Status: Stage 3 complete · Rosenberg discovery expansion in progress · one controlled connector enabled · five disabled
Manifest: `config/provenance-network-connectors.v1.json`(../../config/provenance-network-connectors.v1.json)
Service: `src/services/provenance-network-connectors.ts`(../../src/services/provenance-network-connectors.ts)
Live smoke: `artifacts/provenance-research/getty-connector-smoke-latest.json`(../../artifacts/provenance-research/getty-connector-smoke-latest.json)
Outcome
Stage 3 adds a shared, fail-closed network connector contract and enables one
source: the Getty Provenance Index SPARQL API. Getty's official documentation
provides REST, ActivityStreams, and SPARQL access, identifies the data as Linked
Art/RDF, licenses the API dataset under CC0, and requests source acknowledgment.
The other five sources remain kill-switched. A public search interface, absent
robots file, permissive descriptive-data rule, or technical discoverability is
not enough to construct a connector without a source-specific machine endpoint
and access contract.
Connector decisions
| Source | Network status | Reason |
|---|---|---|
| Getty Provenance Index | Enabled: bounded SPARQL | Official endpoint, CC0 dataset, no authentication, attribution guidance |
| ERR Jeu de Paume | Disabled | No verified machine-access, rate-limit, and reuse contract |
| Legacy Explorer | Disabled | No verified API and archive-wide access/reuse contract |
| Lost Art | Disabled | Search paths disallowed; no verified automation permission |
| Proveana | Disabled | Search paths disallowed; no verified automation permission |
| France POP / Rose Valland | Disabled | POP's CGU permits descriptive-notice reuse under Etalab 2.0 unless otherwise stated, but its official open-data inventory does not list Rose Valland/MNR and no source-specific machine-access or rate contract was verified |
The France decision was reassessed on August 16, 2026 against POP's official
open-data inventory, and
application source. Public source code and a
technically callable application backend are not, by themselves, permission to
automate the Rose Valland collection. Image reuse remains separately
rights-bound, so this lane stays manual-import-only.
The BnF catalogue is a technically eligible future discovery source: its
official SRU documentation
publishes a machine protocol and Open Licence terms. It is not enabled in this
release because it is a new external API and requires explicit project-owner
approval. If approved, it must remain bounded archival discovery—not evidence
of ownership, loss, title, or restitution—and pass the connector controls below.
Getty transport contract
- Endpoint: `https://data.getty.edu/provenance/sparql`
- Method: `POST`
- Request: URL-encoded `query` form field
- Response: SPARQL Results JSON
- Authentication: none
- HTTPS/redirect allowlist: `data.getty.edu` only
- Timeout: 20 seconds per attempt
- Retries: one, only for transport errors, HTTP 429, or HTTP 5xx
- Response limit: 1,000,000 UTF-8 bytes
- Result limit: 100 bindings; an individual request may choose a lower limit
- Minimum interval policy: 1,000 milliseconds
- Query mode: generated read-only `SELECT`; callers cannot supply raw SPARQL
- License: CC0 1.0; Getty acknowledgment is retained in every receipt
- Kill switch: checked before any fetch
- Operator: a non-synthetic operator code is required per request
Callers choose a named template; they cannot submit SPARQL. The supported Getty
templates cover exact labels, Linked Art names/identifiers, Person-or-Group
typing, objects, sales activities connected through title-transfer predicates,
bounded date ranges, and a known Getty entity URI. Every template uses fixed
predicates, exact value seeds, and a hard result limit. Broad substring and
arbitrary graph-wide scans remain prohibited.
The retained Rosenberg discovery run is
`getty-rosenberg-discovery-latest.json`(../../artifacts/provenance-research/getty-rosenberg-discovery-latest.json).
It resolves the exact Linked Art name “Paul Rosenberg” to a Getty `Group` record
and retains 25 bounded sales-activity leads, with raw envelopes and SHA-256
receipts. This is discovery evidence only; actor identity and each activity must
still be reviewed against source records and primary documents.
Receipt and evidence boundary
Every successful run retains the exact response envelope, byte count, SHA-256,
source and final URLs, status, media type, query, timestamp, result count,
attempt count, license, attribution, and documentation URL. Redirects outside
the allowlist, invalid media, malformed JSON, excessive bytes or bindings,
timeouts, disabled sources, engaged kill switches, and non-read-only query
shapes fail closed.
Connector captures always remain `research-only` and
`releaseEligible: false`. They feed the Stage 2 alias and claim-matrix workflow;
they do not establish actor identity, ownership, title, loss, forced sale,
wrongdoing, restitution eligibility, or publication approval.
The retained technical smoke returned zero exact-label bindings for “Paul
Rosenberg.” That proves only that the request and receipt path operated. It is
not evidence that Getty lacks relevant Rosenberg records; alternate labels,
entity identifiers, graph relationships, and source-specific research remain
necessary.
Adding another connector
A new connector requires official machine documentation, verified license and
reuse boundaries, endpoint and redirect allowlists, authentication and rate
rules, generated read-only queries, timeout/byte/result/retry bounds, raw
receipts, failure fixtures, an engaged-by-default kill switch, and accountable
provenance-governance review. Do not adapt or scrape a browser interface to
bypass this gate.
Verification
node --import tsx --test --test-concurrency=1 `
tests/services/provenance-network-connectors.test.ts
The suite covers manifest governance, read-only query generation, receipts,
transport retry, disabled connectors, kill switches, redirects, body limits,
result limits, and media validation.