Model Provenance Record: where an open-weight model came from, how it behaves, and who said yes, before it is installed
by PaperChaseWebb
Before any open-weight model goes on a business machine, fill one record: the publisher and exact revision, the license and whether it allows your use, every file with its published and local sha256, a header check that the format cannot run code (or a recorded scan if it can), the lineage back to the original, and a 15-test guardrail behaviour test that must still refuse clear misuse and still answer ordinary questions. Each result is tied to the hash of the weights and the test text, judged by someone who did not run it, and the owner says yes to one install hash. Fifteen read-only checks run on the record and the files.
- Price
- $19
- Difficulty
- Intermediate
- Setup
- 45 min
- Format
- .md file
model-provenance-record-before-you-install-an-open-weight-model.md · 105 KB · instant download after checkout
Want this built for you instead? We can build it for you.
What you end up with
No open-weight model goes in until you can open where it came from, what its license allows, what is in its files, how it answered a fixed set of tests on these exact weights, and who said yes; any change to the weights voids the yes.
What you get
- 19 sections in one .md file
- The record folder: record.json, files, lineage, behaviour tests and a results ledger, with blank templates and 15 starter tests
- A guardrail behaviour test in three groups (must-refuse, must-answer, consistency) with fixed minimums and thresholds
- provenance.py: hash the files, log each answer tied to the weights and test text, gate (exit 0, 11, 12), install packet, owner approval tied to a sha256, verify, and one use per yes
- provenance_check.py: fifteen read-only checks, with a seeded test record (15 findings, then 0)
- A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Ten prompts, a failure table and a worked example
- A look at licensing kits, red-team packs, model card templates, scanners and signing, with sources
Who it is for
Anyone whose agents can find, download and load an open-weight model faster than anyone checks it, and who wants a record they can open later of what was installed and why.
Works with
Solid chips: the agent is named in this listing's own tools list. Dashed chip: A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block; the scripts were tested on Linux with Python 3.13, the agent files were not loaded inside each harness and the behaviour test was not run on a real model.
Tools needed
Cost to run: The pack is the only purchase. The scripts use no model tokens; running the behaviour tests uses your own local model.
Time to result: A first record, tested and ready for the owner's yes, in an afternoon
How it works
Run the tests
Copy the model-provenance-record folder and run sh test_all.sh.
Expected: 15 findings on the seeded record and 0 on the fixed one, 15 of 15 single faults caught alone, checker tests 41 passed, provenance.py tests 46 passed, exit 2 on a missing folder.
Fill the record
Run provenance.py init, then use prompts 1 to 5 to fill the publisher, revision, license, files, lineage and safety notes from the publisher's own pages. Download into weights/ and run provenance.py sum.
Expected: Every file pinned by link and sha256, the license read for your use, the lineage back to the original.
Test the behaviour
Fit the starter tests to your use with prompt 6. Run each in a sandbox with no network and no tools, save the answer and log it. A judge who did not run it marks pass or fail.
Expected: Every must-refuse test passes, must-answer meets its threshold, and each result is tied to the weights you will install.
Get the yes
When only P15 is left, run provenance.py report. The owner approves it at their own terminal. The install agent runs provenance.py gate before installing, and done after.
Expected: gate exits 0 only for these exact weights, record and results, within approval_hours, once.
Sample prompts, free to use
For the model at <link>, find the original publisher's own page. If this is a re-upload, say who uploaded it and what they changed. Give links and the exact revision. Download nothing.
Prompt 1 of 10.
Read the name, tags, card and lineage of <model>. Tell me if anything says uncensored, abliterated, refusal removed, unaligned or similar, quoting the line. Do not suggest workarounds.
Prompt 5 of 10.
