Every contact has source_type, source_id, and acquired_at

GDPR Art. 13 requires that data subjects be informed of the source from which their personal data was obtained. Art. 30 requires a Records of Processing Activities (RoPA) that includes data sources. Without source_type, source_id, and acquired_at as NOT NULL fields on every contact record, you cannot respond to a regulatory audit, a data subject access request, or a right-to-erasure request that asks you to delete all contacts from a specific list. SLSA Provenance L1 requires a minimum verifiable provenance record for supply-chain integrity. CWE-345 (Insufficient Verification of Data Authenticity) applies when records lack traceable origin.

Add all three provenance fields as NOT NULL columns to the contacts table. Existing rows should be backfilled with a tombstone source identifier if the original source cannot be determined.

ALTER TABLE contacts
  ADD COLUMN source_type  TEXT        NOT NULL
    CHECK (source_type IN ('scraper', 'api', 'purchased', 'form', 'referral')),
  ADD COLUMN source_id    TEXT        NOT NULL,
  ADD COLUMN acquired_at  TIMESTAMPTZ NOT NULL DEFAULT NOW();

// schema.prisma
model Contact {
  source_type  SourceType @map("source_type")
  source_id    String     @map("source_id")
  acquired_at  DateTime   @default(now()) @map("acquired_at")
}

Every ingestion path must supply all three values explicitly — the DEFAULT NOW() on acquired_at is a safety net, not a substitute for explicit population.