provenance
In the study of artifacts and archives, the complete history of ownership and transfer of an object from its manufacture to its current holder, verified through continuous documentary records.
Timeline (last 90 days)
The npm ecosystem also has a provenance mechanism, which can bind release artifacts to their source repository and build pipeline and generate publicly verifiable attestations.
The release commit carries a GPG signature, which together with the npm provenance mechanism makes the package origin traceable, allowing users to verify that the installed package was produced by that repository's CI.
Provenance refers to annotating how each key claim was sourced, distinguished in this article's schema by four values READ, EXECUTED, INFERRED, BLOCKED, replacing 'does the result look right' with 'can the result be traced'.
The authors added a required provenance field to each judging agent's output schema, both tested models followed it well, the cost was almost zero, and the output went from 'confident' to 'verifiable'.
Provenance annotation is the foundation of RAG reliability, requiring that every piece of text be traceable to its position and role in the original file.
Signed evidence can only prove that the report has not been tampered with, and cannot prove that the agent itself is safe.
Decision provenance and trace reconstruction typically rely on structured logging and distributed tracing systems in technical implementation.
npm provenance 是基于 Sigstore 项目构建的供应链安全机制，通过 OIDC 验证发布者身份并将签名记录到透明日志 Rekor
All Facts (8)
The npm ecosystem also has a provenance mechanism, which can bind release artifacts to their source repository and build pipeline and generate publicly verifiable attestations.
50%UnverifiedThe release commit carries a GPG signature, which together with the npm provenance mechanism makes the package origin traceable, allowing users to verify that the installed package was produced by that repository's CI.
50%UnverifiedProvenance refers to annotating how each key claim was sourced, distinguished in this article's schema by four values READ, EXECUTED, INFERRED, BLOCKED, replacing 'does the result look right' with 'can the result be traced'.
50%UnverifiedThe authors added a required provenance field to each judging agent's output schema, both tested models followed it well, the cost was almost zero, and the output went from 'confident' to 'verifiable'.
50%UnverifiedProvenance annotation is the foundation of RAG reliability, requiring that every piece of text be traceable to its position and role in the original file.
50%UnverifiedSigned evidence can only prove that the report has not been tampered with, and cannot prove that the agent itself is safe.
50%UnverifiedDecision provenance and trace reconstruction typically rely on structured logging and distributed tracing systems in technical implementation.
50%Unverifiednpm provenance 是基于 Sigstore 项目构建的供应链安全机制，通过 OIDC 验证发布者身份并将签名记录到透明日志 Rekor
50%