Module write_provenance 

Write-time provenance — a tamper-evident record of who wrote each memory under what authority.

This complements the read-time receipt in crate::provenance (ReadProvenance, which proves which records a recall cited). A WriteProvenance is recorded at REMEMBER / SHARE time and captures, per memory:

• the writing principal,
• the capability under which the write was authorised (crate::model::capability::Capability id),
• the session / trace id,
• a timestamp,

chained by hash so the whole write history is tamper-evident. It exists so that after a poisoning incident the store can be cleaned by principal or by session (FORGET BY PROVENANCE) instead of wiped — targeted remediation instead of a reset.

Chain scheme: content_hash = SHA-256(memory_id ‖ principal ‖ capability_id ‖ session_id ‖ op ‖ authored_at ‖ prev_hash), and each record’s prev_hash is the previous record’s content_hash. Tampering with any field, or reordering / deleting a record, breaks the chain at verify_provenance_chain.

Structs

WriteProvenance

One tamper-evident provenance record for a single memory write.

Enums

WriteFlag

A write-time flag recorded on a provenance record. Flags are hashed into the record’s content_hash, so a flag cannot be stripped without breaking the chain — the security signal is tamper-evident, not advisory metadata.

WriteOp

The write operation a provenance record attributes.

Functions

compute_provenance_hash

Deterministic content hash over the provenance fields + flags + prev_hash.

flags_from_storage

Parse the storage form back to a flag set (sorted+deduped; unknown names skipped). Empty/whitespace → empty.

flags_to_storage

Serialize a flag set to the single-column storage form: a comma-joined list of stable string names, sorted+deduped for a deterministic representation. Empty set → empty string.

verify_provenance_chain

Verify an ordered provenance chain: every record’s content_hash must match its fields, and every prev_hash must equal the previous record’s content_hash. Reordering, deleting, or mutating any record breaks it.