AI provenance & audit trail

Answers "who built this and how was it checked?" as a by-product of the pipeline, not extra work. Essential when the code was agent-generated and the client is a regulated insurer.

What's recorded

• Commits link the agent session, model version, and prompt/skill used (the AI-provenance declaration on every PR).
• Task briefs are retained with their PRs.
• Gate outcomes and human authorisations are recorded immutably.
• Retention matches insurance client audit expectations.

Why it pays off twice

1. Audit — a client's vendor-risk team or a regulator can trace any line to its origin and its checks.
2. Incident response — when an AI-introduced defect is found, the provenance trail answers "what else did this agent/prompt/skill build?" — the blast-radius query that lets you fix the class of defect, not just the instance.

The trail is assembled by the pipeline automatically, so it costs nothing per change and is always complete. Feeds the release evidence pack.

Standards referenced: ISO/IEC 42001, SLSA provenance.