1.8 KiB
Decision: VeriPath Owns Canonical Truth — GeoLocal Is Read-Only
Date: 2026-08-12
Status: Accepted
Owner: Tony / VeriPath
Scope: Architecture | Product | Governance
Context
Early architecture discussions treated VeriPath and GeoLocal as peers that could both read and mutate the canonical business record. This creates two competing authorities, which undermines trust and evidence discipline. There must be exactly one system of record.
Decision
VeriPath is the sole system of record for all business evidence, canonical records, and provenance. GeoLocal may consume approved projections from VeriPath but may never independently mutate canonical truth. Any correction or update request originating from GeoLocal must route back to VeriPath for review and approval.
Alternatives considered
- Dual-write with eventual consistency (Rejected: introduces conflict resolution complexity and erodes the single source of truth).
- GeoLocal as the system of record (Rejected: GeoLocal is agent-access infrastructure; VeriPath owns the evidence-gathering workflow).
Consequences
- Easier: Clear ownership of evidence, freshness, and approval boundaries. Audit trail remains in one place.
- Harder: GeoLocal cannot shortcut corrections; it must delegate back to VeriPath.
- Prohibited: GeoLocal writing to canonical fields, bypassing VeriPath approval, or presenting derived data as authoritative truth.
Revisit trigger
Only if VeriPath and GeoLocal are formally merged into a single legal entity and the organizational boundary no longer exists. Until then, the boundary remains.
Related documents
docs/decisions/2026-08-13-narrowing-scope-veripath-first.mddocs/architecture/canonical-business-record-v0.1.1.mddocs/architecture/evidence-freshness-policy-v0.1.md