Chapter 25. A provenance model for questions

25.1Stable entities and versions

In the proposed question archive, three objects are named: submission Q-v1, edited question Q-v2, and summary S-v1. Q-v1 asks whether later opening is feasible if an extra staff member is available; Q-v2 deletes the condition. Because the wording changes what is being asked, the inferential step is to treat Q-v1 and Q-v2 as separately identifiable objects rather than as interchangeable labels for one question. The edit activity that uses Q-v1 and produces Q-v2 is therefore recorded as a relation between two objects, not as an overwrite of a single one. S-v1 is likewise distinct: the summary activity uses Q-v2, so the summary has its own identity and its own place in the history.

This separation follows PROV-DM's distinction among entities, activities, and agents, and its treatment of a named provenance bundle as an entity (Moreau and Missier, editors, W3C 2013). Role assignments then attach agents to activities—contributor to the submission, editor to the edit, committee to the summary—without turning role into verdict.

The limit is that these records establish production, not quality. An edit activity can be documented even when the edit is semantically defective: deleting the staff condition may leave Q-v2 asking something different from Q-v1, and the archive records the production link anyway. Nor does the committee's appearance as a reviewer mean the committee adopted a conclusion; the name identifies an agent in a role, not an assertion by that agent. A second-order record can say who asserted a derivation edge and from which log, and that assertion is itself an identifiable record.

Thus stable identity is a precondition for a usable history, while semantic support and truth remain separate checks. In the conceptual design—proposed, not deployed—each wording change creates a new object whose relations can be examined rather than assumed.

Once Q-v1 and Q-v2 are separately identifiable, their identifiers still leave two questions open: which version a reader should treat as operative, and what the edit actually changed. The question archive should therefore record those relations explicitly. A successor relation marks Q-v2 as the edited version of Q-v1; a change relation records that the edit deleted the condition under which an extra staff member is available; and a current-version relation states that the summary S-v1 is derived from Q-v2. Without these relations, a reader confronting Q-v1, Q-v2 and S-v1 cannot tell which question the summary compresses or what was removed in the edit.

The inferential step matters more than the number of edges. The edit activity takes Q-v1 as input and produces Q-v2, and the summary activity takes Q-v2 as input. These production links record how the objects arose; they do not certify that the resulting question is semantically sound. Q-v2 is precisely the case where the link survives a defect, since deleting the condition changes the question it poses. Accordingly, the archive may state that Q-v2 was produced by the edit, while any claim that the edit corrected or improved Q-v1 must itself appear as a separately asserted relation, with a record of who asserted it and from which log. Otherwise provenance quietly acquires an evaluative meaning it has not earned.

The same discipline applies to institutional roles. Naming the committee as a reviewer of S-v1 does not establish that it adopted a conclusion; an adoption relation would require its own assertion. This remains a proposed graph rather than a deployed service, so these are proposed relations with defined inputs and outputs, not observed workflow facts. The modest claim is that separating versions without separating successor, current and change relations leaves the archive informative but indeterminate.

25.2An editing activity

The proposed archive treats an edit as an activity with a determinate shape: it consumes one object, yields another, and carries a stated purpose. Here the input is submission Q-v1 and the resulting object is edited question Q-v2. Q-v1 asks whether later opening is feasible if an extra staff member is available; the edit deletes that condition. Recording the purpose alongside the objects lets a reader say not merely that Q-v2 follows Q-v1 in the history, but that the transformation was undertaken in order to remove the stated condition. That is a claim about editorial intent, and the archive should mark it as such rather than burying it in an unlabelled revision.

The roles in the proposal are contributor, editor and committee. Naming them at the level of the activity fixes who occupied which part of the process: the submission belongs to the contributor, the transformation from Q-v1 to Q-v2 to the editor, and the committee to a reviewing position. These role assignments describe the production arrangement. They are recorded as part of the activity rather than inferred afterwards from the existence of the resulting object.

One further activity follows from the first. A summary activity uses Q-v2 and produces summary S-v1. Because Q-v2 is the output of the edit and the input of the summary, the two activities connect through a shared object; the archive can therefore state the derivation of S-v1 from the edited question without introducing a separate, unexplained link. Each activity keeps its own input, output, purpose and role assignment.

