Sources disagree. Most databases pick a winner. donto keeps them all.
dontois a bitemporal, paraconsistent, evidence-first substrate — Rust on Postgres. Real sources conflict: two birth years, three spellings of a name, a record that contradicts the last one. donto doesn't dedupe, overwrite, or resolve the conflict away. It holds every claim side by side, anchored to exactly where it came from, and re-ranks them by reality over time. Contradiction is legal state, identity is a hypothesis you resolve at query time, and nothing is ever destroyed.
The living substrate
The thesis
For fifty years knowledge graphs were scarce — every triple expensive to author, schema first, facts slow. Models invert that economy: GPTKB pulled 105M typed triplesfrom one mid-tier model at ~$0.00009/claim; AutoSchemaKG built a 900M-node graph with no schema; cost falls ~10× a year. The bottleneck is no longer extraction — it's trust.
- 01 · Emit freely
- No fixed schema, no pre-typed predicates. Models invent the predicate they need (~1M minted) and assert in every direction — the signature of abundance, not a bug.
- 02 · Defer to query time
- Typing, alignment, identity-resolution and joining aren't write gates. They're query-time judgments — composed on demand, reversible, never destroying the raw claim.
- 03 · Prune by reality
- Contradiction is stored paraconsistently; a claim's evidence, corroboration and lifecycle decide its standing. Reality is the verifier, not a curator.
The claim lifecycle
Anyone can extract facts. The durable advantage is what happens after: how a claim earns or loses standing over time, evidence intact, contradictions preserved.
- step 1 · Ingest
- Register any source as an immutable, content-addressed document the substrate can always retrieve.
- step 2 · Emit free
- Unbounded claims, predicates invented as needed. Only write-time invariant: an evidence anchor or an explicit hypothesis flag.
- step 3 · Hold incompatible
- Contradictory claims stored side-by-side as legal bitemporal state. A conflict is data, not a failed write.
- step 4 · Hypothesize
- Typed relationship hypotheses proposed where lenses intersect — connections no schema author would pre-type.
- step 5 · Attach evidence
- Supports / rebuts / undercuts / qualifies — argument edges carry evidence and counter-evidence with provenance.
- step 6 · Rank
- Claims scored by value — information gain, novelty, downstream task-lift — not accuracy alone.
- step 7 · Re-rank in time
- New evidence re-scores old hypotheses. Bitemporal: standing compounds; nothing frozen at write time.
- step 8 · Explain
- Answers explained only from attached evidence — faithful by construction, never narrative-first.
Ten invariants, enforced in code
Each invariant is enforced at the schema and API layer and guarded by 80 dedicated invariant test suites in CI — the substrate refuses to be a normal database.
| # | Invariant | Detail |
|---|---|---|
| I1 | No claim without evidence | …or an explicit hypothesis flag — the single write-time gate. |
| I2 | No restricted source without policy | unknown policy defaults to restricted-pending-review, never public. |
| I3 | No destructive overwrite | every correction/retraction/merge is append-only; any past state is reconstructable. |
| I4 | Contradictions are preserved | incompatible claims produce argument edges + review obligations, not failed writes. |
| I5 | Machine confidence is not maturity | a model's self-confidence can't promote a claim; standing is earned. |
| I6 | Governance propagates | derived claims inherit the most restrictive policy of their sources. |
| I7 | Mappings are typed and scoped | no default sameness — every alignment carries a relation type, scope and safety flags. |
| I8 | Identity is a hypothesis | same-person/place/concept are contested claims you query under a lens, not foreign keys. |
| I9 | Adapters report information loss | any import/export that can't carry contradiction, time or governance says so, structurally. |
| I10 | A release is a reproducible view | a named query + policy/source/checksum manifests — never an ad-hoc export. |
The machinery is live
Every piece of the thesis has a running counterpart — watchable in real time at scanner.donto.org.
- Alignment engine
- Embedding fabric (919K predicate + 338K entity vectors, bge-small/HNSW) + a continuous daemon proposing/adjudicating a 1M-row predicate closure. killedBy meets murderedBy at cosine 0.95 — no synonym table.
- Always-on citer
- Extraction (what) and anchoring (where) are separate stages. Every fact gets its exact evidence span — or an honest interpretation flag, never a bogus span. Doubles as a hallucination filter.
- Gleaning loop
- Models stop early by choice; the harness re-prompts to saturation (one article 511 → 3,227 facts). A count floor makes models pad with garbage — saturation decides done.
- One engine, many lanes
- donto-extract: one engine, 8 swappable model lanes as a declarative registry. Capped lanes rotate out automatically; the citer holds every lane to the same evidence standard.
DontoQL
Querying contested knowledge needs more than triples. DontoQL makes the substrate's dimensions first-class:
- Predicate expansion —
PREDICATES EXPANDfolds the alignment closure: ask in your vocabulary, find claims minted in any other. - Identity lenses — strict / cluster / transitive same-as, per-query, never a destructive merge.
- Bitemporal travel —
AS_OFreconstructs what was true and what the system believed. - Policy-aware —
POLICY ALLOWSfilters by governance before content is touched. - Contradiction-ordered — sort by contradiction pressure to surface disagreement.
MATCH ?person ex:diedAt ?place
SCOPE include ctx:genealogy
PREDICATES EXPAND
IDENTITY_LENS clusters
POLICY ALLOWS read_content
ORDER_BY contradiction_pressure DESC
LIMIT 25Benchmarked on LongMemEval
donto-memory was run through LongMemEval (ICLR 2025) under audited no-leakage conditions. Where a history fits a frontier model's context, raw accuracy ties a full-context reader — the substrate earns its keep on retrieval quality, token cost, knowledge-update and abstention.
Full methodology in the LongMemEval study.
Prosopography: a life from scattered fragments
Prosopography — reconstructing people and their relationships from fragmentary, scattered and often contradictory mentions across deeds, registers, newspapers, censuses and inscriptions — is the discipline donto was built for. No single source gives you a person; you triangulate one from dozens of partial, disagreeing attestations. That is exactly the shape of contested reality, and the substrate's hardest invariants are the tools the historian actually needs.
- Every mention is a claim
- A witness in a deed, a name in a burial register, one line in a newspaper — each becomes an evidence-anchored claim with its exact source span, never flattened into a single “record.”
- Name variants aren't noise
- Mahamoodally / Mamode Ally, Lablanche / Lablache — competing surface forms held together and reconciled by similarity at query time, not a hand-kept alias table.
- Is it the same person?
- Identity is a hypothesis (I8). Two attestations become one person only under a lens you pick per query — strict, cluster or transitive — never a destructive merge you can't take back.
- Contradictions triangulate
- Born 1889 vs 1890, this parish vs that — held side by side with their sources. One marriage certificate that names both parents re-ranks the rest; you see which reconstruction the evidence actually supports.
Live in genealogy.donto.org — contested family history is prosopography at its hardest: century-old records, missing links, and identity that is itself the open question.
One substrate, many consumers
Memory for any agent
donto-memory ships an MCP server — three tools that give any MCP agent anchored, recallable, substrate-wide memory. Docs at mcp.donto.org.
# remember — bitemporal from day one
curl -X POST https://memories.apexpots.com/memorize \
-H 'content-type: application/json' \
-d '{"holder":"agent:you",
"text":"Ada moved the API to Rust in March.",
"valid_from":"2026-03-01"}'