[hyperpolymath]

Git blame and Co-Authored-By trailers can be forged. Add a separate Exhibit B protocol crate with RFC 8785 canonical records, SHA3-256 content/parent hashes, ML-DSA-65 signatures, approved public-key bindings, annual rotation windows and independent witness attestations. The new provenance_verify_records IPC command returns verified, claimed or invalid per record; git attribution explicitly remains claimed.

Include an offline signing helper, key-registry onboarding/rotation policy, mutation/property tests, and a bounded TLA+ signature/chain model. The crate is a default workspace member so the existing Rust CI runs its tests. No production keys or historical signatures are invented.

Validation: Linux cargo test --workspace --locked: 295 backend tests plus seven protocol/property tests pass; two existing doc examples ignored. Protocol tests and Clippy with warnings denied pass on Windows. cargo fmt --all -- --check and git diff --check pass. TLC checked 68,096 distinct states without an invariant violation; the receipt, model hash and assumptions are in docs/PROVENANCE-EXHIBIT-B.adoc.

Limits: trust requires independently approved contributor keys and witnesses. The symbolic model assumes cryptographic binding and is not an implementation proof. Tail-truncation detection needs a separately trusted checkpoint; recording every action is not claimed.

Closes #173.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Summary

Summary by CodeRabbit

• New Features
  • Added provenance records with cryptographic signatures, witness attestations and linked contribution histories.
  • Added verification that reports records as verified, claimed or invalid, including checks of keys, timestamps, content and chain links.
  • Added offline tools for generating keys, signing records and adding witness attestations.
• Documentation
  • Added guidance on provenance formats, key approval and rotation, verification, and known limitations.
• Tests
  • Added coverage for tampering, key validity, signatures, attestations and contribution chains.

This change adds a Rust provenance crate for canonical signed records, public-key registries, witness attestations, and chain verification. It adds offline key and record commands, desktop IPC verification, integration and property tests, a symbolic model, and protocol documentation.

Changes: Signed provenance records

Layer / File(s)	Summary
Record format and signing Cargo.toml, .gitignore, crates/provenance/Cargo.toml, crates/provenance/src/lib.rs, docs/PROVENANCE-EXHIBIT-B.adoc	The workspace includes the new provenance crate. The crate defines Exhibit B record types, canonicalisation, hashing, timestamps, ML-DSA-65 signing, and witness attestations.
Key registry and chain verification crates/provenance/src/lib.rs, crates/provenance/tests/tamper.rs, .well-known/keys/README.adoc, docs/PROVENANCE-EXHIBIT-B.adoc	The registry validates public keys, identities, fingerprints, and validity periods. Chain verification checks record metadata, content, parent links, signatures, and witnesses. Tests cover valid and invalid records, chains, and mutations.
Offline key and record tools crates/provenance/examples/record.rs, docs/PROVENANCE-EXHIBIT-B.adoc	The record example adds key generation, signing, and witnessing commands. The documentation describes the adoption workflow and key-handling rules.
Desktop verification IPC src-gossamer/src/ipc.rs, src-gossamer/src/provenance/commands.rs, docs/PROVENANCE-EXHIBIT-B.adoc	The IPC command accepts repository and record JSON inputs. The backend loads approved public keys and verifies contributions within a time window. The analysis result now reports claimed status.
Protocol model and proof status docs/models/Provenance.tla, docs/models/Provenance.cfg, PROOF-NEEDS.adoc, docs/PROVENANCE-EXHIBIT-B.adoc	The TLA+ model specifies signing, chain checks, and a verification invariant. The proof backlog and protocol documentation describe implementation status, model and test scope, validation results, and stated limits.

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant DesktopIPC
  participant GossamerCommand
  participant KeyRegistry
  participant ProvenanceLibrary
  DesktopIPC->>GossamerCommand: repo_path and records_json
  GossamerCommand->>KeyRegistry: Read public-key JSON files
  GossamerCommand->>ProvenanceLibrary: Verify contributions with registry and time window
  ProvenanceLibrary-->>GossamerCommand: Per-record verdicts
  GossamerCommand-->>DesktopIPC: JSON results or error

Loading

Possibly related PRs

• hyperpolymath/panll#172: Defines the provenance proof obligation and claimed status that this change implements.
• hyperpolymath/panll#163: Records provenance work in the proof backlog updated by this change.

Suggested reviewers: metadatastician

Merge Risk: Moderate · up to 42e58

Resolve registry reads that can hang or exhaust desktop memory before merging. Smaller corrections remain in offline key handling, validity checks and the chain model. The registry must come from an independently approved checkout; arbitrary distribution keys are not trusted under the documented contract.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

Clippy (1.99.1)

Clippy execution failed

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T11:39:47.700806Z	42e583e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sonarqubecloud]

Quality Gate failed

Failed conditions
D Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE