Module provenance 

Hermetic provenance, content hashing, and lockfiles (C-050/C-051, spec/reproducibility.md). Pure collection over the parsed module, an environment snapshot, and the filesystem (hashes only): evaluation itself performs no I/O.

Structs

EnvInput

One environment input declared by the document.

FileInput

One file input: stamped path plus content hash.

LockManifest

A complete lockfile record: hash, toolchain, and provenance.

Provenance

Provenance for one evaluation: environment, includes, main file, and the effective profile.

Constants

LOCK_VERSION

Lockfile format version.

Functions

collect_provenance

Collect provenance for an evaluated module: every Env node in the arena (declared inputs — the audit-safe superset of attempted reads), every stamped include file, the main file, and the effective profile. env is the same snapshot evaluation used; main_file is the parsed path when file-based.

content_hash

Content hash over the canonical redacted form: compact JSON with sorted keys, secrets already replaced by ***SECRET*** (value_to_json). Same tree → same sha256:<hex> on every platform. Raw secret values never enter the hash.