donto: An Evidence Operating System for Contested Knowledge · donto
donto: An Evidence Operating System for Contested Knowledge
A systems paper on the architecture, data model, and operational<br>experience of a bitemporal, paraconsistent, evidence-first quad store<br>running at 39.3 million statements.
Thomas Davis · Ajax Davis · 2026-05-28
Abstract
We describe donto , a knowledge-substrate system organised around<br>three commitments most knowledge graphs do not make: that every claim<br>is anchored in evidence under a context, that contradictions are<br>preserved rather than rejected, and that the system records both<br>world-time (when a fact was true in the world) and system-time<br>(when it was believed in the database). The system is implemented as a<br>Rust workspace shipping a PostgreSQL extension (pg_donto, built with<br>pgrx), an HTTP sidecar (dontosrv), a Python FastAPI + Temporal<br>extraction layer (donto-api), a CLI (donto), a terminal UI<br>(donto-tui), and a Lean 4 formal overlay (donto_engine). The<br>native query language, DontoQL , exposes twenty-one clauses<br>covering scope inheritance, polarity, maturity, identity lenses,<br>predicate-alignment closure, bitemporal time-travel, modality,<br>extraction-level filtering, and policy enforcement. The substrate is<br>exercised by genes , a genealogical-research corpus with 39,294,083<br>statements, 938,918 distinct predicates, 19,230 contexts, and 1.84M<br>evidence links across 48 GB on disk. We document the system's data<br>model, its query language, its six-aperture extraction pipeline, its<br>Trust Kernel for policy-gated ingest, its release-and-federation<br>machinery (Ed25519-signed RO-Crate envelopes), and its Lean 4 overlay<br>for shape and rule certification. We characterise its performance<br>(steady ~2.5–3.0 K-row/s insert throughput, sub-100 ms point queries<br>through 1 M rows) and report empirical observations from production:<br>predicate proliferation (~938 k distinct freely-minted predicates),<br>evidence-anchor sparsity (~4.7 % of statements carry an evidence link),<br>and an exceedingly low retraction rate (281 of 39.3 M, ~7 × 10⁻⁶) that<br>reveals the system is currently operated as an append-mostly archive<br>rather than a constantly-revised research notebook. We argue that the<br>combination of evidence-first storage, paraconsistent semantics,<br>bitemporality, and a typed alignment layer is a useful substrate for<br>domains where multiple sources, schemas, communities, and models must<br>make claims about a shared world without forcing premature consensus —<br>language documentation, oral-history, genealogy, legal evidence,<br>clinical observation, and historical research being the motivating<br>cases.
Keywords: knowledge graphs, paraconsistent logic, bitemporal<br>databases, provenance, evidence anchoring, predicate alignment,<br>identity resolution, policy enforcement, scientific reproducibility,<br>Lean 4, language documentation, genealogy.
1. Introduction
1.1 The eight assumptions
Most research-supporting systems silently assume one or more of the<br>following:
There is one correct value to store for a given proposition.
There is one canonical schema to map data into.
There is one entity-resolution answer per referent.
A user either has access to a record or they do not.
Provenance is metadata attached to records rather than the central<br>object of the system.
Machine confidence can stand in for scholarly review.
Exports are static files rather than reproducible views.
Contradictions are quality failures, not data.
donto rejects all eight. Its operating model is open-world,<br>evidence-first, contradiction-preserving, governance-native,<br>bitemporal, multimodal, and schema-plural (PRD §0). The product<br>question the system was designed to answer is:
Given a contested question, can the system return the relevant<br>claims, the evidence behind them, the schema mappings that make<br>them comparable, the identity hypotheses they depend on, the<br>disagreements between them, the access policies governing them,<br>and a reproducible release artefact?
If it can, the substrate works.
1.2 The proving domain
The first proving domain is language documentation , because it<br>exhibits every constraint of contested knowledge simultaneously:<br>incompatible analytical schemas (Universal Dependencies vs WALS vs<br>Grambank), disputed identities (dialect/language boundaries; ISO codes<br>vs Glottolog vs internal community ontologies), multimodal evidence<br>(text, audio, interlinear glosses, phonetic transcription),<br>restricted cultural material (community-governed sacred or sensitive<br>records), diachronic change (reconstructed vs attested forms),<br>formal validation (paradigms have shape constraints), and<br>corpus-scale annotation.
The exercise domain is genealogy — specifically, the<br>North-Queensland family-history corpus that exercises donto in<br>production at genes.apexpots.com. Genealogy is, in our experience,<br>the hardest realistic instance of the same problem: name spelling<br>drifts across records, the same person appears under maiden, married,<br>and clan names,...