The inferential step is modest but useful: given an input, a resulting object and a stated purpose, the design can represent an edit as a directed, role-bearing transformation rather than as a bare succession of versions. The limit belongs to the proposal itself. This is a conceptual design, not a deployed service, so the activities, objects and relations described here are proposed records; nothing in the design authorizes treating the recorded arrangement as an implemented archive or as an established editorial practice.

Once the editing activity is described by its input, resulting object and stated purpose, the further question is what a complete record of that activity actually licenses a reader to conclude. The record can be complete and still carry a mistaken edit. In the proposed archive, the edit activity takes submission Q-v1, which asks whether later opening is feasible if an extra staff member is available, and produces edited question Q-v2, from which that condition has been deleted. The summary activity then takes Q-v2 and produces S-v1. Each step can be documented accurately — which object was used, which was produced, and by whom — while the deletion itself may be semantically defective.

The inferential step worth drawing is therefore limited but consequential: production history is evidence about the process, not automatic semantic validation. The link from Q-v1 to Q-v2 establishes that an editing activity occurred and that Q-v2 is its output; it does not establish that removing the staffing condition preserved the question's meaning. Conversely, a defective edit does not leave the record incomplete. If a later assessment judged the condition essential, the production record would remain a faithful account of how the question came to be modified, while the edit's warrant would be judged separately.

Two scope limits follow. First, S-v1 is a summary of Q-v2, not of Q-v1: its basis is the edited question, and the summary inherits whatever that edit presupposed without thereby certifying it. Second, the committee's appearance as a reviewer does not amount to an adopted conclusion; naming a reviewer and attributing a position are different entries. The proposed record can carry these distinctions by recording, in a second-order layer, who asserted a derivation edge and from which log. That layer prepares the ground for separating the contributor's assertion, the editor's interpretation and any conclusion an institution actually adopts. Throughout, the qualification is that this remains a conceptual design: the graph records proposed relations and their asserted provenance, not a deployed service whose edges carry verified authority.

25.3Who made which assertion

In the proposed archive, the three objects must not be treated as a single chain of endorsement. Q-v1 is the contributor's assertion: whether later opening is feasible if an extra staff member is available. Q-v2 is the editor's interpretation, produced by an edit activity that uses Q-v1 and deletes the condition. S-v1 is the summary derived from Q-v2. Recording the derivation gives these activities named agents and inputs, but it does not make the edit correct: dropping the condition changes what is being asked, and any such semantic defect survives the production record.

The institution's adopted conclusion is an assertion of its own kind. In this example the committee appears as a reviewer, and that appearance licenses no conclusion in Q-v2 or S-v1. Adoption, if it occurs at all, has to be recorded as a separate event with its own agent, activity and object, rather than inferred from a role label already present in the log.

What the graph therefore needs is a distinction between the content of a proposition and the activities that carried it. A second-order record can identify who asserted a derivation edge and from which log that edge was taken; this keeps the claim about the edge separate from the content the edge relates. If the committee were later to adopt S-v1, that would be an additional assertion, conditional here because the example records no such event. The design remains conceptual, not a deployed service.

Layering in this way answers the practical worry raised by a defective edit. The archive can show which activity produced Q-v2 and which agent performed it, while leaving open the distinct questions of what the contributor asserted and what anyone endorsed. Attribution marks responsibility for an edit; adoption marks commitment to a conclusion. Keeping the two apart prevents a complete production history from being mistaken for institutional approval.

The distinction between contributor, editor and committee leaves open a further question of scope: what exactly did each agent commit to? Recording who performed an activity answers only who acted, not what each agent committed to. In the proposed archive, an edit activity uses Q-v1 and produces Q-v2, and a summary activity uses Q-v2 to produce S-v1. Those links identify production, not adoption of the propositions in the objects they touch.

The content of the edit makes the difference concrete. Q-v1 asks whether later opening is feasible if an extra staff member is available; Q-v2 deletes that condition. Attributing the edit activity to the editor establishes that the editor produced Q-v2 from Q-v1. It does not establish that the editor asserted the unconditional feasibility question now carried by Q-v2, or endorsed the conditional version in Q-v1. An editor might remove a qualification for reasons of length, house style or editorial policy while holding no recorded view on feasibility at all. Indeed, the production link can be recorded even when the edit is semantically defective: deleting the condition changes what the question asks, yet the graph will still report that Q-v2 was produced from Q-v1.

