Change Provenance Tracking

Safe Surgery on System Files · Shipped · workstation

Who changed a file, when, and why — linked to the state ledger with actor, reason, and content digest.

Every configuration file modification made through Halbert is recorded with full provenance: which actor (user or system) made the change, the reason given, a content digest of the file before and after, and a timestamp. This creates a complete audit trail.

The provenance module hooks into the WriteConfig tool and records file mode changes, content modifications, and actor attributions. Each record links back to the state ledger and can be queried to reconstruct the complete history of a file.

Limits and invariants

Provenance records are append-only — they cannot be retroactively modified or deleted.

Where this lives

• halbert_core/halbert_core/continuity/provenance.py
• halbert_core/halbert_core/continuity/ownership.py