The Gold Standard · Anthropology
Make the decision path visible
Rollback restores a safer route, but it may leave the ecosystem divided. One directory can point to the restored duty role while another still serves the failed repair, and local teams may keep cached copies of both. Messages then succeed in different places without one authoritative account of who could act.
The gold standard treats this split-brain state as a temporary incident: freeze automatic convergence, map competing versions, protect consequential decisions and re-synchronise only after authority, reachability and effect receipts agree.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · SEE THE SPLIT
1. Define split-brain contact state
A split-brain state exists when two active systems claim different current owners, alternates or escalation paths for the same appeal consequence. Each may be internally consistent and locally reachable.
The danger is not merely duplicate data. Different recipients may take conflicting actions while each believes their route is authoritative.
CHAPTER 2 OF 12 · SEE THE SPLIT
2. Name the decision point and authoritative function
Start with the registry state, closure or revocation that must change. Identify the function legally or operationally responsible for that state, independent of whichever directory currently lists a person.
Authority should decide the graph; the graph should not manufacture authority simply because a record is widely copied.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · SEE THE SPLIT
3. Inventory versions and consumers
Collect version identifiers, effective times, source records, caches, routers, team lists, offline runbooks and recent notices. Mark read and write relationships.
A consumer that only sends messages has different risk from one that can write ownership back into the source register.
| Field | Evidence |
|---|---|
| Decision point | State at risk |
| Version | Claimed current graph |
| Consumer | Read or write role |
| Authority | Primary record |
CHAPTER 4 OF 12 · CONTAIN DECISIONS
4. Stop bidirectional overwrites
Pause merge jobs and write-back connectors that could make the wrong version appear authoritative through repetition. Preserve queues and deltas before changing state.
Allow bounded read-only access where it supports investigation, but prevent automatic promotion or closure based on disputed ownership.
CHAPTER 5 OF 12 · CONTAIN DECISIONS
5. Create a provisional single decision gate
Route consequential actions through a named incident owner who verifies authority against primary evidence. Require dual review for closure until the graph converges.
This manual gate is temporary. It protects the appeal while preventing either directory from winning by speed rather than evidence.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · CONTAIN DECISIONS
6. Worked example: restored and repaired directories both answer
The appeal register is rolled back to a verified duty address, but the organisation directory retains the failed repair and syncs it to a mobile contact list. Both recipients acknowledge notices, and one closes the appeal while the authorised registry owner keeps it open.
The incident owner suspends closure, preserves both receipts and verifies the registry authority. The unauthorised closure is reversed, the mobile cache is quarantined and a new graph version is issued. Changed-context check: if both directories list different people who are jointly authorised for the same decision, the state may be redundant rather than split-brain, but their roles and effect rules still need explicit confirmation.
| Risk | Control |
|---|---|
| Write-back | Pause connector |
| Closure | Dual review |
| Cache | Quarantine |
| Evidence | Preserve delta |
CHAPTER 7 OF 12 · RECONCILE AND SYNC
7. Resolve authority before choosing values
Use appointment records, role charters, delegation dates, revocations and registry control rules. Separate who can receive a notice from who can change the state.
Do not decide by majority of copies, newest timestamp alone or the system with the widest distribution.
CHAPTER 8 OF 12 · RECONCILE AND SYNC
8. Reconcile actions during divergence
Trace notices, acknowledgements, closures and downstream delegations under each version. Reconsider outcomes only when the competing authority could be material.
Preserve stable actions that the verified owner independently confirmed. Record corrections so later readers can reconstruct the sequence.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · RECONCILE AND SYNC
9. Issue and stage an authoritative re-synchronisation
Create a new version with a clear effective time, source signature, consumer list and rollback point. Update read-only consumers first, then controlled writers, and require acknowledgements.
Invalidate caches explicitly. A successful central update is incomplete while offline and mobile copies can still route consequential notices.
| Stage | Proof |
|---|---|
| Issue | Signed version |
| Read consumers | Acknowledged load |
| Writers | Controlled update |
| Close | Effect verified |
CHAPTER 10 OF 12 · KEEP ONE TRUTH
10. Test convergence after realistic delays
Check delayed devices, after-hours routing, restored backups, staff departure and a consumer reconnecting after the incident. Confirm it cannot reintroduce the losing version.
Monitor for a full relevant operating cycle rather than declaring success after the fastest systems converge.
CHAPTER 11 OF 12 · KEEP ONE TRUTH
11. State limits and misconceptions
One authoritative graph cannot guarantee availability, comprehension or action. A clean sync report may miss local exports and informal lists.
Record untested consumers, residual manual routes and the expiry of temporary controls. Convergence is a bounded evidence claim.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · KEEP ONE TRUTH
12. Audit version authority and convergence
Track competing versions, write-back sources, reconciliation decisions, cache invalidations, acknowledgements and recurrence.
The gold standard restores one accountable truth without erasing the split. The incident remains evidence for designing safer ownership and synchronisation.
| Measure | Warning |
|---|---|
| Competing version | Authority unresolved |
| Offline reconnect | Old state returns |
| Unowned consumer | Coverage gap |
| Conflicting receipt | Decision split |
Frequently asked questions
Is every directory mismatch split-brain?
No. It becomes split-brain when competing active versions can influence the same consequential decision.
Which system should win?
The system representing verified decision authority, not necessarily the newest or most widely copied directory.
Why create a new version after reconciliation?
It distinguishes the authoritative result from both the failed repair and the temporary rollback, preserving a clear history.
When can the manual gate end?
After consumers converge, caches are invalidated, effect receipts succeed and delayed reconnection tests do not restore the losing version.
Continue through verified routes
Core routes
Anthropology subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Contact-graph drift repair rollback, incorrect synchronisation and restoring the last known-good route
- Contact-graph version drift, stale alternates and recurrence prevention
- Dead-letter recovery recurrence, broken contact graphs and notification resilience
- Revocation propagation failure modes, dead-letter notices and recovery ownership