Contribution Provenance

Cryptographic signing, verification, and fork tracking for community library primitives. Every pipeline, agent, and connector published to the community library is signed by its author. Consumers verify signatures before importing a primitive. Forked primitives retain provenance back to the original, enabling attribution and trust chains.

• Signing: primitives are signed with the author’s key at publish time
• Verification: the import process checks the signature against the author’s verified identity
• Fork tracking: forked primitives record the original source, version, and author

See the PRD §8.14 for details.