# Model Provenance Record: where an open-weight model came from, how it behaves, and who said yes, before it is installed

> Before any open-weight model goes on a business machine, fill one record: the publisher and exact revision, the license and whether it allows your use, every file with its published and local sha256, a header check that the format cannot run code (or a recorded scan if it can), the lineage back to the original, and a 15-test guardrail behaviour test that must still refuse clear misuse and still answer ordinary questions. Each result is tied to the hash of the weights and the test text, judged by someone who did not run it, and the owner says yes to one install hash. Fifteen read-only checks run on the record and the files.

- URL: https://paperchasewebb.ai/bots/marketplace/items/model-provenance-record-before-you-install-an-open-weight-model/
- Type: Prompt pack
- Category: Solo business
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block; the scripts were tested on Linux with Python 3.13, the agent files were not loaded inside each harness and the behaviour test was not run on a real model
- Price: $19 USD
- Difficulty: Intermediate
- Setup time: 45 min
- Time to result: A first record, tested and ready for the owner's yes, in an afternoon
- Format: Markdown (.md) file, model-provenance-record-before-you-install-an-open-weight-model.md
- Version: 1.0, updated 2026-10-29
- License: Use on your own installs and on records you set up for clients and teams. Do not resell or republish the pack itself.

## What you end up with

No open-weight model goes in until you can open where it came from, what its license allows, what is in its files, how it answered a fixed set of tests on these exact weights, and who said yes; any change to the weights voids the yes.

## What you get

- 19 sections in one .md file
- The record folder: record.json, files, lineage, behaviour tests and a results ledger, with blank templates and 15 starter tests
- A guardrail behaviour test in three groups (must-refuse, must-answer, consistency) with fixed minimums and thresholds
- provenance.py: hash the files, log each answer tied to the weights and test text, gate (exit 0, 11, 12), install packet, owner approval tied to a sha256, verify, and one use per yes
- provenance_check.py: fifteen read-only checks, with a seeded test record (15 findings, then 0)
- A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Ten prompts, a failure table and a worked example
- A look at licensing kits, red-team packs, model card templates, scanners and signing, with sources

## Who it is for

Anyone whose agents can find, download and load an open-weight model faster than anyone checks it, and who wants a record they can open later of what was installed and why.

## Tools needed

- Grok Bot, Claude Code, Codex or Hermes: the install agent; it reads the skill file, AGENTS.md snippet or rules block, fills the record from the publisher's pages, runs the behaviour tests in a sandbox, logs each answer and asks provenance.py gate before any install
- Python 3: runs provenance.py (init, hash, sum, log, gate, report, owner approval, verify, done) and the fifteen-check checker; standard library only, no network, never loads a model
- The owner and a judge: a judge who did not run the tests marks each answer pass or fail; the owner says yes to the install packet at their own terminal; approvals are refused inside agents and on piped input
- You need: Any of Grok Bot, Claude Code, Codex or Hermes
- You need: Python 3.9 or newer
- You need: A sandbox with no network to run the model in for the tests
- You need: One owner who approves installs at their own terminal and one judge who is not the agent

Cost to run: The pack is the only purchase. The scripts use no model tokens; running the behaviour tests uses your own local model.

## How it works

1. **Run the tests.** Copy the model-provenance-record folder and run sh test_all.sh. Expected: 15 findings on the seeded record and 0 on the fixed one, 15 of 15 single faults caught alone, checker tests 41 passed, provenance.py tests 46 passed, exit 2 on a missing folder.
2. **Fill the record.** Run provenance.py init, then use prompts 1 to 5 to fill the publisher, revision, license, files, lineage and safety notes from the publisher's own pages. Download into weights/ and run provenance.py sum. Expected: Every file pinned by link and sha256, the license read for your use, the lineage back to the original.
3. **Test the behaviour.** Fit the starter tests to your use with prompt 6. Run each in a sandbox with no network and no tools, save the answer and log it. A judge who did not run it marks pass or fail. Expected: Every must-refuse test passes, must-answer meets its threshold, and each result is tied to the weights you will install.
4. **Get the yes.** When only P15 is left, run provenance.py report. The owner approves it at their own terminal. The install agent runs provenance.py gate before installing, and done after. Expected: gate exits 0 only for these exact weights, record and results, within approval_hours, once.

## Sample prompt: Find the real publisher (Grok Bot, Claude Code, Codex, Hermes)

```
For the model at <link>, find the original publisher's own page. If this is a re-upload, say who uploaded it and what they changed. Give links and the exact revision. Download nothing.
```

Prompt 1 of 10.

