The Claim Ledger

This is the provenance discipline from Chapter 8, stripped down to a tool you can run today. It needs no particular model, no particular product, no particular year. The rule underneath all of it: a claim is not accepted until it can name where it came from. Consensus is cheap. Provenance is the part that costs you five minutes, and it is exactly the part that keeps you out of trouble.

Run it every time the AI hands you a summary, a plan, or a "done."

The procedure

• List every claim the AI made. One claim per line. No bundling, because bundled claims let a weak one hide behind a strong one.
• Mark each claim as one of four things. Fact: it points at a source you can check. Inference: reasoned from facts, and you name those facts right there on the line. Hypothesis: could be true, needs testing, treat it as a lead and not a finding. Unverified: confidence with nothing under it.
• For each fact, answer two questions. Where does it come from. Can I open that source myself, right now. A page you read, a test you ran, a row you queried, a document with a date on it. If you cannot open it, it is not a fact yet.
• For each claim, all four kinds, ask: what evidence would prove this wrong. A real claim can name its own undoing. If nobody can name a single thing that would break it, you are not looking at a fact. You are looking at a belief in a fact's clothes.
• Anything that cannot point to a source gets removed or demoted before it ships. Not flagged. Not footnoted. Out of the synthesis, into the holding pen, until it earns its way back.

The reason for the last step is the poison rule: one unprovable line sitting next to your true ones drags them all down. The reader, human or machine, hits the thing it cannot verify and starts distrusting the whole page.

A worked example

Say the AI just wired up a quote-request form on a client site and reports success. Ledger it.

• "The form posts to /api/quote and the handler exists." Fact. Source: the route file, and I can open it myself. What kills it: the file missing or the handler renamed.
• "Submissions are saved to the database." Unverified. The agent grepped the code, found the insert, called it done. Code present and data landing are two different facts. Demoted until I submit the form and query the table with my own hands. What kills it: no row.
• "The confirmation email should use the provider we already run." Inference. Named facts: the API key already exists in this stack, and the send is one call against a service we use elsewhere. Stays, marked as inference.
• "The old form failed because of a rate limit." Hypothesis. Nobody opened a log. It is a lead to chase, not a cause to write down. What kills it: the provider logs from the failure window showing something else.

Four confident lines came in. One was a fact. The ledger took five minutes, and it stopped the summary from quietly becoming the record.