
2. Generate English and Spanish as separate renderings from that same record, preferably with separate constrained calls or deterministic templates.
3. Run a structural and semantic parity validator.
4. Route high-risk Spanish content to professional review.

Generating the two versions independently from the same semantic record is safer than translating unconstrained English prose: neither language becomes the evidentiary authority, and an English embellishment is less likely to propagate automatically. Generating both in one unconstrained model response, however, can permit shared hallucinations and malformed cross-language structures. Therefore the composition job should share inputs and identifiers but isolate the renderings.

Both versions must have identical:

• event_id, target date, event ordering, claim IDs, evidence state, source IDs, numbers, units, dates, time-zone interpretation, actor roles, negations, uncertainty class, and correction status.

They may differ in idiom, sentence order inside an event, explanatory context approved in the canonical record, and language-appropriate terminology.

Composition contract

{
  "input": {
    "edition_id": "edition_2026-08-01_draft_03",
    "target_date": "2026-08-01",
    "ordered_candidate_ids": ["cand_01", "cand_07"],
    "candidate_records": "validated-records-only",
    "allowed_claim_ids": ["clm_01", "clm_02"],
    "allowed_source_ids": ["src_01", "src_02"],
    "web_research_authorized": false
  },
  "output_rules": {
    "new_events_allowed": false,
    "new_claims_allowed": false,
    "new_sources_allowed": false,
    "unsupported_quotes_allowed": false,
    "headline_max_characters": 110,
    "summary_max_words_per_language": 95,
    "required_languages": ["en-US", "es"],
    "strict_schema": "daily-brief-composition-4.0"
  },
  "event_output": {
    "event_id": "stable",
    "claim_ids_used": [],
    "source_ids_used": [],
    "evidence_state": "unchanged",
    "uncertainty_text": {
      "en-US": "...",
      "es": "..."
    },
    "headline": {"en-US": "...", "es": "..."},
    "summary": {"en-US": "...", "es": "..."}
  }
}

The compositor may omit a nonmaterial claim to meet length limits, but it cannot add, merge, reinterpret, or strengthen claims. Quotations should be disabled by default; when allowed, the exact quote, speaker, language, source locator, and translation status must already exist in the canonical record.

Automated parity tests

Professional Spanish review remains essential for allegations, criminal or legal terminology, indigenous and regional names, disputed territories, political titles, gender-sensitive language, culturally loaded verbs, quotations, ambiguous pronouns, and sentences where small aspect or mood changes could alter certainty. Automated translation metrics are not evidence that two publication records make exactly the same claims.

Final validation, targeted repair, and failure-mode containment

Final validation should re-derive atomic clauses from the rendered English and Spanish text and compare them with the canonical claim set. This should be a closed-book check: the validator is allowed to use the candidate ledger and approved source snippets but not to browse for facts that would retroactively justify composition.

Required checks include:

• Unsupported factual clauses or newly introduced causal language.
• Citation loss or citation attached to the wrong claim.
• Headline wording stronger than the underlying evidence state.
• Unexplained acronyms and ambiguous organizations.
• Event-date, publication-date, relative-date, or time-zone errors.
• Exact and near-duplicate events.
• Portfolio region, topic, publisher, and origin concentration.
• English–Spanish divergence.
• Fabricated, altered, or unattributed quotations.
• Overstated certainty or omitted allegation attribution.
• Missing “what is unknown” language.
• Missing source metadata, invalid source IDs, or failed URL checks.
• Event-count mismatch.
• Different English and Spanish event-ID sets or ordering.

ALCE’s citation findings and RAGTruth’s annotated examples support treating citation presence and claim support as distinct checks: a response can contain citations while still making unsupported or contradictory claims.

Repair ladder

Hard boundary: automatic repair must never introduce a source, change a date or number, decide which conflicting account is true, upgrade an evidence state, translate an unverified quotation, infer an actor’s motive, resolve a legal allegation, or replace a rejected candidate with an unvalidated one. Crossing that boundary requires returning to the relevant evidence or human-review stage.

Failure-mode analysis

A simple state machine should prohibit regressions such as published → researching or accepted → absent. Permitted transitions should be explicit—for example, accepted → superseded_by_correction, composition_failed → composition_retrying, and package_prepared → package_promoted.

