Context Provenance — References

Provenance vocabularies, the practice of recording origin as a first-class artefact property, and the reason a trust label on a span is a security control.

Representing origin and derivation

• PROV-DM: The PROV Data Model — the W3C model of entities, activities and agents, and specifically the derivation relation, which is the formal shape of "this summary came from those three passages via that transformer".
• PROV-O: The PROV Ontology — the same model expressed for querying, useful when derivation chains need to be traversed rather than only recorded.

Provenance as a shipped artefact property

• SLSA — supply-chain provenance for software builds; a worked example of attaching a signed statement of what produced an artefact and from which inputs, and of the distinction between recording provenance and being able to verify it.
• Datasheets for Datasets (Gebru et al., Communications of the ACM, 2021) — the argument for recording origin, composition, and collection circumstances as a standing property of material rather than as something reconstructed when a question arises.

Why trust must be a recorded property

• Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (Greshake et al., 2023), arXiv:2302.12173 — cited here for the consequence rather than the attack: controls that depend on knowing which spans are untrusted can only work if something recorded that fact at admission.

Joining the record to a request

• OpenTelemetry semantic conventions — the attribute and event vocabulary for model calls, and the practical constraints (attribute size, sampling) that decide whether a telemetry pipeline can carry per-span provenance at all.

No verified reference is recorded for marker-based citation validation, for provenance survival through prompt compression, or for stable fragment identity across re-indexing. These are engineering practices specific to assembled model context.