The same limit applies to the committee. Its name may appear as a reviewer of the summary, but that appearance does not amount to an adopted conclusion; any adoption must be asserted in its own right and scoped to the object or proposition concerned. Where endorsement is later claimed, a second-order record can identify who asserted the relevant edge and from which log, so that the attribution itself becomes attributable. But no amount of activity tracing fills in an endorsement that no agent recorded.

The practical consequence is narrow. Production, assertion and adoption are three different facts, and the activity links available here deliver only the first. The other two have to enter the graph as separate claims with named agents and stated scope; otherwise the archive will report who moved which question while remaining silent on who was willing to stand behind any part of it.

25.4Derivation versus support

A derivation relation has a narrow job: it records that one object was produced using another. In the proposed archive, the edit activity that uses Q-v1 and produces Q-v2 may therefore carry an edge saying that Q-v2 derives from Q-v1, and the summary activity that uses Q-v2 may give S-v1 the corresponding edge. The roles of contributor, editor and committee identify who held each position in these activities; they do not add anything to the production claim itself.

This is worth separating from semantic evaluation because the same history can contain a defective product. Q-v1 asks whether later opening is feasible if an extra staff member is available; Q-v2 deletes that condition. Whatever one makes of that edit, the production link is recordable exactly as it occurred: Q-v2 was produced by an edit that used Q-v1. The derivation edge records a claim of historical dependency between the objects. It does not by itself verify that history or establish whether the deleted condition should have remained. Nor does the presence of a committee as reviewer amount to the committee's adoption of any resulting conclusion.

Because the archive is itself proposed rather than deployed, even these edges must be attributable. A second-order record can identify who asserted a particular derivation edge and from which log. That addition makes the assertion attributable. Some recorded assertions might also be independently verified, but neither verification nor accuracy follows from placing them in a graph. The qualification to carry forward is precise: derivation reports production, so a well-formed derivation graph can still contain items whose content is poor. What the source itself supports or contradicts remains a separate judgment.

In the proposed archive, the edit activity uses Q-v1 and produces Q-v2, and the summary activity uses Q-v2 to produce S-v1. Those production links can be entered directly from the edit log. Yet the edit deletes the condition that an extra staff member is available: Q-v1 asks whether later opening is feasible under that condition, while Q-v2 asks without it. The derivation record remains correct even when the edit is semantically defective, because what it reports is a fact about how one object was made from another.

The inferential step is narrow but consequential. From the derivation edge alone one may not move to support or contradiction. Q-v1 has not thereby endorsed the feasibility question that Q-v2 poses, nor has it refuted anything that follows from it. The source may contradict the resulting claim, but deciding whether it does requires a separate evidential judgment — a reading of Q-v1 against the claim at issue. That judgment should be recorded as its own relation, with its own basis, so that a reader can accept the production history while withholding the evidential one.

Scope and application follow from the split. S-v1 is a summary produced from Q-v2, not a conclusion adopted because it was derived. Roles keep their limits as well: naming the committee as reviewer attributes an activity, not an endorsement. A second-order record can identify who asserted each derivation edge and from which log, but identifying the assertion does not verify it. In this design the edges carry production history; anything stronger waits on a judgment that has actually been made.

25.5The provenance of provenance

Consider the proposed archive objects Q-v1, Q-v2 and S-v1. The edit activity uses Q-v1 and produces Q-v2; the summary activity uses Q-v2. A derivation edge between Q-v1 and Q-v2 says where the edited question came from, not that deleting the staffing condition improved it. The edge is also a recorded assertion. The design should make its recorder and evidential basis inspectable where those are known, and mark gaps where they are not.

A provenance claim can therefore receive its own record of authorship and support. The person or system asserting that an edit produced Q-v2 may differ from the editor who performed the activity. Recording the assertion author, activity actor and available log separately avoids conflating those roles; missing information should remain marked as unknown. In PROV-DM terms, a named bundle of provenance descriptions is itself an entity, so provenance can itself have provenance (Moreau and Missier, editors, W3C 2013).

