Provenance v1.0.0
Cryptographic chain of custody for LLMs, software, agents, tools, and automated systems.

This is the first tagged release of PROVENANCE and therefore represents the complete project history from its constitutional foundation through the implemented Phase 16 release-grade trust lane.

PROVENANCE records who did what, when, where, why, and how — backed by evidence.

It provides a framework-neutral system for capturing actions, preserving exact artifacts, binding evidence and custody records to cryptographic identities, retaining uncertainty explicitly, and independently verifying the resulting record without requiring the original monitored application.

Release Target

commit:
0b1a2eea6c3c2b40a7f2a390fcd3410c75fab742

roadmap state:
Phase 16 implemented

next roadmap stage:
Phase 17 — Immutable Candidate Freeze

This release establishes the implementation state developed across Phases 0–16.

Because this is the first tagged release, there is no previous release baseline or incremental changelog. The notes below describe the complete implemented system.

Highlights

Deterministic canonical evidence identities.
SHA-256 content identity for raw artifacts.
Domain-separated identities for structured PROVENANCE records.
Explicit OBSERVED, DECLARED, and DERIVED evidence classes.
Independent read-only evidence verification.
Local content-addressed evidence storage.
Append-only cryptographically linked custody.
Explicit clock-source assurance.
Real Ollama observation with independent real-model CI.
Dependency-free MCP stdio interface.
Zero-dependency Rust CLI and keyboard-first terminal interface.
Read-only localhost evidence viewer.
Provider-neutral HTTP and local-process adapters.
Portable forensic evidence packages.
Detached Ed25519 SSHSIG signatures.
Git commit anchoring.
Bounded deterministic parallel verification.
Verifiable selective disclosure and redacted derivatives.
Signed offline distributed-custody transfer.
Release-grade full-system trust lane with pinned toolchains and real-model validation.

Phase 0 — Constitutional Foundation

Established the repository's governing evidence and architecture principles before implementation.

The project defines:

what PROVENANCE records
what PROVENANCE does not control
what counts as evidence
how uncertainty is represented
how modules remain separated
which invariants cannot silently change

Core project guidance includes:

README.md
README4AIs.md
AGENTS.md
architecture and invariants documentation
project lineage
donor/provenance documentation
phased roadmap

The foundational design law is:

RECOMPUTE.
DO NOT TRUST STORED CLAIMS WHEN THEY CAN BE RECOMPUTED.
DO NOT REWRITE HISTORY.
DO NOT HIDE EVIDENCE GAPS.

Phase 1 — Canonical Evidence Core

Introduced the dependency-free universal evidence model.

Implemented:

strict canonical UTF-8 JSON
deterministic key ordering
compact separators
canonical trailing-newline policy
duplicate-key rejection
BOM rejection
non-finite and unsafe-number rejection
ordinary sha256:<digest> artifact content identity
domain-separated structured identities
immutable artifact records
immutable event records
relationships
manifests
evidence classification
retention and collection states
self-hash exclusion rules

Evidence classes:

OBSERVED
DECLARED
DERIVED

Raw artifact SHA-256 remains directly interoperable with ordinary forensic and cryptographic tooling.

Structured records use explicit semantic identity domains so that an artifact, event, manifest, custody record, and other structured objects cannot silently share identity semantics.

Phase 2 — Independent Verifier

Added the independent, read-only provenance_verify implementation.

The verifier recomputes rather than trusts:

manifest identities
artifact-record identities
retained artifact hashes
byte counts
event identities
self-hash exclusions
bundle closure
references and relationships
canonical JSON
physical filesystem membership

Adversarial verification covers cases including:

changed artifact bytes
changed structured fields
wrong byte counts
missing evidence
undeclared extra members
duplicate entries
malformed identities
noncanonical JSON
symbolic links
special filesystem entries
unsafe path traversal
malformed or incomplete structured data
unresolved event relationships
parser-depth and numeric-limit failures

The verifier does not repair evidence to make verification succeed.

Phase 3 — Local Content-Addressed Evidence Store

Added the first local evidence store.

