Rumours have no return address. We give them one.

01The thesis

Every rumour, every statistic, every “everyone knows” on the web is a sentence that has been copied more often than it has been checked. Almost none of the copies say where it came from. So the question people actually ask — who started this? — has no answer, and blame for a false claim lands nowhere, or on whoever happened to repeat it last.

The register answers that question with a paper trail: one record per source, one identity per claim, one chain from the earliest known publication to every repetition after it. Three things follow, and they are the whole point of the project:

• Origin is marked. A claim gets a return address: the first source in the register that published it, dated, with the bytes we read.
• Propagation is visible. Everyone who repeated it is listed in order, so copying is no longer indistinguishable from originating.
• The trail cannot be quietly rewritten. Content-addressed ids and signed release manifests mean the record of who said what, when, is verifiable offline — by a journalist, a regulator, or the source named in it.

Truth is the source’s business. Provenance is ours. And provenance is what makes accountability possible — you cannot pin a rumour on anyone if you cannot say where it entered circulation.

02Why it hurts everyone

This is not a niche research problem. The absence of origin is a tax on every person who reads anything, and it lands hardest on the people with the least power to check.

And the fix has to be free and public, because the value only exists if everyone can consult it. A provenance register behind a paywall answers the question for the people who already had it answered.

03Origin & propagation — the core feature

Two computed facts turn a pile of claims into a blame-capable register. Both come from the same identity layer, and both are stated as findings with evidence rather than as verdicts.

1 — Origin: the earliest record we hold

Every assertion (the claim itself, independent of who published it) collects all records that carry it, ordered by publication date. The earliest is the origin record: the first source in the register that put the claim into circulation, with its URL, its date, and the digest of the bytes we read. That is the return address.

2 — Propagation: everyone who repeated it, in order

After the origin record, every dated record sharing the assertion id is a repetition: same claim, different publisher, later date. The register lists them in sequence, counts them, and shows the gaps — the claim that went from one government page to twenty sites in a month, or the one that never travelled at all.

The propagation view is what makes the origin useful rather than merely interesting. “This started here and was copied 19 times” is a citable, checkable statement; “this is misinformation” is an opinion that invites a fight. We publish the first and refuse the second.

04The product

Four surfaces, each useful alone, all fed from one row in one database:

Design principles

• No model in the extraction path. Rule-based, deterministic, auditable, zero per-page token cost. The same page yields the same record in a year.
• Point, do not rehost. Claim text, source URL, licence, date and fetch digest. Not page copies for redistribution.
• No personal data. Claims are statements about the world; anything person-shaped is excluded by rule.
• Nothing deleted, ever. Superseded records are marked and lineage kept, so a correction is itself part of the trail.
• No verdicts. The register reports publication, date and repetition. It never says “false”, “misleading” or “disinformation” about a source.

05Where it stands

06Architecture

1. Acquire — newest Common Crawl release, filtered to an allow-list of domains, plus direct fetch of licence and evidence pages. Raw bytes kept, fetch digest recorded.
2. Extract — deterministic rules pull candidate claims (figures, dates, superlatives, attributions) with surrounding context. No LLM: same input, same output, forever.
3. Gate — licence resolver decides public or withheld per domain from a licence record with URL and date. Unknown licence is withheld, never guessed.
4. Identify — assertion id (normalised text) and record id (assertion + canonical source) computed per row; page digest kept beside them as fetch evidence.
5. Attribute — per assertion: earliest dated record = origin, all later records = propagation, counts and intervals computed. A query over the same rows, not a second dataset.
6. Publish — server renders HTML, PROV-O, JSON-LD and Turtle from one row; badges render from the same id; the nightly build commits a signed manifest.
7. Distribute — badges and embeds, dataset releases for mirrors, open API for tooling.

07Cryptographic identity

Origin attribution is worth nothing if the record of it can be edited afterwards. Today it can be: the digest hashes the whole page, so it identifies the page rather than the claim, every claim from one page shares one hash, and a refetch that changes a single byte orphans the lot. The fix is identity at two levels, both derived from content, so the identifier is the content.

Canonicalisation, versioned as fp1

• Text: Unicode NFC, fold curly quotes and dashes, strip zero-width characters, collapse whitespace, trim.
• URL: lowercase host, drop www./www2./m., drop default port, strip tracking parameters, sort query, drop fragment.
• Date: ISO-8601 UTC or empty. Field order fixed; each id space domain-separated by a literal prefix so the two can never collide.
• Rules frozen per version. An id embedded in someone else’s page must keep meaning the same thing; changing a rule means minting fp2 and keeping a legacy map.

What the two levels buy

Corroboration and origin stop being guesses: 64 assertions appear in more than one place, the most-travelled appears as 20 separate records, and the earliest of those is an origin with an owner and a date. A page-digest model cannot express any of it.

Commitment and proof — verified, not proposed

• Each release builds a Merkle tree over the record ids: root sha256:d3c53ce1acf76b74… over 1,418 leaves.
• Any single record is provable with an 11-hash inclusion proof (~352 bytes). Tested on 50 random records against the root, with forged records rejected, and small-tree tests passing at 1, 2, 3, 4, 5, 7, 8 and 9 leaves.
• Tamper-evident: changing one character of one claim changes the root.
• Append-only: each nightly manifest carries the previous manifest’s hash, so history cannot be quietly rewritten.
• Attributable: the manifest is signed with an Ed25519 project key published at a fixed well-known path, with a key id so rotation is visible.
• Externally anchorable to a public timestamp service, giving “this existed before date X” from a clock we do not control.

