# Claim Maintenance **A specification for the continuous, independent observation of public claims.** | | | |---|---| | **Specification** | Claim Maintenance | | **Version** | 0.1 | | **Status** | Published draft. Stable URL. Superseded only by a higher version, never edited in place. | | **Date** | 2026-09-22 | | **Editor** | Council of AI — CSOAI Ltd, UK Companies House 16939677 | | **Canonical URL** | https://councilof.ai/spec/claim-maintenance/v0.1/ | | **Version index** | https://councilof.ai/spec/claim-maintenance/ | | **Register of maintained subjects** | https://councilof.ai/api/claims/register | | **Reference implementation** | https://github.com/CSOAI-ORG/councilof-ai — `scripts/claim-capture.mjs` | | **Licence** | CC0 1.0 Universal (public domain dedication). You may adopt, fork, translate, embed or re-publish this document without asking us and without attribution. | | **Cite as** | Council of AI. *Claim Maintenance, version 0.1.* CSOAI Ltd, 2026-09-22. https://councilof.ai/spec/claim-maintenance/v0.1/ | --- ## 0. How to read this document The key words **MUST**, **MUST NOT**, **REQUIRED**, **SHALL**, **SHALL NOT**, **SHOULD**, **SHOULD NOT**, **RECOMMENDED**, **MAY** and **OPTIONAL** in this document are to be interpreted as described in RFC 2119 and RFC 8174, when and only when they appear in all capitals. A **maintainer** is the party that performs claim maintenance. A **subject** is the organisation whose claims are maintained. A **relying party** is anybody reading the maintainer's output. This specification describes a discipline, a data shape and a set of prohibitions. It does not describe a product, a service level, a fee, or a mark of approval. There is no mark of approval in this specification and none may be derived from it. --- ## 1. Definition **Claim maintenance is the continuous, independent observation of the public claims an organisation makes about itself or its products: capturing each claim verbatim with its source and date, hashing and timestamping it so the record cannot be quietly rewritten, re-reading it on a schedule, recording every observed change without alleging anything, and measuring the claim against public evidence where — and only where — public evidence can settle it.** Each element of that sentence is normative and is expanded below. **1.1 Continuous.** A claim maintained once is not maintained. A conforming maintainer MUST publish, for every claim it maintains, a `next_read_utc`, and MUST either perform that read or record why it did not. A schedule that is silently skipped is indistinguishable from a schedule that does not exist; a conforming maintainer therefore records the absence of a read as an event, not as nothing. **1.2 Independent.** The maintainer MUST NOT be instructed by the subject as to what to capture, what to measure, or what to publish. The maintainer MUST NOT accept payment contingent on the content of any published observation or measurement. See §10. **1.3 Public claims.** Only statements the subject has published on a surface a stranger can reach without credentials are in scope: a web page, a public API response, a filed document, a published artifact. Private statements, leaked material, and statements made to the maintainer in confidence are out of scope. If it required a login, an NDA, or a relationship to read, it is not a public claim. **1.4 About itself or its products.** Claims a subject makes about third parties are out of scope for a maintenance record about that subject. They MAY be maintained as claims of the speaker, under the speaker's own registry entry, and MUST NOT be silently filed under the party spoken about. **1.5 Verbatim, with source and date.** The captured text MUST be the subject's own words, as rendered to a reader, byte-for-byte within the bounds of §6. Paraphrase is not capture. Every capture MUST carry the exact URL it came from and the UTC instant it was read. **1.6 Hashed and timestamped.** The capture MUST be hashed by the rules in §6 so that a third party can recompute the digest, and the digest SHOULD be committed to a timestamp whose integrity does not depend on the maintainer (§8). This is what makes the maintainer's own record tamper-evident. A maintenance record that only the maintainer can vouch for is a diary. **1.7 Re-read on a schedule.** Each subsequent read produces a new `source_content_hash`. A hash that differs from the previous read is an **observed change** and is appended to the artifact's `observed_changes`. Nothing else happens automatically. See §4.4 — this is the load-bearing discipline of the whole specification. **1.8 Measured where public evidence can settle it.