Four kinds of source

AssessMealPracticality must decide whether a traybake fits Thursday evening. Its contract lists required inputs: evening time budget, oven availability, endorsed allergy constraints, and the candidate recipe structure. Some values arrive from the household request this week. Some from endorsed preference records. Some from deterministic calendar integration. One field, "family tends to dislike creamy sauces," appears because retrieval surfaced an old chat thread with no approval event.

The cognitive unit cannot treat those inputs as interchangeable. Provenance determines whether judgment may proceed, defer to a human, abstain, or refuse. When sources mix without labels, the least trustworthy input dominates, and failures look like model flakiness when they are architecture gaps.

This page is the canonical home for source classification at judgment boundaries. Six forms of memory names where facts live over time. Knowledge is endorsed, not retrieved explains approval for durable belief. Least trustworthy input wins states the composition rule when sources combine.

The four kinds and why classification precedes the call

Approved sources carry endorsement: an authority granted scope for the system to treat a fact as durable and actionable. Leena's confirmed cashew allergy in the household knowledge store is approved, with approver, date, scope, and enforcement path present. Approved sources may drive deterministic guards and product copy that uses "knows."

System sources come from governed infrastructure with inspectable provenance: calendar APIs validated by schema checks, ledger totals from accounting systems, invoice IDs from document stores, configuration emitted by release pipelines. System sources are not "model beliefs." They are records whose origin and transformation chain can be named.

Observed sources are runtime inputs supplied for this pursuit: the originating household sentence, temporary "avoid pasta this week," OCR field values awaiting verification, clerk paste into an exception form. Observed material informs judgment but does not create belief until promotion through approval.

Unaccountable sources cannot be traced or verified: model guesses without citation, retrieval hits with unknown freshness, web snippets without provenance, prompt fragments copied from another team's template. Unaccountable material may propose. It must not decide without crossing endorsement, abstention, or human review gates.

A result is only as trustworthy as the least trustworthy thing that shaped it.

The cognitive unit · Pr. 26

cognitive units declare contracts: required inputs, optional inputs, abstention conditions. Source classification belongs in contract design before prompt work. Teams that skip classification discover failures in production when observed chat overrides approved allergy rules or when unaccountable retrieval fills a hole the contract treated as endorsed. Classification also clarifies who must act when a hole cannot be filled safely. Approved missing means escalation to authority with endorsement path. System missing means retry, fallback, or block. Observed missing means asking a targeted question. Unaccountable present means abstention, deferral, or required bridging under approval.

How sources compose

Input	Source kind	Obligation
"Tuesday and Thursday are busy" (this week's request)	Observed	Context for run, expires
Cashew allergy in preference store	Approved	Enforce in deterministic shell
Calendar busy flags from integrated API	System	Validate schema, do not re-interpret casually
"Maybe sensitivity to cashews?" from old chat retrieval	Unaccountable	Must not override approved allergy
Busy Week Pattern v0.2 from expertise library	Approved + system metadata	Guard must pass, version pinned
Model-inferred "household prefers Italian"	Unaccountable	Propose only, no silent merge to knowledge

The pattern repeats across domains. Field values from document OCR are observed until verification promotes them. Tax rules from finance policy stores are approved. Totals from the general ledger are system. A model guess with no citation remains unaccountable until a human or endorsement path promotes it.

When multiple sources supply the same hole, least trustworthy input wins applies. Every source that influenced the filled hole is listed and ranked by governance strength, with approved and system highest and unaccountable lowest. Paths where unaccountable material can override approved or system facts are blocked. Explicit bridging is required when observed material is promoted to approved knowledge. Retrieval may surface candidates, but approval creates belief, and deterministic code enforces approved facts even when generation narrates differently.

Source mistakes cluster at seams: where retrieval meets knowledge stores, where one cognitive unit hands output to another without joint evaluation, where human paste enters context beside endorsed records. Two green cognitive unit suites can still fail when the join passes unaccountable material into a hole the downstream contract labels approved. Inspecting pipelines as source graphs rather than model graphs reveals these failures. For each edge, the productive question is: what kind of source crosses here, and what gate applies?

Consider JudgeHouseholdFit evaluating whether a candidate meal aligns with household intent. Its contract requires endorsed dislikes (approved, knowledge if persisted), this week's temporary avoid list (observed, context), calendar-derived busy flags (system, validated context), and retrieval about what "similar households liked" (unaccountable, must not fill the hole). The cognitive unit may proceed when approved and system holes are satisfied. Observed holes inform scoring. Unaccountable material triggers abstention or human review, never silent fill. Documenting this table in the cognitive unit spec lets eval assert violations deliberately.

Bridging, promotion, and designed exits

When a hole needs material that is available only as observed or unaccountable, the ecosystem provides structured paths rather than silent merge. Bridging fills a named gap under approval with explicit scope. Promotion moves observed patterns to endorsed knowledge with audit. Abstention returns a designed result when sources cannot meet the contract. Refusal stops when authority or safety forbids proceeding. See retrospection, bridging, and approval. Source classification tells you which path is mandatory.

When required holes cannot be filled with governed sources, the cognitive unit's contract specifies designed exits rather than hallucinated fill. An empty approved hole means deferral to authority with endorsement path, not guessing allergy status. A stale system hole means abstention or retry with idempotent fetch, not substituting model prior. An ambiguous observed hole means asking a targeted question via organisational cognitive unit, not widening context silently. An unaccountable-only hole means refusal or escalation, never presentation as verified. These exits appear in specs and eval scenarios so production behaviour matches trust promises.

Enterprise invoice processing repeats the same pattern. OCR text is observed until a clerk or rules engine verifies it. Tax policy codes are approved. Ledger totals are system. Model-guessed vendor category without citation is unaccountable until promotion. Posting workflows that treat OCR output as approved guarantee seam failures under volume. The architecture transfer test asks whether every input in a high-volume workflow can receive the same four labels. If it can, Thoughtware vocabulary is travelling. If it cannot, the pipeline still hides its weakest link.

Contracts, evaluation, and common mistakes

cognitive unit specifications list required inputs with expected source kinds. Evaluators can assert violations: "approved allergy missing," "unaccountable web fill used for tax code," "observed OCR passed as endorsed without verification event." Trajectory evaluation gains leverage when source transitions are logged: retrieval proposed, human approved, deterministic check fired. Without source typing, eval reduces to output substring matching.

The most common mistake is treating retrieval as approved because the hit was relevant. A close second is labelling model output as system because it passed JSON schema. Skipping source tags in APIs means downstream cognitive units cannot enforce composition rules. Assuming caller-supplied JSON is approved when it is observed paste opens the same gap. Bundling all four kinds into one "context blob" recreates the undifferentiated memory failure at the input boundary. Source classification at boundaries prevents these failures from compounding across composed pipelines.

Documenting source kinds in OpenAPI or protobuf schemas where possible prevents downstream services from accidentally downgrading governance at the wire format. The discipline is small per field but compounds across every judgment boundary in the system.

What to do next

For each input field in a cognitive unit spec, the source kind is named before implementation begins, because that label determines what gates apply, what exits are mandatory, and what composition rules hold when multiple sources fill the same hole. Drawing the pipeline as a source graph with weakest links and required gates marked reveals seam failures that output-only testing misses. Eval cases that deliberately inject unaccountable material at seams prove whether contracts hold under adversarial conditions.

See checkable grounds for what contracts must expose, knowledge is endorsed, not retrieved for the approved path, and the Thoughtware system for where source discipline sits in the whole architecture.

Read next: The ecosystem around cognition.