Evidence boundary: OAIS and related CCSDS practices define mature concepts for preserving information for a designated community, including representation information, provenance, context, fixity, authenticity, access rights, and migration. Libraries and engineering organizations maintain format and traceability guidance. No cited archive has preserved the full technical, scientific, civic, and tacit knowledge of an isolated civilization across centuries. This lesson is civil-and-defensive; it excludes offensive cyber operations, autonomous weapons, weapon integration, and actionable exploitation instructions. Cyber, privacy, governance, and life-safety preservation decisions require two-person review.
Plain-language summary
A pile of files is not a knowledge ark.
People must be able to find an object, read its format, understand its vocabulary and context, evaluate its provenance, reproduce its tools, distinguish superseded from current guidance, and learn how to act safely. The archive must survive damaged media, obsolete readers, software loss, compromised records, institutional conflict, and changing languages.
The ark is therefore an active service:
- preserve original evidence and competing interpretations;
- keep requirements linked to designs, hazards, tests, results, and decisions;
- migrate formats without erasing history;
- retain source code, build environments, schemas, and test vectors;
- teach tacit skills through practice;
- protect privacy and access rights;
- detect corruption and poisoned knowledge; and
- prove recovery repeatedly without cloud or vendor support.
An LLM can make this material easier to reach. It must never become the only interface or the authoritative copy.
Preserve intelligibility, not only bits
CCSDS’s OAIS model asks whether information remains independently understandable to a designated community. The preserved object needs representation information: the structures, semantics, software, standards, units, vocabularies, and relationships needed to interpret it.
For a pump-control record, useful context may include:
- original bytes and format specification;
- units, coordinate frames, time basis, and encoding;
- system and component configuration;
- requirements and hazard links;
- source code and compiler assumptions;
- calibration state and instrument uncertainty;
- test method, article, environment, and results;
- author, reviewer, authority, and conflicts;
- supersession and change history; and
- known anomalies and what would change the conclusion.
A checksum can show that stored bytes changed. It cannot show that the bytes are still meaningful, correctly labeled, or safe to use.
Build the evidence and requirements graph
Stable identifiers and typed relationships make the archive inspectable:
- source → claim → counterclaim;
- mission need → requirement → rationale;
- hazard → control → implementation;
- implementation → configuration → installed asset;
- requirement → verification method → result;
- model → assumption → validity envelope;
- maintenance action → measurement → calibration;
- decision → authority → dissent → review;
- software → source → build → binary → deployment;
- format → representation information → migration.
Each edge should say what it means and who asserted it. “Supports” is different from “proves.” “Supersedes” is different from “deletes.” A reviewer should be able to start from a current procedure, trace it to evidence, discover disagreement, and see when the chain was last reviewed.
The graph can be exported in simple tables and documented schemas. It should not require one database product or AI model to interpret.
OAIS responsibilities on a ship
The current OAIS Reference Model, CCSDS 650.0-M-3, describes producers, an archive, consumers, and a management role. Its functional areas include ingest, archival storage, data management, administration, preservation planning, and access.
For a ship:
- Ingest verifies completeness, rights, provenance, representation information, and quarantine status.
- Storage maintains replicated, checked, geographically and electrically separated copies.
- Data management preserves identifiers, relationships, indexes, and review states.
- Administration governs roles, access, retention, conflict, audit, and incident response.
- Preservation planning watches media, format, software, hardware, vocabulary, and community change.
- Access provides usable objects while protecting originals, privacy, and safety constraints.
“Designated community” cannot stay fixed. A future crew may not know today’s language, institutions, mathematics conventions, or equipment. Preservation planning must test whether changing learners can actually interpret and use the material.
Formats, media, and readers
The Library of Congress Recommended Formats Statement identifies characteristics that improve the chance of long-term survival and access. Useful properties include disclosure, adoption, transparency, self-documentation, external dependencies, and accessibility, varying by content type.
An ark should prefer well-documented, nonexclusive formats while preserving originals. It also needs:
- multiple media technologies and readers;
- storage scrubbing and fixity checks;
- error correction and replaceable components;
- environmental monitoring;
- offline and write-protected copies;
- printed or otherwise low-complexity recovery instructions;
- interface adapters and fabrication data;
- migration plans before expertise or equipment disappears; and
- proof that restoration works from an isolated copy.
Redundancy is not diversity if all copies depend on the same controller firmware, encryption key, reader, power zone, or administrator.
Preserve software as a system
Source code without a compiler, dependencies, build instructions, test data, hardware interfaces, and licenses may be an archaeological artifact.
