feat(core): provenance data model — source hash, event actor/evidence chain (#1172) - #1184
Merged
Conversation
… chain (#1172) Phase 1 of the memory evolution plan (#1172). Additive schema v17 → v18, zero data loss: - memories.source_hash: SHA-256 of content recorded automatically at write time (single shared remember_precomputed path) — auditors recompute it to detect post-write tampering - timeline_events.actor + evidence_json: who performed an event and what evidence supports it (e.g. contradiction resolution, Fase 2 consumer) - Uteke::provenance(id) → ProvenanceReport: provenance fields, trust tier, live-recomputed content hash, and the full event chain - column_exists_in allowlist gains timeline_events (was silently always false, which would double-ALTER in v18 migration) Migration is guarded (column_exists / CREATE IF NOT EXISTS) so legacy stores, fresh stores, and partially-repaired stores all converge to the same shape. Backward compatible: new columns nullable, old binaries unaffected.
🔍 Cora AI Code Review✅ No issues found. Code looks good! Review powered by cora-code · BYOK · MIT |
Exposes the phase-1 provenance model on every surface: - GET /provenance?id= — full report (fields, trust tier, hash comparison, event chain); 404 unknown id, 400 missing param - uteke provenance <id> — human-readable audit output with hash verdict (✓ matches / ✗ MISMATCH / — pre-v18 row), --json for tooling - uteke_provenance MCP tool — JSON report for agents Docs: cli-reference (uteke provenance section), api-reference (regenerated), CHANGELOG.
This was referenced Sep 6, 2026
Closed
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Phase 1 of the memory evolution plan (#1172): the provenance data model, additive schema v17 → v18, zero data loss.
memories.source_hash(TEXT, nullable) — SHA-256 of the content, recorded automatically in the single shared creation path (remember_precomputed, which backsremember/remember_typed/consolidation). Auditors recompute the hash of current content to detect post-write tampering.timeline_events.actor(TEXT) +timeline_events.evidence_json(TEXT, JSON array) — who performed an event and what evidence supports it. Written viaStore::add_timeline_event_with_provenance; existingadd_timeline_eventcallers are untouched (NULL actor/evidence).Uteke::provenance(id)→ProvenanceReport(exported): provenance fields (author_type,source,source_type, timestamps),TrustTierclassification,source_hash(at write) vscontent_hash_now(live-recomputed),deprecated, and the full event chain newest-first.Uteke::set_source_hash(id, Option<&str>)— public for repair/backfill tooling on legacy rows.column_exists_inallowlist did not includetimeline_events, so the helper silently returned false for that table — the v18 migration would have double-ALTERed. Allowlist now includes it, and the migration additionally ensures the table exists with the fresh shape (defensive for partially-repaired stores).Surfaces (HTTP / CLI / MCP for
provenance) land in the follow-up PR — this PR is the schema + core API layer.Why
#1172 item 1 (per the OSS/cloud triage decision): provenance is the correctness primitive everything else builds on. Fase 2 (contradiction evidence chain + undo) writes its resolution rationale as provenance-bearing timeline events; the audit surfaces read them through this model.
Testing
provenance_chain_and_source_hash— hash recorded at write matches live recomputation; direct DB content tampering breaks the match (tamper-evidence property); event chain containscreated; unknown ID →Ok(None).timeline_events_carry_provenance— provenance-bearing event stores actor + evidence (readable back viaUteke::timeline), plain events keep the old shape (backward compat).test_author_type_migration_v15_to_v16(legacy v15 DB → v18) andtest_migration_v11_to_v12_from_v04x_db(fixture without timeline_events) both pass after the defensive CREATE + allowlist fix; fresh-store version stamping asserted at 18.cargo fmt --all✓ ·cargo clippy --workspace --all-targets -- -D warnings✓ ·cargo test -p uteke-core --lib548 passed / 0 failed · server handler suite 23/23 ✓ ·cora review --staged✓ (No issues found).