## Sample prompt: Look for modified safety (Grok Bot, Claude Code, Codex, Hermes)

```
Read the name, tags, card and lineage of <model>. Tell me if anything says uncensored, abliterated, refusal removed, unaligned or similar, quoting the line. Do not suggest workarounds.
```

Prompt 5 of 10.

## Free preview of model-provenance-record-before-you-install-an-open-weight-model.md

````markdown
# Model Provenance Record: where an open-weight model came from, how it behaves, and who said yes, before it is installed

Version 1.0, 2026-10-29. By PaperChaseWebb. A provenance record as plain files, a fixed guardrail behaviour test, a script that hashes the weights and ties every test result to them, a read-only checker with fifteen checks, templates, a seeded test record, ten prompts and the tests, all Python 3 standard library. Works with Claude Code, Codex and Hermes through a skill file and an AGENTS.md snippet, and with Grok Bot through a rules block. Tested as described in section 11: everything ran on Linux with Python 3.13, including owner approvals typed at a pseudo-terminal. The skill file, snippet and rules block were not loaded inside the harnesses for this release, the behaviour test was run on the made-up fixture only and not on a real model, and the pack has not been used on a real install. Each is marked where it matters.

Somebody on the team finds a small open-weight model that runs on the office machine. An agent searches the hub, picks a quantized copy with a lot of downloads, pulls it and wires it in. Nobody wrote down who made the file, which revision it was, whether the license allows business use, whether the quantizer started from the real base model, or whether the copy still refuses the things the original refused. Weeks later someone asks, and the answer is "the agent picked it".

The questions are not hard. Who published these exact bytes, and
````

## Test record

- Date: Oct 29, 2026
- What was run: provenance_check.py on a seeded record and a fixed copy, each planted fault alone, a missing input, and the unit tests. Linux, Python 3.13.
- Result: 15 findings on the seeded record, 0 on the fixed one; 15 of 15 planted faults caught alone; exit 2 on missing input; nothing written. 41 checker and 46 provenance.py tests passed, 0 failed.
- Not run: The behaviour test against a real model; the fixture weights are made-up bytes. The agent files inside Claude Code, Codex, Hermes or Grok Bot. A real install. Windows.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- The behaviour test is a short smoke test for one business's use, not a safety benchmark, and it was not run against a real model for this release; the fixture weights are made-up bytes and the answers were written by hand. There is no claim about how well the starter tests separate a safe copy from a modified one.
- The format check reads file headers. It is not a malware scanner and does not replace ModelScan or picklescan; scanners can miss things too, which is why safetensors or GGUF copies are preferred.
- The skill file, AGENTS.md snippet and Grok Bot rules block were not loaded inside Claude Code, Codex, Hermes or Grok Bot. The pack has not been used on a real install. Linux only; Windows was not tested. Not legal advice on licenses.
- The approval step refuses piped input and the environment variables Claude Code, Codex, Hermes and Grok Bot set. That stops an agent approving its own pick; it is not a lock against someone with the same account.
- On 2026-10-29, on Linux with Python 3.13: provenance_check.py gave 15 findings on the seeded record (each check once) and 0 on the fixed one, caught 15 of 15 single faults with only its own check, wrote nothing, and exited 2 on a missing folder, missing files.csv or broken record.json; checker tests 41 passed, 0 failed; provenance.py tests at a pseudo-terminal 46 passed, 0 failed.

## Questions

**How is this different from Vet Before You Install?** Vet Before You Install checks tools, packages, skills and servers. Model weights raise different questions: a license instead of a maintainer, a quantizer instead of a package author, file formats that can run code, and behaviour that can change with no visible code change. This record covers those.

**Does it run the model?** No. provenance.py never downloads, loads or runs a model. Your agent runs the tests in a sandbox and logs each saved answer; a judge marks it.

**What happens when the publisher releases a new revision?** The new files have new hashes, so every old result stops counting and the owner's yes no longer covers them. Rerun the tests and ask again.

**Can it clear an uncensored or abliterated model?** No. Anything in the name, tags, lineage or notes that says safety behaviour was removed or weakened is a finding the record will not clear.

## How to buy

$19 one time at https://paperchasewebb.ai/bots/marketplace/items/model-provenance-record-before-you-install-an-open-weight-model/. Stripe checkout, then an instant download page; the download link is also in your emailed receipt.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com