{"record":{"id":"7a16a9aaa4ef2aad","repo":"affaan-m/ECC","slug":"provider-provenance-requires-external-result-origin","errorCode":null,"errorMessage":"Provider provenance requires external_result origin","messagePattern":"Provider provenance requires external_result origin","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"skills/taste-application/scripts/tasteforge/assets.py","lineNumber":110,"sourceCode":"    for asset in value:\n        if not isinstance(asset, dict):\n            raise ValueError('Each asset must be an object')\n        asset_id = _text(asset.get('id'), 'asset id')\n        if asset_id in ids:\n            raise ValueError(f'Duplicate asset id: {asset_id}')\n        ids.add(asset_id)\n        if asset.get('modality') not in tuple(MODALITIES):\n            raise ValueError('modality must be image, video or 3d_asset')\n        if asset.get('origin') not in tuple(ORIGINS):\n            raise ValueError('Invalid asset origin')\n    return value\n\n\ndef _provenance(asset: dict[str, Any], base: Path, verify: bool) -> dict[str, Any] | None:\n    source = asset.get('provider_provenance')\n    if asset['origin'] != 'external_result':\n        if source is not None:\n            raise ValueError('Provider provenance requires external_result origin')\n        return None\n    if not isinstance(source, dict):\n        raise ValueError('external_result requires provider provenance and local evidence')\n    provider = _text(source.get('provider'), 'provider')\n    identifiers = {key: _text(source[key], key) for key in ('request_id', 'workflow_id')\n                   if key in source}\n    if not identifiers:\n        raise ValueError('Provider provenance requires request_id or workflow_id')\n    if verify:\n        evidence = _verify_binding(source.get('evidence'), base)\n    else:\n        evidence = _fingerprint(_path(source.get('evidence_path'), base))\n    return dict(provider=provider, **identifiers, evidence=evidence,\n                verification='supplied_local_evidence_only')\n\n\ndef _verify_binding(value: Any, base: Path, modality: str | None = None) -> dict[str, Any]:\n    if not isinstance(value, dict):","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/affaan-m/ECC/blob/8321021c54d670126ce3b2969d5deb880b4b0c2a/skills/taste-application/scripts/tasteforge/assets.py#L92-L128","documentation":"provider_provenance is only meaningful for assets whose origin is 'external_result'. The library throws this when an asset with a different origin supplies a non-null 'provider_provenance', since internal assets cannot claim an external provider's provenance.","triggerScenarios":"An asset with origin 'internal' (or any non-external_result value) that includes a 'provider_provenance' key set to a non-None value, passed to ingest_assets or validate_assets.","commonSituations":"Copy-pasting a template asset entry (including provider_provenance) and changing origin back to internal; a pipeline stamping provenance metadata onto all assets unconditionally.","solutions":["Remove the 'provider_provenance' key from assets whose origin is not 'external_result'","Or change the asset's origin to 'external_result' if it genuinely came from an external provider","Audit the asset-producing pipeline so provenance is only attached when origin is external_result"],"exampleFix":"// before\n{\"id\": \"a1\", \"modality\": \"image\", \"origin\": \"internal\", \"provider_provenance\": {\"provider\": \"x\"}}\n// after\n{\"id\": \"a1\", \"modality\": \"image\", \"origin\": \"internal\"}","handlingStrategy":"validation","validationCode":"for a in assets:\n    if a.get(\"origin\") != \"external_result\" and a.get(\"provider_provenance\") is not None:\n        raise ValueError(f\"asset {a['id']}: provider_provenance only allowed for external_result origin\")","typeGuard":"def provenance_is_consistent(a: dict) -> bool:\n    return a.get(\"origin\") == \"external_result\" or a.get(\"provider_provenance\") is None","tryCatchPattern":"try:\n    ingest_assets(assets)\nexcept ValueError as e:\n    if \"Provider provenance requires external_result\" in str(e):\n        strip_provenance_from_internal_assets(assets); retry()\n    else:\n        raise","preventionTips":["Attach provenance only at the point where an external result is created","Make the asset builder take (origin, provenance) together so they can't diverge","Test with a unit check that internal assets never serialize provenance"],"tags":["validation","provenance","assets"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"8321021c54d670126ce3b2969d5deb880b4b0c2a","analyzedAt":"2026-09-16T10:08:13.343Z","contentChangedAt":"2026-09-16T10:08:13.343Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}