Skip to content

Classification v1

Source schema: doc/schemas/classification.v1.schema.json

Machine-readable schema for the Memarium classification label that travels with data across component boundaries. The label distinguishes the immutable source_tier (stamped once at first ingress or write) from the derived effective_tier (computed from source_tier and any currently-active DeclassifyFact in declassify_trail). Declassification never rewrites source_tier; it appends a fact to the trail. The lattice is intentionally small (Personal > Community > Public) with most-restrictive-wins semantics on merge.

Governing Basis

Project Lineage

Requirements

Stories

Fields

Field Required Shape Description
schema yes const: classification.v1 Content-level discriminator for consumers that inspect the label outside its enclosing envelope.
source_tier yes ref: #/$defs/Tier Immutable classification assigned at first stamping (write into Memarium, ingress from outside, or operator acceptance out of quarantine). Never rewritten. A request that attempts to change source_tier MUST be rejected with reason: source_tier_immutable.
effective_tier yes ref: #/$defs/Tier Derived tier used by egress guards. Equals source_tier unless at least one DeclassifyFact in declassify_trail is currently active (TTL valid, not revoked, not consumed for one-shot, and whose surface/topic_class bind to the current request). Consumers MUST treat effective_tier as a cached derivation of source_tier and declassify_trail — it MUST NOT exceed source_tier in the lattice order (i.e. it is never more restrictive than the source).
provenance yes ref: #/$defs/SpaceOrigin Where the data first entered the system. For locally written facts: the target Memarium space. For ingress from a peer or import: the ingress origin. For derivations: a two-parent reference summarizing the joined inputs.
bound_subjects yes ref: #/$defs/BoundSubjects Tier-dependent projection of the subjects whose dignity interests attach to the fact. Egress to Public surfaces MUST carry only public_projection and MUST NOT carry personal_or_community. Violation is rejected with reason: bound_subjects_not_public.
declassify_trail yes array Append-only, time-ordered history of declassification acts. Possibly empty. Readers compute effective_tier from this trail; they MUST NOT infer classification from the trail alone without source_tier. Transformation facts may be referenced as evidence, but they do not lower classification by themselves in v1.
quarantine no ref: #/$defs/QuarantineMarker Present iff the fact is currently in ingress quarantine (no operator acceptance yet). Guarded reads of a quarantined fact MUST be rejected with reason: quarantined.

Definitions

Definition Shape Description
Tier enum: Personal, Community, Public Small boring lattice. Personal is top (most restrictive), Public is bottom (least restrictive), Community strictly between. Sub-tiers (Internal/Secret/Restricted) are intentionally NOT part of v1 — added only when a concrete edge guard would enforce them. Crisis is orthogonal and carried as a flag on the bearer, not a tier.
SpaceOrigin unspecified Origin of the data. Either a local Memarium space, an external ingress point, or a derivation over parent origins.
BoundSubjects object Tier-dependent projection. Exactly one branch is populated; the choice MUST match effective_tier. Carrying the wrong branch at egress is rejected with reason: bound_subjects_not_public (for Public egress) or classification_mismatch otherwise.
SubjectRef object Reference to a subject whose dignity interests attach to the fact.
PublicProjection object
DeclassifyFact object
TransformationKind enum: k-anonymization, histogram, summary, embedding, redaction, other Evidence-only transformation class. In v1, a TransformationFact is provenance for a DeclassifyFact, not an authorization to lower effective_tier.
TransformationFact object Append-only provenance fact for aggregation, redaction, embedding, or summarization. It can be referenced from DeclassifyFact.evidence_ref, but never changes effective_tier on its own.
QuarantineMarker object Marker indicating that the fact has not yet been accepted by the operator out of the ingress quarantine. While present, guarded reads/publishes MUST be rejected with reason: quarantined.

