Prefect: attest after persistence, not after a Python return.
A Prefect task result may be an in-memory value, cached object, pointer, or stable data artifact. Makoto should attach only when the integration can identify the exact persisted bytes and their predecessors.
Implementation boundary. Prefect does not automatically provide Makoto evidence, signer identity, nested graphs, or a Makoto report in its UI.
The attachment point
| Task completion | Use a post-task hook only after the task has durably committed an artifact whose exact identity can be resolved. |
|---|---|
| Flow handoff | Create a signed handoff when artifacts cross a team, account, region, or external recipient boundary. |
| Retries and cache | Make attestation idempotent; distinguish a reused cached artifact from a newly produced artifact. |
| Prefect context | Carry flow run, task run, deployment, work pool, parameters, and code revision as operation metadata. |
Control flow
@task
def write_curated_data():
artifact_path = persist_exact_bytes()
return artifact_path
# A separate task resolves predecessors and invokes the reference CLI.
uv run makoto attest transform --helpThe wrapper must decide how result storage maps to exact bytes, how signer keys are isolated, and how a retry locates an existing statement instead of silently producing conflicting histories.
What the evidence can say
It can bind a durable task output to exact inputs and selected Prefect context. It cannot treat an arbitrary return value as an artifact or infer an authorized organizational handoff from flow nesting.
Prove one result-storage boundary.
Contribute a tested local or object-storage fixture with retry behavior and an independent receiver policy.