TRUST
A school board and a newspaper will repeat what comes out of this system. Every rule below is downstream of that.
Most of these are enforced by the database rather than asked of the code, because a rule the code has to remember is a rule that eventually gets forgotten.
A passage that cannot prove where it came from is rejected when the document is compiled, and the rejection is surfaced rather than quietly repaired at question time.
Every passage carries the document, its title, its date, the page it sits on, and a link to the hosted copy that opens on that page. Every figure adds its unit and the verbatim quote from the cited page.
Numbers come from a checked registry and never from prose. If a metric is not in the registry, the honest answer is that it is not verified yet. Re-reading a figure out of a retrieved paragraph is how a wrong dollar amount reaches a board meeting, and it is the failure this system was built to make impossible.
The corpus is a public body's own published records, and nothing else. If provenance for a document cannot be stated publicly, it does not belong in the corpus.
The district's own records are the center of it. Records another public body publishes about the district, such as a state education agency's report cards or a county filing, are kept separately and carry that body as their publisher.
Nothing we produce is a document. Not a transcription, not an extract, not a compiled profile, not an analysis. Where a derived artifact was the only route to a figure, the official source behind it is what enters the corpus and the figure enters through the verifier.
Because the record is already public, ANTON creates no new disclosure obligation and no new publishing work. It makes what a district already published answerable.
Each district has its own compiled set of records and its own figures, kept apart from every other district's, and all of it served from one store.
Every row is stamped with the district it belongs to, and the database itself has enforced the separation since the first day, rather than software that could have a bug. Retrofitting isolation onto a live corpus is a migration nobody wants to run under a deadline, so it was never deferred.
Isolation is tested rather than asserted. The test suite sets up two districts and checks that, signed in as one, a search returns zero rows from the other and still returns a full set of its own. An unauthenticated caller gets nothing at all.
search, get_facts, compare_periods, overview, fetch. ANTON cannot create, edit, or delete a district record.
This is enforced by the permissions the serving role holds, not by the absence of a feature. No role the server runs as has the right to update or delete a record, so a write is not something a bug could reach.
Loading new documents is a separate local job, run before deployment, over a fixed corpus. It has no route through the served surface.
Access is granted and revoked one person at a time. The district decides who is on the list, and can take someone off it without involving us.
Every document ANTON serves is already a public record, so the sign-in is not protecting the contents. It exists so that a question can be attributed to the person who asked it, which is what makes the log worth keeping.
There is no shared password and no API key handed to staff. A person signs in as themselves, the same way they would for any other site.
The log is written once and never edited. It carries the operation, the question, what came back, how long it took, the district it was served for, and the identity behind the assistant.
A retrieval quality argument is only as good as the record of what was actually asked. An operation that returns a result without recording who asked for it is not finished.
The log also gives a district a straightforward answer to the question a board will eventually ask, which is who has been using this and what have they been asking.
Nothing in the corpus or the registry is overwritten or deleted. A correcting row points back at the row it replaces.
When a district re-files a corrected figure, the new row takes over and the old one stops being served. When a document is superseded, every figure on it goes out of service on its own, without anyone remembering to withdraw them.
You only ever see the current, verified figure. What was served before is still there, which is what lets an old answer be explained rather than denied.
PROVENANCE STATUS
Every document in the pilot corpus was published by a public body. Not every one still sits at a live public address, and each document carries its status rather than an assumption.
Most of the corpus
The document links back to the public URL it was fetched from, and that URL still resolves.
A few documents
Published by the district and later removed from its site. They are served with an archive caveat attached to every passage they produce.
Some documents
Held while their original public link is recovered. They are still cited page-exactly against the hosted copy, and the gap is stated rather than papered over.
Closing that gap is ordinary corpus work, and it is tracked as such. Saying which documents are in which state is cheaper than being asked later.
Numbers come only from a checked registry, and absence is reported as absence. The failure mode of a general chatbot at a board meeting cannot occur here, and that is a property of the design rather than a promise about behavior.