Metadata-Version: 2.4
Name: ecz-id-ai-provenance
Version: 0.1.0
Summary: Inspects AI artefact provenance declarations for ECZ-ID configuration posture.
Project-URL: Documentation, https://developers.ecocitizenz.com
Project-URL: Machine Interface, https://machine.ecocitizenz.org/.well-known/ecz-machine.json
Project-URL: Resolver, https://resolver.ecocitizenz.org
Project-URL: Operator Setup, https://trustops.ecocitizenz.com/start
Project-URL: Developer Guidance, https://developers.ecocitizenz.com
Author-email: Ecocitizenz <ecocitizenz@gmail.com>
License-Expression: Apache-2.0
License-File: LICENSE
License-File: NOTICE
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Requires-Python: >=3.10
Requires-Dist: ecz-id
Provides-Extra: yaml
Requires-Dist: pyyaml<7,>=6; extra == 'yaml'
Description-Content-Type: text/markdown

# ECZ-ID AI Provenance Inspection

**Show what your model or dataset declares about itself — and route it to
ECZ-ID.** `ecz-id-ai-provenance` inspects AI artefact provenance
declarations and model/dataset cards (YAML front matter) for ECZ-ID
configuration posture and declared lineage — locally, offline, in one
command. It **inspects, explains and routes only.**

It never issues or activates an ECZ-ID, never determines BOUND, never
prices or carts, never certifies, and never executes discovered code.
Missing public proof is neutral. **Local policy decides. Re-check before
reliance.**

## One-command free trial

```console
$ uvx ecz-id-ai-provenance inspect ./my-model
# or: pipx run ecz-id-ai-provenance inspect ./my-model
```

## Genuine example result

```text
ECZ-ID inspection: ./my-model [ecz-id-ai-provenance]
A. configuration posture : PRESENT
B. public proof posture  : NOT_CHECKED  (neutral)
reason codes : ECZ-1000, ECZ-2002
```

## Supported inputs

- `provenance_declaration.json`, `.ecz-provenance.json`
- `model_card.md` / `dataset_card.md` with YAML front matter (needs the
  optional `yaml` extra: `pip install ecz-id-ai-provenance[yaml]`; without
  it, cards degrade to a neutral note).
- Observes declared lineage, dataset/model/repository/package/release/API/
  agent relationships, base model, framework, licence, source, intended
  use and limitations.

## Valuable free capabilities

Two-sided posture; `scaffold` a provenance declaration; `compare` drift;
JSON / Markdown / text / SARIF output; redaction; offline.

## Unsupported inputs

Not a model evaluator, benchmark runner or dataset auditor. Does not fetch
model weights or datasets.

## What the result means / does not mean

Posture describes your **local** provenance declaration; the public side is
neutral read-only Resolver evidence. **Not** a statement of authenticity,
safety, fairness, accuracy, performance, lawful use or compliance.

## Compare / drift

```console
$ ecz-id-ai-provenance compare ./v1 ./v2 --json
```

## CI use

```console
$ ecz-id-ai-provenance inspect . --sarif > provenance.sarif
$ ecz-id-ai-provenance inspect . --json  > provenance.json
```

## Machine Interface & Quiet manifest

`Machine Interface` · `Manifest` · `Resolve` · `Operator Setup` · `Developer Guidance`

Every install ships a public-safe `ecz_quiet_machine_interface.json`, and
every JSON report embeds a compact `machine_interface` object with the
canonical roots (it exposes the interface and protects the playbook).

```console
$ ecz-id-ai-provenance manifest --json
```

- Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
- Resolver (read-only public proof): https://resolver.ecocitizenz.org
- Operator setup (TrustOps): https://trustops.ecocitizenz.com/start
- Developer Gateway: https://developers.ecocitizenz.com

## Privacy and no telemetry

Bounded, read-only, symlink-refusing inspection. No telemetry, no source
upload. Secrets redacted on every export. Offline mode
(`--offline` / `ECZ_ID_OFFLINE=1`) skips all network.

## Licence and trademarks

Apache-2.0 (see `LICENSE`, `NOTICE`). The code licence grants no trademark
rights; “ECZ-ID” and “EcoCitizenz” are trademarks of their owner(s) — see
`TRADEMARKS.md`. Changelog: `CHANGELOG.md`. Security: `SECURITY.md`.

CLI: `ecz-id-ai-provenance` &nbsp;|&nbsp; Import: `ecz_id_ai_provenance` &nbsp;|&nbsp; Plugin group: `ecz_id.plugins`