Applied to the committee, its appearance as reviewer does not establish adoption of a conclusion. A second-order entry can record who asserted that the committee reviewed S-v1 and from which log that assertion was made. This preserves the gap between an activity and the act of asserting what the activity's record shows.

The limit matters. Identifying the recorder and their basis improves accountability for an edge; it does not certify the edge's content. If the log is mistaken or the recorder misread it, the attribution is defective however many layers are added. Support or contradiction still requires a separate evidential judgment, because derivation traces production rather than semantic adequacy. And since this archive remains a conceptual design, the roles contributor, editor and committee are proposed graph labels, not verified descriptions of conduct in any deployed service.

A second-order record is what turns a bare derivation edge into an inspectable claim. In the proposed archive, an edit activity uses Q-v1 and produces Q-v2, and a summary activity uses Q-v2 to produce S-v1. Those production links can be recorded accurately even when the edit is semantically defective: Q-v1 asks whether later opening is feasible if an extra staff member is available, while Q-v2 deletes that condition. The graph therefore records that a transformation occurred, not that it preserved the question's meaning. Adding more edges of the same kind will not close that gap.

What does close part of it is recording, of the derivation edge itself, who asserted it and from which log the assertion came. The editor's claim that Q-v2 follows from Q-v1 becomes an object with a recorder and an evidential basis, rather than an unattributed fact baked into the topology. This is the response to the worry that a complete graph of unverified assertions is semantically empty: edges earn their place only when their status as assertions is exposed. The same treatment applies to the summary edge into S-v1, and to any later claim that the committee reviewed the result.

The recursion should then stop. Its stopping point is set by the audit task, not by a demand for maximal nesting. If the task is to judge whether the edit preserved the submission's condition, one further level is sufficient: name the recorder of the derivation edge and the log consulted. If, instead, the task concerns whether the committee adopted a conclusion, the presence of committee roles as reviewer is not evidence of adoption, and the scope must extend to records of any asserted endorsement. Beyond what the task requires, further levels of provenance-for-provenance add structure without adding audit value. The whole graph remains a conceptual design rather than a deployed service, so each proposed relation is labeled accordingly.

25.6Partial and inaccessible histories

The proposed archive has Q-v1, its edited successor Q-v2, and summary S-v1. Its edit activity uses Q-v1 and produces Q-v2, while the summary activity uses Q-v2. Those production links are recordable. What the archive does not have is a record of the transformation by which the conditional clause in Q-v1 disappeared from Q-v2. That omission is not a reason to stop recording the edit; it is a limitation to state.

The distinction matters because Q-v1 asks whether later opening is feasible if an extra staff member is available, and Q-v2 deletes the condition. A second-order record can identify who asserted the Q-v1-to-Q-v2 derivation edge and from which log. But unless that record itself supplies the missing transformation, the history remains silent on why the condition was removed. The correct entry is therefore a limitation of the history, not a reconstructed rationale.

The same discipline governs inaccessible sources. If the log underlying a derivation edge cannot be inspected, that inaccessibility should be marked at the point where the edge enters the graph. The edge can still carry its asserted provenance—its author and source log—while the audit record notes that neither is available for checking. Recording that gap is already useful; it tells a later reviewer exactly which step cannot be independently confirmed.

This is the stopping point established for second-order records. One scope is enough: identify the missing or inaccessible element and place the limitation beside the relation it qualifies. There is no need to nest further records about records of the gap.

The committee's position illustrates the same restraint. Its name appearing as a reviewer establishes a role, not an adopted conclusion. Likewise, the production link from Q-v2 to S-v1 establishes that the summary was generated, not that the deletion of the condition was endorsed. The graph remains proposed rather than deployed, so these limitations describe its design obligations rather than failures observed in operation.

The proposed archive records two activities directly: an edit activity that takes Q-v1 and produces Q-v2, and a summary activity that takes Q-v2 and produces S-v1. These production links are the archive's solid ground. Where the log documents an activity, the history can state that the activity occurred and identify its input, output and role holders — contributor, editor, committee.

