Documentation | Meta Museum

Status: Stage 2 complete · manual federation only · review-only outputs

Access assessments: `config/provenance-research-access.v1.json`(../../config/provenance-research-access.v1.json)

Actor aliases: `config/provenance-actor-aliases.v1.json`(../../config/provenance-actor-aliases.v1.json)

Service: `src/services/provenance-federated-research.ts`(../../src/services/provenance-federated-research.ts)

Rosenberg research demonstrator

The no-index route `/research/rosenberg` is the first uncertainty-first research

surface. It accepts ordinary-language questions only within the reviewed Paul

Rosenberg case boundary. The planner converts a supported question into fixed,

visible searches with source, template, exact search description, access mode,

and maximum result count. It rejects raw query syntax and unrelated actors. The

page renders the bounded plan first, source outcomes and uncertainty second, and

the retained dossier explanation third. It does not run arbitrary SPARQL or

claim that blocked manual searches succeeded.

Delivered capability

Stage 2 turns the versioned source catalog into a safe federated research

workflow. A provenance operator can prepare one bounded query for several

sources, search each approved public interface manually, import a limited result

envelope, retain its exact bytes and SHA-256 receipt, resolve actor candidates

without automatic merging, and compare source claims as agreement, conflict, or

not comparable.

This implementation deliberately does not scrape or crawl. The dated access

assessment did not establish machine-access and metadata-reuse permission for

any of the six sources. Lost Art and Proveana disallow search paths in their

robots policies and presented automated-client challenges during assessment.

ERR and the Getty Provenance Index returned no robots policy at the assessed

host; Legacy Explorer returned an application page rather than a robots policy;

the French POP robots response contained no directives. Missing or silent

policy is never interpreted as permission.

Source access decision

|---|---|---|---|

The access registry records the dated observation, policy URL, official resource

URL, authentication observation, unknown rate limit, provenance-governance

owner, and mandatory human approval for every source.

Bounded workflow

Create a version-1 query with a non-synthetic ID, purpose, operator code,

one to eight search terms, approved source IDs, and at most 100 results per

source.

Search each source through its normal human-facing interface. Do not bypass

authentication, access challenges, robots policy, or export restrictions.

Save only the bounded result required for the research question. Preserve

its source URL, media type, timestamp, operator, result count, and exact raw

envelope.

Run `createManualProvenanceCapture`. It rejects unknown sources, invalid

operators, insecure URLs, empty or oversized envelopes, and result counts

above the declared maximum. The returned receipt contains byte length and a

SHA-256 digest.

Extract narrow observations without editing the captured raw envelope. Every

observation retains its citation and receipt digest.

Resolve actor labels through the review-only alias policy. Candidate matches

never authorize an identity merge.

Build a claim matrix. Same-subject/same-predicate normalized values may agree

or conflict; different semantics or explicitly incomparable claims remain

`not-comparable`.

Send the matrix, captures, primary documents, and unresolved identity issues

to an accountable provenance reviewer.

Rosenberg collision control

The alias policy explicitly separates:

Paul Rosenberg — Person;
Galerie Paul Rosenberg — Group;
Alfred Rosenberg — Person;
Einsatzstab Reichsleiter Rosenberg — Group.

The bare label `Rosenberg` returns all four candidates and never permits an

automatic merge. Person-to-gallery and person-to-organization relationships

require a separately sourced relationship bridge.

Evidence and publication boundary

Manual imports and claim matrices are always `releaseEligible: false`. A result

may identify a research lead but does not prove identity, ownership, title,

custody, seizure, forced sale, loss, wrongdoing, restitution eligibility, or

scholarly novelty. Synthetic fixtures test mechanics only and never become

historical evidence.

Primary-document inspection remains necessary wherever cards, photographs,

catalogues, correspondence, claims files, or inventories exist. Database

summaries must not replace those records.

Verification


node --import tsx --test --test-concurrency=1 `
  tests/services/provenance-research-source-registry.test.ts `
  tests/services/provenance-federated-research.test.ts

Fixtures cover bounded imports, immutable receipts, ambiguous identities,

agreement, conflict, not-comparable claims, unknown sources, synthetic

operators, and excessive result limits.

Stage 3 completion

Stage 3 now provides the controlled connector framework and one enabled Getty

Provenance Index SPARQL connector. Five sources remain disabled. See

`provenance-network-connectors.md`(provenance-network-connectors.md) for the

official-access decision, transport bounds, live receipt, and kill-switch

rules. Manual federation remains the default for every source without verified

machine permission.