08Blame, done responsibly

Marking origin is the point of the project, and it is also the fastest way to build something that ruins innocent people’s lives. A register that says “this claim started here” is one careless design decision away from being a machine for accusing whoever is named first. These rules are part of the product, not a policy bolted on afterwards.

None of this weakens the project. It is what makes the output citable by journalists and defensible in a lawyer’s office — which is exactly where a provenance tool has to survive if it is going to hold anyone accountable at all.

09Licensing & legal posture

Public builds draw only on sources with a documented public licence: Wikipedia (CC BY-SA), Irish public sector (eGov/OGL), US federal (.gov, public domain), EU institutions (CC BY 4.0), plus named CC BY 4.0 publishers. News domains stay out of the public build entirely until explicitly cleared — the exposure there is real and the value is not worth it.

• Attribution is enforced by the schema. Where a licence requires attribution or share-alike, the record carries the licence identifier and the attribution string; the public build refuses records whose attribution cannot be stated.
• Our own metadata is released permissively — identifiers, URLs, licences, hashes, manifests, origin and propagation data — so mirrors and tooling have no friction. Claim text inherits its source’s licence and is marked as such.
• Defamation and database rights reviewed before origin claims go public at scale. Naming an origin is a factual statement and we can evidence it; the page language, the reply mechanism and the coverage caveat keep it in the realm of fact rather than accusation.
• No personal data. Claims are statements about the world, not about people. Anything person-shaped is excluded by rule and audited.

10Distribution & growth

• Badges first. A one-line embed carrying the origin and the record count, linking back. Every badge is a durable citation of the register and a crawlable link. This is the growth engine; the API is the product for machines.
• Dataset releases. Signed nightly manifests plus periodic full dumps, so mirrors, researchers and model builders consume without hammering the origin.
• Origin checking for tooling. A small helper: given a passage, return the matching assertion, its origin record, its propagation list and its licence. This is the bridge from the register into retrieval and model pipelines — the natural place to fix rumour laundering at the source.
• Reference ecosystems. Wikidata, open-data portals, academic libraries, data-journalism toolkits and fact-checking organisations are the natural places to be listed, cited and forked. Fact-checkers get the origin chain they currently assemble by hand.
• Discoverability. Public claim pages, sitemap, open licence, and a dataset identifier so the register can be cited academically.

What we do not chase: no paid tier, no rate-limit business model, no news corpus, no truth verdicts. The register’s value rises with the number of independent users and mirrors, and both collapse the moment access is gated or the output becomes a judgement call.

11Scale & cost

Extraction is rule-based, so cost scales with bytes fetched rather than tokens, and the origin and propagation views are queries over rows we already hold. The dominant long-run cost is storage and bandwidth, and both fall once claim pages are exported statically.

12Risks

13Ownership & governance

• Neutral project, not a company asset. Its own name and domain, with a plain “built by” line to the originating studio. Credibility with libraries, newsrooms and public bodies depends on that separation.
• One append-only decision log. Licence policy, id version, key rotation, opt-outs and corrections are recorded with their evidence, so a future maintainer sees why as well as what.
• Key custody. The signing key stays with the project owner; the public key is published; rotation is announced inside the manifest chain so it can never be mistaken for tampering.
• Roles. One primary maintainer, with workstreams farmed out and every landed change independently re-derived by someone other than whoever built it. Self-reports are not evidence; claims are recomputed on the box.

14Milestones & KPIs

KPIs we will report

15What is not ready

• Origin and propagation are visible nowhere. The dates and sources needed to compute them are in the register, but no page or badge shows an origin line or a repetition list. Today the register cannot answer the question the project exists to answer.
• Coverage is thin and narrow. 16 domains, mostly Irish and European, crawled from September 2026. “First seen” therefore means first seen by us, in a small window — the §03 caveat is load-bearing until the corpus is much wider.
• The licence gate is wrong for 270 records — withheld though openly licensed. Until Phase 1 lands the public register understates the corpus by roughly 20%.
• No badge or stamp route is live. The endpoints are being built now; there is no embed surface at all today.
• Per-claim identity does not exist in production. The two-level scheme and Merkle commitment are proven on the real data, but the pipeline still stores page digests, and one export path double-prefixes the digest field.
• Nothing is signed and nothing is anchored. No published key, so today’s releases cannot be independently verified.
• No right-of-reply or opt-out mechanism exists yet. §08 is a specification, not a shipped feature, and must ship with — or before — the first public origin claim.
• No legal review of origin language at scale. Naming a first publisher is a factual, evidenced statement; the wording and the reply path still need sign-off before promotion.
• No public dataset dump, no citation identifier, no mirror — nothing yet survives the origin going away.
• Scale path untested. SQLite on a single instance is fine at 1.5k claims and unproven past a few hundred thousand.

16Next five actions

The register is only useful if it outlives us and can be checked without us — and it is only responsible if it names where a claim came from without ever pretending to name who is guilty.