HOW IT WORKS

Compile, verify, serve, correct.

Four stages, in that order, each with its own cadence. Nothing downstream is allowed to fix what an earlier stage got wrong.

Claude or ChatGPT does the reasoning and the writing. ANTON does the lookup, the provenance, and the numbers. Everything below is in service of one property: an answer you can hand to a board member or a reporter without checking it first.

CONNECTING

One connector, added once.

ANTON is added the same way any other connector is added to Claude or ChatGPT. Nobody on the district side installs anything.

Step 1
In Claude or ChatGPT, open connector settings and add the district's ANTON address.
Step 2
Sign in. Access is granted per person against a list the district controls.
Step 3
Ask a question in plain language. The assistant calls ANTON when it needs a record or a figure.

The sign-in is not protecting the documents; they are public records. It is there so a question can be traced back to who asked it.

Request access

THE PIPELINE

What happens to a document between publication and an answer.

A document enters once, is checked once, and is served many times. The checking is mechanical, and it happens before anyone asks a question.

01ONCE PER RELEASE

Compile

The corpus is a fixed set of files plus one manifest row per document.

Every document is registered with its id, type, date, publisher, source URL, and file fingerprint. Pages are extracted and stored as written, because a quote is checked against a page, not against a paraphrase of one.

Text is split into passages of a few hundred tokens that never cross a table, and each passage stays tied to the page it sits on. A copy of every file is hosted so a citation can point at a page anchor rather than at a download.

Idempotent: Ingest is keyed by file hash. Running it twice over the same corpus inserts nothing the second time; a manifest with one new document processes only that document.
Extraction is auditable: Every row records how its text was extracted, so a bad extractor can be traced after the fact. Optical character recognition is a fallback for scanned pages only and is never run over a real text layer.
Nothing we wrote is a document: A transcription, an extract, or an analysis is never registered as a source. Only a public body's own published record is.

02AT INGEST

Verify the numbers

Figures are typed rows that passed a check, not sentences that looked numeric.

Each figure is recorded as a row carrying its metric, period, dimensions, value, unit, page, and the verbatim quote it came from. Re-reading a number out of retrieved prose at question time is precisely the failure this system exists to prevent.

A row is served only when two things hold: its quote appears verbatim on the cited page, and its arithmetic checks pass. Line items sum to their totals. A rate equals collected over billed. Year over year stays inside sanity bands. Anything that fails goes to a review queue and is never served.

Checks are never widened: A row that will not pass is fixed or superseded. Loosening a check so a figure can be shown would make every other figure worth less.
Not verified is a real answer: If a metric is not in the registry, ANTON says it is not verified yet. It does not fall back to a number sitting in a paragraph.
Units travel with values: A figure without a unit and a quote cannot be written at all. Both columns are required.

03PER QUESTION

Serve

Five read-only operations over a connector, which is one address added once in the assistant's own settings.

Keyword ranking and meaning-based ranking are fused by reciprocal rank inside a single database function, in one round trip. That is what lets a question asked in the board's words find the passage written in the staff's words.

Every response carries provenance and an explicit coverage verdict. Every call is logged against the district it was served for and the identity that asked it.

No new software: A connector inside Claude or ChatGPT, which is where the work already happens. No application to install, no infrastructure for district IT to host, no training programme.
Read-only by grant, not by convention: The role the serving system runs as has no right to update or delete. It is not a rule the code has to remember.
Isolation on every query path: The database reads which district a person belongs to from their sign-in and refuses to hand back anyone else's rows. There is no query path that skips it.

04ONGOING

Correct without rewriting

A correction is a new row pointing back at what it replaces.

Nothing is ever overwritten or deleted. When a district re-files a corrected figure, the new row supersedes the old one and the old one stops being served. When a document is superseded, every figure on it goes out of service automatically.

You only ever see the current, verified number. Nothing is silently edited behind it, and the history of what was once served stays intact.