The reference backend uses:

local filesystem
+
content-addressed immutable objects

Implemented:

retained artifact storage
artifact-record storage
event storage
immutable snapshots
strong-content deduplication
exact-byte conflict detection
atomic no-overwrite publication
verifier-gated finalization
durable HEAD advancement
reopening verified snapshots
monotonic evidence availability

Retention may advance:

MISSING
→ DIGEST_ONLY
→ CONTENT_RETAINED

but historical evidence is never rewritten to pretend unavailable evidence was always present.

Extensive hardening covers:

interrupted publication
corrupt objects
stale finalizers
symlink substitution
filesystem identity changes
snapshot reconstruction
directory fsync durability
stale and concurrent processes
descriptor cleanup
concurrent store initialization

Phase 4 — Minimal Append-Only Custody Chain

Extended artifact integrity into cryptographically linked custody.

Implemented custody actions:

CAPTURED
STORED
VERIFIED
EXPORTED
TRANSFERRED
SUPERSEDED

Custody records bind:

subject identity
action
actor/source when available
related identity
previous custody identity
recorded time
time source
time assurance

Clock assurance includes:

LOCAL
NETWORK
AUTHENTICATED_NETWORK
SIGNED_ATTESTATION

Custody order comes from cryptographic predecessor links, not wall-clock comparison.

The ledger is append-only and derives current tips from immutable records rather than trusting mutable per-subject HEAD files.

Concurrency and crash recovery were hardened using:

same-process synchronization
+
POSIX fcntl locking
+
non-authoritative staging

Unknown handlers remain unknown rather than being invented.

Phases 5–6 — Ollama Reference Adapter and Real-Model CI

Added the first real AI-system observation path.

Local Ollama adapter

The stdlib-only adapter uses local Ollama /api/generate.

It captures exact:

request bytes
response bytes
request events
response events
declared model identifiers
adapter identity/version
observation boundaries
failure evidence
custody

Classification remains explicit:

request bytes seen by adapter
→ OBSERVED

response bytes seen from Ollama
→ OBSERVED

model identifier reported by Ollama
→ DECLARED

It does not claim observation of:

hidden model state
chain-of-thought
internal GPU execution
unexposed provider provenance

Transport hardening

The adapter includes protections for:

proxy bypass
non-loopback rejection
redirect rejection
malformed HTTP status
truncated response bodies
truncated HTTP error bodies
duplicate/non-finite/malformed JSON
zero-length responses
failed observations
exact failure-detail retention
repeated identical calls
thread concurrency
cross-process observation races

Real-model CI

Clean GitHub-hosted runners independently exercise:

qwen2.5:0.5b
qwen2:0.5b

Each lane:

verifies the pinned Ollama installer checksum;
installs pinned Ollama;
starts an independent local server;
pulls the reference model;
performs real inference;
records exact evidence;
independently verifies bundle and custody;
tampers retained evidence;
requires verification to fail.

Model output text is deliberately not used as a golden fixture.

Phase 7 — MCP Stdio Interface

Added a dependency-free MCP server over stdio.

Implemented tools:

provenance.record
provenance.inspect
provenance.verify
provenance.finalize
provenance.export
provenance.package

Identity-addressed resources expose artifacts, events, manifests, and custody.

Critical classification rule:

caller assertion
→ DECLARED

observed MCP invocation occurrence
→ OBSERVED

Repeated identical declarations may deduplicate as content but do not collapse separate observed call occurrences.

The MCP layer delegates to the existing core, store, custody, export, and verification implementations rather than creating a separate MCP evidence format.

Phase 8 — Rust CLI and Terminal Interface

Added a zero-external-dependency Rust command-line interface.

Commands developed through the current implementation include:

record
inspect
verify
finalize
export
package
sign-package
anchor-payload
anchor-git
verify-assurance
redact-disclosure
verify-disclosure
transfer-create
transfer-receive
verify-transfer
verify-receipt
tui

The terminal interface includes a keyboard-first slash-command palette.