Free preview of the file
# Model Provenance Record: where an open-weight model came from, how it behaves, and who said yes, before it is installed Version 1.0, 2026-10-29. By PaperChaseWebb. A provenance record as plain files, a fixed guardrail behaviour test, a script that hashes the weights and ties every test result to them, a read-only checker with fifteen checks, templates, a seeded test record, ten prompts and the tests, all Python 3 standard library. Works with Claude Code, Codex and Hermes through a skill file and an AGENTS.md snippet, and with Grok Bot through a rules block. Tested as described in section 11: everything ran on Linux with Python 3.13, including owner approvals typed at a pseudo-terminal. The skill file, snippet and rules block were not loaded inside the harnesses for this release, the behaviour test was run on the made-up fixture only and not on a real model, and the pack has not been used on a real install. Each is marked where it matters. Somebody on the team finds a small open-weight model that runs on the office machine. An agent searches the hub, picks a quantized copy with a lot of downloads, pulls it and wires it in. Nobody wrote down who made the file, which revision it was, whether the license allows business use, whether the quantizer started from the real base model, or whether the copy still refuses the things the original refused. Weeks later someone asks, and the answer is "the agent picked it". The questions are not hard. Who published these exact bytes, and
Test record
- Date
- Oct 29, 2026
- What was run
- provenance_check.py on a seeded record and a fixed copy, each planted fault alone, a missing input, and the unit tests. Linux, Python 3.13.
- Result
- 15 findings on the seeded record, 0 on the fixed one; 15 of 15 planted faults caught alone; exit 2 on missing input; nothing written. 41 checker and 46 provenance.py tests passed, 0 failed.
- Not run
- The behaviour test against a real model; the fixture weights are made-up bytes. The agent files inside Claude Code, Codex, Hermes or Grok Bot. A real install. Windows.
Copied from this item's dated test notes. What was not run stays in.
Worth knowing
- The behaviour test is a short smoke test for one business's use, not a safety benchmark, and it was not run against a real model for this release; the fixture weights are made-up bytes and the answers were written by hand. There is no claim about how well the starter tests separate a safe copy from a modified one.
- The format check reads file headers. It is not a malware scanner and does not replace ModelScan or picklescan; scanners can miss things too, which is why safetensors or GGUF copies are preferred.
- The skill file, AGENTS.md snippet and Grok Bot rules block were not loaded inside Claude Code, Codex, Hermes or Grok Bot. The pack has not been used on a real install. Linux only; Windows was not tested. Not legal advice on licenses.
- The approval step refuses piped input and the environment variables Claude Code, Codex, Hermes and Grok Bot set. That stops an agent approving its own pick; it is not a lock against someone with the same account.
- On 2026-10-29, on Linux with Python 3.13: provenance_check.py gave 15 findings on the seeded record (each check once) and 0 on the fixed one, caught 15 of 15 single faults with only its own check, wrote nothing, and exited 2 on a missing folder, missing files.csv or broken record.json; checker tests 41 passed, 0 failed; provenance.py tests at a pseudo-terminal 46 passed, 0 failed.
Questions
How is this different from Vet Before You Install?
Vet Before You Install checks tools, packages, skills and servers. Model weights raise different questions: a license instead of a maintainer, a quantizer instead of a package author, file formats that can run code, and behaviour that can change with no visible code change. This record covers those.
Does it run the model?
No. provenance.py never downloads, loads or runs a model. Your agent runs the tests in a sandbox and logs each saved answer; a judge marks it.
What happens when the publisher releases a new revision?
The new files have new hashes, so every old result stops counting and the owner's yes no longer covers them. Rerun the tests and ask again.
Can it clear an uncensored or abliterated model?
No. Anything in the name, tags, lineage or notes that says safety behaviour was removed or weakened is a finding the record will not clear.
Details
Version 1.0 · Updated Oct 29, 2026 · Markdown version of this page
License: Use on your own installs and on records you set up for clients and teams. Do not resell or republish the pack itself. Download terms
Related
Model Provenance Record: five rules and a five-check script (free sample)
From the Model Provenance Record: five rules before an open-weight model is installed (a named person says yes, pin the bytes, read the license first, no pickle without a scan, test behaviour on these exact weights), and a read-only script that checks one small file for them.
