On the fact
authored once.

Every fact about reality, whether a privacy guarantee, an operational scope, a company number, a price, or a service area, shall have exactly one canonical source. Every public surface that asserts that fact shall be a derived view of that source, and the derivation shall be mechanical, not manual.

This is the principle the trade names the single source of truth, and the original sense of don't-repeat-yourself — which speaks of knowledge, not code: every piece of knowledge shall have a single, unambiguous, authoritative representation within a system. A derived view is a materialized view, a cached projection that goes stale and shall be regenerated from its source, never amended by hand. To the textbook forms this Charter adds what they leave implicit, the epistemic cost: a stale derived view does not merely duplicate, it reads confidently while it lies, as the law On synthesis records.

When reality changes, the canonical source changes first. A verifier shall confirm the source against deeper engineering signals, so the source cannot lie about itself. Every consumer surface shall then re-render from the new source, or fail the build because its assertion no longer matches. There shall be no remembering to update, and no catching it in review.

The detection patterns most teams rely upon, being review, periodic audit, and the comfort of having a process, catch some drift, some of the time, dependent on human attention. A copy that says one thing while engineering does another becomes, in six months, a quiet lie.

This Charter moves the prevention surface from did anyone notice to does the build pass. That is a different category of guarantee, and the System shall prefer it.

First, the canonical truth manifest, machine-readable and resident in the same repo as the engineering reality it describes, with every fact held in a typed field. Second, the source-repo verifier, a step that walks engineering reality and asserts each manifest field is consistent; should the manifest claim no analytics SDKs while the resolved manifest lists one, the build shall fail.

Third, the consumer-surface verifiers; each surface tags its prose with a claim referencing a manifest field, and a build step reads the canonical manifest and asserts the prose still holds. Prose shall remain human-authored; the writer translates the typed fact into language. But the fact asserted shall be canonical, and any prose asserting it shall be mechanically verified against canon.

Tier A is mechanical and ours: the canonical lives in a file we own, and the verifier runs at build phase, hook, CI, or through the type system, so drift fails the build. This is the strongest form and the default. Tier B is mechanical and third-party: the canonical is ours, but the derived surfaces live inside a tool's caches we cannot instrument; the verifier is the tool itself, and our defence is documented diagnostic and remediation carried in memory and skills. Tier C is behavioural and ours: the fact is a behaviour emerging across components that no compiler reaches; the canonical lives in prose we own, and the verifier is a human reviewer at PR time, prompted by the doc.

Reaching for Tier A when only Tier C is possible is over-engineering. Falling back to Tier C when Tier A would have served is the failure the mantra exists to prevent. When classifying a new application, ask whether the fact is statically checkable from one of our files, and fall back through the tiers only when the answer is genuinely no.

The signals are these: multiple surfaces assert the same class of fact with no link between them; the fact's truth value depends on engineering or operational reality and not on editorial choice alone; a drift slip has already happened, reality having moved while the copy stood still; or the cost of a quiet lie is high, whether through App Review scrutiny, regulatory compliance, customer trust, or contractual obligation.

Below the threshold, individual canonical files and per-project directives suffice, and a manifest shall not be raised. The pattern is product-agnostic: the same shape governs privacy and capability claims, operational scope, brand constants, and pricing alike.

The architecture is the artefact. The prose that describes it, being this file, is a derived view; should the pattern in practice diverge from what is written here, the prose shall be amended to track it. This prose shall not be treated as the spec.

The pattern doc travels across machines and projects as portable prose. A specific instance is project-specific and lives in the project knowledge store; the mechanical components live in the product repos that own the canonical truth. On a fresh machine, clone the Canon, read this file, and the pattern is in scope.