feat: M10 — attribution

[davior]

Builds the spec merged in #28. An asset can now say whose work it is, not just how the file arrived.

Four commits, in dependency order: schema and composition → harvester and API → the Source tab and filters → AI suggestions.

What works now

• Eight attribution fields, editable by hand, with a composed credit line and a Copy button.
• Harvested at ingest from what the file already carries: EXIF/IPTC, ID3, MP4 tags, PDF Info, Office core properties.
• Inherited by clips from their parent, per field, resolved on read.
• Searchable and filterable — by creator, publisher, source title, publication date range, and "missing a source".
• AI proposes, never writes, and only what it can quote evidence for.
• A library-wide re-harvest for everything uploaded before this existed.

The decisions worth reviewing

Embedded metadata is written; an AI may only suggest. EXIF Artist is a fact about the file. What a model reads off a chyron is a claim. The failure modes are not symmetric: a blank publisher is visibly incomplete and prompts a fix, while a confidently wrong one looks finished and ends up crediting somebody else's work to the wrong outlet. So the AI path produces Suggestion rows and stops.

The grounding rule is enforced in the parser, not just asked for in the prompt. The model must quote the thing it read each field from; a field arriving with no evidence is dropped regardless of what it was told. The quote is stored and shown in the panel, because a reviewer who cannot see what the model read is not reviewing anything. "Nothing it could point to" is a correct and common answer.

Clips inherit at read time rather than copying at creation. Copying rots: correcting a publisher six months on would never reach the clips already cut from it, silently. Resolution costs no extra query — to_read_model already receives the parent, batch-loaded since M7.

Filters follow inheritance too. A filter that only looked at the row would answer "everything from the BBC" with the documentary and none of its clips — a quiet incompleteness the user has no way to notice. unattributed follows the same rule: a clip showing its parent's credit is not missing one.

Two schema choices that break house convention on purpose

Both are commented where they would otherwise look like mistakes:

• published_date is a string, not a datetime. Publication dates are routinely partial — a book is from 1994. A datetime forces a fabricated January 1st indistinguishable from a real one, which in a citation record is exactly the quiet falsehood this milestone exists to prevent. ISO partial dates compare correctly as strings, so the range filters need no parsing; a validator keeps the format guaranteed.
• credit_line is an override, not the composed value. A stored composition is stale the moment a component field is corrected.

field_provenance gains a third value, "embedded": a tag read out of a file is a fact about the file but not a claim anyone checked (it is frequently the camera's registered owner), and keeping it distinct from "human" is what lets a later pass propose over it while never proposing over something you typed.

The migration risk, and how it is handled

SQLite FTS5 has no ALTER TABLE ADD COLUMN, so indexing attribution means dropping and recreating asset_fts — and because that table stores its own copy of the text rather than using external-content mode, the recreate destroys the index for every existing asset. The repopulate is invisible to any test that only compares columns: without it the schema is perfect and keyword search silently returns nothing until each asset happens to be edited again.

It gets its own Alembic revision, separate from the eight add_column calls, so a failure there cannot strand the columns. Verified by removing the repopulate and watching the new tests go red.

One related subtlety: the keyword index is the only place inheritance cannot resolve on read, because it stores a snapshot — so an attribution change re-indexes the asset's children. Without that, correcting a parent's publisher leaves every clip of it indexed under a value no longer shown anywhere.

Bugs real files caught

The fixtures are real files rather than mocked tag dictionaries, and two things would have passed against a stub:

• EXIF DateTimeOriginal lives in the Exif sub-IFD (0x8769), not IFD0. Reading only the top level works on hand-built fixtures and fails on every actual photograph. The fixture generator carries the matching trap: Pillow serialises the sub-IFD from the value stored under 0x8769, so mutating the dict get_ifd() returns is silently dropped on save.
• PDF writes its date as D:20190315101112Z — prefixed and separator-less, unlike every other format.

Also found while wiring the UI: Decide built its accept button's accessible name from Suggestion.value, which for an attribution row is the JSON payload — a screen reader would have read out a blob.

Resolved from the spec

The spec left "a bulk attribution pass over a selection" genuinely undecided. Built — it turned out to be one entry in bulk.py::ACTIONS and one button, over machinery M6 already put in place, well under the cost of the design discussion the question implied.

Testing

945 backend tests (up from 916), 283 frontend (up from 264). Lint, Prettier and build clean.

Note for anyone running this locally: it adds two migrations, and migrations do not run outside Docker — alembic upgrade head before starting the backend.

Not covered by tests, and the one thing worth trying by hand: the AI suggestion path needs a real provider configured in Settings. Every test here drives it through a stubbed upstream, which proves the grounding rule and the parser and says nothing about how often a real model can actually ground a field.

🤖 Generated with Claude Code

https://claude.ai/code/session_019RWM7S6z1UPsZqso4p2HAj

---

Generated by Claude Code