Every fact carries metadata about where it came from, who asserted it, and how certain it is.
Provenance is the rule that no fact in Arkeus is allowed to exist without a record of its origin. Every write to memory carries four pieces of metadata: who said it, when they said it, the certainty class it belongs to, and the source document or conversation it came from.
In most AI memory systems, a fact is just a string. It accumulates, gets retrieved, and gets used as if it were true. When it turns out to be wrong, there is no trail back to the moment of contamination. The belief propagates. Downstream agents act on it. The user discovers the problem only after an outbound message embarrasses them.
Arkeus treats that failure mode as architectural, not accidental. The fact_write tool enforces provenance at the boundary: a write without class, source, and owner fails. Downstream consumers check the class before acting. Human-facing drafts are blocked when any load-bearing input is merely inferred.
The eight classes — asserted, observed, inferred, temporary, false, expired, contested, unknown — give every fact a shape. Asserted means Ryan explicitly stated it. Observed means a pattern showed up three or more times. Inferred means the model guessed. Temporary expires. False and expired are kept for audit, not action. Contested means two sources disagree. Unknown tracks the absence of a fact — the observability of what we do not yet know.
The reason provenance matters is not tidiness. It is that the cost of acting on contaminated memory is asymmetric. A fabricated scheduling detail routed to a family agent produces a real draft to a real human. Provenance is the seatbelt that keeps those drafts from leaving the building.