The inferential step matters when an activity is missing. If the transition from Q-v1 to Q-v2 shows the condition about the extra staff member disappearing, one may suspect that some further deliberation prompted the deletion. But that suspected deliberation is not an activity the log supplies. It can enter the archive only as a proposed activity, explicitly marked as an inference and carrying the name of whoever asserted it and the log from which the inference was drawn. The second-order record is what keeps the inferential status visible: it describes an assertion about the history rather than the history itself. The practical rule follows from this distinction. Do not fill a gap with an inferred activity and then report the inference as a retrieved record. Once inferred steps are folded into the retrieved set, the archive can no longer tell a documented transition from a plausible reconstruction, and the completeness of the graph becomes a measure of its own inventiveness.

Two limits bound this proposal. First, a production link records that Q-v2 was produced from Q-v1; it does not establish that deleting the condition was warranted. The edit may be semantically defective even when its provenance is unambiguous, so the recorded link must be read as a historical claim about document production, not a judgment about the question's meaning. Second, the committee's appearance as a reviewer role does not show that it adopted any conclusion. And because this archive is a conceptual design rather than a deployed service, descriptions of retrieval remain provisional too: they say what a completed system should distinguish, not what an existing log has already returned.

25.7A minimal useful record

Consider one edit whose status is disputed. Q-v1 asks whether later opening is feasible if an extra staff member is available; the edited Q-v2 drops that condition. The edit activity used Q-v1 and produced Q-v2, and the summary activity used Q-v2 to derive S-v1. Even if the deletion is a mistake, the production link happened and can be recorded; recording it does not certify the edit.

The smallest useful record for that dispute has four anchors: input, output, actor, reason. Input is Q-v1; output is Q-v2. Actor names the editor in the editor role, not merely the body whose name appears nearby. Reason carries the stated justification for deleting the condition. The summary activity's use of Q-v2 should appear as its own link rather than being folded into the edit entry. These anchors let a later reader locate what was changed, by whom, and on what grounds without consulting a larger graph.

Reason matters because provenance and meaning separate here. A record can state that the activity produced Q-v2 from Q-v1 while leaving open whether the removal preserved the question's meaning. Two further qualifications keep the record honest. First, an appearance as reviewer does not mean the committee adopted any conclusion, so committee affiliation should not be written into the edit's authority. Second, when a derivation edge is asserted rather than logged, a second-order entry should identify who asserted it and from which log. This is the support distinction applied to record types: an inferred activity must not be filled into a gap and then reported as retrieved.

The resulting record locates the dispute; it does not settle it. Whether the deletion was justified, and whether S-v1 carried the dropped condition forward, remain separate claims needing their own entries. The archive itself is proposed, not deployed.

The proposed archive contains three concrete objects: submission Q-v1, edited question Q-v2, and summary S-v1. An edit activity consumes Q-v1 and produces Q-v2; a summary activity then uses Q-v2. These relations are straightforward to draw. Yet the case shows why drawing them is not the same as making the record useful. Q-v1 asks whether later opening is feasible if an extra staff member is available; Q-v2 deletes that condition. The production link from Q-v1 to Q-v2 is accurate, but the edit may be semantically defective: it silently removes the circumstance that made the question answerable.

Suppose, then, that the archive is rendered as an elaborate graph of entities, activities, agents and roles—contributor, editor, committee, with edges for submission, editing, summarizing and reviewing. Such a graph would display the full workflow while leaving the defect untouched. It records that Q-v2 followed from Q-v1, not that a condition was dropped. If the graph cannot answer, in usable terms, what changed and why the change may matter, its extra structure adds form without demonstrated benefit.

A simple annotated document answers the concrete question more directly. It holds the three artifacts, quotes or paraphrases the deleted condition alongside the revision, names the editor as the actor of the edit, and records the reason given for the change, if one was supplied. That record does not establish that the deletion was correct; it establishes what was changed and who proposed the change.

The comparison sets a scope limit rather than a prohibition. A graph earns its additional apparatus only when it can represent more than production—when it can mark, for example, who asserted that the derivation preserves the question and from which log that assertion was taken. Without such a second-order layer, the elaborate graph merely circulates unverified links. One further limit matters: the committee's appearance as reviewer does not by itself adopt any conclusion, and the entire graph remains a design proposal rather than a deployed service.