Conditional Rules

Rule 1

When:

{
  "properties": {
    "source_tier": {
      "const": "Public"
    }
  },
  "required": [
    "source_tier"
  ]
}

Then:

{
  "properties": {
    "effective_tier": {
      "const": "Public"
    }
  }
}

Rule 2

When:

{
  "properties": {
    "source_tier": {
      "const": "Community"
    }
  },
  "required": [
    "source_tier"
  ]
}

Then:

{
  "properties": {
    "effective_tier": {
      "enum": [
        "Community",
        "Public"
      ]
    }
  }
}

Rule 3

When:

{
  "properties": {
    "effective_tier": {
      "const": "Public"
    }
  },
  "required": [
    "effective_tier"
  ]
}

Then:

{
  "properties": {
    "bound_subjects": {
      "required": [
        "public_projection"
      ],
      "not": {
        "required": [
          "personal_or_community"
        ]
      }
    }
  }
}

Field Semantics

schema

  • Required: yes
  • Shape: const: classification.v1

Content-level discriminator for consumers that inspect the label outside its enclosing envelope.

source_tier

  • Required: yes
  • Shape: ref: #/$defs/Tier

Immutable classification assigned at first stamping (write into Memarium, ingress from outside, or operator acceptance out of quarantine). Never rewritten. A request that attempts to change source_tier MUST be rejected with reason: source_tier_immutable.

effective_tier

  • Required: yes
  • Shape: ref: #/$defs/Tier

Derived tier used by egress guards. Equals source_tier unless at least one DeclassifyFact in declassify_trail is currently active (TTL valid, not revoked, not consumed for one-shot, and whose surface/topic_class bind to the current request). Consumers MUST treat effective_tier as a cached derivation of source_tier and declassify_trail — it MUST NOT exceed source_tier in the lattice order (i.e. it is never more restrictive than the source).

provenance

  • Required: yes
  • Shape: ref: #/$defs/SpaceOrigin

Where the data first entered the system. For locally written facts: the target Memarium space. For ingress from a peer or import: the ingress origin. For derivations: a two-parent reference summarizing the joined inputs.

bound_subjects

  • Required: yes
  • Shape: ref: #/$defs/BoundSubjects

Tier-dependent projection of the subjects whose dignity interests attach to the fact. Egress to Public surfaces MUST carry only public_projection and MUST NOT carry personal_or_community. Violation is rejected with reason: bound_subjects_not_public.

declassify_trail

  • Required: yes
  • Shape: array

Append-only, time-ordered history of declassification acts. Possibly empty. Readers compute effective_tier from this trail; they MUST NOT infer classification from the trail alone without source_tier. Transformation facts may be referenced as evidence, but they do not lower classification by themselves in v1.

quarantine

  • Required: no
  • Shape: ref: #/$defs/QuarantineMarker

Present iff the fact is currently in ingress quarantine (no operator acceptance yet). Guarded reads of a quarantined fact MUST be rejected with reason: quarantined.

Definition Semantics

$defs.Tier

  • Shape: enum: Personal, Community, Public

Small boring lattice. Personal is top (most restrictive), Public is bottom (least restrictive), Community strictly between. Sub-tiers (Internal/Secret/Restricted) are intentionally NOT part of v1 — added only when a concrete edge guard would enforce them. Crisis is orthogonal and carried as a flag on the bearer, not a tier.

$defs.SpaceOrigin

  • Shape: unspecified

Origin of the data. Either a local Memarium space, an external ingress point, or a derivation over parent origins.

$defs.BoundSubjects

  • Shape: object

Tier-dependent projection. Exactly one branch is populated; the choice MUST match effective_tier. Carrying the wrong branch at egress is rejected with reason: bound_subjects_not_public (for Public egress) or classification_mismatch otherwise.

$defs.SubjectRef

  • Shape: object

Reference to a subject whose dignity interests attach to the fact.

$defs.PublicProjection

  • Shape: object

$defs.DeclassifyFact

  • Shape: object

$defs.TransformationKind

  • Shape: enum: k-anonymization, histogram, summary, embedding, redaction, other

Evidence-only transformation class. In v1, a TransformationFact is provenance for a DeclassifyFact, not an authorization to lower effective_tier.

$defs.TransformationFact

  • Shape: object

Append-only provenance fact for aggregation, redaction, embedding, or summarization. It can be referenced from DeclassifyFact.evidence_ref, but never changes effective_tier on its own.

$defs.QuarantineMarker

  • Shape: object

Marker indicating that the fact has not yet been accepted by the operator out of the ingress quarantine. While present, guarded reads/publishes MUST be rejected with reason: quarantined.