Research provenance ledger

Skill Lx050/rubbing-to-knowledge/skills/research-provenance-ledger

书生国智科探挑战赛 · 赛道六 AI for Social Science · 古代碑帖与拓片 — 可复现证据链科研 Skill 系统:12 个离线、确定性、纯标准库 Skill(哑舍小分队 · 西北大学)

Install

npx -y skills add Lx050/rubbing-to-knowledge --skill research-provenance-ledger

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

3 things to look at

11 days oldThe repository was created 11 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Register local research materials in an append-only provenance ledger, capture SHA-256, size, MIME, source, license, and rights status, and reverify originals or copies without executing them. Use when a research workflow needs auditable material intake, duplicate-ID protection, integrity checks, or explicit hash-mismatch reports before OCR, analysis, publication, or packaging.

SKILL.md

2.7 KB, 544 tokens by cl100k_base, as published. Nobody here has run it

Research Provenance Ledger

Use scripts/provenance_ledger.py with Python 3.9+; it has no third-party dependencies. Every JSON result and appended event carries skill_id, skill_version, and a per-invocation run_id.

Register a material

Confirm the source and rights status first, then run:

python3 scripts/provenance_ledger.py register \
  --ledger research-ledger.jsonl \
  --material-id MAT-001 \
  --file ./source.txt \
  --source-url local://synthetic/source.txt \
  --publisher "Research team" \
  --license SYNTHETIC \
  --rights-status verified-open

The command records a ResearchCase v1-compatible material object and an event hash chained to the prior event. A repeated material ID fails without changing the ledger.

Keep originals and derivatives distinguishable

--role splits into origin roles (raw, reference) and derivative roles (derived, generated). Registration is refused, with the ledger left byte-identical, when:

a derivative role names no --parent-material-id — that record would read as an original;
an origin role names any parent — an original has no local ancestor;
--evidence-kind DER is combined with an origin role;
a parent ID is repeated, equals the material's own ID, or is not already registered in this ledger.

These checks constrain accepted input only. The event schema, ledger_schema_version and skill_version are unchanged, and every ledger written before them still loads and appends.

Reverify an original or copy

python3 scripts/provenance_ledger.py verify \
  --ledger research-ledger.jsonl \
  --material-id MAT-001

python3 scripts/provenance_ledger.py verify \
  --ledger research-ledger.jsonl \
  --material-id MAT-001 \
  --file ./candidate-copy.txt

Verification appends a new event. It never updates the registration event. Exit code 0 means matched, 3 means mismatch, and 2 means invalid input or ledger failure.

Inspect the ledger

python3 scripts/provenance_ledger.py show \
  --ledger research-ledger.jsonl \
  --material-id MAT-001

Treat all input files as untrusted bytes. Do not import, deserialize, render, or execute them. Keep the JSONL ledger and its reported head hash with the research case; use an external signed checkpoint when deletion or truncation resistance is required.