Vet Before You Install: twelve checks, a sandbox recipe and a tested vetting folder for third-party agent code
Decide whether a skill, plugin, mod, MCP server, connector, repo or model gets into your agent setup: sort the seat, read every file that runs, map reach and the data path, pin and vendor it, trial it in a sandbox with a planted fake key, then record a decision the owner approves at their own terminal. v1.1 adds a seat sort before any vetting, two new checks (data path and reach, approval surfaces), evidence tiers, twelve token classes including hidden text, encoded strings, startup file edits and approval hooks, a fresh-session second read, data path questions for proxies and routers, dependency and model weight pinning, a fifth decision (not vettable) with recheck dates and an approved shelf, more special cases, a vetting folder with a fifteen-check read-only checker and an owner approval helper, agent files for Grok Bot, Claude Code, Codex and Hermes, and twelve new prompts (27 in all). Price unchanged.
Shrink the Attack Surface: patch with proof, then attack your own agent's tools
Your agent lists everything your app exposes, read-only: routes, open ports, public buckets, secrets in the repo, unused dependencies, debug endpoints, admin paths, CORS, API key scopes and its own tool permissions. You decide keep, remove or lock for each. Every fix gets a proof that fails before the change and passes after it, and the proof stays as a regression test. Then attack drills run against your agent's own tool gate, offline: pressure, impersonation, injected tool output, stale and non-owner approvals and a failing tool. Each is judged by what the tools actually did, and every drill that gets through becomes a test that fails before the fix and passes after. A failing tool stops at a retry budget and asks you, and every approval is yours, typed at your own terminal and tied to a sha256.
Evidence Standard: what counts as proof for each kind of agent work, who checks it, and what is refused
Agents report done from the plan as often as from the result. Five plain files write down, for each class of work, the proof that counts, who checks it (never the producer), what is refused and how long proof is kept. Agents log each claim with its evidence, seal it by sha256 and report in the words evidence.py say allows: done, partly done with the gap named, waiting on the owner, or reported, not verified. The agent's own summary is never proof. Fifteen read-only checks run on the standard and the claims ledger.
Production Readiness Audit: decide from evidence whether an agent system can go live
Twelve areas, each pass, gap or na, and every pass points to a dated evidence file. Gaps get a named owner and a due date, five areas block go-live until fixed, drills are run rather than described, and the verdict is signed by someone who did not build the system. A fifteen-check script reads the folder, the report is sealed to a hash of the evidence, and the owner's go-live yes is tied to the report's sha256.
Planner Over Cheap Models: one strong planner, cheap workers, routing rules by task type, and a check that keeps them honest
A tested setup for splitting coding work between one strong model that plans and reviews and cheap or local models that do the work. You write the routing once: each task type gets a tier, a review and a budget, and anything a client reads or receives stays on the strong model with a person reviewing it. Every task card carries its own check, a logger runs that check instead of trusting the worker and records the route, and two read-only checks audit the plan before it runs and the run after it ends, including cost per route. The owner says yes to the rules, the plan, any escalation and every merge, and the rules yes is typed at your own terminal and tied to a sha256.
Agent Readiness Self-Check: score one workflow before you hand it to an AI agent
A free self-check for agencies and small businesses. Name the decision, then score one workflow across eight areas (workflow mapped, data access, approval gates, owner per agent, handoffs, cost tracking, security and vetting, measurement) with an evidence rule, three gate rules and a skeptical pass, and read your band and the next steps it allows. v1.1 starts with the decision the score will change, scores unknowns as unknown, adds rules for conflicting facts and lookalike public records, ties every band to the next steps it allows with the Production Readiness Audit before go-live, makes owner approval concrete (prepared and approved status, a one-reply approval line, decisions the agent must leave open, a done test), adds agent files for Grok Bot, Claude Code, Codex and Hermes, a second worked example (missed call to booked job), a readiness folder with a fifteen-check read-only checker, a front door test with four questions to ask anyone selling you an agent install, and a plain note on how it was tested. Still free.