“Are these the same bytes?”
A digest can identify an exact artifact and expose a one-byte change. It cannot explain where the artifact came from, why it changed, which input preceded it, or who attested to that history.
Why lineage matters
One file becomes ten copies. Its history usually doesn’t.
Data does not stay where it was created. It is copied, reshaped, retained, shared, and forgotten. Without portable lineage, every move separates the bytes from the evidence needed to trust, reproduce, govern, or safely delete them.
The multiplication problem
Now let it move.
It lands in object storage, gets picked up into a warehouse, gets denormalized into three marts because three teams wanted different grain, gets a feature-store copy for the model, gets a nightly backup with a 90-day cycle, gets replicated to a second region for durability, gets pulled into a vendor's SaaS for enrichment, and gets exported once into a notebook by an analyst who left in March.
Call that eight to ten locations, and I am being conservative, because I have not counted the CI fixture somebody generated from prod or the Slack thread with the screenshot.
One source, expanding custody
Every copy creates another question
1 → 10+
downstream copies
01
Source datasetThe place where its history can begin.
- 02Object storageLanding copy
- 03WarehouseLoaded copy
- 04–06Three martsDifferent grain
- 07Feature storeModel input
- 08Nightly backup90-day retention
- 09Region twoDurability replica
- 10Vendor SaaSEnrichment copy
- 11Old notebookOwner departed
Outside the map
CI fixture from production and Slack screenshot: copies that may exist without a system of record, an active owner, or a deletion path.
The bytes multiplied. So did the consequences.
How far did the bad data travel?
Incident response
Without predecessor links, responders must reconstruct the blast radius from job logs, storage listings, and institutional memory.What does “delete it” mean now?
Deletion
A source deletion does not remove warehouse rows, backups, vendor copies, model features, or forgotten analyst exports.Which exact bytes trained the model?
Reproducibility
A table name or notebook path cannot prove the precise input, transformations, schema rules, and code identity used at the time.Who made and approved each copy?
Custody
System identity, signer authorization, and organizational responsibility are separate questions. All three matter at a handoff.Which policy applies downstream?
Retention
A 90-day rule attached to the source is ineffective if downstream copies lose that context or silently adopt different controls.Is this still the same dataset?
Change
Normalization, filtering, enrichment, redaction, and even newline conversion can produce meaningfully different artifacts.
A checksum is necessary. It is not lineage.
“How did these bytes come to exist?”
Lineage connects exact artifacts to origin claims, a hash-linked transformation graph, participating systems, and accountable attesters. Digests make those connections tamper-evident.
Carry the evidence with the data
Makoto begins at the source, then adds immutable signed statements as participating systems transform or hand off the data. The receiver evaluates the resulting evidence under its own trust policy.
Begin with the source
Bind the origin claim to the exact bytes that were collected.
Append every participating step
Each transformation points to exact predecessor statements and artifacts instead of editing history in place.
Name the attesters
Signatures prove control of keys; the receiver separately decides whether those keys were authorized for each claim.
Verify the handoff
The receiver validates schemas, graph continuity, signer policy, signed completeness, and the final artifact digest.
The honest boundary: Makoto does not discover an unrecorded notebook export or Slack screenshot. It makes participating handoffs verifiable and missing evidence visible. Organizational inventory, access control, retention, and discovery systems still have work to do.
From argument to evidence
Watch the history survive the handoff
The runnable walkthrough creates source data, signs its origin, applies two transformations, signs the handoff, and verifies the graph and final bytes as an independent receiver.