Software Evidence in a Minute

Provenance

Why knowing where a fact came from—commit, log, tool, timestamp—is part of the evidence itself.

In one sentence

Provenance is the traceable origin of a piece of evidence: where it came from, when, and under what conditions.

Why it matters

Without provenance, screenshots, pasted logs, and agent summaries cannot be re-checked. Disputes then become arguments about memory instead of artifacts.

How it works

Record the source system (Git, CI, APM, package registry).
Record the locator (commit SHA, job URL, query, file path).
Record time and environment when relevant.
Prefer immutable references (commit SHA) over moving labels (“latest main”) when making decisions.
When evidence is derived (a summary), keep the raw inputs linkable.

Example

Weak: “Tests passed earlier.” Stronger: “CI job 18422 on commit 9f3c1a2 for workflow test.yml finished green at 2026-09-06T16:02Z.”

What this proves

Good provenance proves that a later reader can attempt to relocate the same artifact and audit the claim path.

What this does not prove

Provenance does not make the artifact correct. A well-cited flaky test log is still a flaky test log.

Last reviewed 2026-09-06. Title for citation: Software Evidence in a Minute: Provenance.