Operator-supplied evidence remains DECLARED.

Each successful record invocation also creates unique OBSERVED occurrence evidence.

CLI and MCP intentionally share hardened operational working state so the interfaces cannot acknowledge divergent pending evidence sets.

Phase 9 — Read-Only Evidence Viewer

Added a dependency-free localhost evidence viewer using:

Python HTTP server
pure HTML
pure CSS
minimal vanilla JavaScript

Default network binding:

127.0.0.1

Non-loopback exposure requires explicit operator opt-in.

The viewer accepts only GET and HEAD; mutation methods are rejected.

Views include:

evidence graph
custody timeline
artifact inspection
event inspection
explicit evidence gaps
partial ordering
independent verification dimensions

Rather than a generic TRUSTED label, assurance dimensions remain separate.

Example:

integrity = VERIFIED
custody = PARTIAL
signature = NOT_PRESENT
replay = NOT_ATTEMPTED

Non-interference tests fingerprint evidence roots before and after presentation operations.

Deleting or replacing the UI does not alter evidence identity.

Phase 10 — Provider-Neutral Generic Adapter Interface

Added a generic adapter contract without changing the universal core.

Reference implementations include:

Generic HTTP/HTTPS adapter

Captures ordinary request/response observation boundaries.

Local process adapter

Captures:

argv
stdin
stdout
stderr
process outcome

Directly observed bytes remain OBSERVED.

Provider and transport metadata remain DECLARED under namespaced extensions.

Failure observations may be retained explicitly as COLLECTION_FAILED.

Sensitive HTTP header values and inherited process environments are excluded from ordinary evidence payloads by default.

Phase 11 — Portable Forensic Evidence Packages

Added finalized, portable forensic-package production and independent verification.

A package contains:

finalized evidence bundle
custody snapshot
schema/version metadata
verification metadata
declared gaps

Every physical package member is bound by:

portable relative path
SHA-256 content identity
byte count

The existing evidence bundle remains unchanged inside the package.

Package state and evidence scope remain independent:

package_state = FINALIZED
evidence_scope = open | closed

Packages are:

assembled in staging;
independently verified;
atomically published.

Verification rejects:

missing members
extra members
substitutions
unsafe paths
symlinks/special entries
incorrect identities
incorrect byte counts

Portable packages can be moved between machines and independently verified without the original monitored system.

Phase 12 — Detached Signatures and External Anchoring

Added optional authenticity records without changing package identity.

Ed25519 SSHSIG signatures

Finalized package metadata may be signed using OpenSSH Ed25519 SSHSIG.

Private keys remain producer inputs only.

Verification separately reports package integrity and signature authenticity.

A valid signature proves:

the corresponding private key signed these exact bytes

It does not automatically prove:

human identity
legal identity
organizational authority
intent
truth

Git commit anchors

Package identities can be bound to canonical payloads stored at exact Git commit/path locations.

Git anchor verification operates against a supplied Git object database without requiring network access.

It proves the referenced Git object relationship, not remote publication or trusted timestamping.

Assurance dimensions intentionally remain independent.

Phase 13 — Deterministic Bounded Parallel Verification

Performance hardening was added without weakening verification semantics.

Pattern:

parallel physical work
+
bounded live concurrency
+
deterministic input-order reduction
+
serial reference equivalence

Optimized verification covers independent artifact, event, and package-member operations.

Reference implementations remain available.

Required invariant:

OPTIMIZED VERIFICATION REPORT
==
SERIAL REFERENCE VERIFICATION REPORT

including:

result status
check ordering
error ordering

Worker completion order is never allowed to become report order.

The performance suite directly checks bounded concurrency and serial-reference parity.

Benchmark results remain environment-specific.

Phase 14 — Privacy and Selective Disclosure

Added verifiable privacy-preserving derivative packages.

A retained source artifact can be deterministically redacted into a new DERIVED artifact.

The original artifact is never overwritten or relabeled.

Selective-disclosure packages retain:

source digest
exact original artifact metadata witness
redaction specification
retained redacted derivative
DERIVED lineage event

while withholding the original source bytes.

