provenance.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://agent-run.dev/schemas/provenance.json",
  "title": "Provenance",
  "description": "Cryptographic provenance record — proves how an output was produced.",
  "type": "object",
  "required": ["run_hash"],
  "properties": {
    "run_hash": {
      "type": "string",
      "pattern": "^[a-f0-9]{64}$",
      "description": "SHA-256 hash of canonical run inputs: agent_id + model + tools_available + config_hash + trigger. Verifiable by any party with the same inputs."
    },
    "parent_run_hash": {
      "type": ["string", "null"],
      "pattern": "^[a-f0-9]{64}$",
      "description": "Hash of the parent run that triggered this one, forming a hash chain."
    },
    "lineage": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^[a-f0-9]{64}$"
      },
      "description": "Ordered chain of ancestor run hashes (root first). Enables full audit trail traversal."
    },
    "model_version": {
      "type": "string",
      "description": "Exact model version string used (e.g., 'claude-sonnet-4-5-20250514', not just 'sonnet')."
    },
    "config_hash": {
      "type": "string",
      "pattern": "^[a-f0-9]{64}$",
      "description": "SHA-256 hash of the agent's configuration at time of run. Detects config drift."
    },
    "runtime": {
      "type": "string",
      "description": "Runtime that produced this run (e.g., 'mission-control@2.0.1', 'oneclaw@0.4.0')."
    },
    "signed_by": {
      "type": ["string", "null"],
      "description": "Public key or key ID that signed this provenance record. Null for unsigned records."
    },
    "signature": {
      "type": ["string", "null"],
      "description": "Ed25519 signature over the canonical provenance JSON. Null for unsigned records."
    },
    "created_at": {
      "type": "string",
      "format": "date-time",
      "description": "When this provenance record was generated."
    }
  },
  "additionalProperties": false
}