2026-07-19 Phase 5 Provenance, MCP, and Tool Result Evidence Chain Record

This phase delivers three Layer B items from Phase 4: source-to-citation provenance, MCP Resources/subscription safety, and Tool Result dual projections with unknown-outcome reconciliation. The primary Agent unified provenance baseline, identity semantics, public/protected boundary, cross-course terms, and final regression. Specialist Agents reviewed MCP, Tool Result, and document consistency in directory-isolated changes; the primary Agent replayed counterexamples and repaired residual gaps.

Conclusion boundary

This is a standard-library offline reference implementation, a stable-specification subset, and deep review of high-priority courses. It does not prove the vault as a whole has page-level validation, nor that real OAuth, SDKs, network transport, vector databases, LLMs, distributed exactly-once, signed artifacts, or physical deletion are implemented. Digest fields show consistency within one trusted pipeline, not cross-service authentication or third-party attestation.

1. Source to citation: a recomputable Layer B

• Added an offline source-to-citation evidence-chain project using UTF-8 Markdown fixtures linking source event, canonical revision, parse revision, element, chunk, index entry, published generation, ACL-before-score, extractive claim, and citation.
• canonical_revision_id, parse_revision_id, element_id, chunk_id, index_entry_id, and index_generation_id use a bounded canonical-JSON domain plus complete SHA-256. Original/retrieval text respectively stores content_sha256/retrieval_sha256.
• A public citation retains source URI/version; raw/canonical/parse/element/chunk/index identity; and exact half-open character span. Global generation, selected-entry IDs, aggregate filtering summary, and authorization version are protected audit only, preventing private-corpus change from affecting public response. The teaching trace hashes full runtime query only for tamper recomputation; production public request IDs must be random and not derivable from authorization context.
• The validator does not trust audit-reported selection. It recomputes candidate set, rank, top-k, filter summary, claim, span, and trace from trusted query, current ACL, index generation, and lexical rules.
• A generation binds source snapshot, tombstone, authorization revision, pipeline fingerprint, and full entry set. Once a new generation publishes, old one becomes superseded; ACL tightening, revocation, deletion, and stale snapshot fail closed.
• Fixture binding includes raw JSON SHA-256 and strict-load typed-model SHA-256; in-memory mutation after load requires revalidation. The evaluation artifact separately binds fixture, pipeline, snapshot, tombstone, authorization, index manifest, and harness revision.

Upstream contracts were tightened too: Document Parsing binds parse revision to raw hash, parser name/version, and config hash, then element identity to parse revision/type/coordinate space/line span/body hash; Knowledge Base reconciliation recomputes canonical/search body hashes rather than trusting two database digest fields; Chunking binds index entry to chunk, actual retrieval hash, index revision, and ACL snapshot so title-path/table-header changes invalidate an old index record. RAG09 remains an independent reference model, not wire integration: line coordinates, lexical-unit spans, SQLite integer revisions, and canonical character spans still need versioned adapters and migration tests to connect in production.

2. MCP: Resources, subscriptions, and authorization snapshot

• The teaching profile is fixed to official latest 2025-11-25; 2026-07-28 appears only as a release candidate under /specification/draft, not in the stable contract.
• The offline fixture grows to 54 cases: Resource list/templates/read/subscribe/unsubscribe; list-changed/updated; failed subscribe/cancel; child resources; paging; URI; RFC 6570 templates; canonical Base64; aggregate-size gates.
• One page allows at most 256 items; read allows at most 64 content items totaling 64 KiB. Exact request/response fields, cursor, URI, MIME, text/blob exclusivity, and duplicate content are all validated.
• An active subscription is created only after successful subscribe. Failed subscribe never authorizes updated; failed unsubscribe preserves the old subscription; duplicate pending operations are rejected. Authorization-revision changes clear old subscriptions and block stale reread/update.
• Course-added transport_context is explicitly not an MCP wire field. It binds active token, audience, RFC 8707 resource indicator, tenant, scope, authorization revision, and revocation policy to a resource operation. Roots remain client-coordination hints, not token, ACL, or sandbox.

3. Tool Result v2: model projection, audit projection, and unknown outcome

• Fixture becomes tool-cases-v2: 18 cases and 23 dispatch/query_status steps for read/write authorization, approval, idempotency, call conflict, rate limit, pre-execution timeout, lost post-submit response, receipt reconciliation, and persistent unknown.
• Every tool has exact output schema. Business data is always untrusted_data; error state, recovery action, and OUTCOME_UNKNOWN originate only from the dispatcher’s fixed error catalog, so a handler cannot inject top-level status/recovery/sensitive/control fields.
• model_result is the sole projection allowed back to model/Provider. Subject references, Provider context, full tool contract, downstream request/receipt/status reference, redactions, and digests exist only in protected_audit.
• request_sha256 binds subject/tool/arguments and input/output/effect revision; result_sha256 binds full model projection; call_binding_sha256 binds Provider/API family, response/call/operation, adapter, full tool contract, idempotency key, and both earlier digests. All use full 64-character lowercase hex and are recomputed.
• A counterexample showed that replacing only idempotency_key could reuse a package. The repair places it in call-level binding while excluding it from business request digest: the same intent can retry under a new call, but its result remains bound to the execution key.
• Cross-call package/model-result swaps, forged digests, forged source labels, missing/duplicate/unknown result sets, and protected-audit leakage into Provider payload are rejected. query_operation_status rechecks current subject/resource authorization; without trusted receipt, status stays OUTCOME_UNKNOWN and a non-idempotent write is not guessed successful or replayed.
• OpenAI Responses, Anthropic Messages, and Gemini Interactions adapters serialize verified model projection only. They are schema-only teaching adapters, not live SDK or streaming-continuation integration tests.

