provenance-stamp

Write and verify sha256 provenance sidecars for analysis artifacts.

Updated Apr 18, 2026
One-click install
npx skills add https://github.com/ppavlidis/skillz --skill provenance-stamp-ppavlidis
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: provenance-stamp
Source: https://github.com/ppavlidis/skillz/tree/main/skills/provenance-stamp
Command: npx skills add https://github.com/ppavlidis/skillz --skill provenance-stamp-ppavlidis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Analysis artifacts like downloaded files, processed TSVs, and model outputs often lose track of where they came from, making results impossible to reproduce or audit. This Skill records the sha256 hash, source URL, DOI, upstream version, download timestamp, and analysis parameters in a .meta.json sidecar next to every artifact. ## Core Features & Use Cases - Library and CLI modes: Import write_meta() into any Python script after saving output, or run stamp/verify/show subcommands from the command line on existing files. - Integrity verification: The verify command recomputes the artifact's sha256 and compares it against the sidecar, exiting non-zero on mismatch so corrupted or stale files are caught. - Cross-skill compatibility: The sidecar schema is a superset of the meta.json files produced by the gene-set-fetch, gene-annotations, gene-statistics, and ontology-terms skills, and verify() accepts both sha256 and output_sha256 fields. - Use Case: After downloading a GO annotation file and generating a filtered gene set TSV, stamp the output with the source URL, DOI, upstream release date, and filter parameters so a reviewer can reproduce the exact result months later. ## Quick Start Ask the AI to stamp an existing output file with its source URL, DOI, data version, and parameters, then verify the artifact's integrity against the generated sidecar.

Frequently Asked Questions about provenance-stamp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I record provenance for a data file in Python?

Import write_meta from the stamp module and call it after saving your artifact, passing the source URL, DOI, data version, fetch timestamp, and parameters. It writes a .meta.json sidecar next to the file containing the sha256 hash and all metadata.

How to verify a file has not changed using sha256?

Run python scripts/stamp.py verify on the artifact, or call the verify() function in Python. It recomputes the file's sha256 and compares it to the sidecar, returning exit code 0 on match and 1 on mismatch or missing metadata.

Does provenance-stamp require external Python packages?

No, it requires only Python 3.9 or later with the standard library. It uses hashlib, json, argparse, and datetime, so no pip installs are needed.

Can I add custom fields to the meta.json sidecar?

Yes, any extra keyword arguments passed to write_meta become top-level fields in the sidecar. For example, write_meta(..., pipeline="rnaseq-v2") adds a pipeline field without breaking compatibility with existing sidecars.

What happens if the artifact or sidecar is missing during verification?

The tool fails loudly by design. A missing artifact raises FileNotFoundError, a missing sidecar raises FileNotFoundError, and a sidecar without a sha256 or output_sha256 field raises KeyError, with the CLI printing an error and exiting 1.