The substrate
contradiction-preserving · evidence-first
evidence-first · contradiction-preserving · bitemporal

Sources disagree. Most databases pick a winner. donto keeps them all.

dontois a bitemporal, paraconsistent, evidence-first substrate — Rust on Postgres. Real sources conflict: two birth years, three spellings of a name, a record that contradicts the last one. donto doesn't dedupe, overwrite, or resolve the conflict away. It holds every claim side by side, anchored to exactly where it came from, and re-ranks them by reality over time. Contradiction is legal state, identity is a hypothesis you resolve at query time, and nothing is ever destroyed.

00

The living substrate

● live
42.9M+
statements
1.1M+
minted predicates
77,989
contexts
3.5M
evidence links
6.5M
contested pairs · held
353
consumer namespaces
3,085
argument edges
predicates the models invented — highest volume now
ex:knownAs · 1.1Mmem:episodic/chunk · 487Kex:knownAtLocation · 331Kex:normalized_claims/text_span · 278Kex:datePrecision · 277Kex:whenText · 245Kmem:claim/derived_from · 240Kex:meta/description · 164K
01

The thesis

generative abundance

For fifty years knowledge graphs were scarce — every triple expensive to author, schema first, facts slow. Models invert that economy: GPTKB pulled 105M typed triplesfrom one mid-tier model at ~$0.00009/claim; AutoSchemaKG built a 900M-node graph with no schema; cost falls ~10× a year. The bottleneck is no longer extraction — it's trust.

01 · Emit freely
No fixed schema, no pre-typed predicates. Models invent the predicate they need (~1M minted) and assert in every direction — the signature of abundance, not a bug.
02 · Defer to query time
Typing, alignment, identity-resolution and joining aren't write gates. They're query-time judgments — composed on demand, reversible, never destroying the raw claim.
03 · Prune by reality
Contradiction is stored paraconsistently; a claim's evidence, corroboration and lifecycle decide its standing. Reality is the verifier, not a curator.
02

The claim lifecycle

the moat — not the schema

Anyone can extract facts. The durable advantage is what happens after: how a claim earns or loses standing over time, evidence intact, contradictions preserved.

step 1 · Ingest
Register any source as an immutable, content-addressed document the substrate can always retrieve.
step 2 · Emit free
Unbounded claims, predicates invented as needed. Only write-time invariant: an evidence anchor or an explicit hypothesis flag.
step 3 · Hold incompatible
Contradictory claims stored side-by-side as legal bitemporal state. A conflict is data, not a failed write.
step 4 · Hypothesize
Typed relationship hypotheses proposed where lenses intersect — connections no schema author would pre-type.
step 5 · Attach evidence
Supports / rebuts / undercuts / qualifies — argument edges carry evidence and counter-evidence with provenance.
step 6 · Rank
Claims scored by value — information gain, novelty, downstream task-lift — not accuracy alone.
step 7 · Re-rank in time
New evidence re-scores old hypotheses. Bitemporal: standing compounds; nothing frozen at write time.
step 8 · Explain
Answers explained only from attached evidence — faithful by construction, never narrative-first.
03

Ten invariants, enforced in code

non-negotiable

Each invariant is enforced at the schema and API layer and guarded by 80 dedicated invariant test suites in CI — the substrate refuses to be a normal database.

Donto substrate invariants
#InvariantDetail
I1No claim without evidence…or an explicit hypothesis flag — the single write-time gate.
I2No restricted source without policyunknown policy defaults to restricted-pending-review, never public.
I3No destructive overwriteevery correction/retraction/merge is append-only; any past state is reconstructable.
I4Contradictions are preservedincompatible claims produce argument edges + review obligations, not failed writes.
I5Machine confidence is not maturitya model's self-confidence can't promote a claim; standing is earned.
I6Governance propagatesderived claims inherit the most restrictive policy of their sources.
I7Mappings are typed and scopedno default sameness — every alignment carries a relation type, scope and safety flags.
I8Identity is a hypothesissame-person/place/concept are contested claims you query under a lens, not foreign keys.
I9Adapters report information lossany import/export that can't carry contradiction, time or governance says so, structurally.
I10A release is a reproducible viewa named query + policy/source/checksum manifests — never an ad-hoc export.
04

The machinery is live

running today

Every piece of the thesis has a running counterpart — watchable in real time at scanner.donto.org.

