Skip to main content
Modulo

Contribution Provenance

The community library accepts contributions from anyone, so a consumer needs a way to tell a vetted primitive from an anonymous one. Modulo signs primitives when they are published and checks that signature at import, and the result of that check is what assigns the primitive its trust tier. A forked primitive keeps its provenance back to the original, which is what makes attribution and trust chains possible.

How it works

  • Signing: primitives are Ed25519-signed with the author’s key at publish time
  • Verification: the import process checks the signature against the author’s verified identity. A primitive whose signature is invalid or missing is treated as unverified and falls into the Community trust tier (warning on copy), so unverified content is never presented as a verified publisher’s work
  • Fork tracking: forked primitives record the original source, version, and author

Trust tiers

Signature verification is what assigns a primitive its tier: a primitive signed by an author key that Modulo has vetted is a Verified publisher primitive, and anything else, signed or not, is Community. The two tiers and their badges are listed once, in Library.

  • Library: community and local primitives
  • Connectors: tool integrations for pipeline nodes
  • Pipelines: the directed-graph execution model
Next: Variant A/B Testing