What Changed
Emit provenance metadata alongside the ModuleGraph JSON output: producer name,
producer version, generation timestamp, and input identity (analyzed path +
resolved module path).
Why It Matters
Constitution III (Observable Quality) requires all artifacts to include
provenance: producer, version, timestamp, input. The current ModuleGraph
(metrics/graph.go) carries none of these. This was explicitly deferred as a
Non-Goal in openspec/changes/go-analyze/design.md and recorded as PARTIAL
in the go-analyze proposal's Constitution Alignment table.
Without provenance, a CI system consuming vibe-check JSON cannot verify which
tool version produced a metrics report or when — undermining reproducibility and
auditability of architectural-drift tracking.
Proposed Shape (for discussion)
- Add an optional
provenance object to ModuleGraph, kept omitempty for
backward compatibility (or a top-level envelope wrapping the graph).
- Fields:
producer (e.g. "vibe-check"), version (from build info / ldflags),
generatedAt (RFC3339 UTC), input (analyzed path + module path).
- Additive schema bump; update
metrics/modulegraph.schema.json and the
validator to accept the new field.
Determinism Note
AGENTS.md requires metric computations to be deterministic. A wall-clock
timestamp is inherently non-deterministic, so provenance must be treated as
metadata, not a metric. Provide a way to keep output reproducible — e.g. a
--no-provenance / --reproducible flag, or omit the timestamp under a
deterministic mode — so the determinism guarantee for the metric payload holds.
Acceptance Criteria
References
Note: this issue should be labeled enhancement once that label exists.
What Changed
Emit provenance metadata alongside the
ModuleGraphJSON output: producer name,producer version, generation timestamp, and input identity (analyzed path +
resolved module path).
Why It Matters
Constitution III (Observable Quality) requires all artifacts to include
provenance: producer, version, timestamp, input. The current
ModuleGraph(
metrics/graph.go) carries none of these. This was explicitly deferred as aNon-Goal in
openspec/changes/go-analyze/design.mdand recorded as PARTIALin the go-analyze proposal's Constitution Alignment table.
Without provenance, a CI system consuming vibe-check JSON cannot verify which
tool version produced a metrics report or when — undermining reproducibility and
auditability of architectural-drift tracking.
Proposed Shape (for discussion)
provenanceobject toModuleGraph, keptomitemptyforbackward compatibility (or a top-level envelope wrapping the graph).
producer(e.g."vibe-check"),version(from build info / ldflags),generatedAt(RFC3339 UTC),input(analyzed path + module path).metrics/modulegraph.schema.jsonand thevalidator to accept the new field.
Determinism Note
AGENTS.md requires metric computations to be deterministic. A wall-clock
timestamp is inherently non-deterministic, so provenance must be treated as
metadata, not a metric. Provide a way to keep output reproducible — e.g. a
--no-provenance/--reproducibleflag, or omit the timestamp under adeterministic mode — so the determinism guarantee for the metric payload holds.
Acceptance Criteria
analyzeoutput includes populated provenance fields.documented and optionally suppressible.
References
openspec/changes/go-analyze/proposal.md(Constitution III = PARTIAL),openspec/changes/go-analyze/design.md(provenance Non-Goal)./uf.review-council(Guard persona) during review of PR feat: add Go adapter and vibe-check analyze CLI command #21.