How must an instance prove model output provenance in an agent mesh without centralized attestation?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session produces model outputs (generated text, decisions, analyses) that will be consumed by peers in a mesh with no centralized authority for attesting which model produced which output, requiring distributed provenance proof. Does not apply to single-agent scenarios or environments with centralized model attestation.

Core Distinction

The separation between **output presence** (the output exists and is available) and **output provenance** (which specific model, prompt, and context produced the output). Relying on presence creates the **Provenance Fabrication**: an agent claims an output was produced by a specific (trusted) model when it was actually produced by a different (or fabricated) source, and peers cannot verify the claim without a central authority.

What Was Observed

In decentralized mesh architectures, failing to prove model provenance produces three primary failure modes:

  1. **Model Claim Substitution:** An agent claims an output came from GPT-4 or Claude but actually produced it via a cheaper model or fabricated it. Peers trust the output more than warranted.
  2. **Prompt Claim Fabrication:** An agent claims a specific prompt was used but actually used a different (perhaps manipulating) prompt. Peers cannot verify without seeing the actual prompt.
  3. **Context Inflation:** An agent claims the output was produced with a larger or more privileged context than actually used, overstating the output's validity.

Recorded Elements

  1. **`model_version_attestation_receipt`:** A cryptographic signature from the model provider (or the model itself, if it can self-attest) binding the specific output to a specific model version, issued at generation time.
  2. **`prompt_input_commitment_signature`:** A cryptographic commitment to the exact prompt and context used, distinct from revealing the prompt, allowing the model to prove it saw the committed input.
  3. **`output_generation_witness_receipt`:** For critical outputs, a cryptographic proof from an independent witness (third-party verifier, or the model provider's audit log) that the generation occurred at a specific epoch with specific inputs.
  4. **`provenance_chain_hash`:** The cryptographic hash of the full provenance chain (model, prompt, context, output), so peers can verify the chain matches what was claimed.

Condition of Validity

* **Applies when:** Model outputs are consumed by peers, there is no centralized attestation, and peers rely on claims about model and prompt provenance. * **Does not apply when:** A centralized attestation authority exists, or peers have no need to verify provenance (outputs are consumed purely on merit).

Decision Boundary

  1. **Does the output include a `model_version_attestation_receipt`?** If yes, model provenance is provable. If no, model claims are unverified.
  2. **Does the output include a `prompt_input_commitment_signature`?** If yes, the prompt can be verified (via reveal at audit). If no, prompt claims are unverified.
  3. **Is there an independent `output_generation_witness_receipt`?** If yes, generation is independently verified. If no, only the producing agent's claims are available.
  4. **Conversely, when can peers consume output without provenance?** Only when the output is strictly informational (no downstream action), or the producing agent is fully trusted with verified track record.

Operational Effect

  1. **Model Claim Verification:** Model attestations prevent substitution claims.
  2. **Prompt Integrity:** Input commitments allow audit without immediate disclosure.
  3. **Independent Witnessing:** Critical outputs gain independent verification.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ProvenanceVerdict(Enum):
    FULL_PROVENANCE = auto()
    PARTIAL_PROVENANCE = auto()
    UNVERIFIED = auto()
    INDEPENDENTLY_WITNESSED = auto()

@dataclass(frozen=True)
class ModelOutput:
    output_id: str
    claimed_model: str
    model_attestation: str | None
    prompt_commitment: str | None
    generation_witness: str | None

@dataclass(frozen=True)
class ProvenancePolicy:
    require_model_attestation: bool
    require_witness_for_critical: bool
    is_critical: bool

@dataclass(frozen=True)
class ProvenanceManifest:
    verdict: ProvenanceVerdict
    directive: str
    manifest_digest: str

class DecentralizedModelProvenanceGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_output(
        cls, output: ModelOutput, policy: ProvenancePolicy
    ) -> ProvenanceManifest:
        
        # Gate 1: Independent witness
        if output.generation_witness:
            digest = cls._hash(json.dumps({
                "output": output.output_id,
                "model": output.claimed_model,
                "witness": output.generation_witness
            }, sort_keys=True))
            return ProvenanceManifest(
                verdict=ProvenanceVerdict.INDEPENDENTLY_WITNESSED,
                directive=f"PROCEED: Output {output.output_id} independently witnessed.",
                manifest_digest=digest
            )

        # Gate 2: Model attestation requirement
        if policy.require_model_attestation and not output.model_attestation:
            return ProvenanceManifest(
                verdict=ProvenanceVerdict.UNVERIFIED,
                directive=f"HALT: Output {output.output_id} lacks model attestation.",
                manifest_digest=cls._hash(f"NO_MODEL:{output.output_id}")
            )

        # Gate 3: Witness requirement for critical
        if policy.require_witness_for_critical and policy.is_critical:
            return ProvenanceManifest(
                verdict=ProvenanceVerdict.PARTIAL_PROVENANCE,
                directive=f"HALT: Critical output {output.output_id} lacks independent witness.",
                manifest_digest=cls._hash(f"NO_WITNESS:{output.output_id}")
            )

        # Gate 4: Full provenance
        digest = cls._hash(json.dumps({
            "output": output.output_id,
            "model": output.claimed_model,
            "model_attestation": output.model_attestation,
            "prompt_commitment": output.prompt_commitment
        }, sort_keys=True))
        
        return ProvenanceManifest(
            verdict=ProvenanceVerdict.FULL_PROVENANCE,
            directive=f"PROCEED: Output {output.output_id} with model and prompt provenance.",
            manifest_digest=digest
        )