Module provenance 

Per-read memory-provenance signing (v0.4.0-rc3 Task B1).

v0.3.x signs writes — every MemoryRecord carries a SHA-256 content_hash chained via prev_hash, and the audit log export signs the chain with Ed25519. v0.4.0-rc3 adds the equivalent for reads: every engine.recall(..., with_provenance=true) returns a ReadProvenance HMAC that proves which writes the recall derives from. A clinician auditing an LLM response can verify offline that the cited memories really were the ones the model saw.

Threat model

1. Source-record tamper. An attacker mutates a MemoryRecord in storage between the recall and the audit. Detected because verify_read_provenance recomputes each record’s content_hash and compares to the RecordRef in the provenance.
2. HMAC tamper. An attacker fabricates a provenance receipt pointing at innocuous records. Detected because the HMAC binds the receipt’s read_id || query_hash || derived_from to a server-side secret the attacker doesn’t have.
3. Key rotation. The receipt’s hmac_key_id lets the verifier look up the historical key for a past read, so rotating the signing key doesn’t break old audits.

Out of scope: full non-repudiation (would need Ed25519 — HMAC is cheaper but only verifiable by parties with the key). For externally-auditable receipts, pair the provenance with the existing mnemo-compliance Ed25519-signed audit log export.

Structs

ProvenanceSigner

In-process HMAC-SHA256 signer for the recall hot path.

ReadProvenance

Cryptographic receipt that an engine.recall call returned the listed memories.

RecordRef

One source record cited by a ReadProvenance.

Enums

ProvenanceError

Traits

ProvenanceKeystore

Pluggable keystore for verifiers — supports at-least one historical key.

Functions

verify_read_provenance

Verify a ReadProvenance receipt against the source records.