[raymondginger2018-sudo]

What

Reads of sensitive artifacts (anything matching SENSITIVE_PATH_PATTERNS) now append a
compact provenance footer to the returned text:

[provenance] path=… mtime=… size=… sha256_64k=… read-time snapshot (2610.13227 §5.2 proxy)

• Additive: the numbered content lines are unchanged; the footer is appended after them.
• Fail-safe: the helper is best-effort — any error (missing file, unreadable metadata)
  degrades to no footer and never aborts the read.
• Kill switch: DEEPCODE_PROVENANCE_CONTEXT=0 restores plain reads.
• Proxy-marked: this is a read-time snapshot (mtime/size/sha256 head of the first 64 KB),
  not a write-time ledger — writer identity is deliberately not recorded.

Why

Sensitive config/credential reads enter model context as plain text with no age or integrity
signal: an edited, binary-replaced, or placeholder file is indistinguishable from a fresh one
at the moment it is reused. Emitting the snapshot when the bytes are consumed makes
staleness/tamper evidence visible exactly then (2610.13227 §5.2: proxy provenance at read
time so mutation facts travel with the data).

Tests

tests/test_file_provenance.py — 5 tests:

• sensitive read (.env) gets footer with all fields,
• normal read has no footer,
• kill switch suppresses the footer,
• helper returns "" for a vanished path (never raises),
• helper returns "" for a non-sensitive path.

Notes

Default-on but strictly additive and switchable — happy to flip it to opt-in if you prefer
zero output-shape change by default.

[Zongwei9888]

Thank you, @raymondginger2018-sudo. We're closing this one:

• The footer is added only when the file matches the sensitive-path denylist, but outside Full Access the permission engine denies those reads before ReadTool runs (core/harness/policy.py:204-206). So the footer can only appear under Full Access.
• The description says a later session can see that the file changed, but nothing stores the hash or mtime, so there is nothing to compare against.
• The footer calls every match an MCP/hook config and a code-execution vector, including .env and key files.
• It is on by default and adds an undocumented environment variable.

If you'd like to pursue change detection for hook and MCP config, please open an issue first that describes where the earlier state is kept and which client shows the warning.