Standalone verification proves:

disclosure integrity
source identity witness
declared lineage

When the original source package is supplied, verification can additionally:

bind the source package;
recompute the redaction transform byte-for-byte.

Invalid workflows are rejected, including:

digest-only redaction sources
overlapping ranges
no-op redactions
tampered derivatives
attempts to relabel derivatives as original observations

Phase 15 — Signed Distributed Custody

Added signed offline/store-and-forward evidence transfer between independently operated systems.

Sender path:

verified forensic package
→ signed transfer offer
→ finalized transfer bundle

Receiver path:

verify transfer
→ preserve exact package identity
→ append receiver-local custody
→ sign receiver receipt

Receiver acknowledgements use:

CAPTURED
→ STORED
→ VERIFIED

The transfer system supports:

offline transport
delayed delivery
network partitions
duplicate delivery
crash-prefix recovery
receiver-local custody
independent verification

Duplicate completed delivery is idempotent.

Sender and receiver clocks remain independent.

The protocol records evidence-backed causal edges only.

It explicitly reports:

ordering = PARTIAL

instead of manufacturing a global total order from timestamps.

Transfer acceptance requires a trusted sender fingerprint supplied independently of the transfer itself.

Filesystem and concurrency hardening includes descriptor-bound verification and protection against package/path substitution races.

Phase 16 — Release-Grade Trust Lane

Added a high-assurance validation lane distinct from routine development CI.

The release lane uses:

fresh checkout
pinned GitHub Actions
Python 3.12.11
Rust 1.90.0
Ollama 0.34.0
complete Python test corpus
locked Rust build/test
independent Python hash-seed cross-check
clean-tree enforcement
real Ollama integration
tamper verification
final release-gate aggregation

Real-model lanes use:

qwen2.5:0.5b
qwen2:0.5b

The lane retains real-model observation evidence as short-lived CI artifacts.

Routine module workflows remain smaller and path-scoped; the full lane is deliberately heavier.

Phase 16 is engineering assurance.

It does not claim:

formal proof
immutable implementation freeze
absence of all defects
legal or factual truth

Those are separate later concerns.

Security and Reliability Hardening

Across the development of Phases 1–16, PROVENANCE accumulated adversarial regression coverage around:

canonicalization ambiguity
duplicate JSON keys
malformed numeric data
self-hash defects
hash and byte-count mismatches
missing/extra filesystem members
symbolic-link substitution
special filesystem objects
pathname races
descriptor/path identity changes
atomic no-replace publication
interrupted writes
directory fsync durability
stale writers
crash recovery
same-process concurrency
cross-process locking
custody forks
duplicate delivery
transfer replay/idempotence
trust-record tampering
redaction lineage tampering
adapter truncation and malformed transport
read-only UI mutation
parallel/reference verifier divergence
package substitution
transfer sender-key spoofing
unsupported signature canonicalization claims

The implementation consistently prefers:

fail closed
preserve what is known
retain uncertainty
never silently repair history

CI Architecture

The repository now contains modular validation lanes including:

core
verify
store
custody
ollama
mcp
cli
UI
adapters
package
trust
performance
privacy
transfer
full

Focused workflows provide normal development feedback.

The full workflow provides the high-assurance candidate lane.

Architecture

The implementation remains modular:

provenance-ui
      ↓
provenance-mcp / provenance-cli
      ↓
provenance-adapters / provenance-store / provenance-export
      ↓
provenance-core

evidence
   ↓
provenance-verify

Optional modules do not define universal evidence semantics.

The verifier remains independent of the original monitored application and optional presentation/integration layers.

Evidence and Trust Boundaries

PROVENANCE does not claim to observe or establish things it cannot support with evidence.

It does not automatically establish:

hidden model reasoning
provider-internal execution
human intent
legal identity
physical possession
scientific validity
legal liability
factual truth
perfect global time

A cryptographic signature proves key possession over signed bytes.

A digest proves identity of exact bytes.

