Bitemporal history & attestation chain
The July 12 direct count found provenance rows. Of those, inherited a valid-shaped source-file SHA-256 and 14 did not. No claim linked deterministically to an attestation or witness signature. Claim rows can record when the source asserted it (valid-time) and when we recorded it (system-time), but only 20 rows had a closed valid_toversion. A source hash can be checked only when it is present and the corresponding source release remains obtainable.
How the chain works
- 1Claim — A fact about a facility or provider (e.g. star rating at CCN 460057). Has
valid_from,valid_to, andrecorded_atcolumns (bitemporal). - 2Source — A provenance-source row can name the public file and store its SHA-256. Eight claim-bearing source rows had no hash in the July 12 audit.
- 3Snapshot + witness — Some aggregate snapshot records carry an Ed25519 signature (methodology:
in-toto-witness/v1). This ledger is separate from provenance claims. Historical payload hashes often covered source/date/count metadata rather than complete data bytes.
Bitemporal columns
| Column | Axis | Meaning |
|---|---|---|
| valid_from | Valid-time start | When the source asserted this fact became true |
| valid_to | Valid-time end | When the fact stopped being true; null = still current |
| recorded_at | System-time | When Fonteum first wrote this row to the database |
Backfill note: valid_from ← asserted_at; recorded_at ← created_at. No valid-time was fabricated.
Worked example — real claim
The claim above has valid_from = 2026-06-10 and valid_to = null (current). When CMS releases updated data and a new claim supersedes this one, valid_to will be set and the diff will show the change.
Inspect a claim lookup
Paste a provenance_claims UUID to inspect the lookup result. The current resolver uses a best-effort source match; it is not a deterministic claim-to-signature link.
Methodology
- Witness signature algorithm
- Ed25519 (Node.js crypto module)
- Canonical payload format
- {"methodology_version":"...","sha256":"...","signed_at":"...","snapshot_id":...} — Keys always sorted alphabetically for determinism.
- Methodology version pinned
- in-toto-witness/v1
- Source hash
- Source-file SHA-256 when present in provenance_sources.content_sha256; 14 directly counted claims inherited a null value on July 12, 2026