Nothing is ever erased: Corrections are added on top of what is already there. No role in the system holds the right to update or delete a served record, so this is a property of the database rather than a habit somebody has to keep.
A cited document never disappears: A document that was ever cited is never removed. A better scan does not get to rewrite what an old answer pointed at.

THE FIVE OPERATIONS

The whole surface, in detail.

Five operations, all read-only. ANTON cannot create, edit, or delete a district record. A staff member never has to learn any of these names; the assistant picks the right one.

`search`

USE IT WHEN: The question is about what the records say: a decision, a discussion, a policy, an exact wording.
WHAT COMES BACK: Passages, each with document, title, date, page, and a link that opens the hosted copy on that page.

Narrow it by document type and by date range when the question is already specific. Keyword and meaning-based ranking run together, so a paraphrase of the board's language still lands on the staff's sentence.

`get_facts`

USE IT WHEN: The answer is an amount, a rate, or a count. Any figure at all.
WHAT COMES BACK: Each figure with its unit, its period, its page, a page-exact link, and the verbatim quote it was checked against.

This is the only place a number is allowed to come from. When it returns nothing, the correct answer is that the figure is not verified yet, not a value lifted out of a nearby paragraph.

`compare_periods`

USE IT WHEN: You want one metric across several periods, side by side.
WHAT COMES BACK: Each period's figure with its own citation, and the document each side came from.

It reads the same verified rows that get_facts reads. Nothing is interpolated and nothing is derived. A trend is published numbers placed next to each other.

`overview`

USE IT WHEN: You are orienting, or a search came back empty and you want to know whether the corpus covers the subject at all.
WHAT COMES BACK: Counts by document type, date coverage, and the most recent documents. With a topic, the documents most relevant to it.

Useful before a search as much as after one. It answers the question staff ask first, which is what is even in here.

`fetch`

USE IT WHEN: You have a citation and want to read the figure in the context of its page.
WHAT COMES BACK: The stored text of the pages behind a known id, with its provenance attached.

It takes an id, not a question. Give it a passage id to read every page that passage spans, or a document id to read the whole thing.

None of the five can write. That is the surface, complete, and it is meant to stay small.

COVERAGE AND ABSTENTION

Every response says how far the record actually goes.

A response without passages is never reported as a clean answer, and a response that cannot judge absence never claims it.

OK: The corpus covers the question and the passages returned are the ones that answer it.
NO MATCHING DOCUMENTS: The corpus holds documents of this kind, but none that match the filters as asked.
NOT IN CORPUS: The subject is outside what this district's compiled record covers. ANTON points at where the district actually publishes.
INCONCLUSIVE: Absence cannot be judged from this result. Passages may still come back, but nothing here supports the claim that the record is silent.

When a question cannot be embedded, search falls back to keyword ranking alone. The response says so, and its verdict drops to inconclusive: passages are still served, absence is never claimed on a degraded run.

Abstention is a designed behavior, not a failure state. A question the record cannot support gets a plain statement to that effect rather than the least-bad passage.

RETRIEVAL QUALITY BAR

Two numbers, and neither counts without the other.

Retrieval quality is measured against a district's own questions, each with the page that answers it, before any change to ranking ships.

18 / 20EVAL QUESTIONS RETURN THE RIGHT PASSAGE IN THE TOP FIVE

under 1.5 sSEARCH RESPONSE TIME

all of themABSTENTION QUESTIONS MUST ABSTAIN

The eval set is a district's real questions, each paired with the document and page that answers it. Any change to chunking, embeddings, ranking weights, the fusion function, or filters is a behavior change: the set runs before and after, and both numbers go in the record of the change.

The abstention set is the other half. It holds questions the corpus provably cannot answer, and it gates the floor, which is the bar a passage must clear when nothing in it matched on keywords. Raising the floor makes abstention easier and recall harder, so the two numbers are only ever claimed together, from the same questions file, run with the floor off and the floor on.

Every question in the abstention set has to abstain. That bar is all of them, and like every other check here it is never loosened to make a change look good.

LOOKS MORE RELEVANT IS NOT A RESULT.