A Git anchor proves a relationship to objects in the supplied Git database.

A custody record proves what the custody record actually binds.

A verifier establishes that the declared cryptographic/evidence contract recomputes.

These dimensions are deliberately not collapsed into a generic trust score.

Portability

The reference implementation is POSIX-first and local-first.

Core evidence does not require:

cloud accounts
database servers
containers
blockchain
MCP
UI
AI providers
JavaScript frameworks
network connectivity

Optional infrastructure remains optional.

The evidence is intended to outlive the software that created it.

Documentation

The repository includes dedicated specifications for:

architecture
invariants
evidence bundles
local storage
custody
Ollama observation
generic adapters
MCP
CLI/TUI
read-only UI
portable forensic packages
signatures and Git anchors
performance hardening
privacy and selective disclosure
distributed custody
release-grade validation
project lineage and roadmap

Release Scope

This release contains the complete implementation developed through Phase 16.

Because no earlier version of PROVENANCE was tagged, this release serves as the first cumulative historical baseline for the project.

The exact release target is:

0b1a2eea6c3c2b40a7f2a390fcd3410c75fab742

This commit represents the Phase 16 project state immediately before the roadmap's immutable-candidate/formal-verification stages.

What Comes Next

Phase 17 — Immutable Candidate Freeze

Select and preserve the exact implementation target that later formal verification and archival claims reference.

Once frozen, implementation/evidence-contract changes require restarting the release-candidate process.

Phase 18 — Formal Verification and Archival Final Release

Planned work includes formalizing selected stable invariants against the frozen implementation target and producing the final archival release material.

Potential proof targets include:

self-hash exclusion
append-only correction semantics
classification preservation
manifest sealing
verification purity
non-authority of presentation
event/artifact identity separation
read-only UI non-interference

Formal verification will apply to the explicitly modeled invariants and will not be represented as proof of unrelated runtime, factual, legal, or external-system claims.

Project Law

OBSERVE.
RECORD.
BIND.
VERIFY.

NEVER REWRITE HISTORY.

And throughout the implementation:

CAPTURE ONLY WHAT THE CONTRACT REQUIRES.

PRESERVE EXACTLY WHAT WAS CAPTURED.

KEEP THE CORE INDEPENDENT OF THE INTERFACES.

MAKE OPTIONAL MODULES REPLACEABLE.

MAKE THE EVIDENCE SURVIVE THE SOFTWARE THAT CREATED IT.

RECOMPUTE INSTEAD OF TRUSTING STORED CLAIMS.

Release target: 0b1a2eea6c3c2b40a7f2a390fcd3410c75fab742

Implemented through: Phase 16 — Release-Grade Trust Lane

License: Mozilla Public License 2.0

Project: QSOLKCB / QSOL-IMC

What's Changed

Phase 1: canonical evidence core by @EmergentMonk in #1
Phase 2: independent evidence verifier by @EmergentMonk in #2
Phase 3: local content-addressed evidence store by @EmergentMonk in #3
Phase 4: minimal append-only custody chain by @EmergentMonk in #4
Phase 5–6: local Ollama adapter and real-model CI by @EmergentMonk in #5
Phase 7: MCP stdio interface by @EmergentMonk in #6
Phase 8: Rust CLI and terminal slash palette by @EmergentMonk in #7
Phase 9: read-only localhost evidence viewer by @EmergentMonk in #8
Phase 10: provider-neutral generic adapter interface by @EmergentMonk in #9
Phase 11: portable forensic evidence packages by @EmergentMonk in #10
Docs: consolidate documentation and streamline README by @EmergentMonk in #11
Phase 12: signatures and external anchoring by @EmergentMonk in #12
Phase 13: deterministic bounded parallel verification by @EmergentMonk in #13
Phase 14: privacy and selective disclosure by @EmergentMonk in #14
Phase 15: distributed custody transfers by @EmergentMonk in #15

Full Changelog: https://github.com/QSOLKCB/PROVENANCE/commits/v1.0.0

v1.0.0 - PROVENANCE — Inaugural Release