Provenance: Exhibit-B signed records (ML-DSA-65) to make provenance unforgeable #173
Description
Decision
Owner decision (2026-11-05): PanLL's provenance is unforgeable when each provenance record follows EXHIBIT-B-QUANTUM-SAFE.txt. The definition is recorded in PROOF-NEEDS.adoc (Provenance engine row, #172).
Today src-gossamer/src/provenance/commands.rs reports git blame authors and Co-Authored-By trailers. Anyone can set both, so until this lands that output counts only as claimed, never verified.
Shape of the work (multi-session)
- Record format. Fields:
author-identity,timestamp(ISO 8601 with zone),content-hash(SHA3-256), optionalparent-hash(chain),platform,witnesses. Serialised as canonical JSON (Exhibit B §3, §4.1c). - Signing. ML-DSA-65 (FIPS 204) over the canonical JSON; SLH-DSA or FALCON are the Exhibit B alternates. Pick a Rust implementation that is audited or FIPS-aligned, and record the choice.
- Keys. Contributor public keys under
.well-known/keys/(Exhibit B §5.1), with a rotation policy (§5.2). - Verifier. Implements §4.2 a–e: signature, content hash, timestamp window, and parent-hash chain. Add a new IPC command next to
provenance_analyse_filethat returns per-recordverified/claimed/invalid. - Witnesses. Third-party attestation signatures over the same record.
- Proof obligation (PROOF-NEEDS): verification rejects any record whose fields, content hash or chain link were altered. Start with property tests (field mutation, chain splice), then a formal model.
Out of scope
- Re-signing past history. Records start from adoption, and older history stays "claimed".
Reacted by coderabbitai
Activity
docs(proofs): link the provenance row to #173
coderabbitai commentedon Nov 5, 2026
🔗 Related PRs
#163 - docs(proofs): reconcile PROOF-NEEDS and the proof-debt ledger with the tree [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
fix(provenance): enforce explicit nullable fields and isolate blockin…