4. Cross-course consistency repairs

• Document Parsing, Knowledge Base, Chunking, and RAG project commands use current project root as cwd so public-repository users do not mistakenly invoke a path outside the vault.
• Route 22→29 now explicitly passes Chunking, Embedding, Vector Database, Semantic Search, and Reranking before RAG.
• Deep-reviewed indexes/project pages fill content_origin, content_status, and execution_verified. Dynamic official-material pages stay dynamic; local test success does not make a dynamic external fact static/validated.
• RAG uses “public response”/“protected audit” consistently. Lesson 8’s fixed enum privileged_audit and Lesson 9’s protected_audit are explicitly different schemas. Citation/Generation/Refusal distinguishes Lesson 8 fixture fact/revision schema from Lesson 9 full source/span citation.
• AI Safety now cross-links untrusted tool result, per-tool exact output schema, dual projection, explicit status query, complete-digest binding, MCP, and RAG.

Verification actually performed

Check	Result	Evidence boundary
7 related offline projects, three modes	1,239/1,239 passed	413 each in normal, python -O, warnings-as-errors: Document Parsing 26; Knowledge Base 31; Chunking 32; RAG Lesson 8 68; RAG provenance 62; MCP 94; Tool Result 100.
Combined optimization/warning regressions	194/194 passed	MCP 94 and Tool Result 100 also pass -O -W error.
CLI and fault injection	Passed	Provenance normal PASS/retrieval fault BLOCK; MCP 54 cases has 16 positive passes and 38 expected negative rejections; all Tool Result cases/steps report passed=true.
Specialist attack review	Passed	Parser/config reuse; joint body/digest tamper; stale title/header index; stale generation; citation/audit tamper; MCP URI/token/subscription bypass; Tool Result swap/forged digest/status injection/idempotency-key replacement all fail closed.
Website tests/full build	Passed	Unified site gate reran publication policy, source gate, route metadata, resources, and links.
Supplemental checks	Passed	git diff —check, scoped wikilink/JSON parsing, and project pycache/.pyc scan; three known outer local/submodule states untouched.

Key sources

This record’s source_checked means its sources and changes were summarized on 2026-07-19. Dynamic SDKs, candidate specifications, and product message shapes must be version-pinned and contract-tested again on implementation day.

• W3C PROV Overview and PROV-O: entity/activity/agent/derivation vocabulary.
• OWASP LLM01, LLM02, LLM05, LLM06, and LLM08.
• MCP 2025-11-25 Resources, Schema, and Authorization.
• OpenAI Function calling, Anthropic Handle tool calls, Gemini Function calling, and RFC 9110 §9.2.2.
• SLSA Build Provenance v1.2 and OpenTelemetry Signals: supply-chain analogy and trace/metric/log boundaries. Document hashes are not claimed as SLSA attestation.

Follow-up queue

1. Wire Document Parsing, canonical store, Chunking, real index, and RAG citation into one versioned artifact schema, with migration/round-trip tests for line/character/page/bbox/DOM/JSON-Pointer coordinate spaces.
2. Use official SDKs for real MCP Streamable HTTP/SSE, token signature, issuer/audience/resource/expiry, 401/403, introspection, reconnect, and distributed-subscription recovery.
3. Add real Provider contract tests pinned to OpenAI/Anthropic/Gemini SDK/API versions, covering streaming tool call, parallel result order, continuation token/interaction, thinking-item continuation, and Provider errors.
4. Upgrade mocks to atomic database transactions, unique constraints, outbox, receipt/status query, concurrent/crash recovery; do not claim exactly-once.
5. Add controlled signature/MAC, key rotation, immutable storage, approval principal, and verification policy to artifact manifest, rather than merely comparing self-reported SHA-256.
6. Test real retrieval with Embedding, vector database, reranker, LLM, indirect prompt injection, data poisoning, over-authorization, and post-revocation cache/index invalidation.
7. Implement hierarchy, explicit deny, ABAC/provenance, retention, backup erasure, and auditable-purge evidence.
8. Manually inspect new Mermaid diagrams, Callouts, wide tables, and cross-course navigation in Obsidian/public site.

See the preceding Phase 4 record. Source/license policy continues through the Content Quality and Source Labeling Standard.