02 — The Model: Nodes, Edges, Addressing, Provenance

version v0.33.67 date 8 September 2026

← 01 What Exists↗ · Pack hub↗ · Next → 03 The Worked Example↗

The One Rule Everything Else Serves

Their nodes are theirs. Our nodes attach without altering them.

This is the attach-never-mutate rule of 9 August, applied. No node derived from UnGovr's data is ever edited, corrected, enriched or re-typed in this vault. It is transcribed with its provenance and left alone. Everything this estate adds hangs off it as a new node with a new edge.

Two reasons, and the second is the operational one. First, it is their data under their licence and modifying it while attributing it is dishonest. Second, a snapshot that has been improved cannot be diffed against the live source, so the moment we mutate we lose the ability to say what changed when they push.

Namespaces, Which Are Also The Visual Classes

Three prefixes, and they are never mixed in one node identifier.

Acceptance test 5 is the check on this, and a partner will run it first: open the graph and it must be impossible to confuse a ung: node with a sg: node without reading the label. Colour alone is not enough — colour is already spent on the assertion classes below, so the origin distinction must be carried by shape or border, not by hue.

And separately, the three assertion classes from the method site

Never mixed, and orthogonal to origin:

Node Types

Derived from UnGovr (ung:)

Note the last one. ung:LawReference is a string they published, not a law. It is the near side of the join. Resolving it to an instrument is our inference and is modelled as such.

Anchored to published identifiers (akn:)

Akoma Ntoso is the anchor, and this is settled before anything is minted. It is the published standard for legislative text, it is in the standards site's covered set, and the August rule is to anchor to published identifiers rather than mint. If a jurisdiction's law has no Akoma Ntoso rendering, that is recorded as an open item rather than solved by inventing an identifier scheme.

Our model (sg:)

Edge Types

   ung:Entity ──ung:parent──────────> ung:Entity
   ung:Entity ──ung:child───────────> ung:Entity
   ung:Entity ──ung:boundary────────> ung:Boundary
   ung:Entity ──ung:domain──────────> ung:Domain
   ung:Entity ──ung:membership──────> ung:Membership
   ung:Entity ──ung:openRecordsLaw──> ung:LawReference     ← their graph ends here
   ─────────────────────────────────────────────────────────────────────────────
   ung:LawReference ──sg:resolvesTo─> akn:Instrument       ← THE JOIN. Inferred
   akn:Instrument ──akn:hasProvision> akn:Provision
   akn:Provision ──sg:creates───────> sg:Obligation
   sg:Obligation ──sg:satisfiedBy───> sg:Control
   sg:Control ──sg:evidencedBy──────> sg:Evidence
   sg:Evidence ──sg:accepted────────> sg:Acceptance
   * ──sg:retrievedBy───────────────> sg:Retrieval         ← on every derived node
   * ──sg:inferredBy────────────────> sg:Inference         ← on every inferred edge

One edge carries the whole argument and it is sg:resolvesTo. It is the only edge in the diagram that crosses from their data into ours, it is inferred rather than asserted, and it must be rendered in the inferred class. A reader who thinks UnGovr asserted that resolution has been misled by the drawing.

The Address Scheme: Two Hashes

Inherited unchanged from standards.sgit.ai. A provision has two addresses because it has two kinds of identity, and conflating them is how citations rot.

   akn:Provision
     position_hash  sha256( "akn:us-ca/act/cpra/sec-7922.535/(a)" )
     content_hash   sha256( <the exact bytes of that subsection as retrieved> )

Why both. An amendment that rewords a subsection leaves the position and changes the content, so a citation to the position still resolves and a claim resting on the wording is correctly invalidated. A renumbering does the reverse. A single identifier cannot express that difference, and a system with one hash silently picks which kind of change it is blind to.

Normalisation rule, and it is asymmetric on purpose. The position path is normalised — case folded, whitespace collapsed, numbering canonicalised — because it is a name. The content bytes are never normalised, because the hash's whole job is to be a hash of what was published. Normalising before hashing would mean the artefact cannot be checked against the source it claims to come from.

Provenance Fields

Every derived node and every quoted span carries all seven. A node missing any of them fails verification rather than degrading quietly.

The method field is doing real work and is not boilerplate. A retrieval that went through a summariser, a transcription, or any lossy path records that here — and a node whose method is not a direct byte-preserving fetch cannot carry a content hash, because there are no source bytes to hash. See 06__verification.md↗, where exactly this situation is recorded as the current blocker.

The Two-Edge Rule, Applied

Settled 4 September. Every node in this vault carries two mandatory edges before it carries anything interesting:

1. An origin edge — who asserted this: UnGovr, a published standard, or us
2. A provenance edge — sg:retrievedBy for derived nodes, sg:inferredBy for inferred ones

A node that cannot carry both is not added to the graph. That is the constraint that makes the honest-label requirement mechanical rather than editorial: the model refuses to hold an unattributed node, so nobody has to remember to write the footnote.

And the rendering follows from it, which is the part a partner will check. Origin decides shape. Assertion class decides colour. Provenance decides what the node's detail panel opens.

Claim States

Every claim carries a state, and unevidenced is the default. Settled in the 4 September conformance layer, applied here without modification.

One limit stated plainly, because the temptation runs the other way. This estate is out of band and can evidence any rung including the last. It can never be the inline control that makes the last rung true. A control bounds a grant only if it is enforced by something the grant does not include, and an out-of-band party is never that enforcer. A page that blurs those two is claiming the one thing the architecture rules out.

What This Model Deliberately Does Not Do

This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).