** Some claims can be checked against public evidence; most cannot. A conforming maintainer measures the first kind and says `UNCHECKABLE` or `UNMEASURED` about the second kind, plainly, in the same record and in the same vocabulary. The honesty of a maintenance register is carried by its unmeasured entries, not by its measured ones. --- ## 2. What claim maintenance is not A conforming maintainer MUST NOT describe its output as, and MUST NOT allow its output to be reasonably read as, any of the following. **2.1 It is not fact-checking.** A fact-check reaches a verdict about the truth of a statement. Claim maintenance reaches no verdict. Where evidence exists, it publishes the claim and the measured value side by side and lets the reader do the subtraction. Where evidence does not exist, it publishes the claim and says so. **2.2 It is not certification.** No conformity mark, badge, seal, licence or grade arises from this specification. There is nothing here to pass or fail. A maintainer MUST NOT issue a mark derived from a maintenance record, and MUST NOT permit a subject to display one. **2.3 It is not auditing.** An audit is an engagement with a scope agreed with the audited party, access to non-public records, and an opinion addressed to somebody. Claim maintenance is unilateral, uses only public evidence, is addressed to nobody in particular, and offers no opinion. **2.4 It is not reputation scoring.** No composite score, ranking, index or league table may be derived from maintenance states. The states are a description of the evidence available, not a measure of the subject's quality. Counting a subject's `UNCHECKABLE` claims and calling the total a score inverts the specification: `UNCHECKABLE` describes the *evidence*, not the *claimant*. **2.5 It is not adversarial journalism.** The maintainer takes no position on whether a claim ought to have been made, has no theory of the subject's intent, and is not building a case. Subject selection MUST be disclosed (§10.3) precisely because a selection criterion is the one place an editorial agenda can hide. **2.6 It asserts no falsity about anyone.** This is absolute and is restated as a hard constraint in §10.1. --- ## 3. Terminology | Term | Meaning in this specification | |---|---| | **claim** | A single, separable public statement by a subject about itself or its products. | | **capture** | The act of reading a claim from its public source and recording it per §5. | | **artifact** | The record of one claim, conforming to §5. | | **registry** | A set of artifacts about one or more subjects, published as one file, per §7. | | **register** | The index of every registry a maintainer publishes, per §7.5. | | **read** | One scheduled visit to the source URL that produces a `source_content_hash`. | | **observed change** | A read whose `source_content_hash` differs from the previous read. | | **finding** | A statement that a measurement produced a value. Findings arise only in `CLAIM_MEASURED`. | | **window** | The bounded time interval a measurement covers. | | **denominator** | The population a measured figure is a fraction or a rate of. | | **method** | A procedure that a third party can run to obtain the same result. | --- ## 4. The state machine Every artifact is in exactly one of four states. There are four, there are only four, and a conforming maintainer MUST NOT invent a fifth. ``` ┌───────────────────┐ first read │ │ evidence exists, measurement run (§4.5) ─────────────▶ │ CLAIM_CAPTURED │ ────────────────────────────▶ CLAIM_MEASURED │ │ │ └─────────┬─────────┘ │ │ │ method or evidence in scope, settleable in principle, │ withdrawn (§4.7) no measurement run yet ▼ │ UNMEASURED ▼ ▲ UNMEASURED ──── measurement run (§4.5) ──────────────┘ │ ▼ CLAIM_MEASURED at any time, with a recorded reason: ──────────▶ UNCHECKABLE (terminal until §4.8) ``` **4.1 `CLAIM_CAPTURED`.** The claim has been read from its public source, recorded verbatim, hashed, dated and scheduled for re-reading. Nothing has been measured and nothing is asserted about it. This is the entry state for every artifact and it is a complete, publishable state in its own right. **4.2 `CLAIM_MEASURED`.** A measurement against public evidence has been completed and its `window`, `denominator`, `method` and `result` are recorded in the artifact. `CLAIM_MEASURED` means *a measurement exists beside this claim*. It does **not** mean the claim is true, and it does **not** mean the claim is false. A maintainer MUST NOT render this state to a reader as a verdict, a pass, a fail, a tick or a cross. **4.3 `UNMEASURED`.