Export provenance for an auditor

tovio audit export --format prov-json <target>

tovio audit export --format in-toto <target>

tovio audit export --format prov-json <target> --depth 3 --output lineage.json

These two formats take the same lineage graph tovio audit graph renders and map it into the interchange formats that compliance platforms and supply-chain verifiers already read. They exist so that "show me the provenance" can be answered with a file the auditor's existing tooling ingests, rather than a screenshot of a terminal.

They are not the audit chain

The other four --format values export the flat signed audit chain. These two export one target's derivation graph — a different projection entirely. The consequence is that they require a target and refuse without one:

• chg:<id>
• a commit address, with or without blake3:
• task:<id>
• session:<id>

--depth bounds the walk to parent changes, exactly as it does for the graph, and defaults to 1. Both flags are ignored by the chain formats.

W3C PROV

prov-json emits a PROV document. Humans and agents become PROV agents; changes, commits, and artifacts become entities; the act that produced the change becomes an activity. The lineage edges map onto the standard relations — generated-by, associated-with, attributed-to, derived-from, acted-on-behalf-of.

Identifiers are kind-prefixed composites over the native identity, so one document can carry every node kind without collisions: an entity id embeds the object's address, an agent id embeds its DID. One caveat worth passing to whoever consumes the file — a human author with no enrolled DID exports under a display identity derived from the commit author string. That is a label, not an attested identity, and a consumer must not treat it as one.

in-toto and SLSA

in-toto emits an in-toto attestation carrying the SLSA provenance predicate. The subject is the commit, named by its change id and digested by its address. The acting agent or human DID appears as the builder, under run details where SLSA v1 puts it. The build definition carries the originating prompt's address and task id as external parameters, and the parent commits, the session address, and the tool manifest hash as resolved dependencies. Run metadata carries the session id, the model hash, and the address of the audit entry that attests the whole thing.

Delivery

Destination handling is shared with the chain formats: --output for an atomic write to a file, --tls with optional --cert and --server-name for a pinned collector, and stdout when you give neither.

It refuses rather than mislead

An export that cannot resolve a required lineage node under your scope refuses — it does not emit a partial graph that reads as complete. The two cases that trigger it are a promised-but-absent attachment, typically because a partial clone omitted a session or rationale, and a required node that is present but cannot be decoded.

A node you are merely not cleared to read is not a refusal. Those export as locked references — address and kind, no content — because the confidentiality boundary has to survive the export just as it survives the graph.

The distinction matters when you hit it: unresolvable means fetch the missing objects and retry, or export from a scope that can read them. Scope-redacted means the file is correct and the locked nodes are the honest answer. If you only need to look rather than hand something over, tovio audit graph renders the same lineage with locked markers and never refuses.

An attested session that does not bind is also a refusal

If a session in the exported closure hashes to something the commit did not attest, the export refuses rather than publish a run record it cannot vouch for. The graph still renders it, which is where you go to see what actually mismatched.

One-way, and descriptive

The mapping is not round-trippable. The native objects remain the source of truth; the export is a projection for consumers who speak these standards. Nothing in a PROV document or an attestation is ever consulted in a TOVIO authorization decision — provenance records what happened, and grants nothing.