Reuse retained artifact evidence • tempest

Graft preserves exact research contents and explicit host review decisions. Tempest validates scientific evidence and admits it to a research run. Applications own approval, access, purpose, and current eligibility.

Publish and review completed research

The installed offline example below uses independently pinned promotion bundles from synthetic completed Tempest products. It publishes the complete evidence and readable synthesis using the same public functions as live products.

library(tempest)
example <- new.env()
sys.source(system.file("examples", "artifact-research.R", package = "tempest"), example)
evidence <- example$artifact_research_example()
evidence
#> $evidence_records
#> [1] 4
#> 
#> $historical_report_retained
#> [1] TRUE
#> 
#> $unchanged_review_is_distinct
#> [1] TRUE
#> 
#> $corrected_selection_is_distinct
#> [1] TRUE
#> 
#> $withdrawal_blocks_reuse
#> [1] TRUE
#> 
#> $retry_preserves_withdrawal
#> [1] TRUE

With a completed result from tempest_run() or tempest_session(), use:

store <- graft::graft_store("research-store", create = TRUE)
selection <- tempest_publish_artifact_research(result, store)
# Review the report and evidence before explicitly accepting.
tempest_read_artifact_research(store, selection)
accepted <- graft::graft_accept(
  store, graft::graft_read_selection(store, selection), "pilot",
  expected = NULL, key = "review-1",
  actor = "reviewer", reason = "Evidence reviewed", purpose = "daily-briefing"
)
knowledge <- tempest_reuse_artifact_research(
  store, "pilot", accepted@id, "daily-briefing",
  eligible = function(decision) host_can_consult(decision)
)
result <- tempest_run("Pilot recovery briefing", knowledge = knowledge)

The host callback runs when knowledge is constructed and again at admission. Withdrawal, correction, wrong purpose, or missing content prevents a cached knowledge value from entering another run. A new unchanged review retains the selection but has its own decision identity. Identical decision retries return the original event without reapproving withdrawn knowledge.

The report remains synthesis, not primary evidence. Program identities remain inert provenance, not executable tools. Historical inspection stays available separately from current reuse. The trusted local store has one writer; access, active-task cancellation, backup, and permanent erasure remain host concerns.

Build an exact input

This small example represents two artifacts already retained and selected by a host. In an application, read the references and content from the artifact store and check current eligibility before constructing the input.

library(tempest)
contents <- list(
  "claim:pilot" = "statement_text: The pilot recovered 82%.\nstatus: active",
  "source:pilot" = "excerpt: The pilot recovered 82%."
)
refs <- lapply(names(contents), function(id) {
  list(
    record_id = id,
    revision_id = "revision:1",
    class = if (startsWith(id, "claim")) "Claim" else "Source",
    sha256 = digest::digest(charToRaw(enc2utf8(contents[[id]])),
      algo = "sha256", serialize = FALSE),
    dependencies = if (startsWith(id, "claim")) {
      list(list(record_id = "source:pilot", revision_id = "revision:1"))
    } else {
      list()
    }
  )
})
selection <- list(
  selection_id = "selection:pilot-briefing-1",
  purpose = "daily-briefing",
  records = refs,
  provenance = list(producer = "synthetic-pilot")
)
knowledge <- tempest_artifact_knowledge(selection, contents)
knowledge
#> <tempest_knowledge>
#> • artifact selection: "selection:pilot-briefing-1"
#> • accepted records: 2

Each selected record has an immutable revision reference and the SHA-256 digest of its UTF-8 content bytes. The contents must cover every selected record exactly once. Every declared dependency must resolve to the exact selected revision. Supported evidence classes are Claim, ClaimSupport, EvidenceSpan, and Source. The host supplies the complete required selection; Tempest does not infer omitted relationships or authenticate the host’s acceptance decision.

Only inert text is admitted. Claims use the accepted projection’s statement_text: ... and status: ... fields for briefing change detection. An active statement already present in this input can support a no-change item; a superseded or retracted statement cannot. Storing code or instructions does not make them tools, prompts, or governed procedures.