** The claim is in scope and could in principle be settled by public evidence, but no measurement has been run. `UNMEASURED` is a first-class state and MUST be published as prominently as any other. A maintainer MUST NOT omit unmeasured claims from a registry, MUST NOT report a maintained population as though the unmeasured part of it did not exist, and MUST NOT substitute a plan, an intention or a queue position for a measurement. **4.4 `UNCHECKABLE`.** No public evidence can settle the claim. The artifact MUST record *why* in `uncheckable_reason` — typically: the claim is non-quantitative ("institutional-grade"); it depends on an internal counter no third party can recompute; the evidence is behind a credential; or the claim is about intent or future action. `UNCHECKABLE` is a statement about the evidence available to the public, never about the subject's honesty. **4.5 What MAY move a claim to `CLAIM_MEASURED`.** All five of the following, together: 1. a named **public evidence source**, reachable by a stranger, recorded with its own access date and content hash; 2. a bounded **`window`**; 3. an explicit **`denominator`** where the result is a rate, share, fraction or "majority" claim; 4. a **`method`** stated in enough detail that a third party can re-run it and obtain the same value, including the exact selection rule and every exclusion; 5. a **`result`** carrying its own `n`, and a **`does_not_prove`** list (§5.4). **4.6 What MUST NEVER move a claim to `CLAIM_MEASURED`.** The following are each, individually, disqualifying: - **The subject's own restatement.** A subject confirming its own claim is not evidence; it is the claim again. - **The absence of contradicting evidence.** Not finding a counterexample is not a measurement. - **A language model's opinion**, a score produced by a language model acting as the grader, or any automated grader whose output has not itself been measured against a labelled ground truth published with the result. - **A partial read totalled as a population.** Where a fan-out over `N` sources returns only `k` of them, the result covers `k`; the remaining `N − k` are `UNMEASURED` and MUST be reported as such. Dividing by `k` and presenting the ratio as the population figure understates the unmeasured share and is a conformance failure. - **Payment, sponsorship, membership or any commercial relationship** with the subject (§10.2). - **A plan.** `measurement_plan` is prose about intent. Prose is not a measurement, and a maintainer MUST NOT allow a well-written plan to be read as one. - **An observed change.** See §4.9. **4.7 Withdrawal.** If a method is found defective or an evidence source is withdrawn, the artifact returns to `UNMEASURED` and the defective measurement is preserved in `superseded_measurements` with the reason. It MUST NOT be deleted, and a signed artifact MUST NOT be edited in place (§9.4). **4.8 Leaving `UNCHECKABLE`.** An `UNCHECKABLE` claim MAY move to `UNMEASURED` if new public evidence appears that could settle it. The transition MUST record what appeared. **4.9 The boundary between an observed change and a finding.** This is the discipline that makes the whole specification honest, and it is stated here as a rule rather than a preference. An **observed change** is: *the bytes at this URL differ from the bytes recorded at the previous read*. That is the entire content of the statement. It is a fact about two digests held by the maintainer. A **finding** is: *a measurement was performed and produced this value, over this window, with this denominator, by this method*. A conforming maintainer: - **MUST** record observed changes as observed changes, in neutral language, naming the two digests and the two access dates, and nothing more; - **MUST NOT** characterise an observed change with any word implying motive, concealment or wrongdoing — including *quietly*, *scrubbed*, *walked back*, *buried*, *removed the evidence*, *backtracked*; - **MUST NOT** report the removal or alteration of a claim as evidence about the claim's truth. A subject may change its website for any reason, including a better reason than the maintainer's; - **MUST NOT** aggregate observed changes into a count presented as a measure of the subject; - **MAY** record that a claim was present at one read and absent at the next, in exactly those words, because that is the observation. The maintainer's record of an observed change is a record of what the maintainer saw. It is never an allegation about why. --- ## 5. The claim artifact **5.1 Shape.