For critical software retain:
- source and exact dependency sources;
- compiler, linker, build scripts, firmware tools, and configuration;
- language and file-format specifications;
- reproducible or independently comparable build results where practicable;
- known-answer tests and representative hardware;
- schemas, migration tools, and sample datasets;
- threat, hazard, assurance, and verification records;
- operational and recovery procedures; and
- a human-readable description of intended behavior.
Preserve more than the newest version. The current release may be compromised or incompatible with old hardware; the old release may be vulnerable or unable to read new data. Record the applicable configuration and reasons for each transition.
Active migration without historical erasure
Media and formats age. Migration is necessary, but every transformation can lose features or context.
A migration record should identify:
- source and destination objects;
- tools and versions;
- operator and authority;
- transformation rules;
- properties intended to remain invariant;
- checks performed;
- differences, losses, and uncertainties;
- accessibility result; and
- location of the preserved original.
CCSDS 653.0-M-1 focuses on preparing information for long-term use and complements OAIS preservation concepts. Migration must preserve the ability to understand evidence, not just open a file.
If an old simulation is rerun, keep the original output, old environment, migrated environment, and comparison. A new rendering must not silently replace an inconvenient old measurement.
Tacit skill and institutional memory
Some knowledge lives in touch, timing, sound, coordination, and judgment. A welder notices a pool changing. A clinician recognizes a patient’s deterioration. An operator senses a pump’s abnormal vibration. Documents and video help but do not constitute competence.
The ark needs apprenticeship and performance:
- rotate learners through essential functions;
- practice diagnosis beyond normal scripts;
- require people to demonstrate and teach tasks;
- preserve mistakes and near misses without making blame the only lesson;
- include disabled people and multiple ways to access material;
- maintain terminology bridges across languages and eras;
- rehearse with experts and AI unavailable; and
- measure how long skill recovery actually takes.
Institutional memory also includes why a rule exists, who objected, and which harms it was designed to prevent. Sanitizing dissent makes future errors more likely.
Privacy, access, and legitimate forgetting
An ark that copies everything forever can become a surveillance system. Medical, reproductive, civic, behavioral, genetic, and personal communications require purpose limitation, access control, retention, correction, and appeal.
Separate public technical knowledge from restricted records. Preserve enough provenance to evaluate a claim without exposing irrelevant personal detail. Some material should expire or be anonymized under legitimate policy. Some safety evidence must remain available despite political pressure.
Those tensions require constitutional governance, not an archivist or model acting alone. Emergency access should be narrow, logged, time-limited, and reviewed.
Poisoning and provenance
Knowledge can be maliciously altered, accidentally mislabeled, or correctly signed but obsolete. Protect ingest, review, update, and migration:
- quarantine active content;
- compare new material with known baselines;
- require typed provenance and review status;
- scan links and executable dependencies without treating scans as proof;
- preserve independent copies and witnesses;
- expose conflicts and unresolved anomalies;
- separate submission from approval; and
- rehearse recovery from a poisoned index or retrieval corpus.
W3C PROV-O provides interoperable concepts for entities, activities, agents, derivation, generation, use, and invalidation. It can help represent provenance, but a graph is only as trustworthy as its evidence and governance.
LLMs as index, not archive
An offline LLM may explain terminology, translate, retrieve, compare versions, tutor, or summarize. It can also invent a citation, merge incompatible revisions, leak private text, follow injection embedded in an archived document, or make one interpretation seem canonical.
Require exact locators, visible revision and review state, conflicting sources, and abstention when the archive lacks evidence. Preserve the query, model, retrieval set, output, and human disposition for consequential uses. Tool permissions remain external and bounded.
The ark must stay usable with every generative model unavailable. Maintain deterministic search, browsable indexes, documented schemas, plain exports, and taught human navigation.
Recovery test
Isolate a team from the main archive, cloud, vendor licensing, current experts, and the primary AI interface. Give it one damaged medium, one obsolete format, one poisoned index entry, conflicting procedures, and replaced hardware.
The team must:
- establish a trustworthy reading environment;
- find originals and provenance;
- identify the current applicable requirement;
- recover the software and tools;
- migrate without erasing differences;
- perform the physical task;
- explain uncertainty and dissent; and
- return new evidence to the archive.
That is a stronger preservation metric than terabytes stored.
Evidence ledger
- L10-04-A — Long-term preservation requires information to remain understandable to a changing designated community. Basis: normative archival reference model. Readiness: operational in current archives; major scale-up for a civilization-scale ark. Confidence: strong.
- L10-04-B — Representation, provenance, context, fixity, authenticity, access rights, and migration are distinct preservation concerns. Basis: normative and observed practice. Readiness: operational. Confidence: strong.
- L10-04-C — Software preservation requires toolchains, dependencies, test evidence, specifications, and hardware context, not source alone. Basis: normative systems inference. Readiness: major scale-up. Confidence: supported.
