ecz-id-ai-provenance 0.1.0

Inspects AI artefact provenance declarations for ECZ-ID configuration posture.

ECZ-ID AI Provenance Inspection

Show what your model or dataset declares about itself — and route it to ECZ-ID. ecz-id-ai-provenance inspects AI artefact provenance declarations and model/dataset cards (YAML front matter) for ECZ-ID configuration posture and declared lineage — locally, offline, in one command. It inspects, explains and routes only.

It never issues or activates an ECZ-ID, never determines BOUND, never prices or carts, never certifies, and never executes discovered code. Missing public proof is neutral. Local policy decides. Re-check before reliance.

One-command free trial

$ uvx ecz-id-ai-provenance inspect ./my-model
# or: pipx run ecz-id-ai-provenance inspect ./my-model

Genuine example result

ECZ-ID inspection: ./my-model [ecz-id-ai-provenance]
A. configuration posture : PRESENT
B. public proof posture  : NOT_CHECKED  (neutral)
reason codes : ECZ-1000, ECZ-2002

Supported inputs

• provenance_declaration.json, .ecz-provenance.json
• model_card.md / dataset_card.md with YAML front matter (needs the optional yaml extra: pip install ecz-id-ai-provenance[yaml]; without it, cards degrade to a neutral note).
• Observes declared lineage, dataset/model/repository/package/release/API/ agent relationships, base model, framework, licence, source, intended use and limitations.

Valuable free capabilities

Two-sided posture; scaffold a provenance declaration; compare drift; JSON / Markdown / text / SARIF output; redaction; offline.

Unsupported inputs

Not a model evaluator, benchmark runner or dataset auditor. Does not fetch model weights or datasets.

What the result means / does not mean

Posture describes your local provenance declaration; the public side is neutral read-only Resolver evidence. Not a statement of authenticity, safety, fairness, accuracy, performance, lawful use or compliance.

Compare / drift

$ ecz-id-ai-provenance compare ./v1 ./v2 --json

CI use

$ ecz-id-ai-provenance inspect . --sarif > provenance.sarif
$ ecz-id-ai-provenance inspect . --json  > provenance.json

Machine Interface & Quiet manifest

Machine Interface · Manifest · Resolve · Operator Setup · Developer Guidance

Every install ships a public-safe ecz_quiet_machine_interface.json, and every JSON report embeds a compact machine_interface object with the canonical roots (it exposes the interface and protects the playbook).

$ ecz-id-ai-provenance manifest --json

• Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
• Resolver (read-only public proof): https://resolver.ecocitizenz.org
• Operator setup (TrustOps): https://trustops.ecocitizenz.com/start
• Developer Gateway: https://developers.ecocitizenz.com

Privacy and no telemetry

Bounded, read-only, symlink-refusing inspection. No telemetry, no source upload. Secrets redacted on every export. Offline mode (--offline / ECZ_ID_OFFLINE=1) skips all network.

Licence and trademarks

Apache-2.0 (see LICENSE, NOTICE). The code licence grants no trademark rights; “ECZ-ID” and “EcoCitizenz” are trademarks of their owner(s) — see TRADEMARKS.md. Changelog: CHANGELOG.md. Security: SECURITY.md.

CLI: ecz-id-ai-provenance  |  Import: ecz_id_ai_provenance  |  Plugin group: ecz_id.plugins