Public UI: `/research/query`
Public API: `POST /api/research/query`
Status: first public vertical slice; one reviewed Nazi-era evidence package; additional archive automation disabled
Behavior contract
The route accepts an ordinary-language question of 10–1,000 characters and an
optional result limit of 1–25. It rejects raw SPARQL-shaped input, contact data,
oversized bodies, and malformed JSON. Responses are `no-store` and retain no
ordinary question text beyond the existing digest-only AI-query telemetry.
Every response separates three lanes:
- `museum-index` searches the current Meta Museum Linked Art record index. It
does not claim that upstream museum APIs were freshly queried.
- `nazi-era-archives` may match the reviewed, receipt-backed Paul Rosenberg
evidence package. It does not claim the archives were re-queried.
- `additional-archive-connectors` remains disabled until source-specific
machine-access and reuse approval exists.
The response also normalizes citation coverage by source. Each coverage row
retains the source ID and HTTPS URL, museum or Nazi-era lane, evidence classes,
claim and contradiction ranks, execution state, and `liveQueried: false`.
Museum rows are `indexed-result`; archive rows are
`retained-reviewed-evidence`. An unsupported archive question returns no archive
coverage rather than inheriting sources from an unrelated package.
Claims retain a Linked Art subject identifier and type, property path, evidence
class, confidence, uncertainty, direct HTTPS citations, retrieval timestamps,
rights boundary, and false identity/title/restitution/publication authority.
Missing or unsupported evidence produces an explicit refusal rather than a
generated conclusion.
Reviewed `conflict` and `not-comparable` claim-matrix rows are returned in a
separate ranked collection rather than blended into positive claims. Each row
retains its comparison key, source IDs, compared values, direct citations,
retrieval times, source-written boundary, and false resolution, identity,
legal-title, restitution, and publication authority. An unsupported archive
question receives no contradictions from an unrelated evidence package.
Current limitation
This release is multi-lane, but it is not yet a general live multi-archive
search engine. Only the museum index executes for each request. The Rosenberg
archive package is retained evidence, and other Nazi-era archive connectors are
visibly disabled. A second archive package or connector must meet the same
access, receipt, primary-source, rights, and review requirements before it can
be added.
An August 16, 2026 access reassessment kept POP/Rose Valland manual-only. BnF's
documented Open-Licence SRU catalogue is the next eligible bounded discovery
candidate, but it is deliberately absent pending explicit approval to add that
external API. Neither source would independently establish a restitution claim.
Verification
node --import tsx --test --test-concurrency=1 `
tests/services/federated-provenance-query.test.ts `
tests/api/research-query.test.ts `
tests/pages/research-query-page.test.ts
pnpm research:commons:browser-proof
The browser proof covers desktop and mobile search, lane status, citations,
refusal boundaries, axe accessibility, and horizontal overflow. The proof
runner explicitly selects local file storage so an empty inherited deployment
variable cannot invalidate the isolated test environment.
The exact-release production handoff requires nineteen fixed probes: the
`/research/query` page among seventeen public resources, one fixed supported-answer
`POST /api/research/query`, and one fixed unsupported-archive refusal POST. Each POST receipt binds its request-body
digest and must replay ranked Linked Art claims, at least one primary-document
claim, direct HTTPS citations, uncertainty, rights, executed and retained lane status, first-class cited contradictions, and false consequential
authority. A deployment that omits the page or returns a malformed,
citation-free, or overclaiming answer cannot earn the open Research Commons
readiness point. Each POST receipt also records end-to-end duration and fails
capture or replay above 5 seconds. The refusal receipt additionally requires an
unsupported archive lane, explicit no-package refusal, zero inherited
contradictions, and zero archive claims; the remaining fixed resources have a
15-second ceiling. This is one deployment smoke and cannot satisfy the separate
50-case production latency and cost requirement.
The supported production receipt additionally requires at least three distinct
retained Nazi-era sources, including primary-document and official-catalogue
coverage. Duplicate source IDs, fewer sources, missing evidence classes, or any
row presented as live fails replay.