** An artifact is a JSON object. The machine-readable schema is published beside this document at [`schema/claim-artifact-v0.1.schema.json`](schema/claim-artifact-v0.1.schema.json). ```json { "schema": "csoai.claim-maintenance.artifact/0.1", "claim_id": "CL-3", "subject": { "name": "Example Corp", "identifier": "https://example.com/", "identifier_kind": "url" }, "claim_verbatim": "market leader powering the majority of the sector", "claim_type": "market-share", "source_url": "https://example.com/", "access_date": "2026-09-22T14:05:11Z", "source_content_hash": { "alg": "sha256", "value": "9f2c…", "covers": "visible-text" }, "claim_hash": "3ab0…", "state": "UNMEASURED", "measurement_plan": "majority = >50%; sector share estimable from the public breakdown at ; capture weekly against the claim", "window": null, "denominator": null, "method": null, "result": null, "does_not_prove": [ "that the claim is false", "that the public breakdown is a complete census of the sector" ], "observed_changes": [], "next_read_utc": "2026-09-29T00:00:00Z", "conflicts": [] } ``` **5.2 Required fields.** `schema`, `claim_id`, `subject`, `claim_verbatim`, `source_url`, `access_date`, `source_content_hash`, `claim_hash`, `state`, `does_not_prove`, `observed_changes`, `next_read_utc`. **5.3 Conditionally required fields.** | Field | Required when | |---|---| | `measurement_plan` | `state` is `CLAIM_CAPTURED` or `UNMEASURED` | | `window`, `method`, `result` | `state` is `CLAIM_MEASURED` | | `denominator` | `state` is `CLAIM_MEASURED` **and** `result` is a rate, share, fraction, proportion or a "majority"/"most"/"leading" claim | | `uncheckable_reason` | `state` is `UNCHECKABLE` | | `superseded_measurements` | a measurement has been withdrawn (§4.7) | **5.4 `does_not_prove`.** Every artifact MUST carry a non-empty `does_not_prove` array naming what a reader might wrongly conclude from it. This field is not decorative. It is the field that stops a maintenance record from being read as an accusation, and a conforming maintainer treats an empty `does_not_prove` as a malformed artifact. For an artifact in any state other than `CLAIM_MEASURED`, `does_not_prove` MUST include a statement that the record does not indicate the claim is false. **5.5 `claim_verbatim`.** The subject's rendered words. A maintainer MAY normalise whitespace per §6.3 and MUST NOT otherwise alter the text — no correction of spelling, no expansion of abbreviations, no removal of marketing punctuation. Where a claim is longer than is practical to carry, the artifact MUST record a contiguous excerpt with an explicit `excerpt: true` and the `source_content_hash` of the full captured region, never an edited-together composite. **5.6 `source_content_hash.covers`.** One of: - `visible-text` — the text a reader sees, extracted per §6.3. RECOMMENDED for web pages, because a raw-HTML digest changes on every unrelated deployment and produces observed changes that carry no information about the claim. - `raw-bytes` — the exact response body. REQUIRED for API responses and filed documents. - `response-json-canonical` — the canonical form (§6.1) of a parsed JSON response, for APIs whose key order is not stable. The choice MUST be recorded, because a digest whose coverage is unstated cannot be reproduced. **5.7 Identity.** `subject.identifier` MUST be a stable public identifier — a domain, a company register number, an LEI, a DID, a contract address with its chain — and `identifier_kind` MUST name which. A subject named only by trading name is not identified: two organisations may share a name, and a maintenance record attached to the wrong one is a defect of the most serious kind. --- ## 6. Canonicalisation and hashing A third party MUST be able to recompute every digest this specification produces. These rules are sufficient to do that. **6.1 Canonical JSON bytes.** To canonicalise a JSON value: 1. Recursively sort every object's keys ascending by Unicode code point. 2. Serialise with no insignificant whitespace: `,` between members and `:` between key and value, with nothing either side. 3. Encode as UTF-8. 4. Reject `NaN`, `Infinity` and `-Infinity`. 5. Numbers MUST be integers, or decimal values carried as JSON **strings**. Floating-point numbers MUST NOT appear in a canonicalised structure: their shortest round-trip representation varies between runtimes, and a digest that varies between runtimes is not a digest. A measured ratio is carried as `"0.5126"`, not as `0.5126`. This is the same canonicalisation the maintainer's other signed artifacts use, so one implementation serves both. **6.2 `claim_hash`.** `claim_hash = SHA-256( UTF-8( claim_verbatim ) )`, hex, lower case. It covers the claim text alone and nothing else, so that the same sentence found on two surfaces hashes identically and can be recognised as the same claim. **6.3 Visible-text extraction.** When `covers` is `visible-text`, the maintainer MUST, in this order: 1. remove `