Atomic publication, corrections, and phased implementation

The publication package should be a self-contained immutable directory or object-store prefix:

edition-2026-08-01-r0/
  manifest.json
  edition.en-US.json
  edition.es.json
  source-map.json
  provenance.json
  validation-report.json
  hashes.json

manifest.json should contain:

{
  "edition_id": "brief_2026-08-01_r0",
  "target_date": "2026-08-01",
  "revision": 0,
  "schema_version": "daily-brief-package-4.0",
  "process_id": "proc_...",
  "publication_time": "2026-08-01T11:00:00Z",
  "event_ids": ["evt_01", "evt_02"],
  "languages": ["en-US", "es"],
  "content_hash": "sha256:...",
  "correction_status": "original",
  "supersedes": null
}

Publication protocol

1. Build the complete package in a temporary location on the same storage boundary used for promotion.
2. Validate every file against its schema and verify internal IDs.
3. Verify English–Spanish claim, source, event-order, date, number, and correction parity.
4. Verify that every citation resolves to an existing source record and every source binding resolves to an approved claim.
5. Compute per-file hashes and a package-root hash over a canonical manifest.
6. Insert or update a prepared publication record using an idempotency key such as (target_date, revision, package_hash).
7. Atomically promote the temporary package to its immutable public location or commit the corresponding object-store pointer.
8. Update the public supervisor pointer using compare-and-swap or a serializable database transaction.
9. Treat a repeated request with the same idempotency key as a successful no-op.
10. Run a reconciliation check that the public pointer, database status, and package hash agree.

Database transactions provide the all-or-nothing behavior required for related state changes; PostgreSQL documentation defines a transaction as atomic from the perspective of other transactions. Where filesystem promotion is used, implementation must verify the platform’s same-filesystem atomic replacement semantics and separately ensure durability; atomic visibility alone is not the same as crash-safe persistence.

Inconsistency recovery

• Package promoted, supervisor update failed: read the immutable package manifest, verify its hash and prepared record, then complete the supervisor update. Do not rebuild or republish.
• Supervisor points to missing or invalid package: automatically revert the pointer to the last verified package, mark a critical incident, and quarantine the attempted revision.
• Database committed as prepared, promotion failed: retain the temporary package if valid and retry promotion under the same idempotency key.
• Two workers race: unique constraints on target date and revision plus compare-and-swap on the supervisor pointer permit only one winner.
• Same package requested again: return its existing edition ID and publication status without generating another edition.

Correction lifecycle

The original edition is never overwritten. A correction creates revision r1, r2, and so forth, each with:

• The original edition ID and prior revision hash.
• Changed claim IDs and event IDs.
• Before-and-after normalized propositions.
• Reason, discovery time, approval time, and responsible review role.
• Old and new source bindings.
• Whether the correction affects headline, summary, evidence state, or event selection.
• Matching English and Spanish correction notes.
• A public explanation written in plain language.

The reader-facing default may point to the latest revision, but every revision remains addressable and the correction notice links the versions. AP requires corrections to be explicitly labeled rather than disguised as routine edits; Reuters and SPJ likewise call for prompt, clear, visible correction.

Implementation roadmap

Foundation phase. Define controlled vocabularies, JSON Schemas, stable-ID rules, canonical hashing, append-only attempt logs, and migration adapters for existing candidate artifacts. Implement raw-response retention and source normalization first.

Evidence phase. Add atomic claims, source records, binding locators, independence grouping, URL reconciliation, retrieval snapshots, duplicate fingerprints, and deterministic event validation.

Fail-forward phase. Add accepted-candidate checkpoints, explicit deficit calculations, scoped supplemental requests, idempotent merge behavior, restart recovery, and stage-level quarantine.

Composition phase. Implement the closed composition contract, independent English and Spanish renderers, terminology registry, clause extraction, citation validation, and parity checks.

Publication phase. Build immutable packages, hash manifests, atomic promotion, supervisor reconciliation, no-op duplicate publication, and revisioned corrections.

Evaluation phase. Run deterministic fixtures, shadow the existing pipeline, compare evidence-retention and publication-success metrics, and enable automated publication only after mandatory acceptance criteria are met.

IPTC’s current NewsML-G2 documentation and its production-ready Python tooling can inform identifiers, package metadata, versions, and event state without requiring the internal schema to reproduce the full standard. C2PA could later sign published packages or individual assets, but such signing should be treated as an authenticity and integrity layer rather than proof that editorial claims are correct. C2PA itself distinguishes manifest validity and provenance from broader trust judgments.

Deterministic fixtures, worked examples, benchmarks, and acceptance criteria

Synthetic worked examples

The following examples are deliberately synthetic and are not claims about real events.

