Why land the duplicate instead of deduplicating on ingest?

Because the duplicate is information — it tells you the retry behavior exists. Ingest preserves; transformation corrects. Collapsing the two stages means you can never again distinguish what the source said from what you decided it meant.

Isn't keeping every wart expensive?

Compared to what it buys — replayability and evidence — bronze storage is one of the cheapest lines in the platform. The expensive thing is the question you can't answer because the original was destroyed by a well-meaning cleanup.

What happens at silver when a test fails?

The batch is held in quarantine, the failure alerts with the failing rows attached, and downstream models keep serving the last batch that passed. Nothing broken is promoted while someone decides whether the fix belongs in the data or in the rule.

Star schema in 2026 — really?

The names age; the discipline doesn't. Declared grain, conformed dimensions, additive facts — every semantic layer that works is enforcing those properties, whatever it calls them. The schema is how the contract stays checkable.

Who approves a change to this file?

The named owner — here, finance — reviews the rendered meaning; engineering reviews the implementation; CI runs the contract tests. It merges like any production change, because it is one.

What does the agent do with a question the contract doesn't cover?

It refuses, and says why — the question falls outside the certified surface. Refusal is a designed behavior with its own tests. A copilot that never declines is the one to worry about.

The Library

One record, raw to governed to consumed

Where numbers earn the right to be trusted.

Follow a single order record through a governed pipeline — ingest, bronze, silver, gold, the semantic contract — to the two consumers reading it. Then watch a bad definition change arrive, and watch the trust gate hold it before either consumer serves a wrong answer.

7 stages + the gate·Deterministic — same record, same catch, every run·Meridian Outfitters is a fictional retailer. Every value on this page is labeled, invented, and deterministic.

Skip to the catch ↓

Source systems

Where the record is born — twice

An order lands in the commerce platform: $1,284.00, store #12, customer M-4821. A checkout retry writes it a second time. Neither system considers this a problem. Both are telling the truth as they know it.

orders.raw_event — as emitted

order_id: 48912; raw
amount: 1284.00; raw
status: COMPLETEcasing varies by API version; raw
store_id: 12; raw
region: NULLnot set by the mobile client; wart
placed_at: 2026-03-14T21:03:11-05:00local time, store's zone; raw
— duplicate —: row emitted twice on checkout retry; wart

Why it matters for governance

Governance starts before your pipeline does

Source systems optimize for their own job, not for analytics. Duplicates, drift, and nulls aren't defects to be angry about — they're the standing condition every downstream guarantee has to be built against.

A practitioner would ask

“Why not fix the data in the source system?”

You rarely own the source, and operational teams change it on their schedule, not yours. The governed answer is to make the corrections explicit, tested, and versioned downstream — where you can prove what was done and re-run it when the source changes again.

No. 08 — The signature move

The trust gate earns its keep

The signature move

The trust gate earns its keep

A well-meaning change lands upstream: gift-card sales added into gross revenue — defensible in isolation, and it double-counts redemptions against net_revenue's formula. The proposed contract version 2.4.0-draft heads for certification.

The vocabulary this page runs on

Term

Semantic Contract

A metric definition with a version, an owner, and consumers that are told when it changes.

Term

Trust Gate

The checkpoint between definitions and every consumer that reads them.

The Working Model shows how trust is used — agents answering on a governed layer. This page shows how trust is built. Same discipline, opposite ends of the ladder. Operate the other end →

Every run is identical: same record, same tests, same catch. That isn't a limitation of the demonstration — it's the property being demonstrated.

This pipeline runs on fictional data. Yours doesn't have to.

The audit maps your environment against exactly these stages — where the warts live, where the tests are missing, and where a gate would have already paid for itself.

Take the readiness scorecardRequest a working session