Use it in a new run

result <- tempest_run("Pilot recovery briefing", knowledge = knowledge)
session <- tempest_session("Pilot recovery briefing", knowledge = knowledge)
tempest_session_save(session, "briefing-session")

# Check the host's current access and eligibility policy again before resuming.
resumed <- tempest_session_resume(
  "briefing-session", config = tempest_config(), knowledge = knowledge
)

The workspace retains the full input selection and evidence resources. Session bundles include the selection in session.json and checksummed resource content. STORM bundles retain it in their workspace identity and evidence snapshot. The selection’s input digest binds its description, separately from a native Graft snapshot, receipt, or acceptance event. Source receipts and other source identities can be retained as inert provenance data.

A correction gets a new artifact revision and a new selection. A new run can use that selection while the previous run still resolves its original evidence. Saving and resuming preserves the historical input; it does not freeze permission or automatically reapprove withdrawn knowledge. The host must enforce current eligibility before starting or resuming work. STORM and Co-STORM validate new-run arguments and the supplied retriever before invoking the admission callback. Co-STORM restore validates its saved snapshot and new progress callback, then uses the constructor’s input checks before admission. Freshly admitted artifact knowledge must match the saved selection. Stored procedure references are inert provenance, and live research programs are selected independently by the host. A new run requires an open workspace whose pinned artifact selection matches its knowledge input. These checks do not modify the supplied workspace. The Shiny adapter applies the same check when constructing or restoring a session. Preliminary persona generation receives no artifact knowledge; the constructor checks admission before materializing accepted evidence. This constructor does not monitor policy changes during an active run. Re-admitting the same artifact input for STORM resume preserves the saved research state and original retrieval times; a later read time alone does not make the immutable input different. You can reuse a completed run’s retriever: its sealed workspace is compared with the saved state and retained without reinserting evidence. Resume checks the supplied workspace against the saved evidence and required mutation state before invoking admission; restoration occurs only after admission succeeds.

Researching a correction

The offline correction proof executes two complete STORM runs with scripted chats and synthetic local sources. The second run receives the exact accepted selection, processes contradictory evidence, and produces an observation rather than a no-change result.

Publishing the correction makes a proposal available for review. The host must explicitly accept it before it replaces the current decision. The original report, source contents, spans, and supports remain readable, including supports absent from the correction. A fresh process reopens both the historical selection and the new accepted selection. Retrying the original acceptance cannot restore it as the current decision.

Run this proof from a package checkout:

# Scripted chats; no model or network access required.
devtools::test(filter = "^artifact-correction$")

This verifies execution and revision behavior. Scientific correctness and production access policy still require application-specific evaluation.

Retaining the input basis

Every new STORM and Co-STORM research manifest retains the exact artifact selection supplied to the run, including record revisions, content digests, dependencies, purpose, and host provenance. The manifest must match the workspace when research is saved, restored, or published. A correction therefore records which accepted evidence it consulted even after the current decision changes.

The manifest contains references, not a second copy of every input artifact. Keep the referenced selection and its contents in the artifact store. Reading those references does not grant current reuse permission or program execution authority. New execution still requires current admission.

Research manifests use schema 5. Earlier preproduction manifests must be regenerated; no compatibility conversion is provided.

Scope and current formats

The input is bounded to 1,000 records, 1 MiB of selection metadata, and 1 MiB of text content. The Graft publisher reserves two additional artifacts for the report and proposal, so it accepts up to 998 evidence records. The verified promotion bundle also retains exact source proofs and program provenance. Graft enforces aggregate payload, revision metadata, and selection bounds. Publication may leave unreferenced artifacts on failure; it never implies acceptance.

Resume requires explicit fresh knowledge with the exact saved selection and decision provenance. Policy callbacks and store handles are not serialized. Supplying a later corrected decision does not rewrite an earlier session. Concurrent publication, permanent deletion, and production recovery remain separate work. Native graph promotion is scheduled for removal after consumer adoption is proved.

Workspace format 6, STORM format 9, and Co-STORM format 12 retain artifact inputs. This project is pre-production: regenerate older experimental bundles instead of using a compatibility reader.