Alignment engine
Embedding fabric (919K predicate + 338K entity vectors, bge-small/HNSW) + a continuous daemon proposing/adjudicating a 1M-row predicate closure. killedBy meets murderedBy at cosine 0.95 — no synonym table.
Always-on citer
Extraction (what) and anchoring (where) are separate stages. Every fact gets its exact evidence span — or an honest interpretation flag, never a bogus span. Doubles as a hallucination filter.
Gleaning loop
Models stop early by choice; the harness re-prompts to saturation (one article 511 → 3,227 facts). A count floor makes models pad with garbage — saturation decides done.
One engine, many lanes
donto-extract: one engine, 8 swappable model lanes as a declarative registry. Capped lanes rotate out automatically; the citer holds every lane to the same evidence standard.
05

DontoQL

dimensions SQL doesn't have

Querying contested knowledge needs more than triples. DontoQL makes the substrate's dimensions first-class:

  • Predicate expansionPREDICATES EXPAND folds the alignment closure: ask in your vocabulary, find claims minted in any other.
  • Identity lenses — strict / cluster / transitive same-as, per-query, never a destructive merge.
  • Bitemporal travelAS_OF reconstructs what was true and what the system believed.
  • Policy-awarePOLICY ALLOWS filters by governance before content is touched.
  • Contradiction-ordered — sort by contradiction pressure to surface disagreement.
a real query against the live substrate
MATCH ?person ex:diedAt ?place
SCOPE include ctx:genealogy
PREDICATES EXPAND
IDENTITY_LENS clusters
POLICY ALLOWS read_content
ORDER_BY contradiction_pressure DESC
LIMIT 25
06

Benchmarked on LongMemEval

measured, not claimed

donto-memory was run through LongMemEval (ICLR 2025) under audited no-leakage conditions. Where a history fits a frontier model's context, raw accuracy ties a full-context reader — the substrate earns its keep on retrieval quality, token cost, knowledge-update and abstention.

0.98
retrieval hit@10 (0.85 lexical-only)
0.933
answer accuracy · ~0.946 oracle
~2×
lower token cost vs full history
1.0
abstention on unanswerable

Full methodology in the LongMemEval study.

07

Prosopography: a life from scattered fragments

the flagship hard problem

Prosopography — reconstructing people and their relationships from fragmentary, scattered and often contradictory mentions across deeds, registers, newspapers, censuses and inscriptions — is the discipline donto was built for. No single source gives you a person; you triangulate one from dozens of partial, disagreeing attestations. That is exactly the shape of contested reality, and the substrate's hardest invariants are the tools the historian actually needs.

Every mention is a claim
A witness in a deed, a name in a burial register, one line in a newspaper — each becomes an evidence-anchored claim with its exact source span, never flattened into a single “record.”
Name variants aren't noise
Mahamoodally / Mamode Ally, Lablanche / Lablache — competing surface forms held together and reconciled by similarity at query time, not a hand-kept alias table.
Is it the same person?
Identity is a hypothesis (I8). Two attestations become one person only under a lens you pick per query — strict, cluster or transitive — never a destructive merge you can't take back.
Contradictions triangulate
Born 1889 vs 1890, this parish vs that — held side by side with their sources. One marriage certificate that names both parents re-ranks the rest; you see which reconstruction the evidence actually supports.

Live in genealogy.donto.org — contested family history is prosopography at its hardest: century-old records, missing links, and identity that is itself the open question.

08

One substrate, many consumers

built on donto
09

Memory for any agent

MCP + HTTP

donto-memory ships an MCP server — three tools that give any MCP agent anchored, recallable, substrate-wide memory. Docs at mcp.donto.org.

donto_recalldonto_searchdonto_memorize
# remember — bitemporal from day one
curl -X POST https://memories.apexpots.com/memorize \
  -H 'content-type: application/json' \
  -d '{"holder":"agent:you",
       "text":"Ada moved the API to Rust in March.",
       "valid_from":"2026-03-01"}'
10

Built like infrastructure

under the hood
22
Rust crates
67
API routes
127
SQL migrations
80
invariant suites
23
Lean 4 modules
14
object families
Bind your domain to the substrate.
One read-only discovery surface binds a new consumer — no SQL, no schema migration, just claims, evidence, and the lifecycle. Read the docs · watch it live.