Fully acceptable event

candidate_id: cand_synth_001
event: "Country A's central bank changed its policy rate on the target date."
claims:
  - claim_id: c1
    proposition: "The central bank raised the policy rate from 4.00% to 4.25%."
    evidence_state: independently_corroborated_claim
    bindings:
      - official decision and rate table
      - independent financial-news report based on the published decision
  - claim_id: c2
    proposition: "The new rate took effect immediately."
    evidence_state: verified_public_fact
    bindings:
      - operative clause in official decision
independence:
  groups:
    - central-bank-decision
    - newsroom-original-analysis
decision: selectable
headline_rule: declarative
unknowns: "Future policy direction remains uncertain."

The official decision proves the rate action and effective date. The news report contributes contextual, independently produced analysis but does not create a second origin for the text of the official decision. The event nevertheless passes because the operative fact is a verifiable public act, not an involved party’s claim about an external condition.

Salvageable citation mismatch

candidate_id: cand_synth_002
event: "A regional organization announced deployment of an observation mission."
problem:
  provider_citation:
    title: "Organization approves observation mission"
    url: "mobile.example.org/article/123?utm_source=x"
  retrieved_page:
    canonical_url: "https://example.org/world/article/123"
    updated_title: "Observers to deploy after council vote"
    same_article_id: "123"
    matching_byline: true
    matching_publication_time: true
    content_hash_similarity: 0.97
decision:
  binding: safe_after_reconciliation
  audit_note: "Mobile/tracking URL canonicalized; publisher later updated headline."
  candidate_status: accepted

This event should not be discarded. The system preserves the observed provider URL, final canonical URL, title history, redirect or canonical-tag evidence, and content fingerprints. No new corroboration is required solely because the headline changed harmlessly.

Event that must be rejected

candidate_id: cand_synth_003
event: "Manufacturer says its system intercepted every incoming object."
evidence:
  - manufacturer press release
  - four articles repeating the press release
  - search-result snippet referring to the same release
independence_groups: 1
conflicting_evidence:
  - independent imagery appears inconsistent with the universal claim
claims:
  - "The manufacturer stated that interception was complete."
    state: official_or_involved_party_claim
    support: adequate
  - "Every incoming object was intercepted."
    state: unresolved
    support: inadequate
decision:
  candidate_status: rejected
  rejection_reason: >
    The newsworthy attributable statement is supported, but the proposed
    event headline asserts the underlying universal claim as fact.

The statement’s occurrence could be reported in a differently framed event, but the submitted candidate must be rejected because several URLs represent one involved-party origin and the material factual proposition remains unresolved.

Deterministic fixture suite

A local test server and fixture corpus should reproduce, without live-web dependency:

• HTTP-to-HTTPS redirects and multi-hop redirects.
• AMP, mobile, and canonical-page variants.
• Tracking parameters and parameters that genuinely change content.
• Same title used for two different articles.
• Headline updates with unchanged article identity.
• Corrected stories with changed claims.
• Removed pages with preserved retrieval snapshots.
• Syndicated wire copy across multiple domains.
• Press-release repetition with minor paraphrasing.
• Circular citations.
• Two outlets relying on the same anonymous source.
• Contradictory official and independent evidence.
• English–Spanish number, date, negation, actor, and certainty mutations.
• Composition output that invents a candidate or source ID.
• Process termination after each persistence and publication step.
• Duplicate publication requests and racing workers.

Evaluator labels should be produced by at least two trained reviewers for ambiguous independence and claim-support cases, with adjudication and policy-version recording. Automated evaluator agreement should be reported per category, not hidden in one aggregate score.

Proposed benchmark targets

The chart below contains recommended acceptance targets, not observed system performance.

xychart-beta
    title "Proposed minimum pass rates before unattended publication"
    x-axis ["Claim support", "Citation binding", "EN/ES parity", "Idempotent publish", "Crash recovery"]
    y-axis "Pass rate (%)" 95 --> 100
    bar [99.0, 99.5, 99.5, 100.0, 100.0]

Acceptance criteria

The pipeline is ready for controlled production only when all of the following are demonstrated on representative and adversarial fixtures:

The most important operational metrics are not simply “edition published” or “model call succeeded.” They are validated evidence retained, unsupported material prevented, deficits repaired per supplemental call, candidate-level salvage rate, composition retries completed without research, parity defects detected before publication, and publication attempts recovered without partial visibility.

Selected references. W3C, PROV-O: The PROV Ontology. OHCHR and Berkeley Human Rights Center, Berkeley Protocol on Digital Open Source Investigations. IPTC, NewsML-G2 Documentation and Guidelines. NIST, AI Risk Management Framework: Generative Artificial Intelligence Profile. C2PA, Content Credentials Technical Specification 2.3. Reuters, Journalistic Standards. Associated Press, News Values and Principles. AFP, How We Work. Gao et al., Enabling Large Language Models to Generate Text with Citations. Min et al., FActScore. Niu et al., RAGTruth.