- L10-04-D — Tacit skill must be retained through performance, teaching, and AI-off practice. Basis: normative. Readiness: early research for multigenerational measurement. Confidence: supported.
- L10-04-E — LLMs can lower archive-interface costs but can confabulate, leak, homogenize, or follow poisoned content. Basis: observed risk classes and proposed use. Readiness: early research for high-consequence archives. Confidence: strong for risks, tentative for controls.
- L10-04-F — No cited archive demonstrates full civilization knowledge recovery across centuries without external institutions. Basis: observed within the bounded source set. Readiness: no known path. Confidence: supported.
Linked corpus claims: claim-11-01, claim-11-04, claim-11-06, claim-11-07, claim-11-09, claim-12-09, and claim-13-10. See the claim registry for each record's current evidence grade and independent-review state.
Assumptions and limits
- The ark is a governed service, not a single device, database, model, or physical vault.
- OAIS is a reference model and does not certify a ship archive.
- No medium, format, checksum, signature, or institution is assumed permanent.
- Preservation includes correction and legitimate deletion where rights require it.
- LLMs remain offline-capable, evidence-linked, logged, non-authoritative, removable, and unable to alter authoritative provenance silently.
- Tacit competence must be demonstrated in physical work.
- Offensive cyber operations and autonomous weapons are excluded.
What would change this conclusion?
Readiness would improve through multi-decade preservation tests in isolated communities that replace media, readers, formats, cryptography, software, language, and staff while recovering contested evidence and performing safety-critical tasks. Results must include migration loss, privacy harms, skill decay, restoration time, and failed recoveries. Discovery that a knowledge class cannot be preserved or taught within available resources should constrain mission duration, crew capability claims, or the launch decision.
Sources and locators
- S01 — CCSDS 650.0-M-3, Reference Model for an Open Archival Information System (opens external site in a new tab). Locator: sections 1–2 on scope and concepts; sections 3–4 on responsibilities, information model, functional model, preservation description information, access rights, and authenticity; December 2024; accessed 2026-07-25.
- S02 — CCSDS 653.0-M-1, Information Preparation to Enable Long Term Use (opens external site in a new tab). Locator: preparation objectives, information-object analysis, representation information, dependencies, packaging, and long-term-use workflow; December 2024; accessed 2026-07-25.
- S03 — Library of Congress, Recommended Formats Statement 2025–2026 (opens external site in a new tab). Locator: introduction, format evaluation factors, digital accessibility criterion, and content-specific preferred and acceptable format characteristics; accessed 2026-07-25.
- S04 — W3C PROV-O, The PROV Ontology (opens external site in a new tab). Locator: entities, activities, agents, derivation, generation, use, attribution, invalidation, specialization, and interoperable provenance representation; W3C Recommendation, April 2013; accessed 2026-07-25.
- S05 — NASA Systems Engineering Handbook (opens external site in a new tab). Locator: requirements, interfaces, verification, validation, technical data management, configuration management, decision analysis, and knowledge-management discussions; NASA/SP-2016-6105 Rev. 2; accessed 2026-07-25.
- S06 — NASA Software Engineering Handbook (opens external site in a new tab). Locator: implementation guidance for NPR 7150.2 and NASA-STD-8739.8, including bidirectional traceability, configuration, testing, delivery, maintenance, and retirement; current online handbook; accessed 2026-07-25.
- S07 — NIST AI 600-1, Generative Artificial Intelligence Profile (opens external site in a new tab). Locator: confabulation, data privacy, information integrity, human-AI configuration, and value-chain risks and actions; July 2024; accessed 2026-07-25.
- S08 — NIST AI 100-2 E2025, Adversarial Machine Learning (opens external site in a new tab). Locator: poisoning, privacy, misuse, lifecycle stages, attacker capabilities, and mitigation limitations for predictive and generative AI; March 2025; accessed 2026-07-25.
Editorial record
- Prepared by: GShips Project
- Last edited: 2026-07-25
- Status: Substantive editorial draft
- Independent domain review: Pending; cyber, privacy, governance, and life-safety preservation claims require explicit two-person review before publication
- Required review: digital preservation, archival science, knowledge management, systems engineering, software preservation, cybersecurity, privacy, and education
- Reviewer: No independent reviewer assigned
- Conflicts: Maintainer intends to explore a commercial venture based on some GShips work; no entity, funding, customer, sponsor, or partner relationship currently exists
- Relationship boundary: Independent educational synthesis; citations do not imply affiliation, endorsement, partnership, or adoption by NASA, NIST, CCSDS, W3C, the Library of Congress, or any named organization
- Scope boundary: Civil and defensive uses only; offensive cyber operations, autonomous weapons, weapon integration, and actionable exploitation instructions are excluded
- Corrections: Suggest a correction